This repository is a modified fork of leap71/PicoGK. The geometry kernel, the C# API and the native runtime are LEAP 71's code, not this fork's.
A vulnerability in the kernel or the native runtime affects every PicoGK user, not just this fork. Report those upstream so they actually get fixed at the source:
- Upstream repository: https://github.com/leap71/PicoGK
- Native runtime: https://github.com/leap71/PicoGKRuntime
- Upstream project contact: https://picogk.org and https://leap71.com
Please report to this fork as well if the issue reaches users through this repository, so the fork can be patched or the affected binary pulled. Reporting in both places is the right move when you are unsure.
Report here first if the issue is specific to this fork:
- The prebuilt native binaries committed under
runtime/native/, for example a binary that is outdated relative to a known CVE in c-blosc, LZ4, oneTBB, zlib, Zstandard or liblzma - A submodule pin under
vendor/that points at a compromised or malicious commit - The GitHub Actions workflow in
.github/workflows/ - Anything else introduced by this fork's packaging
This fork tracks a single branch, main, based on upstream commit 709cdd4 (one commit after upstream tag PicoGK-v1.7.7.5). There are no fork releases and no backports.
| Version | Supported |
|---|---|
main (latest commit) |
Yes |
| Anything older | No, please update first |
| Upstream 2.x | Not carried by this fork, report to upstream |
Note that this fork is deliberately behind upstream. If you need current PicoGK, use upstream.
Do not open a public issue for a vulnerability.
Preferred: use GitHub private vulnerability reporting. Go to the Security tab of this repository and click Report a vulnerability. That opens a private advisory visible only to the maintainer, and credits you when it is published.
Alternative: email kevofehr@gmail.com with SECURITY in the subject line.
Useful things to include:
- What the issue is and what an attacker gains
- Which file, binary or submodule is affected
- Version or commit SHA you tested against
- Operating system and .NET SDK version
- Steps to reproduce, and a proof of concept if you have one
- Whether you have already reported it upstream
This is a single-maintainer fork, so response times are best-effort, not contractual.
- Acknowledgement: within 7 days
- Initial assessment: within 14 days
- Fix or mitigation for fork-specific issues: as fast as is practical, and the advisory is published once a fix or a workaround exists
- Kernel issues: forwarded upstream if you have not already reported them, and tracked here until upstream ships a fix
Please give a reasonable window before public disclosure, and let us know if you are working to a deadline. Reporters are credited in the advisory unless they ask not to be.