)]}'
{
  "commit": "981eaa05a5065f5dd09c3139029c0d7dbda956d8",
  "tree": "36fdfe50a860a8340a8e24be0ee30bc9bc2501bf",
  "parents": [
    "315273a91ff5701d7239e64fd96351539939f8e7"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Thu Jun 18 15:18:16 2026 -0700"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Jul 21 17:07:10 2026 -0700"
  },
  "message": "vp8l: avoid allocating many unused Huffman tree groups\n\nA VP8L image contains a number of Huffman tree groups.\nThe number of groups is derived from the largest group index\nobserved in the file. The largest possible index is 2^16-1.\n\nA VP8L file may included unused groups.\n\nDecoding and storing all unused groups can cause excessive\nmemory allocation from a small input file.\n\nUse the same approach to unused groups as libwebp:\nWhen there are many groups (for some definition of \"many\"),\nstore the groups as a compacted array with unreferenced\ngroups removed, and rewrite all references to index into\nthe new array.\n\nIn addition, limit the total number of groups to 2600.\nThe libwebp encoder never produces more than this number of\ngroups, and there don\u0027t seem to be any other encoders in\ncommon use.\n\nFixes golang/go#80069\nFixes CVE-2026-46603\n\nChange-Id: I8738d53b67510a8c12b99fd4df55f4126a6a6964\nReviewed-on: https://go-review.googlesource.com/c/image/+/793460\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Nigel Tao \u003cnigeltao@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nigel Tao \u003cnigeltao@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a28a5bb5a0b4d8a4732f3621b5ef3381414062bf",
      "new_mode": 33188,
      "new_path": "testdata/gopher-doc.skip-hgroup.lossless.webp"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "17941deea43bc9db295d2134b5431cc503e424b7",
      "new_mode": 33188,
      "new_path": "testdata/large-huffman-index.lossless.webp.bz2"
    },
    {
      "type": "modify",
      "old_id": "431948701676b13765c76e7febaa2da2365b1efe",
      "old_mode": 33188,
      "old_path": "vp8l/decode.go",
      "new_id": "00794855af1e0c6105561a0d3c46ff26ebfd574a",
      "new_mode": 33188,
      "new_path": "vp8l/decode.go"
    },
    {
      "type": "modify",
      "old_id": "d6f4341ef6ed4fc72804b4035c72342bad7feaca",
      "old_mode": 33188,
      "old_path": "webp/decode_test.go",
      "new_id": "f0e6fce3b7de2605363b85d0ed67ac008c746146",
      "new_mode": 33188,
      "new_path": "webp/decode_test.go"
    }
  ]
}