pin libpng to released tags, not git

config/source.json

@@ -682,9 +682,10 @@
         }
     },
     "libpng": {
-        "type": "git",
-        "url": "https://github.com/glennrp/libpng.git",
-        "rev": "libpng16",
+        "type": "ghtagtar",
+        "repo": "pnggroup/libpng",
+        "match": "v1\\.6\\.\\d+",
+        "query": "?per_page=150",
         "provide-pre-built": true,
         "license": {
             "type": "file",
@@ -692,9 +693,9 @@
         }
     },
     "librabbitmq": {
-        "type": "git",
-        "url": "https://github.com/alanxz/rabbitmq-c.git",
-        "rev": "master",
+        "type": "ghtar",
+        "repo": "alanxz/rabbitmq-c",
+        "prefer-stable": true,
         "license": {
             "type": "file",
             "path": "LICENSE"

src/SPC/store/Downloader.php

@@ -97,8 +97,9 @@ class Downloader
     public static function getLatestGithubTarball(string $name, array $source, string $type = 'releases'): array
     {
         logger()->debug("finding {$name} source from github {$type} tarball");
+        $source['query'] ??= '';
         $data = json_decode(self::curlExec(
-            url: "https://api.github.com/repos/{$source['repo']}/{$type}",
+            url: "https://api.github.com/repos/{$source['repo']}/{$type}{$source['query']}",
             hooks: [[CurlHook::class, 'setupGithubToken']],
             retries: self::getRetryAttempts()
         ), true, 512, JSON_THROW_ON_ERROR);