Update lcms2 to 2.19.1

[gominimal-pkgmgr-mgr]

Update lcms2 2.17 → 2.19.1

Source: github:mm2/Little-CMS:tag
Release: https://github.com/mm2/Little-CMS/releases/tag/lcms2.19.1
Changelog: mm2/Little-CMS@lcms2.17...lcms2.19.1
Released: 67 days ago (2026-05-06)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 2.19.1 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

• 1 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (1)

This update clears 1 vulnerabilities affecting 2.17:

CVE / GHSA	Severity	Fixed in
CVE-2026-42798	MEDIUM	via range: introduced in commit 453bafe, fixed in commit b76633e

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)

	Component	Old	New
~	lcms2	2.17	2.19.1
~	lcms2-upstream	2.17	2.19.1

Changes

	Old	New
Version	2.17	2.19.1
SHA256	d11af569e42a1baa...	bfc54f7bab59fbc9...
Size	5.2 MB	5.7 MB
Source	gs://minimal-staging-archives/lcms2-2.17.tar.gz	gs://minimal-staging-archives/lcms2-2.19.1.tar.gz

• License: MIT (source: GitHub + tarball)

Quality suggestions

• Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

---

Created by pkgmgr