Skip to content

chore(deps): bump sharp from 0.34.5 to 0.35.3#111

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/sharp-0.35.3
Closed

chore(deps): bump sharp from 0.34.5 to 0.35.3#111
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/sharp-0.35.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps sharp from 0.34.5 to 0.35.3.

Release notes

Sourced from sharp's releases.

v0.35.3

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

  • Improve code bundler support by resolving path to libvips binary.

  • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

  • Emit warning about binaries provided by Electron for use on Linux.

  • Add hasAlpha property to output info. #4500

  • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

  • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

  • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

  • Reject infinite values when validating numbers. #4553 @​metsw24-max

  • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

  • Verify background colour values are numbers. #4556 @​metsw24-max

  • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

  • Tighten recomb and affine matrix verification. #4560 @​chatman-media

  • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits
  • 1018449 Release v0.35.3
  • ba303a7 Prerelease v0.35.3-rc.2
  • 4f94fc5 Upgrade to sharp-libvips v1.3.2
  • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
  • 9a8d002 Docs: Add changelog entry and note about transferable #4520
  • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
  • e000d0b Prerelease v0.35.3-rc.1
  • 9554ca9 Prerelease v0.35.3-rc.0
  • 6a29fd5 Emit warning about native binaries on Linux Electron
  • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sharp-0.35.3 branch 10 times, most recently from 9ef7832 to 4f95aa5 Compare July 13, 2026 17:08
@dependabot
chore(deps): bump sharp from 0.34.5 to 0.35.3
e46144c 
Bumps [sharp](https://github.com/lovell/sharp) from 0.34.5 to 0.35.3.
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sharp-0.35.3 branch from 4f95aa5 to e46144c Compare July 17, 2026 12:15
@ABB65 ABB65 mentioned this pull request Jul 17, 2026
Merged
@ABB65

ABB65 commented Jul 17, 2026

Copy link
Copy Markdown
Member

Superseded by #158. Investigated the CI failure: it was the E2E step on a stale base (7+ commits behind), not sharp — the e2e suite doesn't exercise sharp/@nuxt/image. sharp 0.35.3 is folded into #158 and passes build + the app-smoke-managed e2e (12 tests, app boot loads sharp).

@ABB65 ABB65 closed this Jul 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/sharp-0.35.3 branch July 17, 2026 12:34
ABB65 pushed a commit that referenced this pull request Jul 17, 2026
fix(deps): revert sharp to 0.34.5 — 0.35.3 fails to load on CI Linux
9cbc018 
sharp 0.35.3 crashed the Nuxt server at boot on the CI runner
("Server process exited before becoming ready", sharp.mjs:171 install
error) — its native binary doesn't resolve on linux-x64 there, though it
built fine on darwin-arm64 locally (which is why the local smoke was a
false green). sharp is not a security advisory, so 0.34.5 (known-good on
CI) loses nothing. This also confirms #111's e2e failure was sharp, not a
stale base.
ABB65 added a commit that referenced this pull request Jul 17, 2026
@ABB65
chore(deps): security refresh — resolve critical/high advisories, fol…
0c10311 
…d pending bumps (#158)

* chore(deps): security refresh — resolve critical/high advisories, fold pending bumps

Aggressive dependency pass closing the Dependabot backlog (66 alerts on main).

Direct + toolchain bumps (folds the passing/fixable Dependabot group PRs into one
reviewable change):
- @anthropic-ai/sdk 0.80 -> 0.112, sharp 0.34.5 -> 0.35.3, marked -> 18.0.2,
  vue 3.5.40, vue-router 5.2.0
- testing group (vitest 4.1.10, @vue/test-utils 2.4.11, playwright-core 1.61.1, ...)
- linting group (@nuxt/eslint 1.16, eslint 10.7, @commitlint 21, lint-staged 17)
- tsx 4.23

pnpm overrides for runtime-reachable transitives whose parents pin old versions:
hono ^4.12.25 (MCP loopback server), fast-uri ^3.1.2, fast-xml-parser ^5.7.0,
ws ^8.21.0, qs ^6.15.2, js-cookie ^3.0.7.

A lockfile refresh alone clears the stale advisories on main (shell-quote 1.9.0,
nuxt 4.4.8, vite 7.3.6, devalue 5.8.1, dompurify 3.4.11, tar 7.5.19, ...).

Result: the one critical (shell-quote) and every high are resolved. The only
remaining flagged package is uuid — its advisory needs uuid.v3/v5/v6 called with
a `buf` argument, which Studio's transitive usage (@aws-sdk, uuid.v4) never does,
so a risky cross-SDK major override is deliberately skipped.

The @nuxt/eslint 1.16 bump surfaced real code smells (no-useless-assignment,
preserve-caught-error) — fixed in migrate-postgres, anthropic-ai, cdn-builder,
and the Polar webhook handler.

Supersedes #107, #108, #109, #110, #111.

* fix(deps): revert sharp to 0.34.5 — 0.35.3 fails to load on CI Linux

sharp 0.35.3 crashed the Nuxt server at boot on the CI runner
("Server process exited before becoming ready", sharp.mjs:171 install
error) — its native binary doesn't resolve on linux-x64 there, though it
built fine on darwin-arm64 locally (which is why the local smoke was a
false green). sharp is not a security advisory, so 0.34.5 (known-good on
CI) loses nothing. This also confirms #111's e2e failure was sharp, not a
stale base.

---------

Co-authored-by: Contentrain <mcp@contentrain.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ABB65