Repository navigation
fix(deps): bump the worker's sharp override to 0.35.5 for GHSA-wq5f-xc86-pv6w - #107
WomB0ComB0 wants to merge 1 commit into
Conversation
…c86-pv6w sharp 0.35.4 bundles a libvips whose librsvg is affected by GHSA-wq5f-xc86-pv6w (high, CVE-2026-96889); 0.35.5 is the first patched release. sharp is dev-only here (wrangler -> miniflare) and is held by the worker's npm override, so the override is what has to move. worker/package-lock.json was regenerated with npm 11.19.0, the version the worker CI job runs under Node 24. Only sharp and its @img/* platform packages change.
github-actions
Bot
added
C-Bug
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely identifies the worker dependency update and its security purpose. It matches the main change. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
get-resq-software | 21bb5e2 | Oct 19 2026, 02:05 AM |
|
LGTM! This PR updates the
|
Summary
Fixes the red
scan / osv-scannercheck onmain. sharp 0.35.4 is affected by GHSA-wq5f-xc86-pv6w (high, a librsvg vulnerability in the bundled libvips), and 0.35.5 is the first patched release. sharp is a dev-only transitive dependency (wrangler->miniflare), and the existing npm override inworker/package.jsonholds it at 0.35.4. This PR moves that override to 0.35.5 and regeneratesworker/package-lock.jsonwith npm 11.19.0, the version theworkerCI job runs under Node 24. In the lockfile, onlysharpand its@img/*platform packages change: 27 entries, none added or removed. The Worker still ships zero runtime dependencies, so the deployed bundle is unchanged.Type of change
fix— bug fixbuild— build system or external dependencyTest plan
osv-scanner scan source --recursive ./(v2.3.5, as the shared job runs it) →No issues found. The same scan of the previous lockfile reports GHSA-wq5f-xc86-pv6w against sharp 0.35.4.npm ci --no-audit --no-fund(npm 11.19.0) → installs sharp 0.35.5npm run typecheck→ cleannpm run lint(Biome 2.5.2) → cleannode worker/test/index.test.mjs→ 81 passed, 0 failednpm run build(wrangler deploy --dry-run) → succeeds; bundle 18.87 KiBBreaking changes
None.
Checklist
commit-msghook will reject otherwise)pre-pushhook will reject otherwise)resq pre-commitclean locally (copyright, large files, debug statements, secrets, audit)Summary by CodeRabbit