timothy/ersatztv
1
0
Fork 0
Code Issues 58 Pull Requests 8 Actions Packages Projects Releases 9 Wiki Activity

ImageSharp 4.x: decide on a Six Labors license key, then upgrade off the 3.1.12 hold #936

New Issue
Open
opened 2026-10-29 21:15:59 +01:00 by timothy · 0 comments
timothy commented 2026-10-29 21:15:59 +01:00
Owner
Copy Link
Copy Source

#929 (PR #934) fixes the Pkcs advisory. It keeps SixLabors.ImageSharp at 3.1.12 with TIFF decoding off, and bounds and records each of the six remaining advisories (record security.imagesharp-3x-tiff-decoder-disabled). Renovate holds ImageSharp at 3.x.

ImageSharp 4.x fixes those advisories, but 4.x needs a Six Labors license key, and that is an owner decision. Until it is made, the weekly vulnerability scan stays red on ImageSharp 3.1.12 by design.

Scope

  • Owner: decide whether to get a Six Labors license (or whether this project qualifies for an exemption), and if so, where the key lives (CI secret and runtime config).
  • Then: upgrade to 4.x, remove the Renovate hold, retire or supersede the 3.x record, and check that the vulnerable-package scan is clean.

Done-when

  • Licensing decision recorded on this issue
  • If yes: ImageSharp on 4.x, Renovate hold removed, record superseded, dotnet list package --vulnerable clean of ImageSharp
  • Adversarial review passed
#929 (PR #934) fixes the Pkcs advisory. It keeps SixLabors.ImageSharp at 3.1.12 with TIFF decoding off, and bounds and records each of the six remaining advisories (record `security.imagesharp-3x-tiff-decoder-disabled`). Renovate holds ImageSharp at 3.x. ImageSharp 4.x fixes those advisories, but 4.x needs a Six Labors license key, and that is an owner decision. Until it is made, the weekly vulnerability scan stays red on ImageSharp 3.1.12 by design. ## Scope - Owner: decide whether to get a Six Labors license (or whether this project qualifies for an exemption), and if so, where the key lives (CI secret and runtime config). - Then: upgrade to 4.x, remove the Renovate hold, retire or supersede the 3.x record, and check that the vulnerable-package scan is clean. ## Done-when - [ ] Licensing decision recorded on this issue - [ ] If yes: ImageSharp on 4.x, Renovate hold removed, record superseded, `dotnet list package --vulnerable` clean of ImageSharp - [ ] Adversarial review passed
timothy added the priority: low label 2026-10-29 21:15:59 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#936