fix(deps): bump sharp from 0.31.2 to 0.32.6

Th3S4mur41 commented 1 year ago

Fixes sharp vulnerability in libwebp dependency CVE-2023-4863

ink-splatters commented 1 year ago

@Th3S4mur41 I was about to submit my PR but you were first :) Just want to add two points nice to be addressed in my opinion:

your fix updates lockfileVersion which seems outside of the PR scope. To be safe, just use node v14.15 as minimum specified in packages.json:

jq '.dependencies.sharp = "0.32.6"' package.json | tee package.json > $(mktemp)
nvm install 14.15
nvm use 14.15
npm install

seems logical to bump up version in CHANGELOG / add appropriate description

the above would make it roughly the same what I've done: https://github.com/ink-splatters/sharp-cli/tree/master

Disclaimer: I'm not affiliated with the author in any way.

Th3S4mur41 commented 1 year ago

Good catch @ink-splatters I've updated the PR 😉

vseventer commented 11 months ago

@Th3S4mur41 @ink-splatters Thanks for this - it prompted me to take some time to work on this. In addition to updating the Sharp version, I've also added all new commands and options part of recent Sharp releases.

Tagged as v4.2.0.

vseventer / sharp-cli

fix(deps): bump sharp from 0.31.2 to 0.32.6 #87