Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libpng* to *1.6.59* has Succeeded.
Next steps:
- apply the patch: git am 0001-libpng-upgrade-1.6.58-1.6.59.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From 083c6a33018a5a34bb398a04cb673056dec99f0c Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Sat, 3 Oct 2026 05:43:30 +0000
Subject: [PATCH] libpng: upgrade 1.6.58 -> 1.6.59
Version 1.6.59 [September 28, 2026]
Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<[email protected]>.)
Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
Applied fixes and updates to the CMake build.
Adopted the REUSE Specification for licensing the CI files.
---
...0001-tests-stream-per-test-results-to-stdout.patch | 11 ++++-------
.../libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} | 2 +-
2 files changed, 5 insertions(+), 8 deletions(-)
rename meta/recipes-multimedia/libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb}
(97%)
diff --git
a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
index 139495d211..0c5e742bc1 100644
---
a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
+++
b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
@@ -1,4 +1,4 @@
-From e0898e243cbef677a862612f04b6bca2b07c2453 Mon Sep 17 00:00:00 2001
+From 22ec13788d1003de4b4f89eaaf47f28fe61523b2 Mon Sep 17 00:00:00 2001
From: Trevor Gamblin <[email protected]>
Date: Wed, 12 Aug 2026 12:22:54 -0400
Subject: [PATCH] tests: stream per-test results to stdout
@@ -34,7 +34,7 @@ Signed-off-by: Trevor Gamblin <[email protected]>
create mode 100755 test-driver-tee
diff --git a/Makefile.am b/Makefile.am
-index eb7078158..a2e64fbe6 100644
+index fa5bbeb..8092616 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -111,6 +111,12 @@ TESTS =\
@@ -50,7 +50,7 @@ index eb7078158..a2e64fbe6 100644
endif
# man pages
-@@ -165,7 +171,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@[email protected]
+@@ -216,7 +222,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@[email protected]
# not done in the source directory!
EXTRA_DIST= \
ANNOUNCE AUTHORS CHANGES INSTALL LICENSE README TODO TRADEMARK \
@@ -61,7 +61,7 @@ index eb7078158..a2e64fbe6 100644
CMakeLists.txt example.c libpng-manual.txt
diff --git a/test-driver-tee b/test-driver-tee
new file mode 100755
-index 000000000..a6d5aa027
+index 0000000..a6d5aa0
--- /dev/null
+++ b/test-driver-tee
@@ -0,0 +1,167 @@
@@ -232,6 +232,3 @@ index 000000000..a6d5aa027
+# time-stamp-time-zone: "UTC0"
+# time-stamp-end: "; # UTC"
+# End:
---
-2.55.0
-
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
similarity index 97%
rename from meta/recipes-multimedia/libpng/libpng_1.6.58.bb
rename to meta/recipes-multimedia/libpng/libpng_1.6.59.bb
index 928b010c9c..4dbd769cf7 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
@@ -15,7 +15,7 @@ SRC_URI =
"${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
file://0001-tests-stream-per-test-results-to-stdout.patch \
"
-SRC_URI[sha256sum] =
"28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775"
+SRC_URI[sha256sum] =
"d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389"
MIRRORS += "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/
${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/older-releases/"
--
2.47.1
packages/x86-64-v3-poky-linux/libpng/libpng-ptest: FILELIST: added "/usr/lib/libpng/ptest/src/contrib/testpngs/ch1n3p04.png /usr/lib/libpng/ptest/src/contrib/testpngs/ch2n3p08.png" packages/x86-64-v3-poky-linux/libpng/libpng: FILELIST: removed "/usr/lib/libpng16.so.16.58.0", added "/usr/lib/libpng16.so.16.59.0" Changes to packages/x86-64-v3-poky-linux/libpng (sysroot): /usr/lib/libpng16.so.16 changed symlink target from libpng16.so.16.58.0 to libpng16.so.16.59.0 /usr/lib/libpng16.so changed symlink target from libpng16.so.16.58.0 to libpng16.so.16.59.0 /usr/lib/libpng16.so.16.58.0 moved to /usr/lib/libpng16.so.16.59.0
0001-libpng-upgrade-1.6.58-1.6.59.patch
Description: Binary data
Version 1.6.59 [September 28, 2026]
Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<[email protected]>.)
Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
Applied fixes and updates to the CMake build.
Adopted the REUSE Specification for licensing the CI files.
packages/x86-64-v3-poky-linux/libpng: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng: SRC_URI changed from "https://downloads.sourceforge.net/libpng/libpng16/libpng-1.6.58.tar.xz file://run-ptest file://0001-tests-stream-per-test-results-to-stdout.patch" to "https://downloads.sourceforge.net/libpng/libpng16/libpng-1.6.59.tar.xz file://run-ptest file://0001-tests-stream-per-test-results-to-stdout.patch" packages/x86-64-v3-poky-linux/libpng: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-dbg: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-dbg: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-dbg: FILELIST: removed "/usr/lib/.debug/libpng16.so.16.58.0", added "/usr/lib/.debug/libpng16.so.16.59.0" packages/x86-64-v3-poky-linux/libpng/libpng-dbg: PKGSIZE changed from 1682800 to 1683984 (+0%) packages/x86-64-v3-poky-linux/libpng/libpng-dev: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-dev: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-dev: PKGSIZE changed from 179835 to 179839 (+0%) packages/x86-64-v3-poky-linux/libpng/libpng-doc: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-doc: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-doc: PKGSIZE changed from 268133 to 268149 (+0%) packages/x86-64-v3-poky-linux/libpng/libpng-locale: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-locale: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-ptest: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-ptest: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-ptest: FILELIST: added "/usr/lib/libpng/ptest/src/contrib/testpngs/ch2n3p08.png /usr/lib/libpng/ptest/src/contrib/testpngs/ch1n3p04.png" packages/x86-64-v3-poky-linux/libpng/libpng-ptest: PKGSIZE changed from 2561218 to 2563677 (+0%) packages/x86-64-v3-poky-linux/libpng/libpng-src: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-src: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-src: FILELIST: directory renamed /usr/src/debug/libpng/1.6.58/mips -> /usr/src/debug/libpng/1.6.59/mips, directory renamed /usr/src/debug/libpng/1.6.58/intel -> /usr/src/debug/libpng/1.6.59/intel, directory renamed /usr/src/debug/libpng/1.6.58/contrib/libtests -> /usr/src/debug/libpng/1.6.59/contrib/libtests, directory renamed /usr/src/debug/libpng/1.6.58 -> /usr/src/debug/libpng/1.6.59, directory renamed /usr/src/debug/libpng/1.6.58/powerpc -> /usr/src/debug/libpng/1.6.59/powerpc, directory renamed /usr/src/debug/libpng/1.6.58/contrib/tools -> /usr/src/debug/libpng/1.6.59/contrib/tools packages/x86-64-v3-poky-linux/libpng/libpng-src: PKGSIZE changed from 2276248 to 2276639 (+0%) packages/x86-64-v3-poky-linux/libpng/libpng-staticdev: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-staticdev: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng-tools: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng-tools: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng: PV changed from "1.6.58" to "1.6.59" packages/x86-64-v3-poky-linux/libpng/libpng: PKGV changed from 1.6.58 [default] to 1.6.59 [default] packages/x86-64-v3-poky-linux/libpng/libpng: FILELIST: removed "/usr/lib/libpng16.so.16.58.0", added "/usr/lib/libpng16.so.16.59.0" Changes to packages/x86-64-v3-poky-linux/libpng (sysroot): /usr/lib/libpng16.so.16 changed symlink target from libpng16.so.16.58.0 to libpng16.so.16.59.0 /usr/lib/libpng16.so changed symlink target from libpng16.so.16.58.0 to libpng16.so.16.59.0 /usr/lib/libpng16.so.16.58.0 moved to /usr/lib/libpng16.so.16.59.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247146): https://lists.openembedded.org/g/openembedded-core/message/247146 Mute This Topic: https://lists.openembedded.org/mt/121559736/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
