Summary
Updates the vulnerable dependency trees behind all 116 open Dependabot alerts captured on October 27, 2026, and includes the backend ImageSharp and SignalR fixes discovered during container validation. Refs #1104; overlaps the ImageSharp upgrade in #1049.
Changes
- Refreshes root, frontend, and Discord bot npm lockfiles; raises patched direct-dependency floors and preserves separate Undici 6.x/7.x trees.
- Upgrades ImageSharp to 4.1.3 and pins SignalR.Common to 10.0.13 with its required Options/DI abstraction patches.
- Adds the maintainer-approved assembly-scoped Six Labors Community license, shared build configuration, and expiry/renewal instructions. Other license files remain ignored. The included license expires January 25, 2028.
- Adds six real-decoder tests for PNG/JPEG/GIF/WebP and ordinary/oversized malformed BigTIFF headers.
- Keeps the alert inventory, remediation tracking, and validation results in issue #1104 and this PR description.
Validation
- Clean
npm ci, completenpm audit --json(zero vulnerabilities), and installed dependency graph checks pass in all three projects on Linux/Node 24.22.1. - All 116 original advisory ranges reproduce in the baseline locks and are absent from every matching candidate lock entry. An independent review also found no incompatible resolved npm dependency ranges.
- Frontend: 90 files / 681 tests pass; lint, type check, production build, and repository-path checks pass.
- Backend: licensed Release solution build, formatting check, locked restore, and 31 focused image/security integration tests pass. Full NuGet audit, including transitive packages across all five projects, reports no vulnerable packages.
- Full native Linux backend suite: 3,872 passed, 148 platform/fixture skips, zero failures (4,020 total), in 6 minutes 20 seconds. The test container uses a non-root user, a complete writable repository layout, fresh temp storage on a native Docker volume, and a read-only fixture mount.
- The ...
Automated Canary build