You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Advisory version ranges still flag 3.2.0 as vulnerable (GHSA-j3p4-wp97-rph4, GHSA-j9gm-c75j-xc9q, GHSA-jjfr-hcj7-qf5w, GHSA-wmxv-xphr-5c9g, GHSA-gwg2-r3hj-4w44) #3218
ImageSharp 3.2.0 backports the fixes for these advisories (#3208), but the GitHub Advisory Database entries still list the affected range as >= 2.0.0, <= 4.1.1 with 4.1.2 as the only patched version.
As a result, NuGet audit (NU1902/NU1903) reports 3.2.0 as vulnerable, which fails builds that use TreatWarningsAsErrors and pushes consumers toward suppressions or a major-version upgrade.
Could the advisory ranges be updated to < 3.2.0 || >= 4.0.0, < 4.1.2 (with 3.2.0 listed as a patched version) for these five advisories? Related: #3205.
Activity
JimBobSquarePants commentedon Oct 12, 2026
As documented in the related post. Corrections were submitted on the 9th October. We are waiting on GitHub to action the corrections.
https://sixlabors.com/posts/security-support-and-license-enforcement/
JimBobSquarePants commentedon Oct 12, 2026
For example
github/advisory-database#10273
OlegoO commentedon Oct 12, 2026
@JimBobSquarePants Thank you for the clarification