chore(deps): bump sharp from 0.33.5 to 0.35.0 in /api in the npm_and_yarn group across 1 directory - #143
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps the npm_and_yarn group with 1 update in the /api directory: [sharp](https://github.com/lovell/sharp). Updates `sharp` from 0.33.5 to 0.35.0 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.33.5...v0.35.0) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 security issues
Security issues:
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Fixed security issues:
- sharp (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="api/package-lock.json" line_range="184-202" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-ppc64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 2
<location path="api/package-lock.json" line_range="203-215" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-riscv64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 3
<location path="api/package-lock.json" line_range="533-551" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-arm64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+184
to
+202
| "node_modules/@img/sharp-libvips-linux-ppc64": { | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.0.tgz", | ||
| "integrity": "sha512-WOpkVxAjFd369iaIzEgNRreFD+gWdUMIGD5zplhNKNeqS6mm5dac3q2AFyCBmzYoAdouzZvRBgxy4z8QHZb4/A==", | ||
| "cpu": [ | ||
| "ppc64" | ||
| ], | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-ppc64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+203
to
215
| "node_modules/@img/sharp-libvips-linux-riscv64": { | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.0.tgz", | ||
| "integrity": "sha512-DRWw0mOHusrCCuw2rqP87oLg6PGlkomVDFqw2hIwsSfwWpu4k3XLcBPaKKl6ct/GtL/cwNkgwjV/tc0Mqht3VA==", | ||
| "cpu": [ | ||
| "riscv64" | ||
| ], | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-riscv64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+533
to
551
| "node_modules/@img/sharp-win32-arm64": { | ||
| "version": "0.35.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.0.tgz", | ||
| "integrity": "sha512-M5eKxug0dabbaWgFKvPa3odNs2OpaP+81NASfGKkt4GcYXpNhSu7CaeYxWkLNV6vHmUp4hnCxnxrUyhUJhXbKA==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-arm64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /api directory: sharp.
Updates
sharpfrom 0.33.5 to 0.35.0Release notes
Sourced from sharp's releases.
... (truncated)
Commits
2ed5af4Release v0.35.04475cf1Tests: update locator hash for sharp-libvips v1.3.0deb22ddUpgrade to sharp-libvips v1.3.007f1be9Prerelease v0.35.0-rc.8df1109bPrerelease v0.35.0-rc.7aca49b3Upgrade to libvips v8.18.3e9e86f5Type-check density option before range validation (#4536)2f0bcf0Docs: update supported image formats98e03b8Revert "Guard heif bitdepth property for prebuilt binaries"e4ea2f3CI: Ignore package minimum age in smoke testsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.