Skip to content

Update sharp to address inherited libvips vulnerabilities #58

Description

@replghost

Problem

@zen-browser/surfer@1.14.6 declares sharp: ^0.32.6. Current npm audit reports high-severity advisory GHSA-f88m-g3jw-g9cj for sharp <0.35.0, covering inherited libvips CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and CVE-2026-35591.

Downstream consumers cannot remediate safely: npm reports fixAvailable: false, and forcing a 0.x minor override can cross sharp API/ABI boundaries.

Requested change

  • update Surfer to a patched sharp >=0.35.0
  • exercise Surfer's image/icon/packaging paths on supported platforms
  • publish a new Surfer release so downstream lockfiles can remove the advisory

Observed in paritytech/epoca after all other actionable npm audit findings were remediated; these sharp/Surfer entries are the only remaining audit findings.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions