search

disintegration / imaging

Imaging is a simple image processing package for Go
MIT License
5.21k stars 432 forks source link

Snyk reports vulnerability #167

Open mcandre opened 10 months ago

mcandre commented 10 months ago

Please address the security bug identified by Snyk:

https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDISINTEGRATIONIMAGING-5880692

On a related note, GitHub dependabot claims that updating the transient dependency golang.org/x/image to v0.10.0 or higher is sufficient. However, Snyk continues to report this disintegration/imaging module as vulnerable.

I don't have enough information to determine whether GitHub or Snyk is more accurate. Someone should clarify the situation.

If necessary, fork this repository.

mcandre commented 8 months ago

As a workaround, I am using the https://github.com/anthonynsimon/bild library.