build(deps): bump github.com/kovidgoyal/imaging from 1.8.22 to 1.8.23

Bumps [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) from 1.8.22 to 1.8.23.
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.22...v1.8.23)

---
updated-dependencies:
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

go.mod

@@ -49,7 +49,7 @@ require (
 	github.com/jellydator/ttlcache/v3 v3.4.1
 	github.com/jinzhu/now v1.1.5
 	github.com/justinas/alice v1.2.0
-	github.com/kovidgoyal/imaging v1.8.22
+	github.com/kovidgoyal/imaging v1.8.23
 	github.com/leonelquinteros/gotext v1.7.3-0.20260422134830-b012b4ccae69
 	github.com/libregraph/idm v0.5.0
 	github.com/libregraph/lico v0.67.0

go.sum

@@ -732,8 +732,8 @@ github.com/kovidgoyal/go-parallel v1.1.1 h1:1OzpNjtrUkBPq3UaqrnvOoB2F9RttSt811ui
 github.com/kovidgoyal/go-parallel v1.1.1/go.mod h1:BJNIbe6+hxyFWv7n6oEDPj3PA5qSw5OCtf0hcVxWJiw=
 github.com/kovidgoyal/go-shm v1.0.0 h1:HJEel9D1F9YhULvClEHJLawoRSj/1u/EDV7MJbBPgQo=
 github.com/kovidgoyal/go-shm v1.0.0/go.mod h1:Yzb80Xf9L3kaoB2RGok9hHwMIt7Oif61kT6t3+VnZds=
-github.com/kovidgoyal/imaging v1.8.22 h1:CtpoRXQpS79xxJsKu8+LUJJE/0i4FLquJZy0QH+QNlM=
-github.com/kovidgoyal/imaging v1.8.22/go.mod h1:y8wo4JTv4D+skbtQf6fHg8nA1qtagvCcn8J2Nu5k2Jg=
+github.com/kovidgoyal/imaging v1.8.23 h1:4WsboyQ/E8tic2kX49P93Rvscg33SPsCwTBG5EZZF54=
+github.com/kovidgoyal/imaging v1.8.23/go.mod h1:k3Iot3H0v2rSWXIxQISfT3e9wIryqzAHLHCuhG7z9lM=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=

vendor/github.com/kovidgoyal/imaging/publish.py

@@ -5,7 +5,7 @@ import os
 import subprocess
 
 
-VERSION = "1.8.22"
+VERSION = "1.8.23"
 
 
 def run(*args: str):

vendor/github.com/kovidgoyal/imaging/webp/decode.go

@@ -5,6 +5,7 @@
 package webp
 
 import (
+	"bufio"
 	"bytes"
 	"errors"
 	"image"
@@ -123,16 +124,39 @@ func decode(r io.Reader, configOnly bool) (image.Image, image.Config, error) {
 				c, err := vp8l.DecodeConfig(chunkData)
 				return nil, c, err
 			}
+			if seenVP8X {
+				// Verify the VP8L chunk dimensions match before
+				// calling vp8l.Decode, to catch malicious images
+				// following a small VP8X header with a huge VP8L chunk.
+				//
+				// Peek the VP8L header.
+				//
+				// chunkData is always an unbuffered riff.chunkReader.
+				// Creating a bufio.Reader here doesn't add any
+				// inefficiency, since the vp8l package will do it
+				// if we don't.
+				bufReader := bufio.NewReader(chunkData)
+				chunkData = bufReader
+				const vp8lHeaderSize = 5
+				vp8lHeader, err := bufReader.Peek(vp8lHeaderSize)
+				if err != nil {
+					if err == io.EOF {
+						err = errInvalidFormat
+					}
+					return nil, image.Config{}, err
+				}
+				c, err := vp8l.DecodeConfig(bytes.NewReader(vp8lHeader))
+				if err != nil {
+					return nil, image.Config{}, err
+				}
+				if c.Width != int(widthMinusOne)+1 || c.Height != int(heightMinusOne)+1 {
+					return nil, image.Config{}, errInvalidFormat
+				}
+			}
 			m, err := vp8l.Decode(chunkData)
 			if err != nil {
 				return nil, image.Config{}, err
 			}
-			if seenVP8X {
-				bounds := m.Bounds()
-				if bounds.Dx() != int(widthMinusOne)+1 || bounds.Dy() != int(heightMinusOne)+1 {
-					return nil, image.Config{}, errInvalidFormat
-				}
-			}
 			return m, image.Config{}, nil
 		case fccVP8X:
 			if seenVP8X {

vendor/modules.txt

@@ -869,7 +869,7 @@ github.com/kovidgoyal/go-parallel
 # github.com/kovidgoyal/go-shm v1.0.0
 ## explicit; go 1.24.0
 github.com/kovidgoyal/go-shm
-# github.com/kovidgoyal/imaging v1.8.22
+# github.com/kovidgoyal/imaging v1.8.23
 ## explicit; go 1.25.0
 github.com/kovidgoyal/imaging
 github.com/kovidgoyal/imaging/apng