Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency sharp to ~0.32.0 [security] #956

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 16, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
sharp (source, changelog) ~0.31.2 -> ~0.32.0 age adoption passing confidence

GitHub Vulnerability Alerts

GHSA-54xq-cgqr-rpm3

Overview

sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity GHSA-j7hp-h8jx-5ppr.

Who does this affect?

Almost anyone processing untrusted input with versions of sharp prior to 0.32.6.

How to resolve this?

Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest 0.32.6, which provides libwebp 1.3.2.

Using a globally-installed libvips?

Please ensure you are using the latest libwebp 1.3.2.

Possible workaround

Add the following to your code to prevent sharp from decoding WebP images.

sharp.block({ operation: ["VipsForeignLoadWebp"] });

Release Notes

lovell/sharp (sharp)

v0.32.6

Compare Source

v0.32.5

Compare Source

v0.32.4

Compare Source

v0.32.3

Compare Source

v0.32.2

Compare Source

v0.32.1

Compare Source

v0.32.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (rebase) November 16, 2023 22:23
Copy link

vercel bot commented Nov 16, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
graphql-ez ✅ Ready (Inspect) Visit Preview 💬 Add feedback Feb 24, 2024 9:55am

Copy link

changeset-bot bot commented Nov 16, 2023

⚠️ No Changeset found

Latest commit: 30146b0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/npm-sharp-vulnerability branch from e23ff0a to 3e07b8f Compare January 4, 2024 16:17
@renovate renovate bot force-pushed the renovate/npm-sharp-vulnerability branch from 3e07b8f to 5663c57 Compare January 4, 2024 16:24
@renovate renovate bot force-pushed the renovate/npm-sharp-vulnerability branch 2 times, most recently from 83054a4 to e6dcb41 Compare January 4, 2024 20:16
@renovate renovate bot force-pushed the renovate/npm-sharp-vulnerability branch from e6dcb41 to d5afbce Compare January 4, 2024 20:40
@renovate renovate bot force-pushed the renovate/npm-sharp-vulnerability branch from d5afbce to 64d6d5d Compare January 4, 2024 20:47
@renovate renovate bot changed the title fix(deps): update dependency sharp to ~0.32.0 [security] fix(deps): update dependency sharp to ~0.32.0 [security] - autoclosed Feb 24, 2024
@renovate renovate bot closed this Feb 24, 2024
auto-merge was automatically disabled February 24, 2024 07:55

Pull request was closed

@renovate renovate bot deleted the renovate/npm-sharp-vulnerability branch February 24, 2024 07:55
@renovate renovate bot changed the title fix(deps): update dependency sharp to ~0.32.0 [security] - autoclosed fix(deps): update dependency sharp to ~0.32.0 [security] Feb 24, 2024
@renovate renovate bot reopened this Feb 24, 2024
@renovate renovate bot restored the renovate/npm-sharp-vulnerability branch February 24, 2024 09:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants