# libpng 1.6.58

LIBPNG: Portable Network Graphics support, official libpng repository

Snapshot of gominimal/pkgs commit `02e5f823e4b55b925a4db249e262e7b4f73a96e3` (pushed 2026-07-29T21:20:39.000Z).

## Install

```sh
min add libpng
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-40930 | MEDIUM | 5.4 | fixed | — | LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body |

## Transitive advisories

2 advisories inherited through runtime dependencies:

- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (3): base, toolchain, make
- Runtime (2): glibc, zlib

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 40 | low |
| advisories | 25 | low |
| quality | 20 | low |
| maintenance | 67 | mid |
| licence | 90 | good |

## Links

- Homepage: http://libpng.sf.net
- Package page (HTML): https://minimal.dev/pkgs/libpng
- JSON API (floats latest): https://minimal.dev/api/pkgs/libpng.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/libpng/sbom.json