Repository navigation
Bump wrangler to 4.158.0 and drop the sharp override - #27
Merged
Merged
Conversation
wrangler 4.158.0 brings miniflare's undici to 7.30.1, which clears the eight undici advisories npm audit reports on the committed lockfile: GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6, GHSA-f72v-6w45-q472, GHSA-qrxm-fqhp-jwvm and GHSA-xjj6-f33q-929c. undici 7.30.1 first ships with wrangler 4.153.0; 4.158.0 is the version Dependabot proposes across these repos. The sharp override (^0.35.5, for GHSA-wq5f-xc86-pv6w) has done its job: every miniflare from wrangler 4.151.1 on pins sharp at exactly 0.35.5, and the lockfile resolves 0.35.5 without it. Left in place it would force a later miniflare pin back into ^0.35.5. Lockfile written with npm 12 so the @img/sharp-* entries keep their libc field. npm audit on it reports nothing; npm ci under node:22's npm 10 passes, as do the tests where the repo has them, and wrangler deploy --dry-run builds the Worker.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves wrangler from 4.151.1 to 4.158.0 and drops
"overrides": {"sharp": "^0.35.5"}. Merging redeploys the Worker throughdeploy-worker.yml, which runsscripts/check-routes.pyafter the deploy.undici
wrangler 4.151.1's miniflare carries undici 7.29.1. undici 7.30.1 fixes all eight advisories below and first ships with wrangler 4.153.0; 4.158.0 is the version Dependabot proposes in five of the six worker repos.
npm audit --package-lock-onlynpm auditon this branchsharp
The override pushed sharp past miniflare's exact pin for GHSA-wq5f-xc86-pv6w. Every miniflare from wrangler 4.151.1 through 4.161.0 pins sharp at exactly 0.35.5, and this lockfile resolves 0.35.5 without the override. Left in place, it would force a later miniflare pin back into
^0.35.5.The same change is open in pkghaus/apt, pkghaus/buildinfos, pkghaus/plausible-worker, pkghaus/reproducible, pkghaus/stats.
Dependabot
This supersedes #26 (wrangler 4.158.0). They change the
wranglerline, which sits directly above the override this removes, so they and this PR can't both merge without a conflict. Once wrangler is at 4.158.0 Dependabot should close them; if it doesn't, close them by hand.Verified
@img/sharp-*entries keep theirlibcfield; identical to deps: bump wrangler from 4.158.0 to 4.159.0 in /worker #26's apart from@jridgewell/resolve-uri3.1.2 to 3.1.3, a patch npm resolved within rangenpm ciunder node:22 (npm 10.9.8, as CI runs it): passesnpm test: no test script in this packagenpx wrangler deploy --dry-runwith 4.158.0: builds (0.31 KiB)