dependencies.lock.json

{
    "schemaVersion": 1,
    "dependencies": [
        {
            "name": "linux-uapi-headers",
            "version": "6.18.38",
            "revision": "v6.18.38",
            "url": "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.38.tar.xz",
            "sha256": "ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045",
            "license": "GPL-2.0-only WITH Linux-syscall-note",
            "buildOptions": [
                "headers_install only",
                "ARCH=x86 for x86_64",
                "ARCH=arm64 for arm64"
            ],
            "reason": "Pinned sanitized Linux UAPI headers for the musl target sysroot"
        },
        {
            "name": "musl",
            "version": "1.2.6",
            "revision": "v1.2.6 plus the listed upstream security patch",
            "url": "https://musl.libc.org/releases/musl-1.2.6.tar.gz",
            "sha256": "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a",
            "license": "MIT",
            "buildOptions": [
                "--disable-shared",
                "--prefix=/usr",
                "--syslibdir=/lib",
                "-O2",
                "-fPIC",
                "LLVM tools only"
            ],
            "patches": [
                {
                    "path": "cmake/patches/musl-1.2.6-iconv-gb18030.patch",
                    "sha256": "444fa70e52ca158fb7d4bad560637790bbf8f72e80b82fff840dd66fa83091e3",
                    "upstreamCommit": "67219f0130ec7c876ac0b299046460fad31caabf",
                    "reason": "Fix CVE-2026-6042 pathological GB18030 decoding"
                }
            ],
            "securityNotes": [
                "CVE-2026-40200 affects 32-bit targets; this project builds only x86_64 and arm64"
            ],
            "reason": "Sole target C library and static-PIE startup objects"
        },
        {
            "name": "fortify-headers",
            "version": "3.0.2",
            "revision": "3.0.2",
            "url": "https://github.com/jvoisin/fortify-headers/archive/refs/tags/3.0.2.tar.gz",
            "sha256": "a4aab14c56eb00239cbd61ac65b3e778cf29ec82f06116ba343a50552882f587",
            "license": "0BSD",
            "buildOptions": [
                "header-only installation under /usr/include/fortify",
                "_FORTIFY_SOURCE=3",
                "Clang pass_dynamic_object_size checks",
                "musl system-header overlay"
            ],
            "reason": "Provide effective inline fortify checks missing from the pinned musl headers"
        },
        {
            "name": "llvm-runtimes",
            "version": "22.1.2",
            "revision": "llvmorg-22.1.2",
            "url": "https://github.com/llvm/llvm-project/releases/download/llvmorg-22.1.2/llvm-project-22.1.2.src.tar.xz",
            "sha256": "62f2f13ff25b1bb28ea507888e858212d19aafb65e8e72b4a65ee0629ec4ae0c",
            "license": "Apache-2.0 WITH LLVM-exception",
            "buildOptions": [
                "compiler-rt builtins and static-PIE CRT objects only",
                "libc++ static only",
                "libc++abi static only",
                "libunwind static only",
                "tests and benchmarks disabled for runtime libraries",
                "musl target sysroot",
                "LLVM tools only"
            ],
            "reason": "Pinned C++ runtime, ABI, unwinder, and compiler builtins"
        },
        {
            "name": "boringssl",
            "version": "0.20260713.0",
            "revision": "8b43ff0f72137b31b23d482f0b2344186d797b03",
            "url": "https://github.com/google/boringssl/releases/download/0.20260713.0/boringssl-0.20260713.0.tar.gz",
            "sha256": "8176853e9d5c0f1af15270587f3c577171a60fddbd0ee903f7763663c04db949",
            "license": "Apache-2.0",
            "buildOptions": [
                "BUILD_SHARED_LIBS=OFF",
                "BUILD_TESTING=OFF",
                "FIPS=OFF",
                "OPENSSL_NO_ASM=ON to keep every crypto object under ThinLTO and CFI",
                "crypto and ssl static archives only",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "generated release sources only; Go and Perl are not invoked",
                "LLVM tools only"
            ],
            "reason": "Sole TLS and cryptography provider for origin and Runtime API HTTPS"
        },
        {
            "name": "nghttp2",
            "version": "1.69.0",
            "revision": "68cb6900fde14c77f0cd7add0e094a862960eb99",
            "url": "https://github.com/nghttp2/nghttp2/releases/download/v1.69.0/nghttp2-1.69.0.tar.xz",
            "sha256": "1fb324b6ec2c56f6bde0658f4139ffd8209fa9e77ce98fd7a5f63af8d0e508ad",
            "license": "MIT",
            "buildOptions": [
                "ENABLE_LIB_ONLY=ON",
                "BUILD_SHARED_LIBS=OFF",
                "BUILD_STATIC_LIBS=ON",
                "BUILD_TESTING=OFF",
                "ENABLE_APP=OFF",
                "ENABLE_DOC=OFF",
                "ENABLE_EXAMPLES=OFF",
                "ENABLE_HPACK_TOOLS=OFF",
                "ENABLE_HTTP3=OFF",
                "SIZEOF_SSIZE_T=8 for the two supported 64-bit targets",
                "OpenSSL discovery disabled; libnghttp2 contains no TLS implementation",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "reason": "HTTP/2 framing and HPACK support for curl origin requests"
        },
        {
            "name": "curl",
            "version": "8.21.0",
            "revision": "68720b4837284335b2d63cb358f8f6ce65f5bc55",
            "url": "https://curl.se/download/curl-8.21.0.tar.xz",
            "sha256": "aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6",
            "license": "curl",
            "buildOptions": [
                "HTTP_ONLY=ON",
                "BUILD_SHARED_LIBS=OFF",
                "BUILD_STATIC_LIBS=ON",
                "BUILD_CURL_EXE=OFF",
                "BUILD_TESTING=OFF",
                "CURL_USE_OPENSSL=ON with the pinned BoringSSL archives",
                "CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG=ON",
                "USE_NGHTTP2=ON with the pinned static nghttp2 archive",
                "CURL_ZLIB=ON with the pinned static zlib archive",
                "brotli, zstd, libpsl, IDN, SSH, GSSAPI, and HTTP/3 disabled",
                "cookies, authentication, proxy, netrc, alt-svc, HSTS, DoH, MIME, and WebSocket support disabled",
                "no default CA bundle or CA directory; callers supply embedded trust data",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "reason": "Bounded HTTP/HTTPS transport for the Lambda Runtime API and validated origins"
        },
        {
            "name": "mozilla-ca-bundle",
            "version": "2026-07-16",
            "revision": "curl Mozilla CA extract dated 2026-07-16",
            "url": "https://curl.se/ca/cacert-2026-07-16.pem",
            "sha256": "3ff344e30b9b1ed2971044eabb438a08f2e2245ddb5f8ab1a3ad8b63ab4eaf91",
            "license": "MPL-2.0",
            "buildOptions": [
                "119 Mozilla-trusted root certificates in PEM format",
                "downloaded through the hash-verified superbuild source cache",
                "compiled into the static bootstrap as read-only data",
                "supplied to curl through CURLOPT_CAINFO_BLOB",
                "no runtime CA file or directory lookup"
            ],
            "securityNotes": [
                "the dated URL and SHA-256 prevent an upstream trust-store update from silently changing a release",
                "refreshes require a dependency-lock change and embedded-bundle regression review"
            ],
            "reason": "Pinned public Web PKI trust roots for verified origin HTTPS without a runtime filesystem dependency"
        },
        {
            "name": "ada-idna",
            "version": "3.4.4",
            "revision": "8d50724a7dea209a05234a445e28f97994b0a5f6",
            "url": "https://github.com/ada-url/ada/archive/refs/tags/v3.4.4.tar.gz",
            "sha256": "77bc5bbc383ed098cc60266ad6ee912de2431bb62d89248c0e17c4e712dcdaf9",
            "license": "MIT",
            "buildOptions": [
                "first-party CMake adapter compiles only the generated src/ada_idna.cpp translation unit",
                "Unicode 17.0.0 UTS #46 mapping, normalization, Punycode, Bidi, and ContextJ tables",
                "nontransitional processing",
                "simdutf and the full WHATWG URL parser excluded",
                "static libada_idna archive and ada_idna.h only",
                "MIT license notice installed with the target artifacts",
                "production hardening flags including libc++ hardening, fortify, ThinLTO, trapping CFI, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "warnings as errors",
                "LLVM tools only"
            ],
            "securityNotes": [
                "Ada to_ascii can return a syntactically invalid DNS name, so first-party code independently enforces STD3 ASCII labels, hyphen rules, non-empty labels, and DNS label/name lengths",
                "raw Unicode hostname input is capped at 4096 bytes before allocation-heavy conversion",
                "libidn2, libunistring, ICU, simdutf, and runtime Unicode data files are absent from the dependency graph"
            ],
            "reason": "Permissively licensed, self-contained IDNA conversion for Unicode origin hostnames"
        },
        {
            "name": "libexpat",
            "version": "2.8.2",
            "revision": "c61098da494eea1cbd091118118dcee417faacea",
            "url": "https://github.com/libexpat/libexpat/releases/download/R_2_8_2/expat-2.8.2.tar.xz",
            "sha256": "3ad89b8588e6644bd4e49981480d48b21289eebbcd4f0a1a4afb1c29f99b6ab4",
            "license": "MIT",
            "buildOptions": [
                "EXPAT_SHARED_LIBS=OFF",
                "EXPAT_BUILD_TOOLS=OFF",
                "EXPAT_BUILD_EXAMPLES=OFF",
                "EXPAT_BUILD_TESTS=OFF with a first-party bounded in-memory parser test",
                "EXPAT_BUILD_DOCS=OFF",
                "EXPAT_BUILD_FUZZERS=OFF and EXPAT_OSSFUZZ_BUILD=OFF",
                "EXPAT_DTD=ON, EXPAT_GE=ON, and EXPAT_NS=ON with amplification protections retained",
                "EXPAT_CONTEXT_BYTES=1024",
                "EXPAT_WITH_GETRANDOM=ON using the musl getrandom wrapper as the sole entropy source",
                "arc4random, getentropy, direct SYS_getrandom, and /dev/urandom sources disabled",
                "static libexpat archive, public headers, generated configuration, and expat.pc only",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "cfi-icall alone disabled because libexpat invokes public XML parser handlers across ABI-compatible callback signatures that ThinLTO assigns different type identities",
                "warnings as errors",
                "LLVM tools only"
            ],
            "securityNotes": [
                "2.8.2 fixes CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403 through CVE-2026-56408, and CVE-2026-56412 in the library",
                "xmlwf-only fixes CVE-2026-56409 through CVE-2026-56411 are present upstream while xmlwf is excluded from this build"
            ],
            "reason": "Pinned XML parser required by libvips metadata and serialization support"
        },
        {
            "name": "libffi",
            "version": "3.7.1",
            "revision": "5c1c43091ed611fdea774374355eb938c73a9157",
            "url": "https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz",
            "sha256": "d5e9a6638ddbd2513ddb54518eb67e4bbe6fa707bcc01c10f6212f0a088d819d",
            "license": "MIT",
            "buildOptions": [
                "curated CMake static-only source build after upstream cross-configuration",
                "--disable-shared and --enable-static",
                "--disable-docs, --disable-raw-api, and --disable-symvers",
                "struct arguments and closures retained for GObject",
                "static executable trampoline tables enabled to avoid generating writable executable instructions",
                "x86_64 uses ffi64.c, ffiw64.c, unix64.S, and win64.S",
                "arm64 uses ffi.c and sysv.S",
                "architecture ABI assembly is the narrow CFI instrumentation exception; x86 CET and arm64 BTI/PAC plus non-executable-stack annotations are required",
                "all C sources retain fortify, ThinLTO, trapping CFI, and warnings as errors",
                "warning exceptions are source-local: unused ABI parameters in prep_cif.c and aarch64/ffi.c, plus dlmalloc integer-offset idioms included by closures.c",
                "the configure cache asserts musl memcpy availability because Clang rejects Autoconf's obsolete incompatible redeclaration under warnings as errors",
                "static libffi archive, ffi.h, ffitarget.h, and libffi.pc only",
                "LLVM tools only"
            ],
            "securityNotes": [
                "3.7.1 fixes aarch64 ffi_call memory corruption when passing many large structs by value",
                "3.7.1 includes the 3.5.2 close-on-exec fix for static trampoline file descriptors",
                "the x86_64 smoke test exercises both ffi_call and an allocated closure through the static PIE"
            ],
            "reason": "Pinned foreign-call ABI and closure support required by GLib GObject"
        },
        {
            "name": "pcre2",
            "version": "10.47",
            "revision": "f454e231fe5006dd7ff8f4693fd2b8eb94333429",
            "url": "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.gz",
            "sha256": "c08ae2388ef333e8403e670ad70c0a11f1eed021fd88308d7e02f596fcd9dc16",
            "license": "BSD-3-Clause WITH PCRE2-exception",
            "buildOptions": [
                "BUILD_SHARED_LIBS=OFF and BUILD_STATIC_LIBS=ON",
                "PCRE2_BUILD_PCRE2_8=ON with 16-bit and 32-bit libraries disabled",
                "PCRE2_STATIC_PIC=ON",
                "PCRE2_SUPPORT_UNICODE=ON",
                "PCRE2_SUPPORT_JIT=OFF to forbid runtime executable-memory generation",
                "PCRE2_BUILD_PCRE2GREP=OFF and PCRE2_BUILD_TESTS=OFF with a first-party bounded Unicode match test",
                "POSIX wrapper, pcre2test, pcre2grep, documentation, and shared libraries excluded",
                "default upstream match, depth, heap, lookbehind, and nesting limits retained",
                "static libpcre2-8 archive, public header, and libpcre2-8.pc only",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors except -Wno-overlength-strings for the upstream 5686-byte error-message table",
                "LLVM tools only"
            ],
            "securityNotes": [
                "10.47 fixes an easily reachable pcre2_callout_enumerate crash for patterns containing a Unicode character class",
                "JIT is excluded so the production process does not allocate executable memory for regular expressions"
            ],
            "reason": "Pinned Unicode regular-expression engine required by GLib GRegex"
        },
        {
            "name": "zlib",
            "version": "1.3.2",
            "revision": "da607da739fa6047df13e66a2af6b8bec7c2a498",
            "url": "https://zlib.net/zlib-1.3.2.tar.gz",
            "sha256": "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16",
            "license": "Zlib",
            "buildOptions": [
                "ZLIB_BUILD_SHARED=OFF",
                "ZLIB_BUILD_STATIC=ON",
                "ZLIB_BUILD_TESTING=OFF",
                "ZLIB_INSTALL=OFF with curated archive, header, and generated zlib.pc installation",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "reason": "Bounded HTTP content decoding and PNG/codec compression support"
        },
        {
            "name": "glib",
            "version": "2.88.2",
            "revision": "07233788db387cc362f09c4882ce4838f4a553a4",
            "url": "https://download.gnome.org/sources/glib/2.88/glib-2.88.2.tar.xz",
            "sha256": "cf3f215a640c8a4257f14317586b8f1fdd25a10a93cb4bdda147c0f9ad88e74f",
            "license": "LGPL-2.1-or-later",
            "buildOptions": [
                "Meson cross build driven by the CMake superbuild",
                "default_library=static and b_staticpic=true",
                "GLib, GObject, GThread, GModule stub, and GIO static archives only",
                "GModule dynamic loading disabled for the static build and GIO modules cannot load shared objects",
                "tests, installed tests, tools, documentation, man pages, introspection, GIRepository, translations, and fuzz targets excluded",
                "SELinux, libmount, xattr, libelf, DTrace, SystemTap, and sysprof integrations disabled",
                "debug infrastructure disabled while GLib assertions and API checks remain enabled",
                "pinned static PCRE2, libffi, and zlib dependencies from the target sysroot",
                "production hardening flags including fortify, split-unit ThinLTO, stack protection, zero initialization, and architecture branch protection",
                "explicit CFI exception for GLib's pervasive documented generic callback ABI; all other hardening remains enabled",
                "upstream warning level 3 with warnings as errors",
                "development headers and normalized static pkg-config metadata installed without target utilities or shared libraries",
                "LLVM tools only"
            ],
            "patches": [
                {
                    "path": "cmake/patches/glib-2.88.2-disable-static-dlopen.patch",
                    "sha256": "a6103ea35c5ccdea9f56d08bded4d9c8c74b01776834a7d996d86ba7b5b5a95a",
                    "upstreamCommit": null,
                    "reason": "Disable dlopen-backed GModule, omit GIRepository when introspection is disabled, make Clang 22 conversions and fallthrough explicit in target-specific paths, use the signed gint8 range on unsigned-char arm64, and scope a musl CMSG_NXTHDR sign warning in the deployment-only static build"
                }
            ],
            "securityNotes": [
                "GIO environment and compiled module paths cannot load code because G_MODULE_SUPPORTED is false",
                "GLib is the sole CFI dependency exception because its public generic callback ABI intentionally permits function-pointer conversions rejected by Clang CFI; first-party code and compatible dependencies retain trapping CFI",
                "static LGPL distribution requires the corresponding-source and relinking compliance bundle defined by the release plan"
            ],
            "reason": "Pinned GLib, GObject, and GIO foundation required by libvips"
        },
        {
            "name": "libaom",
            "version": "3.14.1",
            "revision": "03087864cf4bea6abb0d28f95cf7843511413d8f",
            "url": "https://storage.googleapis.com/aom-releases/libaom-3.14.1.tar.gz",
            "sha256": "44bf90dbd23e734d50e70a8c41c285193922938bd0d3bc2ee56764d181d55ef5",
            "license": "BSD-2-Clause AND LicenseRef-AOM-Patent-License-1.0",
            "buildOptions": [
                "static libaom archive with PIC",
                "AV1 decoder and encoder with high-bit-depth support",
                "generic C target with runtime CPU detection and architecture SIMD disabled",
                "multithreading retained for bounded image encode/decode work",
                "WebM I/O and bundled libyuv disabled",
                "examples, tools, tests, test data, and documentation disabled",
                "production hardening flags including fortify, ThinLTO, trapping CFI, stack protection, zero initialization, and architecture branch protection",
                "warnings as errors",
                "LLVM tools only"
            ],
            "patches": [
                {
                    "path": "cmake/patches/libaom-3.14.1-preserve-fortify.patch",
                    "sha256": "32eafecf0cdc20a822f6c5a3f18c3ee122d52220e6df7bd42b294084e2601672",
                    "upstreamCommit": null,
                    "reason": "Preserve the superbuild's _FORTIFY_SOURCE=3 setting in Release builds instead of overriding it with _FORTIFY_SOURCE=0"
                }
            ],
            "securityNotes": [
                "generic target removes assembly and runtime CPU dispatch from the static deployment graph",
                "no plugin or runtime codec-loading interface is built",
                "first-party media code must apply checked dimension and resource limits before invoking libaom"
            ],
            "reason": "Pinned AV1 decode and encode implementation for no-plugin libheif AVIF support"
        },
        {
            "name": "libheif",
            "version": "1.22.2",
            "revision": "763bc8bb87788d64d39ece623ceed988de12dc5b",
            "url": "https://github.com/strukturag/libheif/releases/download/v1.22.2/libheif-1.22.2.tar.gz",
            "sha256": "eea48e4841f83fbe51d029337ffd2d14512d0203015dad40b90213d872958af3",
            "license": "LGPL-3.0-or-later",
            "buildOptions": [
                "BUILD_SHARED_LIBS=OFF",
                "ENABLE_PLUGIN_LOADING=OFF and every codec plugin option disabled",
                "built-in AOM AV1 decoder and encoder only",
                "libsharpyuv color conversion from the pinned libwebp build",
                "libde265, x265, kvazaar, FFmpeg, and WebCodecs HEVC paths disabled",
                "AVC, VVC, JPEG, JPEG 2000, JPEG 2000 HT, and uncompressed codec paths disabled",
                "examples, development tools, GDK Pixbuf plugin, documentation, tests, and fuzzers disabled",
                "experimental features and header compression disabled",
                "multithreading and bounded parallel tile decoding retained",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, and architecture branch protection",
                "cfi-icall alone disabled for libheif's public versioned writer and built-in codec-backend callback tables; plugin loading remains compiled out",
                "reduced visibility and warnings as errors",
                "LLVM tools only"
            ],
            "patches": [
                {
                    "path": "cmake/patches/libheif-1.22.2-use-cross-aom-discovery.patch",
                    "sha256": "396d9ef983774908ce6259216ff68172d0e50bb5d6c97413f8d1b03ab97d4e68",
                    "upstreamCommit": null,
                    "reason": "Use libheif's rooted FindAOM fallback while cross-compiling so the imported AOM target cannot place musl C headers before libc++ wrapper headers, and explicitly discard the result of completed parallel tile jobs under Clang's nodiscard diagnostics"
                }
            ],
            "securityNotes": [
                "HEIC decode and encode report unavailable at runtime because no HEVC codec backend is linked",
                "plugin loading is compiled out, so codec shared objects cannot extend the deployment graph",
                "generic HEIF container parsing remains in libheif but image/heif is rejected by first-party MIME policy",
                "first-party media code must apply checked dimensions, frame counts, and resource limits before invoking libheif",
                "static LGPL distribution requires the corresponding-source and relinking compliance bundle defined by the release plan"
            ],
            "reason": "Pinned AVIF container decode and encode for libvips without libde265, HEVC, or HEIC support"
        },
        {
            "name": "libvips",
            "version": "8.18.2",
            "revision": "17ad2f62dda7e39985955da189183e594683d45e",
            "url": "https://github.com/libvips/libvips/releases/download/v8.18.2/vips-8.18.2.tar.xz",
            "sha256": "a30d4aede16f1c2899c1a2241870f8a7409feafa38484bcdcdac113d6d6f8ff5",
            "license": "LGPL-2.1-or-later",
            "buildOptions": [
                "Meson cross-build with --default-library=static and b_staticpic=true",
                "C API only; C++ bindings, examples, tools installation, documentation, introspection, VAPI, deprecated API, tests, and fuzzers excluded",
                "dynamic modules disabled and the libheif loader compiled into libvips",
                "JPEG, PNG, WebP, GIF through the separately pinned libnsgif archive, EXIF, lcms2, zlib, and AVIF through the pinned AVIF-only libheif enabled",
                "libde265, x265, HEVC plugins, and every other libheif codec backend absent from the dependency graph",
                "Meson rsvg, pangocairo, and fontconfig features explicitly disabled",
                "ImageMagick, GraphicsMagick, TIFF, OpenEXR, JPEG XL, JPEG 2000, PDF, video, RAW, SVG, font, archive, FFT, ORC, and Highway integrations disabled",
                "PPM, Analyze7, and Radiance loaders disabled to reduce attack surface",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "cfi-icall alone disabled for libvips because GObject operation registration uses the same generic callback conversions as the approved GLib ABI exception",
                "warnings as errors and LLVM tools only"
            ],
            "patches": [
                {
                    "path": "cmake/patches/libvips-8.18.2-use-pinned-libnsgif.patch",
                    "sha256": "4920de2dd9c000807ba6e37796fa20ca4685d860648100ec0bc227a889086c5a",
                    "upstreamCommit": null,
                    "reason": "Replace libvips' bundled libnsgif copy with the separately pinned, hardened static libnsgif archive"
                }
            ],
            "securityNotes": [
                "libvips exposes its HEIF foreign operation because AVIF and HEIC share libheif container APIs; first-party MIME policy rejects image/heif before dispatch",
                "runtime module loading is compiled out and no shared codec module is produced or installed",
                "final-binary policy rejects libde265, x265, dynamic-loader references, and unexpected codec archives",
                "static LGPL distribution requires the corresponding-source and relinking compliance bundle defined by the release plan"
            ],
            "reason": "Pinned static media operation graph with AVIF support and no HEVC implementation"
        },
        {
            "name": "libpng",
            "version": "1.6.58",
            "revision": "3061454d980de7d53608f594194cfac722721d2a",
            "url": "https://download.sourceforge.net/libpng/libpng-1.6.58.tar.xz",
            "sha256": "28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775",
            "license": "libpng-2.0",
            "buildOptions": [
                "curated CMake static-only source build",
                "shared libraries, tests, tools, and generated symbol scripts excluded",
                "upstream scripts/pnglibconf.h.prebuilt standard configuration",
                "PNG_INTEL_SSE_OPT=1 on x86_64",
                "PNG_ARM_NEON_OPT=2 on arm64",
                "pinned static zlib only",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "securityNotes": [
                "1.6.58 includes the 1.6.57 fixes for CVE-2026-34757 and the 1.6.56 fixes for CVE-2026-33416 and CVE-2026-33636",
                "1.6.58 fixes the png_get_PLTE stale-palette regression introduced in 1.6.56"
            ],
            "reason": "Pinned PNG decode/encode primitives for static images and the first-party APNG pipeline"
        },
        {
            "name": "libjpeg-turbo",
            "version": "3.1.4.1",
            "revision": "9217719d3a58633923b096af4c1d50d304768a64",
            "url": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.1.4.1/libjpeg-turbo-3.1.4.1.tar.gz",
            "sha256": "ecae8008e2cc9ade2f2c1bb9d5e6d4fb73e7c433866a056bd82980741571a022",
            "license": "IJG AND BSD-3-Clause AND Zlib",
            "buildOptions": [
                "ENABLE_SHARED=OFF",
                "ENABLE_STATIC=ON",
                "WITH_SIMD=OFF so every codec object remains under ThinLTO and trapping CFI and output stays architecture-independent",
                "WITH_ARITH_DEC=ON",
                "WITH_ARITH_ENC=OFF",
                "WITH_JPEG7=OFF and WITH_JPEG8=OFF for the libjpeg v6b-compatible API/ABI",
                "WITH_TURBOJPEG=OFF",
                "WITH_JAVA=OFF",
                "WITH_TOOLS=OFF",
                "WITH_TESTS=OFF with a first-party in-memory encode/decode smoke test",
                "WITH_FUZZ=OFF",
                "CMAKE_SIZEOF_VOID_P=8 for the two supported 64-bit targets",
                "SIZE_T=8 and UNSIGNED_LONG=8 for the two supported LP64 targets",
                "-ffp-contract=off for architecture-independent floating-point DCT behavior",
                "-Wno-unused-parameter for upstream precision-wrapper callbacks whose parameters are conditionally unused",
                "libjpeg static archive only",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "cfi-icall alone disabled because libjpeg-turbo invokes libvips source-manager callbacks across ABI-compatible signatures that ThinLTO assigns different type identities",
                "warnings as errors",
                "LLVM tools only"
            ],
            "securityNotes": [
                "3.1.4.1 includes the 3.1.4 fix for TurboJPEG destination-buffer reallocation paths that could leak memory or lead to a caller double free; the TurboJPEG API is nevertheless excluded from this build"
            ],
            "reason": "Pinned JPEG decode/encode primitives for libvips and first-entry ICO fallback"
        },
        {
            "name": "libwebp",
            "version": "1.6.0",
            "revision": "4fa21912338357f89e4fd51cf2368325b59e9bd9",
            "url": "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0.tar.gz",
            "sha256": "e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564",
            "license": "BSD-3-Clause",
            "buildOptions": [
                "BUILD_SHARED_LIBS=OFF",
                "WEBP_LINK_STATIC=ON",
                "WEBP_BUILD_LIBWEBPMUX=ON",
                "WEBP_BUILD_ANIM_UTILS=OFF",
                "all command-line tools, examples, extras, JavaScript, and fuzztest targets disabled",
                "image-library and OpenGL discovery disabled",
                "WEBP_ENABLE_SIMD=ON with runtime dispatch",
                "WEBP_USE_THREAD=ON using musl pthread support",
                "near-lossless encoding, 16-bit colorspace swapping, and bit tracing disabled",
                "libsharpyuv, libwebp, libwebpdemux, and libwebpmux static archives only",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "reason": "Pinned WebP encode/decode and animation mux/demux primitives for static output and the first-party APNG pipeline"
        },
        {
            "name": "libnsgif",
            "version": "1.0.0",
            "revision": "e97bc7b86f19ace910a2c71025ad2d94a28a1d2e",
            "url": "https://download.netsurf-browser.org/libs/releases/libnsgif-1.0.0-src.tar.gz",
            "sha256": "6014c842f61454d2f5a0f8243d7a8d7bde9b7da3ccfdca2d346c7c0b2c4c061b",
            "license": "MIT",
            "buildOptions": [
                "first-party CMake adapter compiles only src/gif.c and src/lzw.c",
                "C99 static archive only",
                "upstream examples, tests, fuzz corpora, documentation, and NetSurf buildsystem excluded",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "cfi-icall alone disabled because libnsgif invokes libvips bitmap callbacks across ABI-compatible signatures that ThinLTO assigns different type identities",
                "strict upstream warning set with warnings as errors",
                "LLVM tools only"
            ],
            "reason": "Pinned GIF frame scanning, animation metadata, and decode primitives used by the libvips GIF loader"
        },
        {
            "name": "libexif",
            "version": "0.6.26",
            "revision": "b2edc5a8adf4d1b79ce9413a9c9d8f3ab871c082",
            "url": "https://github.com/libexif/libexif/releases/download/v0.6.26/libexif-0.6.26.tar.xz",
            "sha256": "4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c",
            "license": "LGPL-2.0-or-later",
            "buildOptions": [
                "first-party CMake adapter compiles exactly the 25 upstream library C sources",
                "static libexif archive, public API headers, and libexif.pc only",
                "Canon, Fuji, Olympus, and Pentax MakerNote parsers enabled",
                "NLS, gettext, documentation, tests, examples, and tools excluded",
                "HAVE_LOCALTIME_R=1 with _POSIX_C_SOURCE=200809L on musl",
                "-ffp-contract=off for architecture-independent metadata formatting",
                "-Wno-switch for upstream GPS tag macros intentionally outside the historical ExifTag enum",
                "production hardening flags including fortify, ThinLTO, trapping CFI except cfi-icall, stack protection, zero initialization, hidden visibility, and architecture branch protection",
                "cfi-icall alone disabled because libexif's public callback traversal ABI is invoked through generic callback conversions after ThinLTO; libvips retains the same narrow exception",
                "warnings as errors",
                "LGPL corresponding-source and relink artifacts required in the release compliance bundle",
                "LLVM tools only"
            ],
            "securityNotes": [
                "0.6.26 fixes CVE-2026-32775, CVE-2026-40385, and CVE-2026-40386 in MakerNote parsing"
            ],
            "reason": "Pinned EXIF metadata and orientation parsing for the libvips JPEG loader"
        },
        {
            "name": "lcms2",
            "version": "2.19.1",
            "revision": "21c582a594fe5279f90c0b93437c398f93bf62b0",
            "url": "https://github.com/mm2/Little-CMS/releases/download/lcms2.19.1/lcms2-2.19.1.tar.gz",
            "sha256": "bfc54f7bab59fbc921012014a8032e4cba4abd46db47d46b76416a8c0b2815c8",
            "license": "MIT",
            "buildOptions": [
                "LCMS2_BUILD_SHARED=OFF",
                "LCMS2_BUILD_STATIC=ON",
                "LCMS2_BUILD_TOOLS=OFF",
                "LCMS2_BUILD_TESTS=OFF with a first-party bounded in-memory ICC round-trip test",
                "LCMS2_WITH_JPEG=OFF",
                "LCMS2_WITH_TIFF=OFF",
                "LCMS2_WITH_ZLIB=OFF",
                "LCMS2_WITH_THREADS=ON using musl pthread support",
                "LCMS2_WITH_FASTFLOAT=OFF",
                "LCMS2_WITH_THREADED_PLUGIN=OFF",
                "CMAKE_C_BYTE_ORDER=LITTLE_ENDIAN for the two supported Lambda targets",
                "CMAKE_SIZEOF_VOID_P=8 for the two supported 64-bit targets",
                "_POSIX_C_SOURCE=200809L for the musl gmtime_r declaration",
                "-ffp-contract=off for architecture-independent color calculations",
                "lcms2 static archive and public API header only",
                "production hardening flags including fortify, ThinLTO, and trapping CFI",
                "warnings as errors",
                "LLVM tools only"
            ],
            "securityNotes": [
                "2.19 includes the fix for CVE-2026-41254 and additional integer-overflow guards; 2.19.1 is the upstream hot-fix release"
            ],
            "reason": "Pinned ICC profile parsing, generation, and color transforms for the libvips media pipeline"
        },
        {
            "name": "yyjson",
            "version": "0.12.0",
            "revision": "8b4a38dc994a110abaec8a400615567bd996105f",
            "url": "https://github.com/ibireme/yyjson/archive/refs/tags/0.12.0.tar.gz",
            "sha256": "b16246f617b2a136c78d73e5e2647c6f1de1313e46678062985bdcf1f40bb75d",
            "license": "MIT",
            "buildOptions": [
                "BUILD_SHARED_LIBS=OFF",
                "YYJSON_BUILD_TESTS=OFF",
                "YYJSON_BUILD_FUZZER=OFF",
                "YYJSON_BUILD_MISC=OFF",
                "YYJSON_BUILD_DOC=OFF",
                "YYJSON_DISABLE_INCR_READER=ON",
                "YYJSON_DISABLE_UTILS=ON",
                "YYJSON_DISABLE_NON_STANDARD=ON",
                "production hardening flags including fortify, ThinLTO, and CFI",
                "LLVM tools only"
            ],
            "reason": "Bounded Function URL event parsing and response metadata serialization"
        },
        {
            "name": "googletest",
            "version": "1.17.0",
            "revision": "v1.17.0",
            "url": "https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz",
            "sha256": "65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c",
            "license": "BSD-3-Clause",
            "scope": "test",
            "buildOptions": [
                "BUILD_GMOCK=OFF",
                "INSTALL_GTEST=OFF",
                "test-only static linkage"
            ],
            "reason": "GoogleTest unit-test framework; excluded from bootstrap"
        }
    ]
}