Skip to content

Possible fix(deps): sharp 0.34.5 → 0.35.0 (GHSA-f88m-g3jw-g9cj) in bun.lock #295

Description

@begininvoke

Spotted what might be an issue in bun.lock around line 286.

This HIGH severity vulnerability affects sharp versions prior to 0.35.0 due to multiple flaws in the upstream libvips dependency. Processing untrusted image data (particularly GIF, TIFF, and VIPS formats) can cause application crashes, denial of service, or potential remote code execution. Risk Level: HIGH. Impact is critical for any service processing user-uploaded or untrusted media files.

Something like this might fix it:

Update package.json to require the patched version:
-    "sharp": "0.34.5",
+    "sharp": "^0.35.0",
After updating the dependency, regenerate your lockfile by running:
bun install

For reference: rule GHSA-f88m-g3jw-g9cj. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.


Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions