Repository navigation
Update sharp in the test dependencies to fix a librsvg advisory - #25
Merged
Gabriel Mongefranco (gabrielmongefranco) merged 1 commit intoOct 8, 2026
Merged
Conversation
Sharp 0.35.4 bundles a librsvg build with a memory bug that a crafted SVG image could use to run code on glibc-based Linux (GHSA-wq5f-xc86-pv6w). Sharp 0.35.5 ships the patched librsvg 2.63.2. Sharp is not a direct dependency. It comes in through the Node build of Transformers.js, which the model tests install. The app itself loads the browser build from a CDN and never uses sharp. The existing ^0.35.4 range already allows 0.35.5, so only the lockfile changes.
Gabriel Mongefranco (gabrielmongefranco)
merged commit Oct 8, 2026
a2fcc6e
into
main
2 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
This updates sharp from 0.35.4 to 0.35.5 in
tests/package-lock.json, along with its matching libvips platform packages (1.3.3 to 1.3.4). It fixes Dependabot alert 1, advisory GHSA-wq5f-xc86-pv6w.Why
The librsvg library bundled with sharp 0.35.4 has a memory bug. A crafted SVG image could use it to run code on glibc-based Linux. Sharp 0.35.5 ships the patched librsvg 2.63.2.
Where sharp comes from
Sharp is not a direct dependency of this project. The Node build of Transformers.js depends on it for loading images, and the model tests install that build. The app loads the browser build of Transformers.js from a CDN and never uses sharp, so the app and its users were never exposed. The model tests only process text and never decode an image, so the practical risk in CI was also low.
tests/package.jsonalready allows^0.35.4through Transformers.js, so only the lockfile changes.Testing
npm auditintests/reports 0 vulnerabilities.npm ci --prefix tests, thennode --test tests/crisis-models.test.mjs tests/rerank-models.test.mjs tests/skill-offer-models.test.mjs: 321 passed, 0 failed.