Raise direct sharp dependencies in token-server and e.cash to ^0.35.0 to clear GHSA-f88m-g3jw-g9cj (high, libvips CVE-2026-33327/28/35590/91).
Details
Details
- Reviewers
PiRK - Group Reviewers
Restricted Project - Commits
- rABC342bf5f7dfc6: [monorepo] Bump sharp to ^0.35.0 for libvips CVEs
- pnpm install
- pnpm audit --audit-level high # sharp advisory gone; high 6→5
- rg 'sharp@0.35' pnpm-lock.yaml
Diff Detail
Diff Detail
- Repository
- rABC Bitcoin ABC
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) Never bring a script to a dependency battle - bring a lockfile.
────────────────────────────────────────
Review complete
No findings ✔
3 files reviewed:
- apps/token-server/package.json
- pnpm-lock.yaml
- web/e.cash/package.json
────────────────────────────────────────