CGA-5xq9-r29r-3742

This vulnerability relates to the GitLab dependency: 'disintegration/imaging'. At the time of writing, this package is already consuming the latest version: v1.6.2. This vulnerability is noted as disputed, but the reasoning is not clear if this is accurate. There are also links to (still open) GH issues associated with triggering the finding. Marking as pending-upstream-fix, as it's not clear if this is a false positive. For more information, please see:

• https://github.com/golang/vulndb/issues/2039
• https://github.com/disintegration/imaging/issues/165