CGA-h8rp-v97v-qq43

Currently there is no fix implemented for the CVE regarding github.com/disintegration/imaging v1.6.2, there is an open PR upstream that can be found here addressing this issue: https://github.com/disintegration/imaging/issues/165

This vulnerability relates to the GitLab dependency: 'disintegration/imaging'. At the time of writing, this package is already consuming the latest version: v1.6.2. This vulnerability is noted as disputed, but the reasoning is not clear if this is accurate. There are also links to (still open) GH issues associated with triggering the finding. Marking as pending-upstream-fix, as it's not clear if this is a false positive. For more information, please see:

• https://github.com/golang/vulndb/issues/2039
• https://github.com/disintegration/imaging/issues/165