[Proposal] Remove SkiaSharp.Views Dependency

[TheCodeTraveler]

Feature name

Remove SkiaSharp.Views Dependency

Link to discussion

(Discord) https://discord.com/channels/1136756209475661914/1136757631550238781/1154823859766308906

Progress tracker

• Android Implementation
• iOS Implementation
• MacCatalyst Implementation
• Windows Implementation
• Tizen Implementation
• Unit Tests
• Samples
• Documentation

Summary

A direct reference to SkiaSharp.Views v2.88.6 was added to CommunityToolkit.Maui.Core for net7.0-tizen after a security vulnerability was reported on SkiaSharp; the vulnerability is patched in SkiaSharp v2.88.6:

Maui/src/CommunityToolkit.Maui.Core/CommunityToolkit.Maui.Core.csproj

Lines 53 to 55 in bf9d66d

	<ItemGroup Condition="$(TargetFramework.Contains('-tizen'))">
	<PackageReference Include="SkiaSharp.Views" Version="[2.88.6,)" />
	</ItemGroup>

The tizen-net7.0 library has a transitive dependency to SkiaSharp via net7.0-tizen -> Tizen.UIExtensions.NUI -> Microsoft.Maui.Graphics.Skia -> SkiaSharp.

We should remove this direct package reference once Microsoft.Maui.Graphics.Skia has been updated to use SkiaSharp v2.88.6 and then Tizen.UIExtensions.NUI has subsequently been updated to use the latest version of Microsoft.Maui.Graphics.Skia.

We are blocked until Tizen.UIExtensions.NUI is updated.

Motivation

The .NET MAUI Community Toolkit strives to avoid adding direct dependencies to external libraries. I created this Issue to ensure that our temporary dependency to SkiaSharp to avoid the security vulnerability does not become a permanent dependency in our library.

Detailed Design

To remove the direct dependency, we must remove following lines of code from CommunityToolkit.Maui.Core:

Maui/src/CommunityToolkit.Maui.Core/CommunityToolkit.Maui.Core.csproj

Lines 53 to 55 in bf9d66d

	<ItemGroup Condition="$(TargetFramework.Contains('-tizen'))">
	<PackageReference Include="SkiaSharp.Views" Version="[2.88.6,)" />
	</ItemGroup>

Usage Syntax

(None)

Drawbacks

(None)

Alternatives

(None)

Unresolved Questions

(None)

[vhugogarcia]

The .NET MAUI team is bumping up the version now on the .NET MAUI repository: dotnet/maui@c37907a

Hopefully, it will be approved and merged soon.
🙂🙂

[TheCodeTraveler]

Update

The Microsoft.Maui.Graphics.Skia v7.0.100 NuGet Package has been updated to SkiaSharp v2.88.6: dotnet/maui@199adf7

We are still blocked until Tizen.UIExtensions.NUI is updated. We will monitor the progress on their PR here (Thanks Jay!!): dotnet/maui#18442

[ghost]

Reopening Proposal.

Only Proposals moved to the Closed Project Column and Completed Project Column can be closed.

[jfversluis]

Oooh well actually, I think we still got work to do here on our side now? @JoonghyunCho?

[JoonghyunCho]

Oooh well actually, I think we still got work to do here on our side now? @JoonghyunCho?

Thanks for merging dotnet/maui#18442 ! I expect this will be resolved when the new maui version releases?

[TheCodeTraveler]

Awesome!!

Yup - once the net7.0-tizen workload (or the net8.0-tizen workload) is updated to use Tizen.UIExtensions.NUI v9.2.0, we can remove our dependency to SkipSharp.Views.

We'll keep this Proposal open until the PR to remove the SkiaSharp.Views dependency is closed:

Maui/src/CommunityToolkit.Maui.Core/CommunityToolkit.Maui.Core.csproj

Lines 53 to 55 in bf9d66d

	<ItemGroup Condition="$(TargetFramework.Contains('-tizen'))">
	<PackageReference Include="SkiaSharp.Views" Version="[2.88.6,)" />
	</ItemGroup>

[ghost]

Reopening Proposal.

Only Proposals moved to the Closed Project Column and Completed Project Column can be closed.