Update libjpeg?

[greggmorris]

Has there been any discussion about updating libjpeg-9 to release f (14-Jan-2024)? We're getting grief about vulnerabilities in the current 9c version.

[shawnlaffan]

None so far. I've opened StrawberryPerl/build-extlibs#65 to track it.

[shawnlaffan]

A UCRT build using gcc13 is at https://github.com/StrawberryPerl/build-extlibs/releases/download/gcc13.2_ucrt_posix/64bit_jpeg-9f-bin_20250530.zip

If you have an existing strawberry perl you are not worried about changing, then you can extract the contents of the zip file into the .../c directory. (Edit - a build of 5.40 as it needs UCRT).

I'll start a build of 5.40 shortly.

[greggmorris]

Thanks. We're still on 5.38.2 but would like to move to 5.40.2. We are still deciding if we need to remediate 5.38.2 in some way or if we can wait for 5.40.2. It's above my pay grade....

[shawnlaffan]

An MSCVRT variant that will work with 5.38 is at https://github.com/StrawberryPerl/build-extlibs/releases/download/dev_gcc13.1_20230606/64bit_jpeg-9f-bin_20250530.zip

[greggmorris]

Very helpful, thanks again!