Skip to content

Backport v3 security fixes and license enforcement - #3208

Merged
JimBobSquarePants merged 21 commits into
release/3.1.xfrom
js/v3-security-licensing
Oct 9, 2026
Merged

JimBobSquarePants merged 21 commits into
release/3.1.xfrom
js/v3-security-licensing

Conversation

@JimBobSquarePants

@JimBobSquarePants JimBobSquarePants commented Oct 9, 2026 •

Copy link
Copy Markdown
Member

Prerequisites

  • I have written a descriptive pull-request title
  • I have verified that there are no overlapping pull-requests open
  • I have verified that I am following the existing coding patterns and practice as demonstrated in the repository. These follow strict Stylecop rules 👮.
  • I have provided test coverage for my change (where applicable)

Description

PR #3176:

PR #3187:

Source: PR #3176, commit 9ee7d1d. Advisory: GHSA-v76p-62qx-wwq2. Retains the v3 decoder signatures.
Source: PR #3187, commit 8de892a. Advisory: GHSA-gwg2-r3hj-4w44. Retains v3 jagged CLUT storage.
Source: PR #3187, commit 73d8e02. Related closed report: GHSA-f77j-67h2-c87w.
Source: PR #3187, commit c4c4bf2. Advisory: GHSA-j3p4-wp97-rph4. Retains the v3 ref parameter.
Source: PR #3187, commits a9498c6 and 906f037. Advisory: GHSA-j9gm-c75j-xc9q. Introduces the shared sizing hook and output bounds check; the separate T6 backport supplies its own capacity bound.
Source: PR #3187, commits a9498c6, cdc79d0, and 906f037. Advisory: GHSA-jjfr-hcj7-qf5w. Adds the T6 capacity bound and requires each compressor to supply its bound.
Source: PR #3187, commit 7781fbd. Related closed report: GHSA-7cgg-p2wf-w8p6. Retains the v3 GIF buffer and recovery behavior.
Source: PR #3187, commit 23ed0b0. Applies the existing header check to both decode and identify.
Source: PR #3187, commits ea0475e and 0446ba0. Related closed reports: GHSA-9mwh-795v-jggc and GHSA-pwwx-2f3p-q9cm describe the same scanline arithmetic defect.
Source: PR #3187, commits 2b52b55, 14ddc15, and 18532d7. Reports: GHSA-prqg-xhg6-9cf5 and GHSA-mqm8-wwpv-jqq3 describe overlapping metadata allocation defects. Preserve v3 EXIF/XMP truncation recovery and validate ICC framing before allocation.
Source: PR #3187, commit 4b73eaa. Advisory: GHSA-gwg2-r3hj-4w44. Verify a complete profile with a truncated CLUT is rejected without allocating its claimed grid.
Use ubuntu-22.04-arm with the existing ARM label opt-in and .NET 6 lane. Keep failed-output artifact names distinct for the two Ubuntu architectures.
This was referenced Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant