Commit c213e58f for libheif
commit c213e58f6cd0923ba6709763bb42c5a5ad5944c1
Author: Dirk Farin <dirk.farin@gmail.com>
Date: Mon Sep 21 20:31:28 2026 +0200
Update the 2026 advisory and release counts after v1.23.5
diff --git a/README.md b/README.md
index 84b7b7ce..a2298010 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ libheif can be built with a subset of the supported codecs to keep the size and
Alternatively, the libheif codecs can also be built as separate plugins that can be installed and loaded dynamically when used.
> **Project status (August 2026).** libheif and libde265 are maintained by a single independent developer with almost
-> no recurring funding, while 37 security advisories had to be investigated, fixed and released in 2026 alone.
+> no recurring funding, while 61 security advisories had to be investigated, fixed and released in 2026 alone.
> If libheif is part of your product or service, please read [Funding](#funding) and [Commercial support](#commercial-support).
> Security issues are reported as described in [SECURITY.md](SECURITY.md).
@@ -431,8 +431,8 @@ libheif and libde265 are developed and maintained by me, Dirk Farin, as an indep
The libraries are used by practically every open-source application and service that handles HEIC or AVIF
files (see [Software using libheif](#software-using-libheif)), but the maintenance work is almost entirely unfunded.
-From January to August 2026, 37 security advisories were published for libheif, most of them found with
-automated tools by organizations that use libheif in their products, and six releases were made mainly to ship
+From January to September 2026, 61 security advisories were published for libheif, most of them found with
+automated tools by organizations that use libheif in their products, and nine releases were made mainly to ship
security fixes. Each fix means reproducing, fixing, testing, fuzzing and releasing, currently done in evenings and
on weekends. Details are in [SECURITY.md](SECURITY.md).
@@ -470,7 +470,7 @@ Sponsorship through GitHub Sponsors funds the project as a whole and does not in
### Sponsors
-As of August 2026, the recurring sponsorship for libheif and libde265 amounts to **$41 per month**, against a goal of
+As of September 2026, the recurring sponsorship for libheif and libde265 amounts to **$41 per month**, against a goal of
$5,000 per month, which would fund about two days per week of maintenance (see [funding.json](funding.json)).
Thank you to everyone who sponsors the project.
diff --git a/SECURITY.md b/SECURITY.md
index 4bdd7b53..6298f8b4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -152,8 +152,8 @@ The following are targets, not commitments (see [Maintenance capacity](#maintena
libheif and libde265 are maintained by one independent developer, largely in unpaid evenings
and weekends. There is no security team.
-To make the workload concrete: from January to August 2026, 37 security advisories were
-published for libheif (3 rated critical, 13 high), and six releases were made mainly to ship
+To make the workload concrete: from January to September 2026, 61 security advisories were
+published for libheif (4 rated critical, 20 high), and nine releases were made mainly to ship
security fixes. Most of the 2026 reports were found with automated or AI-assisted tools,
often run by organizations that use libheif in their products.
Reproducing, fixing, testing, fuzzing and releasing each fix takes hours to days.
diff --git a/funding.json b/funding.json
index 4b56103f..32c9bbfe 100644
--- a/funding.json
+++ b/funding.json
@@ -7,7 +7,7 @@
"name": "Dirk Farin",
"email": "dirk.farin@gmail.com",
"phone": "",
- "description": "Author and sole maintainer of libheif (HEIF/AVIF file format library) and libde265 (H.265/HEVC decoder). These libraries are used by practically all open-source software that reads or writes HEIC and AVIF images, including ImageMagick, GIMP, libvips/sharp, Pillow, darktable, digiKam, GDAL and the GNOME and KDE desktops, and through these by a large number of web services and image pipelines. The work is currently almost entirely unfunded: in 2026 alone, 37 security advisories had to be investigated, fixed and released in unpaid evenings and weekends.",
+ "description": "Author and sole maintainer of libheif (HEIF/AVIF file format library) and libde265 (H.265/HEVC decoder). These libraries are used by practically all open-source software that reads or writes HEIC and AVIF images, including ImageMagick, GIMP, libvips/sharp, Pillow, darktable, digiKam, GDAL and the GNOME and KDE desktops, and through these by a large number of web services and image pipelines. The work is currently almost entirely unfunded: in 2026 alone, 61 security advisories had to be investigated, fixed and released in unpaid evenings and weekends.",
"webpageUrl": {
"url": "https://github.com/farindk"
}