From 43f8c7f2efcc3175edfbdbabf2308b5ee8c31ec6 Mon Sep 17 00:00:00 2001 From: Petr Glaser Date: Fri, 25 Sep 2026 13:51:34 +0200 Subject: [PATCH] fix(core): raise image-size and sharp floors past known advisories - dependencies.image-size: ^2.0.1 -> ^2.0.4. image-size <= 2.0.2 has unbounded parser loops on malformed ICNS/JXL/HEIF input (GHSA-w3rx-r6r6-pgpr / CVE-2025-71330, GHSA-5p2g-fcmc-qvqq / CVE-2025-71329), fixed in 2.0.3. - peerDependencies.sharp: >=0.33.5 -> >=0.35.4. sharp < 0.35.4 bundles vulnerable libvips/libheif (GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c). Co-Authored-By: Claude Opus 5.5 (1M context) --- packages/core/package.json | 4 ++-- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/packages/core/package.json b/packages/core/package.json index dbf4986..84dcf6e 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -59,7 +59,7 @@ "preview-pack": "bash ./scripts/preview-pack.sh" }, "dependencies": { - "image-size": "^2.0.1", + "image-size": "^2.0.4", "knitwork": "^1.2.0", "rslog": "catalog:", "type-fest": "catalog:", @@ -95,7 +95,7 @@ "peerDependencies": { "react": ">=16.9.0", "react-dom": ">=16.9.0", - "sharp": ">=0.33.5", + "sharp": ">=0.35.4", "ipx": ">=3.0.3" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3ea31bf..8df6d51 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -212,8 +212,8 @@ importers: packages/core: dependencies: image-size: - specifier: ^2.0.1 - version: 2.0.2 + specifier: ^2.0.4 + version: 2.0.4 knitwork: specifier: ^1.2.0 version: 1.2.0 @@ -2963,9 +2963,9 @@ packages: image-meta@0.2.1: resolution: {integrity: sha512-K6acvFaelNxx8wc2VjbIzXKDVB0Khs0QT35U6NkGfTdCmjLNcO2945m7RFNR9/RPVFm48hq7QPzK8uGH18HCGw==} - image-size@2.0.2: - resolution: {integrity: sha512-IRqXKlaXwgSMAMtpNzZa1ZAe8m+Sa1770Dhk8VkSsP9LS+iHD62Zd8FQKs8fbPiagBE7BzoFX23cxFnwshpV6w==} - engines: {node: '>=16.x'} + image-size@2.0.4: + resolution: {integrity: sha512-QRUkFFsRV/6fuESxb9Vkq+a0LkSrgKXuc2NEqfikiXxxN/G3tjWt5EVUlMaImRBZRZK/jRBEbYvpPYZL8t08Zw==} + engines: {node: '>=18'} hasBin: true indent-string@4.0.0: @@ -7243,7 +7243,7 @@ snapshots: image-meta@0.2.1: {} - image-size@2.0.2: {} + image-size@2.0.4: {} indent-string@4.0.0: {}