Uh oh!
There was an error while loading. Please reload this page.
Clean up redundant ImageSharp references, document the elFinder HTTP pin - #763
Merged
Merged
Conversation
The package looks like a stray ASP.NET Core 2.x reference on net10.0 and was queued for removal on that reading. It is not: elFinder.Net.* 1.5.0 pulls in the ASP.NET Core 2.1.x graph, including Microsoft.AspNetCore.Http 2.1.1, which carries GHSA-hxrm-9w7p-39cc (high severity). Removing the reference lets the transitive 2.1.1 win and restore starts warning NU1903. The reference is a deliberate lift to a patched 2.x, so it stays until elFinder itself is replaced or upgraded. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ImageSharp is not used anywhere in the solution - there is no `SixLabors` identifier in any .cs file. It reached three .csproj files as a direct reference, which read like a second graphics stack alongside SkiaSharp. It is neither. `dotnet nuget why` shows it arriving transitively through Scryber.Core 9.5.0 and elFinder.Net.Core 1.5.0, both of which already ask for 3.1.12. Dropping the three references and the now-unreferenced PackageVersion resolves the same 3.1.12 with no NU1903 downgrade warning, so these were pins to a version the graph produced on its own. ImageSharp still ships in the output through those two dependencies, so the Six Labors Split License question is unaffected by this change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type: bugfix
Issue
Two package references in the admin projects looked like leftovers. Verifying them
before removal showed they meant opposite things.
Microsoft.AspNetCore.Http2.3.11 inGrand.Web.AdminSharedreads as a strayASP.NET Core 2.x package on net10.0. It is not.
elFinder.Net.*1.5.0 pulls in thewhole ASP.NET Core 2.1.x graph, including
Microsoft.AspNetCore.Http2.1.1,which carries GHSA-hxrm-9w7p-39cc (high severity). The direct reference is a
deliberate lift to a patched 2.x. Removing it makes restore emit NU1903.
SixLabors.ImageSharpappeared to be a second graphics stack alongsideSkiaSharp, referenced directly by three projects. There is no
SixLaborsidentifier in any
.csfile in the solution; the only graphics code isGrand.Business.Storage/Services/PictureService.cs, which uses SkiaSharp.dotnet nuget whyshows ImageSharp arriving throughScryber.Core9.5.0 andelFinder.Net.Core1.5.0, both already asking for 3.1.12 - so all three directreferences were pins to a version the graph produces on its own.
Solution
Microsoft.AspNetCore.Httpreference, with a comment in the.csprojrecording the advisory it lifts and that it should only be removed together with
elFinder.
SixLabors.ImageSharpreferences and the now-unreferencedPackageVersionentry.Breaking changes
None. ImageSharp still resolves at 3.1.12 through Scryber and elFinder, so nothing
changes in the build output.
Note that ImageSharp therefore still ships in the artifacts, so the Six Labors
Split License question is unaffected by this PR - it needs one of those two
dependencies replaced, which is a separate decision.
Testing
dotnet restore ./GrandNode.sln --force- no NU1903, no errors.dotnet list src/Web/Grand.Web.Admin package --include-transitive | grep -i sixlaborsstill reports
SixLabors.ImageSharp 3.1.12.dotnet build ./GrandNode.sln- clean.dotnet test ./src/Tests/Grand.Web.Admin.Tests/Grand.Web.Admin.Tests.csproj(51 pass)and
./src/Tests/Grand.Business.Common.Tests/Grand.Business.Common.Tests.csproj(126 pass, 2 skipped).
confirm the thumbnail renders; generate an order PDF to exercise Scryber.
🤖 Generated with Claude Code