Repository navigation
refactor(api): replace ImageSharp with SkiaSharp - #198
Merged
Merged
Conversation
ImageSharp 3.2.0 now refuses to build without a Six Labors license key, and every version up to 4.1.1 carries the advisories published on 2026-10-07 (GHSA-j3p4-wp97-rph4 and four others), so neither staying on 3.1.12 nor taking the 3.2.0 bump was an option for a public repository anyone should be able to build. SkiaSharp (MIT) takes over the two jobs ImageSharp had: validating and re-encoding uploaded photos, and turning EXIF-rotated photos upright before OCR. Its decoder reports the orientation tag without applying it and its encoders write no EXIF, so the orientation is now applied to the pixels when a photo is stored, where ImageSharp used to carry the tag over. The Linux native binaries come from the NoDependencies package, since the runtime image has no fontconfig.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ImageSharp stopped being an option on two fronts at once:
No Six Labors license found. Set $(SixLaborsLicenseKey)…), which is why deps: Bump the dotnet-minor-patch group with 3 updates #195 is red. A key would be needed by every build from source: CI, the Docker build, forks, anyone self-hosting.SkiaSharp 4.153.1 (MIT) takes over the two jobs ImageSharp had:
FileSystemPhotoStorage): same checks, same order. The header is read for dimensions before any full decode, the decode itself is the last check, and the stored file is re-encoded from pixels (JPEG/WebP quality 75, ImageSharp's default, so stored photos weigh what they did).UprightImage): untagged photos still go to the engine byte for byte. Rotated ones are turned upright and sent as PNG.One behaviour change, deliberate: Skia's decoder reports the EXIF orientation without applying it, and its encoders write no EXIF. So
OrientedImageapplies the orientation to the pixels when a photo is stored. ImageSharp used to copy the photo's metadata into the stored file, GPS included, despite the class comment saying only pixels were kept. That is now actually true.Linux native binaries come from
SkiaSharp.NativeAssets.Linux.NoDependencies, because the default Linux build links fontconfig, which the runtime image doesn't have.dotnet publishships bothlinux-x64andlinux-arm64. The Dependabot ignore rule for ImageSharp majors goes away with the package.Checklist
UprightImageTests(pass-through, orientations 6 and 8 checked by pixel colour, garbage passed through), a storage test that a tagged photo is stored upright, existing fixtures moved to Skia. Since Skia can't write EXIF,TestImages.WithExifOrientationsplices an APP1 segment by hand, whichTesseractOrientationTestsnow uses toodotnet build -c Release(no warnings),dotnet test(331 passed, 4 OCR benchmarks skipped without engines locally),--locked-moderestore of Api and TestsRelated issues
Supersedes the ImageSharp part of #195.