HEIC: Upgrade libheif from v1.23.1 to v1.23.4

Upgrading libheif (which provides the heif-convert, heif-enc, heif-info, and heif-thumbnailer binaries) from v1.23.1 to v1.23.4 picks up the security fixes published in the three upstream releases since our current pin, so all base images — distro-packaged or built from source via install-libheif.sh — stay current.

Upstream describes v1.23.2, v1.23.3, and v1.23.4 each as ABI- and API-compatible drop-in replacements for their predecessor, so this is a straight version bump with no call-site changes on our side.

Summary of upstream changes

Three consecutive security and bugfix releases, all rated by upstream as "users are strongly advised to upgrade":

Each release also carries hardening and bugfix work beyond the advisories listed below; see the upstream release notes for the full detail.

Security

Published upstream advisories, by release. Severities are upstream's own ratings. Several CVE IDs are not yet assigned; the GHSA identifier is authoritative in those cases.

v1.23.2

• CVE-2026-84383 (GHSA-g89c-p67h-r497) — critical
• GHSA-2jg2-4ch7-h545 — critical
• CVE-2026-84384 (GHSA-24wx-9w62-c96w) — high
• CVE-2026-84447 (GHSA-x8xm-cm2c-cfc8) — high
• CVE-2026-84446 (GHSA-xw34-mjcp-jqh8) — high
• CVE-2026-84444 (GHSA-j264-xvrp-5v7q) — high
• CVE-2026-84448 (GHSA-p58j-h3vm-3fp5) — medium

v1.23.3

• GHSA-x8r2-mggj-j6wr — critical
• GHSA-8fmq-r4pf-7m57 — high
• GHSA-w7mc-p8jc-p853 — high
• GHSA-4jqm-2x34-6f6r — high
• CVE-2026-84451 (GHSA-hh47-fhqr-cj2r) — medium
• CVE-2026-84450 (GHSA-gh5q-69gg-c964) — medium
• GHSA-4h82-g446-83fm — medium
• GHSA-9rj8-5mp5-26c9 — medium
• GHSA-mw6f-29j3-76f4 — medium
• GHSA-8857-r8x5-7499 — low

v1.23.4

• GHSA-vg7w-rp49-4fc2 — high
• GHSA-xrp2-63fq-jm8q — high
• GHSA-prgh-72vc-3xmc — high
• GHSA-fqpw-fj22-78w4 — medium
• GHSA-4rv4-953r-p24q — medium
• GHSA-rhgw-q5g8-xjh2 — medium

Distribution

Prebuilt binaries for Ubuntu and Debian are published on our download server:

• https://dl.photoprism.app/dist/libheif/

The following v1.23.4 artifacts will be available:

• .tar.gz archives (AMD64 + ARM64) for bookworm, jammy, noble, plucky, questing, resolute, and trixie, plus a noble-arm archive for ARMv7. These are consumed by install-libheif.sh on hosts and base images that build libheif from source.
• A photoprism-libheif Debian package (.deb, AMD64 + ARM64) for resolute (Ubuntu 26.04). It Provides/Replaces/Conflicts the distro libheif* packages so the from-source build and apt do not coexist; install-libheif.sh installs it via apt-get on Resolute and falls back to the tarball path elsewhere.

This installs our latest libheif build on supported Linux distributions (run as root):

bash <(curl -s https://raw.githubusercontent.com/photoprism/photoprism/develop/scripts/dist/install-libheif.sh)

Tasks

• Bump pinned LIBHEIF_VERSION in Makefile build-libheif* targets to v1.23.4.
• Bump the Makefile build-libheif-deb-{amd64,arm64} targets to v1.23.4.
• Build and publish .tar.gz archives for bookworm, jammy, noble, plucky, questing, resolute, trixie, and noble-arm (ARMv7).
• Build and publish the resolute photoprism-libheif .deb (AMD64 + ARM64) via make build-libheif-deb.
• Bump default version in scripts/dist/install-libheif.sh to v1.23.4.
• Refresh the resolute, trixie, and jammy / jammy-slim develop base images so they bundle libheif v1.23.4.