Conversation
--- updated-dependencies: - dependency-name: Magick.NET-Q16-AnyCPU dependency-version: 14.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
HOLD — pas un refus, un gate sur preuve (ai-01, 2026-07-25)Ce bump est traité à part des 19 autres PRs dependabot mergées aujourd'hui (#859/#861/#862/#863/#864/#811 puis #865-#870/#872-#878) : celles-là ne touchent que des Pourquoi ce n'est pas un bump cosmétiqueLes release notes portent un lot de correctifs ImageMagick de sûreté mémoire : stack overflow (MVG), heap buffer overflow (MVG, JP2), use-after-free (8BIM), information disclosure (MNG), plus un policy bypass corrigeant un fix incomplet de CVE-2026-49219. Il y a donc un vrai contenu sécurité — ce n'est pas un « nice to have » qu'on enterre. Pourquoi je ne merge pas sur la CI verte
Ce qui n'est pas un argument contreLe bundle déjà bâti (80 PDFs, 5.30 GB, GO visuel du 14/07) ne peut pas être invalidé par ce merge : un changement de Exploitabilité dans notre modèle de menace : FAIBLELe pipeline traite nos propres assets (CSV + captures CardPen), hors ligne, sans chemin d'upload utilisateur. Les vecteurs listés exigent un input crafted. Ça justifie de gater sur preuve plutôt que de merger en urgence — mais pas de laisser traîner indéfiniment. DoD pour lever le HOLD — comparaison golden-master bornéePas besoin d'une régén 8 langues (celle-là est déjà HOLD sur le contenu final, donc un gate indéfini serait un mauvais gate) :
Dispatché à cc @jsboige — si tu préfères merger tout de suite sans la comparaison (exploitabilité faible + bundle déjà bâti non affecté), dis-le et je merge ; le gate est là pour respecter le classement high-risk de #120, pas pour bloquer par principe. 🤖 Coordinator ai-01 |
HOLD lifted — merging. New evidence overturns my earlier reasoning.I placed this on HOLD earlier this cycle on the grounds that (a) #120 classified Magick.NET as "Phase 2 high risk", (b) the unit tests are image-blind so green CI proves nothing about pixel output, and (c) a 1. This is remediation, not a speculative bump — 28 live advisory warnings on masterA forced restore on master ( This means CLAUDE.md's documented zero-warning build invariant (#587) is currently violated on master on any clean restore. The advisories were published against 14.14.0 after #587 landed; nothing regressed in our code, the advisory set drifted underneath a pinned version. 2. 14.15.0 is the exact patched version — verified per-advisory, not inferredNot "a newer version hopefully helps" — 14.15.0 is the declared first-patched version for all of them. 3. Licence unchanged — the test that just caught #887 passes hereApplied the same check that blocked the AutoMapper bump:
No licence drift. (Contrast #887: AutoMapper 14.0.0 MIT → 15.1.3 4. The pixel-output concern is real but the gate is downstream, and it is mandatory anywayMy point (c) was backwards. The full 8-language release regen has not run yet — it is deliberately held until final content is on master. So this bump lands before the regen, and the regen's visual QA (ai-01 verdict, geometry-counted per [ Patch-level bump inside the same minor line, CI green (build Debug + Release + GitGuardian), advisory-clearing, licence-stable, and the visual gate is downstream and unavoidable. The residual risk is bounded by a QA step we are required to perform regardless. Merging. Follow-ups I own: update the CLAUDE.md dependency table (14.14.0 → 14.15.0, with the no-op-CMYK-for-PNG note preserved) so the doc does not rot, and re-verify a clean restore reports 0 NU19xx after merge. 🤖 Coordinator ai-01 |
…nce pin (#871, #887) (#902) - Magick.NET-Q16-AnyCPU 14.14.0 -> 14.15.0 (#871 merged): 14.15.0 is the declared first-patched version for 5 advisories (4 medium + 1 low) that accumulated against 14.14.0. Licence unchanged (Apache-2.0). - NEW AutoMapper row documenting the 14.0.0 licence pin. The rationale previously existed only as a comment in the .csproj, which is not where an agent looks before approving a dependency bump — #887 (Dependabot 15.1.3) would have silently reverted the ratified decision jsboige 2026-06-23 and pulled the repo from MIT into RPL-1.5/commercial. - Note that NuGet audit warnings surface on `restore`, not incremental `build` — an incremental build reports 0 while a forced restore reported 28 NU1901/NU1902 lines. This is how the #587 zero-warning invariant went red without any code change (advisory drift against a pinned version). Docs only; 0 code, 0 config, 0 prod CSV. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…134) (#961) Dispatch ai-01 (msg-gzd0d3) : mesurer et rapporter, ne rien corriger dans le même geste. Additif — 0 ligne du dossier audité modifiée. 6 affirmations PÉRIMÉES mesurées sur master 3094d42 : - §3.2 « Virtues .content.svg FR-figés » → native-script 8/8 (9f52446 #686/#724, tailles distinctes du FR). Même défaut que l'addendum #960 a corrigé dans le doc GO, non reporté ici. - §3.2 es/ar/fa/zh « 3 SVGs » → 5 SVGs chacun. - §4 tests « 596/601 » → 643/638/5 (CI run 30280070312). Contradiction interne avec le §0 corrigé par #959. - §4 Magick.NET « 14.14.0 » → 14.15.0 (#871). - §3.6/§5.8/§7/§8.2(c) titre PT « English Channel » « appel à décision » → résolu (#803 7e72f3e, absent de Cards/, source de rendu jamais portée #640). - §5.4(a)/§8.2(a) #636 « arbitrage ouvert » → CLOSED 2026-07-06 + prémisse jumelle fausse. 4 OK re-mesurés (Virtues 223, OWL 6030505/862709 B, 145 aifAttackType, 5558 EN, 4861 FR, 57 broadMatch — v5.2 tient sur master actuel). 3 non re-mesurés ce tick (Fallacies 1408, Scenarii 167, prefLabel/broader — probe imparfaite, cohérents). Correction du dossier audité = PR séparée à décider par ai-01 (owner gate #134). Co-authored-by: Your <your.email@example.com> Co-authored-by: Claude-Code <noreply@anthropic.com>
…follow-up) (#962) The release-gate dossier carried six facts measured stale against master 3094d42. All are mechanical/premise drift from July merges — no verdict, no release scope changed. This pass corrects the dossier body that #959 (header/§0) deliberately left untouched. 1. §3.2 Virtues .content.svg were marked FR-figé ("gap structural"). FALSE: Argumentum_Virtues_MindMap_{lang}.content.svg are native-script 8/8, committed via #665/#715/#724/#686 (9f52446). Distinct-size proof (git cat-file -s): fr 431931 / en 418954 / ru 485254 / pt 446948 / es 432142 / ar 461859 / fa 461654 / zh 1148677 — a FR clone would be ~431931 everywhere. Twin premise of #636 (CLOSED 2026-07-06), false for the same reason. Marked RÉSOLU. 2. §3.2 es/ar/fa/zh mindmap SVG count 3 → 5 each (git ls-files | wc -l). fr 6 / en 5 / ru 5 / pt 5 / es 5 / ar 5 / fa 5 / zh 5. 3. §4 tests 596/601 → 643/638/0/5 (CI run 30280070312, both matrix legs), aligning with §0/#959. The 596/601 was pre-#911 (Test step was a no-op). 4. §4 Magick.NET 14.14.0 → 14.15.0 (#871 6f1a6e1a, 5 advisories patched). Also adds AutoMapper 14.0.0 (#588) and PdfPig 0.1.14 official (#908). 5. §3.6 + §5.8 + §7 + §8.2(c) "PT titre English Channel — open finding, appel à décision" → RÉSOLU. git grep "English Channel" -- Cards/ = 0. Per ai-01 precision: the string lived in an EMBEDDED csv key that is IGNORED at runtime (HarvestManager.cs overwrites it with the real CSV), so the defect never reached a card — NOT "resolved by #803". The observed mistranslation was stale-harvest, not a live prod defect. Separated from PT row-1 cover contamination (#306, distinct, also closed). 6. §5.4(a) + §8.2(a) #636 "arbitrage ouvert" → CLOSED 2026-07-06 (twin premise of #1). Every value above is re-read at source (git ls-files / cat-file -s / grep / gh issue view), not taken from an intermediate report. 3 audit-probe imperfections (Fallacies/Scenarii counts grabbed Archive/2022; skos:prefLabel grep namespace-split) are documented honestly in the audit report, not masked. Scope: 1 docs file, docs-only, 0 prod write, 0 OWL, 0 CSV. Correction PR, decision to merge = ai-01 (pre-tag sensitive zone, #134 gate). Audit report: docs/investigations/2026-07-28-release-validation-v0.9.0-audit.md (landed in #961). This PR is the body-correction follow-up ai-01 gave GO on (arbitrage qgsvq4, 2 precisions applied: "n'a jamais atteint une carte" phrasing + PT vs EN distinct #306). Co-authored-by: Your <your.email@example.com> Co-authored-by: Claude-Code <noreply@anthropic.com>
1 participant
Updated Magick.NET-Q16-AnyCPU from 14.14.0 to 14.15.0.
Release notes
Sourced from Magick.NET-Q16-AnyCPU's releases.
14.15.0
What's Changed
PingAsynctoMagickImageandMagickImageCollection(#2032).ImportIndexedPixelstoMagickImage(#2040)Related changes in ImageMagick since the last release of Magick.NET:
Library updates:
Full Changelog: dlemstra/Magick.NET@14.14.0...14.15.0
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.