ImageSharp Licensing: Transitive Fixes and the 3.2.0 Key

A vulnerability alert names SixLabors.ImageSharp, but your application never installed it directly. It arrived through a CMS, PDF tool or another NuGet package. Adding a newer ImageSharp version to your project may look like a routine fix. It can also change which licence terms apply to your application.

Do not add a direct reference to SixLabors.ImageSharp without a valid licence covering that direct use, even if the only purpose is to fix a vulnerable transitive dependency. If your use requires a commercial licence, obtain it before adding the reference. Six Labors has explicitly addressed this upgrade scenario in its maintainer clarification.

A valid licence does not always mean a paid licence. ImageSharp has qualifying free-use routes. Separately, versions starting with 3.2.0 in the v3 line and 4.0.0 in the v4 line require a valid build-time key for direct references, including qualifying community use. Six Labors documents that distinction in its ImageSharp documentation.

Transitive dependency: why the route into your project matters

The term is transitive dependency: your application references a third-party package, and that package brings in ImageSharp. The Six Labors Split License shipped with ImageSharp 3.2.0 defines this route as an indirect installation in object form through a dependency unrelated to Six Labors. It separately defines a direct dependency as a work you install directly.

Your application → Third-party PDF package → ImageSharp
                   direct dependency        transitive dependency

Your application → ImageSharp
                   direct dependency

Under the split licence, qualifying transitive consumption is licensed under Apache 2.0. Other Apache-licensed routes include open-source or source-available software, direct use by a for-profit company or individual with less than USD 1 million annual gross revenue, and direct use by a nonprofit or registered charity. Other scenarios fall under the commercial licence.

This exception specifically requires an intermediary unrelated to Six Labors. Do not assume that installing another Six Labors package gives you the same transitive exemption for the whole stack.

A security-only direct reference still counts

Consider this proposed project-file change:

<!-- Adding this is a direct reference. Check your entitlement first. -->
<PackageReference Include="SixLabors.ImageSharp" Version="3.2.0" />

The justification might be that a scanner flagged an older dependency, and the application never calls ImageSharp APIs. That does not preserve the transitive status of the new reference. The project now explicitly installs ImageSharp.

In a January 2025 discussion, a developer asked whether adding a direct ImageSharp reference solely to upgrade IronPDF's transitive dependency would preserve Apache 2.0 treatment. The maintainer said the direct reference changes the applicable licensing position and advised requesting an upstream update. The scanner report in that particular exchange was subsequently retracted; it should not be presented as evidence of a current vulnerability. The discussion remains directly relevant to the licensing question.

A vulnerability alert does not create a licensing exception. If you need a commercial licence and do not hold one, do not add ImageSharp directly as an emergency override. Apply the free-use criteria to your actual circumstances rather than assuming every direct reference requires payment.

Why ImageSharp 3.2.0 deserves an upgrade review

ImageSharp 3.2.0 was released on 9 October 2026. Its release notes include backported security fixes and licence enforcement. That combination matters for teams staying on v3 because their upstream dependencies prevent a move to v4.

Six Labors' October announcement describes the key requirement as enforcement of existing terms, rather than a new licence. It also extends security maintenance to older majors for 12 months after their successor's first stable release. For ImageSharp v3, the stated deadline is 12 May 2027. Existing published packages are not being rewritten.

The operational concern is that a minor-version security update can introduce a build prerequisite. A team may approve the version bump, then discover that its release agents lack a valid key. Our assessment: review entitlement and CI configuration alongside compatibility, before the security update reaches the release pipeline.

Six Labors' enforcement announcement says validation applies to direct dependencies; consumers receiving the libraries through a third-party package are outside that build-key requirement. Missing or invalid keys can fail direct-reference builds. Conversely, an older version building successfully never proved that the organisation met its licence obligations.

Free eligibility, a paid licence and a build key are different checks

Six Labors' current licensing guidance says a commercial licence is required for direct use in closed-source, for-profit software produced by a business earning more than USD 1 million in annual gross revenue. The revenue test concerns the business, not just the application being patched. Eligible users can apply for a free Community licence.

The split licence's small-business exception uses “less than” USD 1 million, while the pricing FAQ describes the paid requirement as “more than” that amount. If your revenue is exactly at that boundary, obtain clarification from Six Labors rather than assuming the wording creates an exemption.

Situation	What to establish before upgrading
ImageSharp remains genuinely transitive through an unrelated third party	Confirm the dependency path and the applicable Apache 2.0 obligations.
You qualify for free direct use	Document eligibility and obtain a valid Community key for versions that enforce one.
Your direct use requires a commercial licence	Obtain the appropriate licence and configure its valid key before adding the reference.
Your entitlement or dependency classification is unclear	Resolve it with Six Labors before treating a direct override as approved.

A key is a build credential, not a substitute for entitlement. Confirm that the issued licence covers your organisation and use.

Licence obligations do not disappear with transitive use

The split licence also requires documentation to reference the licence actually granted to your use. Apache 2.0 treatment is permission with conditions. When redistributing covered work, Apache License 2.0 requires supplying the licence, marking modified files, retaining applicable notices in distributed derivative source, and carrying forward applicable NOTICE attributions when present. Keep these records in your third-party notices and software inventory.

For commercial use, verify that the purchasing entity and developer tier match your organisation. Six Labors counts developers employed by that entity, rather than only the team using ImageSharp. Its pricing FAQ also warns that an expired licence prevents builds and can leave continued use in breach of the agreement. Assign responsibility for renewal instead of discovering expiry during a release.

A practical response to an ImageSharp vulnerability alert

Start by identifying what your project actually resolves. Microsoft documents package listing with transitive dependencies. With .NET 10, use:

dotnet package list --include-transitive
dotnet package list --include-transitive --vulnerable

With .NET 9 or earlier, the command order is dotnet list package --include-transitive; add --vulnerable for the vulnerability report. Older SDKs may require restoring the project first.

To identify the package introducing ImageSharp, use Microsoft's dependency-graph command, available from the .NET 8.0.4xx SDK:

dotnet nuget why YourApp.csproj SixLabors.ImageSharp

Then make the remediation decision:

Read the actual advisory. Match its affected ranges and vulnerable operation to your resolved version and application's exposure.
Look for an upstream update. Prefer a supported release of the third-party package that brings in the patched ImageSharp version. Confirm the resulting dependency graph.
Check entitlement before a direct override. Obtain the required commercial licence or establish free-use eligibility and arrange the necessary key.
If an update is unavailable, escalate the dependency decision. Ask the upstream maintainer for a fix, evaluate replacing the dependency, or agree on documented interim controls with the security owner.
Verify the result. Restore, rebuild in the release pipeline, test affected image-processing paths and rerun the audit. Record both the security outcome and licence basis.

The concerns are concrete. The BigTIFF decoder advisory lists 3.2.0 as patched and earlier v3 versions as affected. The ICC profile parsing advisory also lists 3.2.0 as patched; how the vulnerable parser is reached differs between v3 and v4. These examples do not establish that any chosen version fixes every future advisory.

Do not leave a vulnerable release in place merely to avoid the key requirement. Equally, suppressing an alert does not patch the library. Any temporary exception needs evidence specific to the advisory, an owner and a review date.

Central package management is not a licensing shortcut

Check Directory.Packages.props and imported build files as well as the visible .csproj. Microsoft explains that Central Package Management's transitive pinning can implicitly promote a transitive dependency to a top-level dependency without an explicit project-level PackageReference.

That is a NuGet behaviour, not a legal ruling on every pinning configuration. Do not assume that omitting the reference from one file guarantees the transitive licensing exception. If a central override changes your classification, get Six Labors' interpretation before relying on it.

Prepare the build after establishing entitlement

For a licensed direct-reference build, the current ImageSharp instructions support an issued sixlabors.lic file or a property pointing to it:

<PropertyGroup>
  <SixLaborsLicenseFile>path/to/sixlabors.lic</SixLaborsLicenseFile>
</PropertyGroup>

Use the supplied file unchanged. Keep commercial and unrestricted keys private; only appropriately assembly-scoped community keys are intended for public repositories. Check key availability and expiry in CI as well as on developer machines. This configuration example assumes valid entitlement; it does not grant one.

Do not directly reference ImageSharp without a valid licence covering your use. Fixing a transitive vulnerability is a security obligation, not permission to skip the licence check. Treat the patched version, your entitlement and the build-key configuration as parts of the same release decision.

Sources checked 7 November 2026. This guide explains the published terms and maintainer guidance; it is not a determination of an individual organisation's legal position. Researched and edited with AI assistance by Techotick Editorial. Cover: original dependency-path illustration.