Compliance issues regarding GPL-2.0 and LGPL-3.0

[paul-boca]

We have been trying to update Magic.NET to 13.4.0 for functionality and security reasons. When using our dependency scanner on Magick.NET 13.4.0, a couple of licenses associated with third-party packages were flagged for review. The licenses were found in Notice.linux-musl.txt, Notice.win.txt, Notice.linux.txt, Notice.osx.txt.

The flagged licenses are:

GPL-2.0 applicable to rsvg 2.40.20

LGPL-3.0 applicable to multiple components

Our compliance teams are asking if the third-party components with the above licenses can be removed/replaced and if you can offer an explanation regarding their effects on your software, please. If we are not able to update because of licensing issues, we are left with unfixed security issues, so we’d like to understand what the possible solutions are.

Thank you!

[dlemstra]

That was a mistake in the build pipeline. If you look at version 13.5.0 which is the most recent version you will see that the license is correct (read LGPL) again.