Repository navigation
Bump the npm_and_yarn group across 2 directories with 8 updates - #7
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.1` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.3.0` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.5` | | [ws](https://github.com/websockets/ws) | `8.19.0` | `8.21.3` | Bumps the npm_and_yarn group with 5 updates in the /examples directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.2` | `4.0.5` | | [sharp](https://github.com/lovell/sharp) | `0.33.5` | `0.35.0` | Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `js-yaml` from 4.1.1 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Updates `linkify-it` from 5.0.0 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 14.1.0 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.0...14.3.0) Updates `picomatch` from 4.0.3 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `ws` from 8.19.0 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.21.3) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `flatted` from 3.3.1 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `js-yaml` from 4.1.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Updates `picomatch` from 4.0.2 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `sharp` from 0.33.5 to 0.35.0 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.33.5...v0.35.0) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 14 security issues
Security issues:
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
- Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="examples/package-lock.json" line_range="6053-6064" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 2
<location path="examples/package-lock.json" line_range="6070-6081" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 3
<location path="examples/package-lock.json" line_range="6087-6101" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 4
<location path="examples/package-lock.json" line_range="6107-6126" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 5
<location path="examples/package-lock.json" line_range="6127-6146" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-ppc64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 6
<location path="examples/package-lock.json" line_range="6147-6161" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-riscv64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 7
<location path="examples/package-lock.json" line_range="6167-6181" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-s390x):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 8
<location path="examples/package-lock.json" line_range="6187-6201" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 9
<location path="examples/package-lock.json" line_range="6207-6221" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 10
<location path="examples/package-lock.json" line_range="6227-6241" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 11
<location path="examples/package-lock.json" line_range="6455-6471" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-wasm32):** Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later AND MIT` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 12
<location path="examples/package-lock.json" line_range="6492-6511" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-arm64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 13
<location path="examples/package-lock.json" line_range="6512-6531" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-ia32):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>
### Comment 14
<location path="examples/package-lock.json" line_range="6532-6549" />
<code_context>
</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-x64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
6053
to
6064
| "node_modules/@img/sharp-libvips-darwin-arm64": { | ||
| "version": "1.0.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.0.4.tgz", | ||
| "integrity": "sha512-XblONe153h0O2zuFfTAbQYAX2JhYmDHeWikp1LM9Hul9gVPjFY427k6dFEcOL72O01QxQsWi761svJ/ev9xEDg==", | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.0.tgz", | ||
| "integrity": "sha512-EKbmBKtyTH+GPFDRw2TgK2oV6hyxxlJVIar4hoTYSNmIwipgMFdxPQqR392GmfdsPGWga0mCFN1cCKjRb9cljw==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "darwin" |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-darwin-arm64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6070
to
6081
| "node_modules/@img/sharp-libvips-darwin-x64": { | ||
| "version": "1.0.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.0.4.tgz", | ||
| "integrity": "sha512-xnGR8YuZYfJGmWPvmlunFaWJsb9T/AO2ykoP3Fz/0X5XV2aoYBPkX6xqCQvUTKKiLddarLaxpzNe+b1hjeWHAQ==", | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.0.tgz", | ||
| "integrity": "sha512-Pl2OmOvrJ42adUllESxBsG54PfXLo1OYg9i3c5/5Ln/qJ0gZuTM9YMhQJPIbXqwidLRc/c2zuHt4RsrymmNv7A==", | ||
| "cpu": [ | ||
| "x64" | ||
| ], | ||
| "dev": true, | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "darwin" |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-darwin-x64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6087
to
6101
| "node_modules/@img/sharp-libvips-linux-arm": { | ||
| "version": "1.0.5", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.0.5.tgz", | ||
| "integrity": "sha512-gvcC4ACAOPRNATg/ov8/MnbxFDJqf/pDePbBnuBDcjsI8PssmjoKMAz4LtLaVi+OnSb5FK/yIOamqDwGmXW32g==", | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.0.tgz", | ||
| "integrity": "sha512-A8UpHoUDW4DwnXoV6+q3C1s7QLRAHtPDEjWuNZjwHMyoCNZnm0GeNN8ls9f/bsEYTRQRW96C/n34XJQHJ2fT7A==", | ||
| "cpu": [ | ||
| "arm" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-arm): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6107
to
+6126
| "node_modules/@img/sharp-libvips-linux-arm64": { | ||
| "version": "1.0.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.0.4.tgz", | ||
| "integrity": "sha512-9B+taZ8DlyyqzZQnoeIvDVR/2F4EbMepXMc/NdVbkzsJbzkUjhXv/70GQJ7tdLA4YJgNP25zukcxpX2/SueNrA==", | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.0.tgz", | ||
| "integrity": "sha512-C0SqjoFKnszqa44EQ7xoaT48nnO0lOyXEULfXMWi8krrjOPGYkeK30Okzla6ATbBYsyZ0ySinK0FVkpv3DwzfQ==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-arm64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+6127
to
+6146
| "node_modules/@img/sharp-libvips-linux-ppc64": { | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.0.tgz", | ||
| "integrity": "sha512-WOpkVxAjFd369iaIzEgNRreFD+gWdUMIGD5zplhNKNeqS6mm5dac3q2AFyCBmzYoAdouzZvRBgxy4z8QHZb4/A==", | ||
| "cpu": [ | ||
| "ppc64" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "glibc" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" | ||
| ], | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linux-ppc64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6227
to
6241
| "node_modules/@img/sharp-libvips-linuxmusl-x64": { | ||
| "version": "1.0.4", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.0.4.tgz", | ||
| "integrity": "sha512-viYN1KX9m+/hGkJtvYYp+CCLgnJXwiQB39damAO7WMdKWlIhmYTfHjwSbQeUK/20vY154mwezd9HflVFM1wVSw==", | ||
| "version": "1.3.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.0.tgz", | ||
| "integrity": "sha512-LiYMhUZicB1QG//+RvmYZpXJO8fYRENfp+MZUCnG9aw+AKvGAy9gPaCnuwsPcBFs8EV66M0NNxj9VHcNklE8zw==", | ||
| "cpu": [ | ||
| "x64" | ||
| ], | ||
| "dev": true, | ||
| "libc": [ | ||
| "musl" | ||
| ], | ||
| "license": "LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "linux" |
There was a problem hiding this comment.
security (license/@img/sharp-libvips-linuxmusl-x64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6455
to
+6471
| "node_modules/@img/sharp-wasm32": { | ||
| "version": "0.33.5", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.33.5.tgz", | ||
| "integrity": "sha512-ykUW4LVGaMcU9lu9thv85CbRMAwfeadCJHRsg2GmeRa/cJxsVY9Rbd57JcMxBkKHag5U/x7TSBpScF4U8ElVzg==", | ||
| "version": "0.35.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.0.tgz", | ||
| "integrity": "sha512-9woLIFORERCr+6cWu87dQ22J34EExkhc73U1kZW0c+RclQqWetoodByp4dWZ/hN8/KVmTRAx2HOnUwib8AwZdA==", | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT", | ||
| "optional": true, | ||
| "dependencies": { | ||
| "@emnapi/runtime": "^1.11.0" | ||
| }, | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-wasm32): Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later AND MIT open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
+6492
to
6511
| "node_modules/@img/sharp-win32-arm64": { | ||
| "version": "0.35.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.0.tgz", | ||
| "integrity": "sha512-M5eKxug0dabbaWgFKvPa3odNs2OpaP+81NASfGKkt4GcYXpNhSu7CaeYxWkLNV6vHmUp4hnCxnxrUyhUJhXbKA==", | ||
| "cpu": [ | ||
| "arm64" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-arm64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6512
to
6531
| "node_modules/@img/sharp-win32-ia32": { | ||
| "version": "0.33.5", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.33.5.tgz", | ||
| "integrity": "sha512-T36PblLaTwuVJ/zw/LaH0PdZkRz5rd3SmMHX8GSmR7vtNSP5Z6bQkExdSK7xGWyxLw4sUknBuugTelgw2faBbQ==", | ||
| "version": "0.35.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.0.tgz", | ||
| "integrity": "sha512-z0+pZ03QCDvdVN0Ez9IX/yjWC19ikMlXrmdYMwYNLTh2BLPx3hXWPvyqWfquZ0BTO9O6GVOjIVoTcyyacMnWlQ==", | ||
| "cpu": [ | ||
| "ia32" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": "^18.17.0 || ^20.3.0 || >=21.0.0" | ||
| "node": "^20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (license/@img/sharp-win32-ia32): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
Comment on lines
6532
to
6549
| "node_modules/@img/sharp-win32-x64": { | ||
| "version": "0.33.5", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.33.5.tgz", | ||
| "integrity": "sha512-MpY/o8/8kj+EcnxwvrP4aTJSWw/aZ7JIGR4aBeZkZw5B7/Jn+tY9/VNwtcoGmdT7GfggGIU4kygOMSbYnOrAbg==", | ||
| "version": "0.35.0", | ||
| "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.0.tgz", | ||
| "integrity": "sha512-feNnlz5ZHKr0MY1LPHvZQyJeBkbo4ctsn0D8FvA53VTw5TC63rfEL2UrWbkSBR19htSE7Mw78xYVwdJqoMWVHw==", | ||
| "cpu": [ | ||
| "x64" | ||
| ], | ||
| "dev": true, | ||
| "license": "Apache-2.0 AND LGPL-3.0-or-later", | ||
| "optional": true, | ||
| "os": [ | ||
| "win32" | ||
| ], | ||
| "engines": { | ||
| "node": "^18.17.0 || ^20.3.0 || >=21.0.0" | ||
| "node": ">=20.9.0" | ||
| }, | ||
| "funding": { | ||
| "url": "https://opencollective.com/libvips" |
There was a problem hiding this comment.
security (license/@img/sharp-win32-x64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source
This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 7 updates in the / directory:
1.1.121.1.183.3.33.4.44.1.14.3.15.0.05.0.214.1.014.3.04.0.34.0.58.19.08.21.3Bumps the npm_and_yarn group with 5 updates in the /examples directory:
1.1.111.1.183.3.13.4.44.1.04.3.14.0.24.0.50.33.50.35.0Updates
brace-expansionfrom 1.1.12 to 1.1.18Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.14Updates
flattedfrom 3.3.3 to 3.4.4Commits
e6f5ca73.4.447f14faremoved E_STRICT from PHP4050568fixced go-lang issues in CI4303f4dMerge pull request #101 from mfinelli/gocriticfixes106735bupdated package-lock.json670a1bd3.4.350a61a9Fix #104 - allownullas replacer value8aa64f4solved crytical errors over dependenciesb85577fFix go-critic errorsbb8c63cMerge pull request #100 from WebReflection/WebReflection-patch-1Updates
js-yamlfrom 4.1.1 to 4.3.1Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
86e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omap33d05b54.3.0 released663bfabDrop demo publish, to not override new v5 one.1cb8c7bAdd v4-legacy tag for publish02f27afRestore umd builds back to es58be84edFix es5 compatibility59423c6ReplacemaxMergeSeqLengthoption withmaxTotalMergeKeys(more robust). Ba...6842ef6doc polish590dbab4.2.0 releasedUpdates
linkify-itfrom 5.0.0 to 5.0.2Changelog
Sourced from linkify-it's changelog.
Commits
50a0c915.0.2 releasedde3b885Update package hooks13effaaAdd package lock39d748dBump c800ce877Drop tlds depsecde823Update benchmark to mitata23c62cdRefactor demo / doc build and publishfd63f3bCI config updatef4ea5afdemo: update bootstrap & layout1454fb6lint: dim warningsUpdates
markdown-itfrom 14.1.0 to 14.3.0Changelog
Sourced from markdown-it's changelog.
Commits
ff0ee0814.3.0 released52e2749Bump linkify-it / vite deps56c2404fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)0fbb18bBump vite from 8.0.14 to 8.0.16 (#1181)83450e2Rework benchmark deps and bump versions57a6863benchmark => tinybench7608db1Update CI config9d8eb42Added package-lock and updated versions to latest possible0aee70dlint: enable@stylistic/no-multi-spacesrule8878985lint => neostandardUpdates
picomatchfrom 4.0.3 to 4.0.5Release notes
Sourced from picomatch's releases.
Commits
4f41a8e4.0.502cfc1bUpdate .verb.md and run verb to generate README documentationcc52ff6Only run the upload code coverage step for 1 matrix permutation6d426d7Allow workflow to continue if the code coverage step to failsa00b954Merge branch 'codeql-coverage'9680381Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename648b4f2Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches70e6485Configure code coverage upload for CodeQLab8bc4dfix: honor the windows option when matching basenames6289307fix: preserve all branches when rewriting risky repeated extglobsUpdates
wsfrom 8.19.0 to 8.21.3Release notes
Sourced from ws's releases.
... (truncated)
Commits
c791e70[dist] 8.21.3e97a20e[fix] Reject offers withclient_max_window_bitsbelow config787ebf2[dist] 8.21.2b4d62ebRevert "[ci] Trust Coveralls Homebrew tap"e4bb883[security] Use GitHub PVR as main reporting channel2eb3be0[test] Skip test on Node.js versions where it does not applyae1de54[dist] 8.21.18e9511b[ci] Trust Coveralls Homebrew tapf197ac6[fix] Lower default values ofmaxBufferedChunksandmaxFragments8df8265[ci] Update actions/checkout action to v7Updates
brace-expansionfrom 1.1.11 to 1.1.18Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.14Updates
flattedfrom 3.3.1 to 3.4.4Commits
e6f5ca73.4.447f14faremoved E_STRICT from PHP4050568fixced go-lang issues in CI4303f4dMerge pull request #101 from mfinelli/gocriticfixes106735bupdated package-lock.json670a1bd3.4.350a61a9Fix #104 - allownullas replacer value8aa64f4solved crytical errors over dependenciesb85577fFix go-critic errorsbb8c63cMerge pull request #100 from WebReflection/WebReflection-patch-1Updates
js-yamlfrom 4.1.0 to 4.3.1Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
86e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omap33d05b54.3.0 released663bfabDrop demo publish, to not override new v5 one.1cb8c7bAdd v4-legacy tag for publish02f27afRestore umd builds back to es58be84edFix es5 compatibility59423c6ReplacemaxMergeSeqLengthoption withmaxTotalMergeKeys(more robust). Ba...6842ef6doc polish590dbab4.2.0 releasedUpdates
picomatchfrom 4.0.2 to 4.0.5Release notes
Sourced from picomatch's releases.
Commits
4f41a8e4.0.502cfc1bUpdate .verb.md and run verb to generate README documentationcc52ff6Only run the upload code coverage step for 1 matrix permutation6d426d7Allow workflow to continue if the code coverage step to failsa00b954Merge branch 'codeql-coverage'9680381Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename648b4f2Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches70e6485Configure code coverage upload for CodeQLab8bc4dfix: honor the windows option when matching basenames6289307fix: preserve all branches when rewriting risky repeated extglobsUpdates
sharpfrom 0.33.5 to 0.35.0Release notes
Sourced from sharp's releases.
... (truncated)
Commits
2ed5af4Release v0.35.04475cf1Tests: update locator hash for sharp-libvips v1.3.0deb22ddUpgrade to sharp-libvips v1.3.007f1be9Prerelease v0.35.0-rc.8df1109bPrerelease v0.35.0-rc.7aca49b3Upgrade to libvips v8.18.3e9e86f5Type-check density option before range validation (#4536)2f0bcf0Docs: update supported image formats98e03b8Revert "Guard heif bitdepth property for prebuilt binaries"e4ea2f3CI: Ignore package minimum age in smoke testsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Update dependency group across root and
examplesto apply recent security patches and maintenance upgrades. Notable behavior changes:sharprequires Node.js >= 20.9.0 and drops theinstallscript;wsintroduces fragmentation limits with lower defaults.examples(and any workflows usingsharp0.35.0). Older runtimes will fail installation.wsoptionsmaxBufferedChunksandmaxFragmentsexplicitly; compression offers with mismatchedclient_max_window_bitsmay be rejected.picomatch,linkify-it,markdown-it,js-yaml, andbrace-expansioninclude DoS/CVE fixes and parsing improvements; no code changes expected—run tests to confirm.rollupupdated to 4.62.4; optional native compression/binaries may appear in lockfile—no configuration changes required.Written for commit b523652. Summary will update on new commits.