Skip to content

chore(deps): resolve sharp to 0.35.4 - #177

Merged
bpapillon merged 1 commit into
mainfrom
orbit-security-2026-09-09-root
Sep 14, 2026
Merged

bpapillon merged 1 commit into
mainfrom
orbit-security-2026-09-09-root

Conversation

@schematic-orbit

Copy link
Copy Markdown
Contributor

Adds a sharp resolution so the copy miniflare pins exactly (sharp "0.35.2") moves to the patched release. Every miniflare 4.x release, up to the current 4.20260730.0, still pins 0.35.2, so bumping the direct dependency would not clear it.

GHSA Package Severity Version How
GHSA-rgj7-g3m4-5g8c sharp high 0.35.2 → 0.35.4 yarn resolution

@bpapillon bpapillon self-assigned this Sep 9, 2026
@bpapillon
bpapillon marked this pull request as ready for review September 14, 2026 16:34
@bpapillon
bpapillon requested a review from a team as a code owner September 14, 2026 16:34
@bpapillon
bpapillon merged commit f33b87a into main Sep 14, 2026
7 checks passed
@bpapillon
bpapillon deleted the orbit-security-2026-09-09-root branch September 14, 2026 16:34
bpapillon added a commit that referenced this pull request Sep 14, 2026
fern-config now generates the resolutions block, so the copy Replay
reapplies from #156 and #177 duplicated the key.
bpapillon added a commit that referenced this pull request Sep 14, 2026
* [fern-generated] Update SDK

Generated by Fern
CLI Version: unknown
Generators:
  - fernapi/fern-typescript-node-sdk: 3.93.0

* [fern-replay] Applied customizations

Patches applied (2):
  - patch-7a37bae5: chore(deps): resolve dependabot security alerts (#156)
  - patch-f33b87ac: chore(deps): resolve sharp to 0.35.4 (#177)

* chore(deps): drop hand-added resolutions block

fern-config now generates the resolutions block, so the copy Replay
reapplies from #156 and #177 duplicated the key.

---------

Co-authored-by: fern-api[bot] <115122769+fern-api[bot]@users.noreply.github.com>
Co-authored-by: Ben Papillon <benpapillon@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants