fix: patch sharp advisory in live application lock

[seathatflowsinourveins]

Scope

Patch the live application recipe's sharp 0.35.4 dependency to the first fixed release 0.35.5 for GHSA-wq5f-xc86-pv6w. Its required Sharp/@img family moves with it; the captured macOS lock stays byte-identical under one file-scoped exception expiring 2026-12-24.

• Base commit: 0d5e6506434fab598dee861c749a22e628beb75a.
• Lane: lane:foundation.
• Owned paths: live application pnpm lock, retained prior lock and recipe history, bounded qualification outputs, dedicated frozen-macOS exception, its coverage test, dated decision, qualification receipt and evidence registry.
• .github/osv-scanner.toml and .github/osv-scanner-lockfiles.json are byte-identical to the base. The frozen variant retains SHA-256 f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2.

SOTA sources

• Sharp maintainer advisory GHSA-wq5f-xc86-pv6w, published 2026-10-06T13:43:57Z: affected <0.35.5, first patched 0.35.5, librsvg CVE-2026-96889.
• Sharp v0.35.5 release, published 2026-09-27T13:44:22Z, lovell/sharp@51a990faa26ade5586a4934ac9673c98d8893326; sharp-libvips v1.3.4 supplies librsvg 2.63.2.
• pnpm supported targeted update and frozen-lockfile installation, read 2026-10-06; installed pinned pnpm 12.4.2 help/error rejects a versioned selector on an indirect dependency. Published latest and the resulting resolved version were independently checked as exactly 0.35.5; no override or package.json edit was needed.
• Next 16.3.8 published metadata: its optionalDependencies.sharp range ^0.35.4 permits 0.35.5. This is the lock's only direct dependent on sharp. All 27 replacement resolution integrity values match published npm metadata; 67 unrelated package entries, importers and the pnpm manager document remain unchanged.
• Sharp source at the prior pin, src/common.cc:323,506,596, and src/pipeline.cc:48: SVG file/buffer input can reach librsvg. Exception justification rests on the retained variant having no supported installer/build/server/replay consumer found in scoped source review, with removal before any manual replay or new consuming route; the macOS label is not itself a reachability exemption.
• Repository conventions: native-agent-stack@0d5e6506434fab598dee861c749a22e628beb75a:blueprints/convergence-practice/application-delivery/Makefile:3-5,27-32, README.md:170-180; #765, #587 and #252 retain prior bytes/qualifications and append supersessions. Original full-stack receipts and canonical experiment records remain untouched.

Evidence-class table

Claim	Evidence class	Command / receipt
First patched release, dependent range and SVG reachability	source_review	Maintainer advisory/release, pinned source and published npm metadata above
Exact frozen install, peers, typecheck, production build, loaded sharp/librsvg versions	local_integration	relock-2026-10-06-sharp.*.txt; evidence/receipts/sharp-0355-qualification-20261006.json
Frozen byte identity, retained old live lock and bounded family-only changes	local_integration	Hash/source comparisons and recipe revision ledger; 27 replacements / 67 unrelated unchanged
Repository integrity and declared-record consistency	local_integration	Validator, 32 convergence records and 96 touched tests pass; these do not establish upstream or live application acceptance
Advisory present for sharp 0.35.4 and absent for 0.35.5	source_review	Supported OSV version-query API; this is not a native scanner or full-inventory scan
Complete application/API/browser qualification	local_integration, failed	make verify exits 2 on 12 dedicated-PostgreSQL setup errors; browser attempt exits 1 on occupied configured port 18080, with no browser case executed
Required hosted OSV and other CI checks	pending	Must be observed at this PR's head; no local scanner executable was found in the inspected locations

Local commands run

Frontend commands below ran in the live application directory, using the recipe's pinned pnpm 12.4.2 through Corepack, task-private cache/store/state/temp paths and a public-registry-only npmrc; heavy commands ran one at a time at nice 19. relock-2026-10-06-sharp.sh.txt records the supported replay pattern. Worktree/state path prefixes are sanitized in public outputs.

corepack pnpm update sharp --no-save --lockfile-only --ignore-scripts
exit 0; exact resolved sharp 0.35.5 checked
corepack pnpm install --frozen-lockfile --ignore-scripts
exit 0
corepack pnpm peers check
exit 0
corepack pnpm typecheck
exit 0
corepack pnpm build
exit 0
node -e 'const r=require("module").createRequire(require.resolve("next/package.json"));const s=r("sharp");console.log(JSON.stringify({sharp:s.versions.sharp,vips:s.versions.vips,rsvg:s.versions.rsvg}));if(s.versions.sharp!=="0.35.5"||s.versions.rsvg!=="2.63.2")process.exit(1)'
exit 0; sharp 0.35.5, vips 8.18.7, rsvg 2.63.2
nice -n 19 python3 scripts/validate.py
exit 0; 69 components, 4 profiles, 214 receipts, 10,345 hashed files
nice -n 19 python3 scripts/validate_convergence.py --all-recorded --json
exit 0; all 32 records valid
nice -n 19 python3 -m unittest tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use tests.test_native_maintenance
exit 0; 96 tests, repeated after the new files were staged
git diff --check
exit 0
git diff --cached --check
exit 0 after explicit output whitespace sanitization

Failed attempts and acceptance limits

• pnpm update sharp@0.35.5 --no-save --lockfile-only --ignore-scripts exits 1 with ERR_PNPM_UPDATE_VERSION_ON_INDIRECT_DEP, before mutation. The supported unversioned indirect update resolves exactly the independently verified first patch; no override is added.
• A single-document PyYAML read exits 1 because pnpm 12 stores two YAML documents; upstream safe_load_all corrects the comparison.
• First make verify exits 2 because pnpm is not on PATH. Supported Corepack enable creates only task-private shims. The second unchanged run passes schema/type/build checks on supported Python 3.13.16, then exits 2 on 12 PostgreSQL connection-timeout setup errors. The full actual failed log is retained privately and its decisive counts/cause in the public receipt. No PostgreSQL build, container/image pull or global installer was introduced.
• Separate unchanged pnpm test:e2e exits 1 because port 18080 is occupied and Playwright's recipe refuses reuse. No other owner's service was stopped and no test was relaxed. Full-stack acceptance remains unfinished.
• Initial staged diff checking found three trailing build-progress spaces. They were trimmed with that sanitization explicitly recorded, their hashes re-registered and the check repeated. Actual private output remains retained.
• Native full-inventory OSV execution and unchanged upstream tests are unclaimed. The database's zero finding for the fixed version does not replace the required hosted scanner verdict.

Decision record

docs/decisions/2026-10-06-sharp-live-relock-frozen-variant.md records the targeted patch, rejected broad-ignore/historical-rewrite alternatives and evidence boundaries. Remove or re-review the frozen exception before replay, a new consumer, changed bytes or 2026-12-24. Registry is committed last. Independent bounded source/scope critic accepted this separation; co-op GPT micro-check and command-center exact-head ACK are requested. PR stays draft for that read; 5f owns landing.

Host evidence

No evidence/hosts/ change or platform-status claim.

• Host-receipt validation: not applicable.
• Command-center exact-head review requested; no platform status flip.

Checklist

• No workflow/action change; existing pinned actions and permissions stay untouched.
• No secrets are printed, logged or committed; no new required secret.
• No paid hosting or billing surface.
• Peer-owned paths, services and worktrees preserved.
• Frozen evidence remains byte-identical; registry last; no merge or settings change.

Review follow-up — 2026-10-06

The co-op relays CC item task-ns2604-coop-20261006T170124Z, ruling 2: accept the disclosed browser gap for this urgent security landing conditional on a fresh frozen install/frontend build and restoration of the unrelated Mako JSON escape spelling. Both fresh frontend commands passed. make postgres-init exits 2 (inner 127) because the recipe's .runtime/postgresql/18.6/bin/initdb is missing. The recipe's postgres-install source-build target was not run under the upstream-never-rebuild and park rules. Playwright fixes both service and base URLs to port 18080, held by the local alert service; the service is untouched. No new browser cases ran.

Source: native-agent-stack@4f32d59d0b411cc69beccac9a2676449c70d0e9d:blueprints/convergence-practice/application-delivery/Makefile:3-5,27-32,34-58 and playwright.config.ts:8-16; original Mako row at base 0d5e6506. Full sanitized argv, return codes, actual outputs and classes are in evidence/receipts/sharp-review-followup-20261006.json and relock-2026-10-06-sharp.review-*.txt. Actual returned output remains privately durable; public progress whitespace/EOF normalization is explicit. The original qualification receipt and production/frozen locks stay byte-identical to the reviewed head.

pnpm 12.4.2 install --frozen-lockfile (task-private cache/store/state/public-registry config)
exit 0; lock current, resolution skipped, 26ms
NEXT_TELEMETRY_DISABLED=1 pnpm build
exit 0; Next 16.3.8 production build
make postgres-init
exit 2; missing .runtime/postgresql/18.6/bin/initdb, inner 127
nice -n 19 python3 -m unittest tests.test_osv_lockfile_coverage tests.test_frozen_macos_variant_no_use tests.test_native_maintenance
exit 0; 96 tests, 8.999s
nice -n 19 python3 scripts/validate.py
exit 0; 69 components, 4 profiles, 214 receipts, 10,349 hashed files

Both original literal Mako \u2192 spellings now exactly match the base row; parsed values are unchanged. Dated unfinished follow-up after the tools window: qualify the dedicated test DB through an upstream-supported release path and run the unchanged browser recipe in an isolated network namespace if no supported port override exists. Frontend build is not a browser/image-response or exploit test. Independent bounded source critic accepts the repair and separation. New-head co-op micro-check/CC ACK and hosted checks still required; registry is committed last. No broad ignore, alert-service takeover, source build, host configuration or merge.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T20:49:27.151827Z	5f5f635	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 5f5f635c80941e27281b4d3877c05c7e29b430c9. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at this exact head, with no P1 item.

Observed main 0d5e6506434fab598dee861c749a22e628beb75a. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 0d5e6506434fab598dee861c749a22e628beb75a head 5f5f635c80941e27281b4d3877c05c7e29b430c9 base 0d5e6506434fab598dee861c749a22e628beb75a merged-tree 03d4c43fb43b1565dd58b1f8fe0023ca26729afe merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 19, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 18, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10349 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 03d4c43fb43b1565dd58b1f8fe0023ca26729afe)

Required checks at this head: 7 pass . Unresolved review threads: 0.

Accepted residual (the command center, item task-native-agent-stack-5f-20261006T204429Z). Application qualification is unfinished at this head:

• the browser suite and the API tests did not run;
• test-database init failed on a missing initdb;
• the browser config needs ports 18080 and 18081, and 18080 is held by the old distribution's ntfy.

The frozen-lockfile install and the production build passed. The command center accepted this P2 explicitly for this landing. It is a security relock of one dependency with an unchanged frozen lock, and every open PR's required osv-scanner check is blocked until it lands. The follow-up stays registered with github-ci-finalize.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 4ce7632b865a19fe806f12442f64d7157f08f18c (parent 0d5e6506434fab598dee861c749a22e628beb75a), tree 03d4c43fb43b1565dd58b1f8fe0023ca26729afe. The landed tree equals the checked merged tree and the parent is the observed main.