From 7bb353814c1ed765ec4d634fe47201bd93d60dc2 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Fri, 2 Oct 2026 23:47:11 +0200 Subject: [PATCH] package/libpng: security bump to version 1.6.59 https://github.com/pnggroup/libpng/blob/v1.6.59/ANNOUNCE Fixes CVE-2026-46675. Switched to sha256 tarball hash provided by upstream. Signed-off-by: Bernd Kuhls Signed-off-by: Fiona Klute --- package/libpng/libpng.hash | 5 ++--- package/libpng/libpng.mk | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/package/libpng/libpng.hash b/package/libpng/libpng.hash index c387ffbf02..8c3647b8f9 100644 --- a/package/libpng/libpng.hash +++ b/package/libpng/libpng.hash @@ -1,5 +1,4 @@ -# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.58/ -sha1 6263409a6907d180e7b990827ca84ee944c6cc17 libpng-1.6.58.tar.xz +# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.59/ +sha256 d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389 libpng-1.6.59.tar.xz # Locally computed: -sha256 28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775 libpng-1.6.58.tar.xz sha256 bdb0a645ea18c60507d0368379b1ac5474b92255fcc2d115e07486a7672ba526 LICENSE diff --git a/package/libpng/libpng.mk b/package/libpng/libpng.mk index 1915941b82..eeedd81f8a 100644 --- a/package/libpng/libpng.mk +++ b/package/libpng/libpng.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBPNG_VERSION = 1.6.58 +LIBPNG_VERSION = 1.6.59 LIBPNG_SERIES = 16 LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz LIBPNG_SITE = https://downloads.sourceforge.net/project/libpng/libpng$(LIBPNG_SERIES)/$(LIBPNG_VERSION)