From af6fb9e1fb030ecc8cf2f1d564fb1e3a9b5c57f5 Mon Sep 17 00:00:00 2001
From: Bernd Kuhls <bernd@kuhls.net>
Date: Fri, 24 Jul 2026 19:24:00 +0200
Subject: [PATCH] package/libass: security bump version to 0.17.5

https://github.com/libass/libass/releases/tag/0.17.5

Fixes CVE-2026-61626 & CVE-2026-61627.

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f6ca8d4f5f27232f439bb3e68ace6f7baf20d5cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/libass/libass.hash | 3 ++-
 package/libass/libass.mk   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/package/libass/libass.hash b/package/libass/libass.hash
index 2f4f718813..467c9b3816 100644
--- a/package/libass/libass.hash
+++ b/package/libass/libass.hash
@@ -1,3 +1,4 @@
+# From https://github.com/libass/libass/releases/tag/0.17.5
+sha256  2dca25c0e0c837ddf00b52011b3f82cac1e4ddd3ad018227806b0c2288864acc  libass-0.17.5.tar.xz
 # Locally computed
-sha256  78f1179b838d025e9c26e8fef33f8092f65611444ffa1bfc0cfac6a33511a05a  libass-0.17.4.tar.xz
 sha256  f7e30699d02798351e7f839e3d3bfeb29ce65e44efa7735c225464c4fd7dfe9c  COPYING
diff --git a/package/libass/libass.mk b/package/libass/libass.mk
index ff42c6d621..3675a75f93 100644
--- a/package/libass/libass.mk
+++ b/package/libass/libass.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBASS_VERSION = 0.17.4
+LIBASS_VERSION = 0.17.5
 LIBASS_SOURCE = libass-$(LIBASS_VERSION).tar.xz
 # Do not use the github helper here, the generated tarball is *NOT*
 # the same as the one uploaded by upstream for the release.