Merge PR "[AUTO-CHERRYPICK] [AUTOPATCHER-CORE] Upgrade libpng to 1.6.56 for CVE-2026-33636, CVE-2026-33416 [HIGH] - branch 3.0-dev" #16370

CBL-Mariner-Bot · web-flow · commit 4af80023cb74 · 2026-03-30T12:23:26.000-07:00
diff --git a/SPECS/libpng/libpng.signatures.json b/SPECS/libpng/libpng.signatures.json
@@ -1,5 +1,5 @@
 {
   "Signatures": {
-    "libpng-1.6.55.tar.xz": "d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d"
+    "libpng-1.6.56.tar.xz": "f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18"
   }
 }
diff --git a/SPECS/libpng/libpng.spec b/SPECS/libpng/libpng.spec
@@ -1,6 +1,6 @@
 Summary:        contains libraries for reading and writing PNG files.
 Name:           libpng
-Version:        1.6.55
+Version:        1.6.56
 Release:        1%{?dist}
 License:        zlib
 Vendor:         Microsoft Corporation
@@ -57,6 +57,9 @@ make %{?_smp_mflags} -k check
 %{_mandir}/man3/*
 
 %changelog
+* Sat Mar 28 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.6.56-1
+- Auto-upgrade to 1.6.56 - for CVE-2026-33636, CVE-2026-33416
+
 * Wed Feb 11 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.6.55-1
 - Auto-upgrade to 1.6.55 - for CVE-2026-25646
 
diff --git a/cgmanifest.json b/cgmanifest.json
@@ -10851,8 +10851,8 @@
         "type": "other",
         "other": {
           "name": "libpng",
-          "version": "1.6.55",
-          "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.55.tar.xz"
+          "version": "1.6.56",
+          "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.56.tar.xz"
         }
       }
     },

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`{`
`2`	`2`	`"Signatures": {`
`3`		`- "libpng-1.6.55.tar.xz": "d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d"`
	`3`	`+ "libpng-1.6.56.tar.xz": "f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18"`
`4`	`4`	`}`
`5`	`5`	`}`
Original file line number	Diff line number	Diff line change
`@@ -10851,8 +10851,8 @@`
`10851`	`10851`	`"type": "other",`
`10852`	`10852`	`"other": {`
`10853`	`10853`	`"name": "libpng",`
`10854`		`- "version": "1.6.55",`
`10855`		`- "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.55.tar.xz"`
	`10854`	`+ "version": "1.6.56",`
	`10855`	`+ "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.56.tar.xz"`
`10856`	`10856`	`}`
`10857`	`10857`	`}`
`10858`	`10858`	`},`