Repository navigation
chore(deps): bump wrangler from 3.114.17 to 4.158.0 - #15
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) from 3.114.17 to 4.158.0. - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.158.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 security issues
Security issues:
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package-lock.json" line_range="741-760" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-ppc64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 2
<location path="package-lock.json" line_range="761-774" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-riscv64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 3
<location path="package-lock.json" line_range="1106-1125" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-arm64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>| "node_modules/@img/sharp-libvips-linux-ppc64": { | ||
| "version": "1.3.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.4.tgz", | ||
| "integrity": "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ==", | ||
| "cpu": [ | ||
| "ppc64" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-ppc64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
| "node_modules/@img/sharp-libvips-linux-riscv64": { | ||
| "version": "1.3.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.4.tgz", | ||
| "integrity": "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q==", | ||
| "cpu": [ | ||
| "riscv64" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-riscv64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
| "node_modules/@img/sharp-win32-arm64": { | ||
| "version": "0.35.5", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.5.tgz", | ||
| "integrity": "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": "^18.17.0 || ^20.3.0 || >=21.0.0" | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-arm64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Bumps wrangler from 3.114.17 to 4.158.0.
Release notes
Sourced from wrangler's releases.
... (truncated)
Commits
c579d50Version Packages (#16681)f1d81a2[miniflare] Enable local Artifacts in development tools [3/3] (#16186)dc35efbBump dependencies to clear 101 Dependabot alerts (#16700)4d88a45[miniflare] Stabilize Artifacts integration tests on Windows (#16693)0083f80[wrangler] Harden the local KV pagination regression test (#16697)fa3edb3[wrangler] Use config account_id in d1 migrations list --remote (#16688)9a0732cVersion Packages (#16654)44d1ee4fix(wrangler): stopwrangler deleteorphaning Container applications (#16011)8ac43dfRequire explicit route metadata flags when downloading Worker configuration (...680666eVersion Packages (#16646)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)