fix(security): bump sharp to 0.35.4 and require Node >=22 - #426
Open
SavioBS629 wants to merge 1 commit into
Open
SavioBS629 wants to merge 1 commit into
SavioBS629 wants to merge 1 commit into
Conversation
sharp <=0.35.4-rc.0 inherits high-severity libvips/libheif advisories (CVE-2026-33327/33328/35590/35591 and GHSA-g89c-p67h-r497 / GHSA-2jg2-4ch7-h545). The fix ships in sharp 0.35.4, which is a semver major and requires Node >=20.9.0. - Bump sharp ^0.34.5 -> ^0.35.4 (refreshes the bundled libvips/libheif). - Raise engines.node >=18 -> >=22 to match what CI, the Docker image, and the recommended setup already run, and to satisfy sharp's floor. - README: update the "Node version >= 18.0" notes to >= 22.0. No application code changes: the only sharp call site (src/lib/utils.ts `sharp(buffer).png({ quality }).toBuffer()`) is unchanged across 0.34 -> 0.35. Verified on Node 22: npm audit clears the sharp advisory; lint, typecheck, and the full test suite pass; and an end-to-end image smoke test (a >1MB PNG through maybeCompressBase64) compresses correctly with the new libvips. BREAKING: drops support for Node 18/19 for consumers of the npm package. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited) Review profile: ASSERTIVE Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bump
sharp^0.34.5→^0.35.4to clear the inherited libvips/libheif advisories, and raise the supported Node floor to match.sharpengines.node>=18>=22>= 18.0>= 22.0Advisories fixed
npm auditconfirms the sharp advisory is cleared.Why Node >=22
sharp 0.35.4 requires Node ≥20.9.0. CI (
22.x), the Docker image (NODE_VERSION=22),.nvmrc, and the recommended setup already run Node 22, so this only corrects the stale declared floor. Set to>=22to match what we run/recommend (could be>=20.9.0if we want to keep Node 20/21 consumers).No application code changes
The only sharp call site —
src/lib/utils.ts:is unchanged across 0.34 → 0.35.
Testing (Node 22)
npm audit→ sharp advisory clearednpm run lint,tsc --noEmit,vitest run→ all pass (651/651)maybeCompressBase64compressed 7.7 MB → 2.6 MB via the new libvips — the native path works end-to-end.BREAKING for external consumers: drops Node 18/19 support. Everything we run is already on 22, but this needs PM/security sign-off before merge since it narrows the published
enginesrange.🤖 Generated with Claude Code