ImageMagick sample: move to Magick.NET 14.17.1 for security fixes - #2237
Open
vladimir-pecanac-main wants to merge 1 commit into
Conversation
Magick.NET-Q8-AnyCPU 13.6.0 is affected by 162 published advisories, all fixed by 14.15.0. Version 14 takes image sizes as uint and moves Drawables to ImageMagick.Drawing, so the sample gets the matching signature, casts and using directive. Behaviour is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security update for the
csharp-images/GenerateImagesInCSharpUsingImageMagicksample, which backs the "Generate Images in C# Using ImageMagick" article.The sample pinned
Magick.NET-Q8-AnyCPU13.6.0. The GitHub advisory database lists 162 advisories that affect 13.6.0 (26 high, 98 medium, 38 low), published between July 2025 and September 2026 and all fixed by 14.15.0. A few of them: CVE-2026-23952 (fixed in 14.10.2), CVE-2026-46692 (14.12.0), CVE-2026-49219 (14.14.0), CVE-2026-55594 (14.15.0). This moves the sample to 14.17.1, the newest release, which has no open advisory.Magick.NET 14 takes image sizes as
uintand movesDrawablesto theImageMagick.Drawingnamespace, so the sample does not compile on 14.x as written. Behaviour is unchanged.Four files, one folder.
ImageMagickLibrary.csproj:Magick.NET-Q8-AnyCPU13.6.0 to 14.17.1.ImageService.cs:using ImageMagick.Drawing;, andCreateBlankImagetakesuint width, uint heightto match theMagickImage(color, uint, uint)constructor. A zero size still throwsArgumentException.Program.cs:image.Widthandimage.Heightareuintnow, so they are cast tointbefore they go toCreateCircle.Tests/ImageMagickLibraryLiveTest.cs: the same casts onMagickGeometry.WidthandHeight, and the invalid-size theory takesuint.The target framework stays net8.0 and the test packages are unchanged; neither had to move for this.
dotnet build -c Release: 0 warnings, 0 errors.dotnet test(all tests, including the Live ones CI filters out): 7 of 7 passed. SDK 10.0.302, runtime 8.0.27. The program still writes the 480 x 300 AliceBlue image with the YellowGreen circle.