package/libheif: security bump version to 1.20.1
Release notes: https://github.com/strukturag/libheif/releases
Version 1.19.6 fixes CVE-2025-43966 & CVE-2025-43967:
https://github.com/strukturag/libheif/releases/tag/v1.19.6
Updated license hash due to upstream commit:
https://github.com/strukturag/libheif/commit/377a957bd84018f4d27588c989fa5c66935c16ed
Note:
The patch for CVE-2025-43966 fixes libheif/image-items/iden.cc which was
added in version 1.19.0.
https://github.com/advisories/GHSA-7g9v-7vc7-pmrw
The patch for CVE-2025-43967 does not apply cleanly to 1.18.2 even after
renaming "/image-items/" to "/codecs/". Therefore, this patch is not
backported.
https://github.com/advisories/GHSA-c48q-x6xw-g5h8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add justification from Bernd why the security fix is not
backported]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bernd Kuhls