CVE-2023-4863 impacting libwebp 1.0.2

[delroth]

Hi!

This Go library vendors libwebp 1.0.2, which is vulnerable to CVE-2023-4863 (critical severity buffer overflow in libwebp image decoding). Upstream has a 1.0.3 available with the vulnerability fixed: https://github.com/webmproject/libwebp/tree/1.0.3

Could you please update the vendored libwebp and tag a new release of this library so dependents can get updated?

Thank you!

[nikooo777]

please @chai2010 can you push this change?

[trunov]

@chai2010 hey, please update the package.

[nikooo777]

nice, that happened! this can finally be closed now

[cogtea]

Thanks for the update, Any idea when release 1.0.3 will be available?