chore(deps): bump sharp from 0.35.3 to 0.35.4 - #379
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
tsforge | cca2199 | Sep 07 2026, 09:50 PM |
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.3 to 0.35.4. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/sharp-0.35.4
branch
from
September 7, 2026 21:50
02f7888 to
cca2199
Compare
agjs
added a commit
that referenced
this pull request
Sep 25, 2026
Dependency bumps (dependabot #376 #379 #380 #381 #384 #387 #389 #390 #391 #392 #393 #394): wrangler 4.131.2, astro 7.3.2, mermaid 12.0.0, sharp 0.35.4, bun-types 1.4.2, @astrojs/starlight 0.42.0, globals 17.12.0, eslint 10.10.0 + typescript-eslint 8.69.0, @astrojs/react 6.0.5, @astrojs/sitemap 3.7.4, softprops/action-gh-release 3.0.3. - Starlight 0.42 (via @astrojs/mdx 8) needs the @astrojs/markdown-remark ^7.3.0 peer; added to the docs app (the docs build failed without it). - typescript-eslint 8.69 flags `void _drop;` as a meaningless void; removed (the `_` prefix + rest-sibling destructuring already silence unused-var). Security scans - osv: every accepted-risk entry had expired (2026-09-12) and no longer matched; the 8 open advisories were all fixable, so patched versions are pinned via overrides (devalue, js-yaml, lodash-es, smol-toml, svgo, valibot) and the dead allowlist is emptied. osv-scanner: no issues. - gitleaks: allowlist the Chrome extension manifest — its "key" is the extension's PUBLIC key (pins the ID the bridge accepts), not a secret.
agjs
added a commit
that referenced
this pull request
Sep 25, 2026
…eaking into non-code sessions (#395) * docs(spec): chrome research bridge design * feat(browser): research in the user's logged-in Chrome + stop coding-mode leaking into non-code sessions Chrome research bridge - New MV3 extension (packages/chrome-extension) connected to tsforge over a token- and Origin-checked localhost WebSocket (chrome-bridge subsystem). - browser_* tools: tabs, adopt, open, navigate, read (chunked markdown with numbered refs), click, scroll, screenshot, close; agent tabs live in a "tsforge" tab group. Read + navigate only, enforced in the extension: default-deny click policy re-checked on the live element at click time, group-scoped tabs, http(s)-only navigation, private hosts blocked. - note tool: append-only notes/<topic>.md, outside the code write-guard. - TSFORGE_BROWSER / _PORT / _ALLOW_PRIVATE, /browser, /config toggle, docs. Non-code sessions no longer get the TypeScript build machinery - Auto gate stays dormant until the folder has JS/TS code, then wakes; while dormant: assistant prompt, no check/pull_conventions, no gate runs/nudges. - ESLint with nothing to lint passes (--no-error-on-unmatched-pattern). - Research reads count as progress for readonly-spin without a live gate. - task_complete works without a gate (marked not gate-checked). - Folders with no code start in normal mode, not plan-first. - Repetition re-steer, checklist rules and /gate "" follow the gate state. - Assistant prompt no longer opens as a TypeScript engineer. * chore(deps): fold open dependabot bumps; fix security scans Dependency bumps (dependabot #376 #379 #380 #381 #384 #387 #389 #390 #391 #392 #393 #394): wrangler 4.131.2, astro 7.3.2, mermaid 12.0.0, sharp 0.35.4, bun-types 1.4.2, @astrojs/starlight 0.42.0, globals 17.12.0, eslint 10.10.0 + typescript-eslint 8.69.0, @astrojs/react 6.0.5, @astrojs/sitemap 3.7.4, softprops/action-gh-release 3.0.3. - Starlight 0.42 (via @astrojs/mdx 8) needs the @astrojs/markdown-remark ^7.3.0 peer; added to the docs app (the docs build failed without it). - typescript-eslint 8.69 flags `void _drop;` as a meaningless void; removed (the `_` prefix + rest-sibling destructuring already silence unused-var). Security scans - osv: every accepted-risk entry had expired (2026-09-12) and no longer matched; the 8 open advisories were all fixable, so patched versions are pinned via overrides (devalue, js-yaml, lodash-es, smol-toml, svgo, valibot) and the dead allowlist is emptied. osv-scanner: no issues. - gitleaks: allowlist the Chrome extension manifest — its "key" is the extension's PUBLIC key (pins the ID the bridge accepts), not a secret. * test(f19): give the cold write-guard tests a real timeout The write-guard and end-to-end F19 tests each build a fresh TypeScript program + ESLint engine for a new plugin workspace: ~1s locally, 2s under CI=true, and 5s+ on a shared GitHub runner, where they hit bun's default 5s timeout. The late rejection then surfaced as a misleading "expected promise that rejects" — the drift IS detected (all six pass under CI=true with a longer timeout). They are correctness tests, not perf budgets: 30s, matching the explicit timeouts other heavy tests in the suite already use.
Contributor
Author
|
Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request. |
Collaborator
|
Superseded by #395, which landed this bump on main (with bun.lock regenerated; this PR couldn't pass CI because dependabot doesn't update bun.lock). Released in 0.54.0. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps sharp from 0.35.3 to 0.35.4.
Release notes
Sourced from sharp's releases.
Commits
7f1a0a2Release v0.35.4f927818Upgrade to sharp-libvips v1.3.3e802092Prerelease v0.35.4-rc.0e13eb2fCI: Fix wasm32 build (#4589)a82a0b3Upgrade to libvips v8.18.68044fe4Bound resize dimensions to coordinate limit147f859Docs: changelog entries for #4578 #4584ee5bfb8Tests: use yauzl directly rather than via extract-zip wrapper7a77889Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)ea5bef2Improve support for input Streams finishing before output is requested (#4584)