Repository navigation
Conversation
…TFM (CVE fixes incl. CVE-2026-106114), migrate v4 API surface, and wire Six Labors license into CI build
…TFM (CVE fixes incl. CVE-2026-106114), migrate v4 API surface, and wire Six Labors license into CI build
mee-ironsoftware
left a comment
mee-ironsoftware
left a comment
There was a problem hiding this comment.
🤖 Automated
/scrutinizereview — not yet read by@mee-ironsoftware.
Automated review — verdict: fix-then-ship
Blockers: 0 · Major: 3 · Nits: 1 — 4 inline, 0 in this body.
This is deliberately a comment only: it never approves and never requests changes. The verdict above is advisory; @mee-ironsoftware will follow up.
Adds a net80 TFM that builds against ImageSharp 4.1.2 / Drawing 3.1.2 to pick up CVE fixes; the conditional-TFM approach is the right shape (v4 is net8-only), but for net8 consumers this is a breaking dependency bump that downstream repos aren't ready for, and the new PNG encoder mapping doesn't preserve every depth it claims to.
Reviewed head SHA 0e7d703a83ebf5f3c21a616177557f75a402c268. Re-request review on this PR to get a fresh pass.
… type/bit depth, per-pixel-type fallback for L16/La16/La32/A8 etc.) and add round-trip tests
…2.2.0/3.1.3, add nuspec excludes
Sawraz-IS
changed the title
…ipeline The signing step template only signed bin/<config>/netstandard2.0 and bin/<config>/net60, so the net80 IronSoftware.Drawing.Common.dll shipped unsigned in IronSoftware.System.Drawing 2026.11.4 (and in every product that bundles it, e.g. IronPrint's lib/net8.0* folders). Add the missing net80 step and give the three steps accurate names. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Title
Added a dedicated .NET 8 target that uses SixLabors.ImageSharp 4.1.2 and SixLabors.ImageSharp.Drawing 3.1.2, allowing .NET 8+ projects to upgrade to ImageSharp v4 and pick up its security fixes (including CVE-2026-106114). .NET 6 and other targets are unchanged
Description
Added a .NET 8 target using ImageSharp 4.1.2 and Drawing 3.1.2, enabling security fixes including CVE-2026-106114. Other targets remain unchanged.
Fixes #(issue number)
Fixes DW-38
Type of change
Please select the relevant option by placing an 'x' inside the brackets, like this: [x].
How Has This Been Tested?
Run tests on .Net8
Checklist:
Please run through the checklist as much as possible and mark the items completed by placing an 'x' inside the brackets, like this: [x].
Additional Context
Add any other context, screenshots, or information about the pull request here.
Signing fix: net80
IronSoftware.Drawing.Common.dllwas shipped unsignedFound while verifying the published
IronPrint 2026.10.4-prerelease, which bundles this library:IronSoftware.Drawing.Common.dllis not Authenticode-signed in thenet80folder ofIronSoftware.System.Drawing 2026.11.4(thenetstandard2.0andnet60folders are signed, and every folder of the previous release was). The unsigned file propagates to every product that bundles it (IronPrint's sixlib/net8.0*folders were unsigned).CI/step_templates/sign_drawing_libraries_dll.yml, run by the deploy job beforenuget pack, only had signing steps forbin/<Configuration>/netstandard2.0andbin/<Configuration>/net60; the net80 target added by this PR had no step.azuresigntoolstep forbin/<Configuration>/net80(same arguments as the other two), and the step names now say which framework they sign (both existing steps were named ".NET6").bin/$configuration$/net80/IronSoftware.Drawing.Common.*and the deploy job downloadsbin/$(Configuration)(which containsnet80) before signing, so the new step signs the file that gets packed.Get-AuthenticodeSignatureonlib/net80/IronSoftware.Drawing.Common.dll.SixLabors.*,BitMiracle.LibTiff.NET) are not ours to sign and stay as shipped.