From 143d503c6c8a442629da47035e23c090cce0860b Mon Sep 17 00:00:00 2001
From: Rangi <35663410+Rangi42@users.noreply.github.com>
Date: Wed, 8 Apr 2026 20:58:41 -0400
Subject: [PATCH] Update libpng to 1.6.56 (#1922)

Fixes #1920

This also switches from Homebrew-installed `sha2`
to macOS-preinstalled `shasum`.
---
 .github/scripts/build_libpng.sh         | 10 +++-------
 .github/scripts/install_deps.sh         |  2 +-
 .github/scripts/mingw-w64-libpng-dev.sh |  5 +++--
 cmake/deps.cmake                        |  4 ++--
 4 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/.github/scripts/build_libpng.sh b/.github/scripts/build_libpng.sh
index 968d9894..51a06d30 100755
--- a/.github/scripts/build_libpng.sh
+++ b/.github/scripts/build_libpng.sh
@@ -1,17 +1,13 @@
 #!/bin/bash
 set -euo pipefail
 
-pngver=1.6.53
+pngver=1.6.56
 
 ## Grab sources and check them
 
 curl -LOJ "http://prdownloads.sourceforge.net/libpng/libpng-$pngver.tar.xz?download"
-# Brew doesn't provide any sha256sum, so we're making do with `sha2` instead.
-if [ "$(sha2 -q -256 libpng-$pngver.tar.xz)" != 1d3fb8ccc2932d04aa3663e22ef5ef490244370f4e568d7850165068778d98d4 ]; then
-	sha2 -256 libpng-$pngver.tar.xz
-	echo Checksum mismatch! Aborting. >&2
-	exit 1
-fi
+echo f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18 \*libpng-$pngver.tar.xz | \
+	shasum -a 256 -c -
 
 ## Extract sources and patch them
 
diff --git a/.github/scripts/install_deps.sh b/.github/scripts/install_deps.sh
index 420442b3..0452eaa2 100755
--- a/.github/scripts/install_deps.sh
+++ b/.github/scripts/install_deps.sh
@@ -11,7 +11,7 @@ case "${1%-*}" in
 		# macOS bundles GNU Make 3.81, which doesn't support synced output.
 		# We leave it as the default in `PATH`, to test that our Makefile works with it.
 		# However, CMake automatically uses Homebrew's `gmake`, so our CI has synced output.
-		brew install bison sha2 md5sha1sum make
+		brew install bison md5sha1sum make
 		# Export `bison` to allow using the version we install from Homebrew,
 		# instead of the outdated one preinstalled on macOS (which doesn't even support `-Wall`...)
 		export PATH="/opt/homebrew/opt/bison/bin:$PATH"
diff --git a/.github/scripts/mingw-w64-libpng-dev.sh b/.github/scripts/mingw-w64-libpng-dev.sh
index 7808a465..77842a75 100755
--- a/.github/scripts/mingw-w64-libpng-dev.sh
+++ b/.github/scripts/mingw-w64-libpng-dev.sh
@@ -1,13 +1,14 @@
 #!/bin/bash
 set -euo pipefail
 
-pngver=1.6.53
+pngver=1.6.56
 arch="$1"
 
 ## Grab sources and check them
 
 wget http://downloads.sourceforge.net/project/libpng/libpng16/$pngver/libpng-$pngver.tar.xz
-echo 1d3fb8ccc2932d04aa3663e22ef5ef490244370f4e568d7850165068778d98d4 libpng-$pngver.tar.xz | sha256sum -c -
+echo f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18 \*libpng-$pngver.tar.xz | \
+	sha256sum -c -
 
 ## Extract sources and patch them
 
diff --git a/cmake/deps.cmake b/cmake/deps.cmake
index 81ece158..c1ea12f8 100644
--- a/cmake/deps.cmake
+++ b/cmake/deps.cmake
@@ -3,8 +3,8 @@
 # These are kept in a separate file so that it can be hashed as a key for our CI's `actions/cache`.
 
 FetchContent_Declare(PNG
-                     URL https://download.sourceforge.net/libpng/libpng-1.6.55.tar.xz
-                     URL_HASH SHA256=d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d
+                     URL https://download.sourceforge.net/libpng/libpng-1.6.56.tar.xz
+                     URL_HASH SHA256=f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18
                      FIND_PACKAGE_ARGS 1.5.4)
 
 set(PNG_TESTS OFF CACHE INTERNAL "") # We do not care for these two (and they can even cause compile errors!)