Repository navigation
Update libpng to 1.6.59 - #800
Conversation
Fixes GHSA-qvg3-h654-xq3j (use-after-free of zlib input in png_read_end). The recipe comment now uses SourceForge's direct /project/ form: the downloads.sourceforge.net/<project>/<file> shortcut it carried serves an HTML page, which aborted the automated bump. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. 🧰 Additional context used📚 Code guidelines (1)No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: gominimal/pkgs/.coderabbit.yaml Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour. 📝 WalkthroughWalkthroughThe libpng build configuration now specifies version 1.6.59. The archive URL comment and SHA-256 checksum are updated; the source URL template remains unchanged. Changeslibpng source update
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to No merge-blocking issue was identified in this metadata update. Run the stated build and test checks before merging. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Verified: SourceForge and gs:// mirror both hash to the declared sha256; top dir matches strip_prefix; soname unchanged within libpng16 (8 reverse deps, no pins); repro flags intact.
Nit: GHSA-qvg3-h654-xq3j in the body 404s on github.com/advisories, the advisories API and OSV. The tarball's ANNOUNCE names the fix as CVE-2026-46675 (UAF of zlib input in png_read_end), which matches the description. Suggest citing the CVE in the merge commit.
Bumps libpng 1.6.58 → 1.6.59.
Fixes GHSA-qvg3-h654-xq3j (medium): use-after-free of zlib input in
png_read_endafter an incomplete zTXt/iTXt/iCCP chunk. Affects>= 1.6.0, <= 1.6.58; patched in 1.6.59.Source. I did this by hand because the automated bump kept failing. The archive is the official SourceForge release (
downloads.sourceforge.net/project/libpng/libpng16/1.6.59/libpng-1.6.59.tar.xz), 1,074,540 bytes.xz -tpasses, the top directory islibpng-1.6.59/, andpng.hhasPNG_LIBPNG_VER_STRING "1.6.59".gs://minimal-staging-archives/libpng-1.6.59.tar.xz; the bucket copy re-downloads to the same sha256 as the pin:d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389.Diff is the same three lines as the 1.6.58 bump (#88): version, sha256, and the origin comment.
Why the automated bump failed, and the comment change. The recipe's origin comment used SourceForge's shortcut form
downloads.sourceforge.net/libpng/libpng-1.6.58.tar.xz, which cannot name a file and serves an HTML page. pkgmgr's comment reader bumped it to 1.6.59 and downloaded 149 KB of HTML (caught by the new download guard; pkgmgr#927 now skips that form). The comment now uses the direct/project/libpng/libpng16/<ver>/form so the file works the same either way.Needs a human reviewer; build + tests are the merge gate.
🤖 Generated with Claude Code
Summary by CodeRabbit