Version 3.119.3
Preview only · Superseded by 3.119.4 · Never released as stable — these changes rolled up into 3.119.4 · NuGet
API changes · SkiaSharp API diff · HarfBuzzSharp 8.3.1.4
Highlights
This preview-only release focused on security hardening and stability: Spectre mitigations landed for both Windows and Linux native libraries, a NativeAOT crash was fixed for apps with reflection disabled, and a fontconfig crash on Linux ARM64 was resolved. All of these changes shipped cumulatively in 3.119.4. Community contributors @sshumakov and @Copilot drove both Spectre mitigation PRs and the AoT fix.
Security
- Spectre mitigation for Windows — Enables
/QspectreforlibSkiaSharp.dll, reducing information-disclosure risk on Windows. ❤️ @sshumakov (#3496) - Spectre mitigation for Linux — Enables Spectre mitigation flags for
libSkiaSharp.so. ❤️ @sshumakov (#3502) - libwebp updated to 1.6.0 — Latest security release. (#3478)
- brotli updated to 1.2.0 (#3469)
- libexpat bumped to 2.7.3 — Security fix release (from 2.6.4). (#3458)
- libpng updated to 1.6.54 (#3452)
Bug Fixes
- Fixed NativeAOT crash with
IlcDisableReflection=true— Resolves a crash in apps compiled ahead-of-time with reflection disabled. ❤️ @Copilot (#3485) - Fixed Linux ARM64 startup crash — Adds the fontconfig runtime library to the ARM64 cross-compile sysroot, resolving a crash at startup on Linux ARM64. (#3494)
Community Contributors ❤️
| Contributor | What They Did |
|---|---|
| @sshumakov | Spectre mitigations for Windows and Linux native libraries |
| @Copilot | Fixed NativeAOT crash with IlcDisableReflection=true |
Links
Preview 1 (February 7, 2026)
Security hardening with Spectre mitigations for Windows and Linux, NativeAOT crash fix, Linux ARM64 fontconfig fix, and multiple native dependency security updates (libwebp, brotli, libexpat, libpng).