update libwebp to 1.3.2

This addresses CVE-2023-4863. Additionally, Linux aarch64 and macOS arm64 binaries are added. Linux x86 is removed as previously this was an x64 binaries; prebuilt x86 Linux binaries are no longer distributed. The source and binaries are from: https://developers.google.com/speed/webp/download Fixes: imagemin#62
jzern · Oct 13, 2023 · 579f868 · 579f868
1 parent 91dfc00
commit 579f868
Show file tree

Hide file tree

Showing 11 changed files with 5 additions and 4 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -7,8 +7,9 @@ const pkg = JSON.parse(fs.readFileSync(new URL('../package.json', import.meta.ur
 const url = `https://raw.githubusercontent.com/imagemin/cwebp-bin/v${pkg.version}/vendor/`;
 
 const binWrapper = new BinWrapper()
-	.src(`${url}osx/cwebp`, 'darwin')
-	.src(`${url}linux/x86/cwebp`, 'linux', 'x86')
+	.src(`${url}osx/arm64/cwebp`, 'darwin', 'arm64')
+	.src(`${url}osx/x86-64/cwebp`, 'darwin', 'x86-64')
+	.src(`${url}linux/aarch64/cwebp`, 'linux', 'aarch64')
 	.src(`${url}linux/x64/cwebp`, 'linux', 'x64')
 	.src(`${url}win/x64/cwebp.exe`, 'win32', 'x64')
 	.dest(fileURLToPath(new URL('../vendor', import.meta.url)))

diff --git a/lib/install.js b/lib/install.js
@@ -11,7 +11,7 @@ bin.run(['-version']).then(() => {
 	console.info('compiling from source');
 
 	try {
-		const source = fileURLToPath(new URL('../vendor/source/libwebp-1.2.1.tar.gz', import.meta.url));
+		const source = fileURLToPath(new URL('../vendor/source/libwebp-1.3.2.tar.gz', import.meta.url));
 
 		binBuild.file(source, [
 			`./configure --disable-shared --prefix="${bin.dest()}" --bindir="${bin.dest()}"`,

diff --git a/test/test.js b/test/test.js
@@ -18,7 +18,7 @@ test('rebuild the cwebp binaries', async t => {
 	}
 
 	const temporary = temporaryDirectory();
-	const source = fileURLToPath(new URL('../vendor/source/libwebp-1.2.1.tar.gz', import.meta.url));
+	const source = fileURLToPath(new URL('../vendor/source/libwebp-1.3.2.tar.gz', import.meta.url));
 
 	await binBuild.file(source, [
 		`./configure --disable-shared --prefix="${temporary}" --bindir="${temporary}"`,

diff --git a/vendor/linux/aarch64/cwebp b/vendor/linux/aarch64/cwebp
diff --git a/vendor/linux/x64/cwebp b/vendor/linux/x64/cwebp
diff --git a/vendor/linux/x86/cwebp b/vendor/linux/x86/cwebp
diff --git a/vendor/osx/arm64/cwebp b/vendor/osx/arm64/cwebp
diff --git a/vendor/osx/cwebp b/vendor/osx/cwebp
diff --git a/vendor/osx/x86-64/cwebp b/vendor/osx/x86-64/cwebp
diff --git a/vendor/source/libwebp-1.2.1.tar.gz → vendor/source/libwebp-1.3.2.tar.gz b/vendor/source/libwebp-1.2.1.tar.gz → vendor/source/libwebp-1.3.2.tar.gz
diff --git a/vendor/win/x64/cwebp.exe b/vendor/win/x64/cwebp.exe