search

ststeiger / PdfSharpCore

Port of the PdfSharp library to .NET Core - largely removed GDI+ (only missing GetFontData - which can be replaced with freetype2)
Other
1.06k stars 239 forks source link

Visual Studio detecting Venerability with SixLabours.ImageSharp dependencies #433

Open bhaveshvakil opened 6 months ago

bhaveshvakil commented 6 months ago

Can someone upgrade this package?

https://github.com/advisories/GHSA-65x7-c272-7g7r

As per author, they already fixed the issue but PdfSharpCore is still using old package.

Thanks

chrisg32 commented 6 months ago

@bhaveshvakil If you add package SixLabors.ImageSharp 2.1.7 the error will go away.

This should be closed with https://github.com/ststeiger/PdfSharpCore/pull/429

hungphamcrl commented 5 months ago

will PdfSharpCore works with 2.1.8? version 2.1.7 is vulnerable now

chrisg32 commented 5 months ago

@hungphamcrl it should it you add the 2.1.8 package directly.

PR #435 will bump the minimum version to 2.1.8

TonyValenti commented 5 months ago

PR https://github.com/ststeiger/PdfSharpCore/pull/427 contains that fix and preserves different versions for legacy builds of the library as well.

Grynet commented 4 months ago

It would be great if this could finally get some attention from the author.

As mentioned solution proposals have already been provided in the linked PR

jarrabito commented 4 months ago

Is there an ETA on this?