# Security

Please report vulnerabilities through [GitHub Security Advisories](https://github.com/outskirtslabs/vips/security/advisories).

For general policy and support expectations, see [Outskirts Labs Security Policy](https://docs.outskirtslabs.com/security-policy).

## Bundled native dependencies

Native companion jars `1.3.3-1` bundle `sharp-libvips` 1.3.3 (libvips 8.18.6).
Versions reported in the [sharp-libvips 1.3.3 release notes](https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3):

|     |     |
| --- | --- |
| Dependency | Version |
| aom | 3.15.0 |
| archive | 3.8.9 |
| cairo | 1.18.4 |
| cgif | 0.5.3 |
| exif | 0.6.26 |
| expat | 2.8.3 |
| ffi | 3.8.0 |
| fontconfig | 2.18.3 |
| freetype | 2.14.3 |
| fribidi | 1.0.16 |
| glib | 2.89.4 |
| harfbuzz | 14.3.1 |
| heif | 1.23.2 |
| highway | 1.4.0 |
| imagequant | 2.4.1 |
| lcms | 2.19.1 |
| mozjpeg | 0826579 |
| pango | 1.58.2 |
| pixman | 0.46.4 |
| png | 1.6.58 |
| proxy-libintl | 0.5 |
| rsvg | 2.62.91 |
| tiff | 4.7.2 |
| uhdr | 2.0.2 |
| vips | 8.18.6 |
| webp | 1.6.0 |
| xml2 | 2.15.3 |
| zlib-ng | 2.3.3 |