Merge PR "[AUTO-CHERRYPICK] [AUTOPATCHER-CORE] Upgrade libpng to 1.6.51 for CVE-2025-64505, CVE-2025-64506, CVE-2025-65018, CVE-2025-64720 - branch 3.0-dev" #15193

Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>

Author: 3 people

SPECS/libpng/libpng.signatures.json

@@ -1,5 +1,5 @@
 {
- "Signatures": {
-  "libpng-1.6.40.tar.xz": "535b479b2467ff231a3ec6d92a525906fb8ef27978be4f66dbe05d3f3a01b3a1"
- }
+  "Signatures": {
+    "libpng-1.6.51.tar.xz": "b1872484c1c5c70acc79cbb15fb366df954fa8d5dacbe7f729d858902d17933c"
+  }
 }

SPECS/libpng/libpng.spec

@@ -1,6 +1,6 @@
 Summary:        contains libraries for reading and writing PNG files.
 Name:           libpng
-Version:        1.6.40
+Version:        1.6.51
 Release:        1%{?dist}
 License:        zlib
 Vendor:         Microsoft Corporation
@@ -57,6 +57,9 @@ make %{?_smp_mflags} -k check
 %{_mandir}/man3/*
 
 %changelog
+* Thu Nov 27 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.6.51-1
+- Auto-upgrade to 1.6.51 - for CVE-2025-64505, CVE-2025-64506, CVE-2025-65018, CVE-2025-64720
+
 * Fri Dec 15 2023 Neha Agarwal <nehaagarwal@microsoft.com> - 1.6.40-1
 - Update to v1.6.40
 

cgmanifest.json

@@ -10821,8 +10821,8 @@
         "type": "other",
         "other": {
           "name": "libpng",
-          "version": "1.6.40",
-          "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.40.tar.xz"
+          "version": "1.6.51",
+          "downloadUrl": "https://downloads.sourceforge.net/libpng/libpng-1.6.51.tar.xz"
         }
       }
     },