chore(deps): update dependency sharp to ^0.35.0 [security]#3003
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency sharp to ^0.35.0 [security]#3003renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📦 Bundle Stats —
|
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 806.9 KB | - |
| Internal (gzip) | 155.0 KB | - |
| Bundled (raw) | 1.42 MB | - |
| Bundled (gzip) | 319.3 KB | - |
| Import time | 98ms | +1ms, +1.4% |
@portabletext/editor/behaviors
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 467 B | - |
| Internal (gzip) | 207 B | - |
| Bundled (raw) | 424 B | - |
| Bundled (gzip) | 171 B | - |
| Import time | 2ms | +0ms, +3.3% |
@portabletext/editor/plugins
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 2.7 KB | - |
| Internal (gzip) | 894 B | - |
| Bundled (raw) | 2.5 KB | - |
| Bundled (gzip) | 827 B | - |
| Import time | 7ms | +0ms, +0.3% |
@portabletext/editor/selectors
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 82.7 KB | - |
| Internal (gzip) | 15.4 KB | - |
| Bundled (raw) | 78.4 KB | - |
| Bundled (gzip) | 14.3 KB | - |
| Import time | 8ms | +0ms, +0.6% |
@portabletext/editor/traversal
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 28.1 KB | - |
| Internal (gzip) | 5.6 KB | - |
| Bundled (raw) | 28.1 KB | - |
| Bundled (gzip) | 5.5 KB | - |
| Import time | 6ms | +0ms, +0.2% |
@portabletext/editor/utils
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 30.6 KB | - |
| Internal (gzip) | 6.4 KB | - |
| Bundled (raw) | 28.2 KB | - |
| Bundled (gzip) | 6.1 KB | - |
| Import time | 6ms | -0ms, -0.1% |
🗺️ . · ./behaviors · ./plugins · ./selectors · ./traversal · ./utils · Artifacts
Details
- Import time regressions over 10% are flagged with
⚠️ - Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.
📦 Bundle Stats — @portabletext/markdown
Compared against main (1bd850bd)
| Metric | Value | vs main (1bd850b) |
|---|---|---|
| Internal (raw) | 53.8 KB | - |
| Internal (gzip) | 9.8 KB | - |
| Bundled (raw) | 348.9 KB | - |
| Bundled (gzip) | 96.3 KB | - |
| Import time | 40ms | +1ms, +3.1% |
🗺️ View treemap · Artifacts
Details
- Import time regressions over 10% are flagged with
⚠️ - Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.34.5→^0.35.0sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
GHSA-f88m-g3jw-g9cj
More information
Details
Impact
A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.
Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.
Patches
Using prebuilt binaries provided by sharp?
Most people rely on the prebuilt binaries provided by sharp.
Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.
Using a globally-installed libvips?
Please ensure you are using the latest libvips 8.18.3.
Workarounds
Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
lovell/sharp (sharp)
v0.35.0Compare Source
Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.
Breaking: Remove
installscript frompackage.jsonfile.Compiling from source is now opt-in via the
buildscript.Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based
iqquality metrics.Breaking: Add
limitInputChannelswith a default value of 5.Breaking: Remove deprecated
failOnErrorconstructor property.Breaking: Remove deprecated
paletteBitDepthfrommetadataresponse.Breaking: Remove deprecated properties from
sharpenoperation.Breaking: Rename
format.jp2kasformat.jp2for API consistency.Upgrade to libvips v8.18.3 for upstream bug fixes.
Remove experimental status from WebAssembly binaries.
Add prebuilt binaries for FreeBSD (WebAssembly).
Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.
Ensure TIFF output
bitdepthoption is limited to 1, 2 or 4.Add AVIF/HEIF
tuneoption for control over quality metrics.#4227
Add
keepGainMapandwithGainMapto process HDR JPEG images with embedded gain maps.#4314
Add
toUint8Arrayfor output image as aTypedArraybacked by a transferableArrayBuffer.#4355
Require prebuilt binaries using static paths to aid code bundling.
#4380
TypeScript: Ensure
FormatEnumkeys match reality.#4475
Add
marginoption totrimoperation.#4480
@eddienubes
Ensure HEIF primary item is used as default page/frame.
#4487
Add image Media Type (MIME Type) to metadata response.
#4492
Add
withDensityto set output density in EXIF metadata.#4496
Improve
pkg-configpath discovery.#4504
Add WebP
exactoption for control over transparent pixel colour values.Add support for ECMAScript Modules (ESM).
#4509
@florian-lefebvre
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate using a curated preset maintained by