chore(deps): bump sharp from 0.35.3 to 0.35.4 in /frontend - #62
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.3 to 0.35.4. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
) Supersedes #60, #61 and #62, all of which CI rejected. #60 and #62 failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH: Dependabot regenerates pnpm-lock.yaml without the `pnpm.overrides` block, so `pnpm install --frozen-lockfile` refuses the lockfile. Re-resolved locally instead, keeping overrides intact. #61 bumped anyio in only one of the four uv lockfiles that carry the advisory. Security alerts cleared (11 -> 0): - anyio 4.13.0 -> 4.15.1 (critical + medium) in backend, tests/e2e, tools/fixtures and tools/simulator. `--upgrade-package anyio` alone under-shot to 4.14.2 in backend; pinned the resolve to >=4.15 so all four lockfiles agree. No manifest constraints were added. - js-yaml -> 4.3.2, sharp -> 0.35.4, baseline-browser-mapping -> 2.11.21 (frontend, all transitive). Raised the js-yaml and sharp override floors and added a baseline-browser-mapping floor, since browserslist was still pulling a vulnerable 2.10.34 alongside a patched copy. minor-and-patch group (#60), all 11 packages at or above its targets: next/eslint-config-next 16.3.4, react/react-dom/@types/react/ @types/react-dom 19.3.0, @types/node 26.6.2, tailwindcss and @tailwindcss/postcss 4.3.3, happy-dom 20.14.5, orval 8.34.0. Overrides use caret floors, not exact pins. Verified locally: pnpm install --frozen-lockfile succeeds; frontend tsc/lint/build clean and 601 tests pass; backend ruff/mypy clean and 317 tests pass. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #63, which is now merged. This PR could not be merged as-is: Dependabot regenerates #63 re-resolved the lockfile locally with the overrides intact and carries every bump from this PR at or above its targets. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps sharp from 0.35.3 to 0.35.4.
Release notes
Sourced from sharp's releases.
Commits
7f1a0a2Release v0.35.4f927818Upgrade to sharp-libvips v1.3.3e802092Prerelease v0.35.4-rc.0e13eb2fCI: Fix wasm32 build (#4589)a82a0b3Upgrade to libvips v8.18.68044fe4Bound resize dimensions to coordinate limit147f859Docs: changelog entries for #4578 #4584ee5bfb8Tests: use yauzl directly rather than via extract-zip wrapper7a77889Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)ea5bef2Improve support for input Streams finishing before output is requested (#4584)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.