Problem
@zen-browser/surfer@1.14.6 declares sharp: ^0.32.6. Current npm audit reports high-severity advisory GHSA-f88m-g3jw-g9cj for sharp <0.35.0, covering inherited libvips CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and CVE-2026-35591.
Downstream consumers cannot remediate safely: npm reports fixAvailable: false, and forcing a 0.x minor override can cross sharp API/ABI boundaries.
Requested change
- update Surfer to a patched
sharp >=0.35.0
- exercise Surfer's image/icon/packaging paths on supported platforms
- publish a new Surfer release so downstream lockfiles can remove the advisory
Observed in paritytech/epoca after all other actionable npm audit findings were remediated; these sharp/Surfer entries are the only remaining audit findings.
Problem
@zen-browser/surfer@1.14.6declaressharp: ^0.32.6. Currentnpm auditreports high-severity advisory GHSA-f88m-g3jw-g9cj forsharp <0.35.0, covering inherited libvips CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and CVE-2026-35591.Downstream consumers cannot remediate safely: npm reports
fixAvailable: false, and forcing a 0.x minor override can cross sharp API/ABI boundaries.Requested change
sharp >=0.35.0Observed in paritytech/epoca after all other actionable npm audit findings were remediated; these sharp/Surfer entries are the only remaining audit findings.