mozjpeg: 3.3.1 -> 4.0.3

Fixes CVE-2018-14498.

pkgs/applications/graphics/mozjpeg/default.nix

@@ -1,18 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libpng, nasm }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libpng, zlib, nasm }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.1";
+  version = "4.0.3";
   pname = "mozjpeg";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "mozjpeg";
     rev = "v${version}";
-    sha256 = "1na68860asn8b82ny5ilwbhh4nyl9gvx2yxmm4wr2v1v95v51fky";
+    sha256 = "1wb2ys0yjy6hgpb9qvzjxs7sb2zzs44p6xf7n026mx5nx85hjbyv";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libpng nasm ];
+  cmakeFlags = [ "-DENABLE_STATIC=NO" "-DPNG_SUPPORTED=TRUE" ]; # See https://github.com/mozilla/mozjpeg/issues/351
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ libpng zlib nasm ];
 
   meta = {
     description = "Mozilla JPEG Encoder Project";