Skip to content

fix: patch sharp advisory in live application lock #797

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seathatflowsinourveins merged 4 commits into from
Oct 6, 2026
Merged

fix: patch sharp advisory in live application lock #797

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8a25574
fix: patch live sharp lock and scope frozen variant exception
seathatflowsinourveins Oct 6, 2026
4f32d59
evidence: register sharp relock records last
seathatflowsinourveins Oct 6, 2026
40836ca
fix: retain sharp review checks and restore Mako history spelling
seathatflowsinourveins Oct 6, 2026
5f5f635
evidence: register sharp review repair last
seathatflowsinourveins Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/osv-scanner-frozen-macos.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,8 @@ reason = "next 16.2.0 through 16.3.5 (fixed in 16.3.6): the Node.js ImageRespons
id = "GHSA-68fv-2mgg-jv7q"
ignoreUntil = 2026-12-24
reason = """source-map-js 1.2.1 is affected; 1.2.2 fixes malicious indexed-source-map denial of service (upstream PR 79, cf7658058ceeaa8619d5ae0ec90be6905209d016). This exception applies only to evidence/artifacts/macos-application-20260924/variant/pnpm-lock.yaml, SHA256 f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2. Source review at native-agent-stack ecfa112764c664d35377dd66b8cfcb67e5a94d60 found current consumers that hash or scan the retained files, and no supported installer, build, server or replay route consuming this variant. Historical scratch execution is recorded; this does not qualify replay or manual installation. Remove this exception and re-review before any execution from these dependencies, whenever a consuming route is introduced, or at expiry. The maintained application lock remains under the ordinary scan without this exception. Evidence: evidence/receipts/osv-frozen-macos-source-map-js-20261005.json."""

[[IgnoredVulns]]
id = "GHSA-wq5f-xc86-pv6w"
ignoreUntil = 2026-12-24
reason = """sharp 0.35.4 includes the affected librsvg dependency (CVE-2026-96889); sharp 0.35.5 supplies librsvg 2.63.2 through sharp-libvips 1.3.4. SVG processing reaches VipsForeignLoadSvgFile or VipsForeignLoadSvgBuffer through OpenInput (lovell/sharp@7f1a0a22cc285fe180766f4935d50b55af6e8432:src/common.cc:323,506,596). This exception applies only to the frozen variant lock named in this file's header, SHA256 f1c707b8295e85bd396e49b990de92dc82bc0d58eca1e4e4bef31262d9898cd2. Source review at native-agent-stack@0d5e6506434fab598dee861c749a22e628beb75a found retained historical qualification metadata and no supported installer, build, server or replay consumer of this variant. Historical scratch execution does not qualify reuse; the artifact's macOS label alone is not a reachability argument. Remove this exception and re-review before manual installation, replay, introduction of a consumer, or expiry. The maintained application lock receives the production fix and remains under the ordinary scan without this exception. Evidence: evidence/receipts/sharp-0355-qualification-20261006.json."""
8 changes: 8 additions & 0 deletions blueprints/convergence-practice/application-delivery/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,14 @@ the first frozen install while the release was a day old; no exclusion was added
and the unchanged candidate passed the same bounded checks after the window
([receipt](../../../evidence/receipts/nextjs-1638-qualification-20261001.json)). `make verify` has not been repeated at 16.3.8.

On October 6, 2026 the live lock moved sharp 0.35.4 to first patched **0.35.5**
for [GHSA-wq5f-xc86-pv6w](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w).
Its required companions select sharp-libvips 1.3.4 and librsvg 2.63.2. Frozen
install, peers, schema/type checks and production build passed; the full recipe
attempt failed on the unavailable dedicated PostgreSQL test database, and the
browser attempt refused an occupied port. The [qualification receipt](../../../evidence/receipts/sharp-0355-qualification-20261006.json)
retains these outcomes separately. The captured macOS lock is unchanged.

Two compatibility decisions were made from actual evidence. The latest
TypeScript 7.0.2 failed the current OpenAPI generator's declared `^5.x` peer and
native type generation. The accepted project pins the latest supported
Expand Down
Loading
Loading