tb@ pointed out a number of unreleased fixes to graphics/lcms2:

https://marc.info/?l=oss-security&m=177646929211758&w=2

I looked at the changelog since the 2.18 release, and it contains several
other commits similar to those mentioned in the mail above, and 2.17..2.18
does as well.
Therefore I'd like to float the idea of updating lcms2 to the latest commit on
github. All jdks, wlroots, chafa, libjxl, poppler build without complaint, so
I *believe* the other consumers will probably be happy with it as well.

What do you think?
Index: Makefile
===================================================================
RCS file: /cvs/ports/graphics/lcms2/Makefile,v
retrieving revision 1.28
diff -u -p -r1.28 Makefile
--- Makefile	5 Aug 2025 08:04:51 -0000	1.28
+++ Makefile	18 Apr 2026 14:31:14 -0000
@@ -1,10 +1,12 @@
 COMMENT =		color management library
 
-DISTNAME =		lcms2-2.17
+V =			2.18.429ea28
+DISTNAME =		lcms2-${V}
+COMMIT =		429ea284550f1925d5b1b4b9ef901dfd62031158
+DIST_TUPLE =		github mm2 Little-CMS ${COMMIT} .
 CATEGORIES =		graphics
-SITES =			${SITE_SOURCEFORGE:=lcms/}
 
-SHARED_LIBS +=  lcms2                2.0      # 2.16
+SHARED_LIBS +=  lcms2                2.1      # 2.19
 
 HOMEPAGE =		https://www.littlecms.com/
 
@@ -20,6 +22,8 @@ LIB_DEPENDS =	graphics/tiff
 CONFIGURE_STYLE =	gnu
 CONFIGURE_ENV =		CPPFLAGS="-I${LOCALBASE}/include" \
 			LDFLAGS="-L${LOCALBASE}/lib"
+
+WRKDIST =		${WRKDIR}/Little-CMS-${COMMIT}
 
 DEBUG_PACKAGES =	${BUILD_PACKAGES}
 
Index: distinfo
===================================================================
RCS file: /cvs/ports/graphics/lcms2/distinfo,v
retrieving revision 1.14
diff -u -p -r1.14 distinfo
--- distinfo	5 Aug 2025 08:04:51 -0000	1.14
+++ distinfo	18 Apr 2026 14:31:14 -0000
@@ -1,2 +1,2 @@
-SHA256 (lcms2-2.17.tar.gz) = 0Rr1aeQqG6oWUNIK1h0S5Br0/q1Kp5ZKAfk7CLU6sHQ=
-SIZE (lcms2-2.17.tar.gz) = 5245319
+SHA256 (mm2-Little-CMS-429ea284550f1925d5b1b4b9ef901dfd62031158.tar.gz) = nXj4m8jow8e2LKeBsef/MOoc2Wl9/dR147vVXpUsySE=
+SIZE (mm2-Little-CMS-429ea284550f1925d5b1b4b9ef901dfd62031158.tar.gz) = 5604746

• lcms2-2.18.429ea28.diff (2K)