From eb09850690bcc7559d021ea83af2d2762a819596 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:44:02 +0000
Subject: [PATCH] build(deps): bump github.com/kovidgoyal/imaging from 1.8.22
 to 1.8.23

Bumps [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) from 1.8.22 to 1.8.23.
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.22...v1.8.23)

---
updated-dependencies:
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod                                        |  2 +-
 go.sum                                        |  4 +--
 .../github.com/kovidgoyal/imaging/publish.py  |  2 +-
 .../kovidgoyal/imaging/webp/decode.go         | 36 +++++++++++++++----
 vendor/modules.txt                            |  2 +-
 5 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/go.mod b/go.mod
index 82ce8b7126..d1b87323d5 100644
--- a/go.mod
+++ b/go.mod
@@ -49,7 +49,7 @@ require (
 	github.com/jellydator/ttlcache/v3 v3.4.1
 	github.com/jinzhu/now v1.1.5
 	github.com/justinas/alice v1.2.0
-	github.com/kovidgoyal/imaging v1.8.22
+	github.com/kovidgoyal/imaging v1.8.23
 	github.com/leonelquinteros/gotext v1.7.3-0.20260422134830-b012b4ccae69
 	github.com/libregraph/idm v0.5.0
 	github.com/libregraph/lico v0.67.0
diff --git a/go.sum b/go.sum
index d4d95c24ab..5a53d02fe3 100644
--- a/go.sum
+++ b/go.sum
@@ -732,8 +732,8 @@ github.com/kovidgoyal/go-parallel v1.1.1 h1:1OzpNjtrUkBPq3UaqrnvOoB2F9RttSt811ui
 github.com/kovidgoyal/go-parallel v1.1.1/go.mod h1:BJNIbe6+hxyFWv7n6oEDPj3PA5qSw5OCtf0hcVxWJiw=
 github.com/kovidgoyal/go-shm v1.0.0 h1:HJEel9D1F9YhULvClEHJLawoRSj/1u/EDV7MJbBPgQo=
 github.com/kovidgoyal/go-shm v1.0.0/go.mod h1:Yzb80Xf9L3kaoB2RGok9hHwMIt7Oif61kT6t3+VnZds=
-github.com/kovidgoyal/imaging v1.8.22 h1:CtpoRXQpS79xxJsKu8+LUJJE/0i4FLquJZy0QH+QNlM=
-github.com/kovidgoyal/imaging v1.8.22/go.mod h1:y8wo4JTv4D+skbtQf6fHg8nA1qtagvCcn8J2Nu5k2Jg=
+github.com/kovidgoyal/imaging v1.8.23 h1:4WsboyQ/E8tic2kX49P93Rvscg33SPsCwTBG5EZZF54=
+github.com/kovidgoyal/imaging v1.8.23/go.mod h1:k3Iot3H0v2rSWXIxQISfT3e9wIryqzAHLHCuhG7z9lM=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
diff --git a/vendor/github.com/kovidgoyal/imaging/publish.py b/vendor/github.com/kovidgoyal/imaging/publish.py
index e1ebf58134..587dc4cff5 100644
--- a/vendor/github.com/kovidgoyal/imaging/publish.py
+++ b/vendor/github.com/kovidgoyal/imaging/publish.py
@@ -5,7 +5,7 @@
 import subprocess
 
 
-VERSION = "1.8.22"
+VERSION = "1.8.23"
 
 
 def run(*args: str):
diff --git a/vendor/github.com/kovidgoyal/imaging/webp/decode.go b/vendor/github.com/kovidgoyal/imaging/webp/decode.go
index e3d449f5be..98d8cf247b 100644
--- a/vendor/github.com/kovidgoyal/imaging/webp/decode.go
+++ b/vendor/github.com/kovidgoyal/imaging/webp/decode.go
@@ -5,6 +5,7 @@
 package webp
 
 import (
+	"bufio"
 	"bytes"
 	"errors"
 	"image"
@@ -123,16 +124,39 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) {
 				c, err := vp8l.DecodeConfig(chunkData)
 				return nil, c, err
 			}
-			m, err := vp8l.Decode(chunkData)
-			if err != nil {
-				return nil, image.Config{}, err
-			}
 			if seenVP8X {
-				bounds := m.Bounds()
-				if bounds.Dx() != int(widthMinusOne)+1 || bounds.Dy() != int(heightMinusOne)+1 {
+				// Verify the VP8L chunk dimensions match before
+				// calling vp8l.Decode, to catch malicious images
+				// following a small VP8X header with a huge VP8L chunk.
+				//
+				// Peek the VP8L header.
+				//
+				// chunkData is always an unbuffered riff.chunkReader.
+				// Creating a bufio.Reader here doesn't add any
+				// inefficiency, since the vp8l package will do it
+				// if we don't.
+				bufReader := bufio.NewReader(chunkData)
+				chunkData = bufReader
+				const vp8lHeaderSize = 5
+				vp8lHeader, err := bufReader.Peek(vp8lHeaderSize)
+				if err != nil {
+					if err == io.EOF {
+						err = errInvalidFormat
+					}
+					return nil, image.Config{}, err
+				}
+				c, err := vp8l.DecodeConfig(bytes.NewReader(vp8lHeader))
+				if err != nil {
+					return nil, image.Config{}, err
+				}
+				if c.Width != int(widthMinusOne)+1 || c.Height != int(heightMinusOne)+1 {
 					return nil, image.Config{}, errInvalidFormat
 				}
 			}
+			m, err := vp8l.Decode(chunkData)
+			if err != nil {
+				return nil, image.Config{}, err
+			}
 			return m, image.Config{}, nil
 		case fccVP8X:
 			if seenVP8X {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6c17e2b6eb..b6205a3efc 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -869,7 +869,7 @@ github.com/kovidgoyal/go-parallel
 # github.com/kovidgoyal/go-shm v1.0.0
 ## explicit; go 1.24.0
 github.com/kovidgoyal/go-shm
-# github.com/kovidgoyal/imaging v1.8.22
+# github.com/kovidgoyal/imaging v1.8.23
 ## explicit; go 1.25.0
 github.com/kovidgoyal/imaging
 github.com/kovidgoyal/imaging/apng