PdfSharpCore Bump SixLabors.ImageSharp from 1.0.4 to 2.1.9 in /PdfSharpCore

Bumps SixLabors.ImageSharp from 1.0.4 to 2.1.9.

Release notes

Sourced from SixLabors.ImageSharp's releases.

v2.1.9

What's Changed

[2.1] Fix overflow in MemoryAllocator.Create(options) by @antonfirsov in SixLabors/ImageSharp#2732

Backport GIF LZW fix to 2.1 by @antonfirsov in SixLabors/ImageSharp#2756

Backport 2759 to 2.1.x by @antonfirsov in SixLabors/ImageSharp#2770

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.8...v2.1.9

v2.1.8

What's Changed

V2 - Limit Read Palette Indices by @JimBobSquarePants in SixLabors/ImageSharp#2719

V2 - Clear Pixel Buffers on Decode. by @JimBobSquarePants in SixLabors/ImageSharp#2717

V2 - Limit all memory allocations in the MemoryAllocator layer by @JimBobSquarePants in SixLabors/ImageSharp#2715

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.7...v2.1.8

v2.1.7

What's Changed

[release/2.1] Disallow allocation attempts of unrepresentable sizes by @antonfirsov in SixLabors/ImageSharp#2553

[release/2.1] Tiff decoding robustness improvements (#2550) by @antonfirsov in SixLabors/ImageSharp#2554

[release/2.1] PBM decoder robustness improvements and BufferedReadStream observability by @antonfirsov in SixLabors/ImageSharp#2555

Backport 2681 by @JimBobSquarePants in SixLabors/ImageSharp#2688

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.6...v2.1.7

v2.1.6

What's Changed

Backport - Handle EOF in Jpeg bit reader when data is bad to prevent DOS attack. by @JimBobSquarePants in SixLabors/ImageSharp#2524

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.5...v2.1.6

v2.1.5

What's Changed

Backport #2501 by @JimBobSquarePants in SixLabors/ImageSharp#2509

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.4...v2.1.5

v2.1.4

What's Changed

Backport WebP fix to 2.1 by @antonfirsov in SixLabors/ImageSharp#2420

Full Changelog: https://github.com/SixLabors/ImageSharp/compare/v2.1.3...v2.1.4

v2.1.3

... (truncated)

Commits

9816ca4 Merge pull request #2770 from SixLabors/af/backport-2759-2.1.x
b33d666 handle DecodingMode
6b2030b Merge branch 'release/2.1.x' into af/backport-2759-2.1.x
8ffad3f Issue2012BadMinCode should decode now
1f5bf23 skip Issue2758_DecodeWorks
3bf8c57 manual port of 3.1 gif decoder
28c20de Clamp JPEG quality estimation results.
4b910e7 Decode LZW row by row
a1f2879 Merge pull request #2756 from SixLabors/af/git-av-2.1
898df7f backport #2749 to 2.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Jul 22 '24 17:07 dependabot[bot]

Could this be prioritized? SixLabors.ImageSharp 1.0.4 has a known vulnerability, so I get warnings in my build as it is now.

Nov 16 '24 23:11 cmeeren

please

Nov 18 '24 06:11 wolfgangschneider

Yes, I am also waiting for this, as I have to fix this vulnerability as well

Feb 20 '25 08:02 OlegKrymskyi

I think this library is no longer maintained. Switching to the original PdfSharp is probably the best option, its core build no longer depends on System.Drawing.Common.

Mar 07 '25 11:03 manfromarce

Note: I suggest updating ImageSharp to 2.1.10, which is the latest 2.x version without known vulnerabilities (as of now). The 3.x version are also fixed, but changed to the Split License, which may invoke problems for some users. Similar to the SixLabors.Fonts dependency; there are no known vulnerabilities, but from 2.x, it also changed the license.

Jun 24 '25 09:06 OregonGhost