fix(deps): patch the sharp and js-yaml advisories - #9
Merged
Merged
Conversation
Raise sharp ^0.35.2 -> ^0.35.4. - GHSA-rgj7-g3m4-5g8c (high) - sharp, patched in 0.35.4 - GHSA-2883-w6h3-9f4x (high) - js-yaml Resolved versions were read back out of the lockfile rather than assumed, and the set of resolved name@version pairs was compared against HEAD to confirm nothing unrelated moved. No source file uses the sharp.<Type> namespace form, which is the one way a sharp 0.33/0.34 -> 0.35 move can break a TypeScript build. Only the manifest(s) and lockfile(s) are touched. No workflow file is modified.
|
The latest updates on your projects. Learn more about Snapvisor notifications ↗︎
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Advisories published after this fleet's last green dependency audit. This repo
was resolving
sharp0.35.2 and three copies ofjs-yaml— 3.14.2, 4.1.1 and 4.2.0.sharp<0.35.4, patched 0.35.4js-yamlNeither
nextadvisory needs authentication.What changed
packages/core/package.json,packages/webdriverio/package.jsonandpnpm-workspace.yaml, plus the lockfile. No workflow file is touched.packages/core/package.jsonsharp^0.35.2^0.35.4packages/webdriverio/package.jsonsharp^0.35.2^0.35.4pnpm-workspace.yamloverridessharp@<0.35.4,js-yaml@3andjs-yaml@4pnpm-workspace.yaml, notpackage.json. This repo is on pnpm 11, which movedoverridesout of the manifest, and it already keeps nine of them there. The three new entries were inserted into that existing block in its own style and rough alphabetical order; the nine existing entries are untouched.js-yamlneeded two separate version-scoped entries, because this tree carries both a 3.x and a 4.x copy.js-yaml@3goes to 3.15.2 andjs-yaml@4to 4.3.2, so each consumer stays inside its own major. A single blanketjs-yamloverride would have dragged the 3.x consumer onto 4.x, which removedsafeLoad/safeDump.minimumReleaseAge: 1440is respected. This workspace refuses packages published in the last 24 hours; every target version here is well past that.sharppatch bump can break a build.sharp0.35 moved its TypeScript types: 0.33 shippeddeclare namespace sharpwithexport = sharp, while 0.35 shipsexport interfacefrom an.mtsentry point, so any code writingsharp.ResizeOptionsstops compiling. That exact failure hit another repo earlier in this sweep. This repo contains nosharp.<Type>namespace usage, checked across every.ts/.tsxfile, so it is not exposed.name@versionpair count is identical before and after at 1765, the only differences aresharp's platform binaries, and exactly one declared specifier changed.pnpm auditproduction audit, before / afterBaseline captured on the unmodified tree at
4f12233b.Watched packages flagged before:
js-yaml,sharp.Watched packages flagged after: none.
The two criticals that remain belong to unrelated advisories in the test and driver toolchain.
Verified locally
pnpm install --lockfile-only(pnpm 11.8.0 via corepack, the repo's ownpackageManager)pnpm-lock.yamlsharp0.35.4,js-yaml3.15.2 and 4.3.2sharp)git ls-files --eoli/lf w/lfThe build and tests were not run locally and are not claimed to pass. This is a multi-package SDK monorepo with browser-driver packages; the repo's
ci.yml,pr.yml,publish-sdk.ymlandrelease.ymlare the gate.One thing deliberately left alone, flagged rather than skipped silently.
examples/nextjs/package.jsondeclaresnext14.1.4, which is affected by both critical advisories in this sweep. It is aprivate: trueexample that sits outside the pnpm workspace (packages/*), so it has no entry in the lockfile and is not installed by CI. It is untouched here because Next 14 has no patched release at all — the first patched version is 15.5.24, a major upgrade and an app migration rather than a dependency bump.Merge policy for this repo
This repository is not Dokploy source-bound. The classifier reads every column of both
applications.csvandcomposes.csvand finds no unit binding a git source to it, so no push here can redeploy anything. It does have CI, so this PR is being squash-merged once its checks are green, not before.