ImageSharp Licensing: Security Fixes and the 3.2 Key
A security scanner flags ImageSharp inside your website or .NET application. Your team proposes adding a newer version directly to the project. Before approving that change, check the licence: a dependency override can change your organisation's entitlement as well as the resolved package version.
Do not add a direct reference to SixLabors.ImageSharp without a valid licence covering that direct use, even when the only purpose is fixing a vulnerable transitive dependency. If your use requires a commercial licence, obtain it before adding the reference.
A valid licence may be a qualifying free licence. It is not automatically a paid subscription. The separate concern is that ImageSharp 3.2.0 introduces a build-time key requirement for direct references in the v3 line. This guide explains what a business owner, technical lead and delivery partner should establish before approving the patch.
For additional technical context, see Techotick's ImageSharp licensing article: transitive dependency fixes and the 3.2.0 key. The official Six Labors sources below remain the basis for the licence explanation.
Understand how ImageSharp enters your application
A transitive dependency arrives through another package. Your application might reference an unrelated PDF or CMS package, which itself depends on ImageSharp. A direct dependency is one your project installs explicitly.
The Six Labors Split License shipped with ImageSharp 3.2.0 defines qualifying transitive use as indirect consumption in object form through a third-party dependency unrelated to Six Labors. That route is covered by Apache 2.0. Installing another Six Labors library is not automatically the same exception.
Adding a direct ImageSharp reference to force a newer resolved version changes the dependency relationship. Not calling its APIs in your own code does not keep the new reference transitive. In its answer to this exact upgrade scenario, the maintainer advised seeking an update from the upstream package owner and said that a direct reference changes the licensing position.
The alert in that historical discussion was later retracted. It illustrates the licensing issue; it is not evidence that a particular current release is vulnerable.
Separate free eligibility from commercial licensing
The split licence provides Apache 2.0 routes for qualifying transitive use, open-source or source-available software, direct use by a for-profit company or individual with less than USD 1 million annual gross revenue, and direct use by a nonprofit or registered charity. Other scenarios fall under the commercial licence.
Six Labors' licensing guidance describes the commercial requirement for direct use in closed-source, for-profit software by a business earning more than USD 1 million annually. This is a US-dollar threshold, not A$1 million or the revenue from one website. The licence and FAQ use different wording at exactly USD 1 million; obtain clarification rather than assuming eligibility at that boundary.
Record which legal entity uses the package and the basis for its entitlement. A working build, a small project budget or a supplier's subscription does not by itself establish that your organisation is covered. For commercial plans, Six Labors counts developers employed by the purchasing entity rather than just the project team.
If commercial licensing applies and your organisation does not hold the required licence, do not directly reference ImageSharp as a security workaround.
Why the ImageSharp 3.2 key can affect release planning
The current ImageSharp documentation requires a valid build-time key for direct references from 3.2.0 in the v3 line and 4.0.0 in the v4 line. Qualifying Community users still need a valid issued key for those direct-reference builds. A genuinely transitive installation is outside that direct-reference enforcement requirement.
Six Labors' October 2026 announcement combines security backports with enforcement in maintained older releases. It describes enforcement of existing terms, not a new licence, and gives ImageSharp v3 a security-maintenance deadline of 12 May 2027.
For a business maintaining a live application, this creates a release-planning concern. A team may approve a minor-version update but find that the release pipeline has no key, the key is expired or procurement has not established entitlement. Assign licence ownership before the change reaches production. An older package building without a key does not prove compliant use.
Once entitlement is established, developers can use the supplied sixlabors.lic file and the documented SixLaborsLicenseFile setting. Commercial and unrestricted keys must remain private. Check the release agents and renewal process as well as individual developer machines.
A safer remediation decision for the business
| Your position | Next step |
|---|---|
| ImageSharp remains transitive through an unrelated third party | Check for a supported upstream package update that brings in the required fix. |
| Your organisation qualifies for free direct use | Document eligibility and arrange a valid Community key where the release requires one. |
| Direct use requires commercial licensing | Obtain the appropriate licence and configure its key before adding the reference. |
| The dependency path or entitlement is unclear | Get the technical owner and Six Labors to clarify the position before approving an override. |
- Confirm the advisory. Identify the resolved version, affected range and vulnerable operation. Do not treat every scanner message as an identical risk.
- Ask for an upstream fix. Check the package that introduces ImageSharp and its supported releases. Ask its maintainer about the required patched dependency if necessary.
- Approve both the security and licensing decisions. Record the chosen version, entitlement, key owner, testing scope and any interim risk acceptance.
- Verify the release. Test affected image uploads, transformations, document generation and other relevant business journeys in a production-like environment. Rebuild through the real release pipeline and rerun the audit.
- Keep an exit plan. If an upstream package cannot be maintained, assess replacing it. Any temporary control or exception needs evidence, an owner and a review date.
Do not leave a vulnerable version in place simply to avoid licensing work. Suppressing an alert also does not patch the dependency. A complete remediation decision must address the security exposure and the permission to use the proposed package.
Check central overrides and licence notices
Ask developers to inspect shared build files, not only the visible project file. Microsoft documents that central transitive pinning can implicitly promote a dependency to top-level status without an explicit project-level reference. That NuGet behaviour is a reason to review the actual dependency graph; it is not a legal ruling on every configuration. Do not assume a central pin preserves the licensing exception.
The split licence also requires documentation to identify the licence actually granted. Where Apache 2.0 applies, its redistribution conditions include supplying the licence, marking changed files, retaining applicable notices in derivative source and carrying forward applicable NOTICE attributions. Include the correct record in your third-party software inventory.
This is part of ongoing application support and maintenance: know what is installed, who owns its updates and which obligations travel with it.
ImageSharp licensing questions
Sources Checked
Primary licensing and platform sources were checked for this guide on 8 November 2026. Techotick's article provides further technical explanation of the same dependency issue.
- Six Labors: Six Labors Split License, ImageSharp 3.2.0
- Six Labors: ImageSharp licence and build configuration
- Six Labors / GitHub: Maintainer clarification: upgrading a transitive dependency
- Six Labors: Security Support and License Enforcement
- Six Labors: Commercial and Community licensing guidance
- Apache Software Foundation: Apache License, Version 2.0
- Microsoft: Central Package Management and transitive pinning
- Techotick Editorial: ImageSharp licensing: transitive dependency fixes and the 3.2.0 key (related editorial explanation)
The hero is an AI-generated conceptual illustration, not a screenshot of a real product or build. Confirm the published licence and your organisation's circumstances before making a licensing decision.