CVE-2025-25977 affects package canvg < 4.0.3 which metabrainz/listenbrainz-server depends on.

Please self-assign this ticket and check metabrainz/listenbrainz-server alerts, then:

• Dismiss the corresponding alert in GitHub if there is a valid reason (patch in progress, no bandwidth, tolerable risk, inaccurate alert, or unused code) for.
• Create a new ticket in the affected JIRA project, link it to this ticket (do not move this ticket to another project), and address that new ticket.

In both case, GitHub Bot will close this ticket for you, except if you backport a patch on a vulnerable dependency.

This ticket has been created by SEC automation.