fix(deps): dev dependency security fixes - #24275
fix(deps): dev dependency security fixes#24275javascript-sdk-gitflow[bot] wants to merge 2 commits into
Conversation
Resolves GHSA-p293-qw3h-jr36 (CVE-2026-75604) and GHSA-2xp9-vwfh-vxw4, both critical. A single patch bump to 15.5.24 covers both advisories. Dependabot alerts: https://github.com/getsentry/sentry-javascript/security/dependabot/2526 and https://github.com/getsentry/sentry-javascript/security/dependabot/2527 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolves GHSA-26w7-cxv4-gfx2 (critical). Only the astro-7 test apps can take this fix: the astro 4/5/6 e2e apps and the packages/astro dev dependency are pinned to those majors on purpose, and 7.2.8 is the only patched release. Dependabot alert: https://github.com/getsentry/sentry-javascript/security/dependabot/2524 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
| "@img/sharp-win32-ia32" "0.35.4" | ||
| "@img/sharp-win32-x64" "0.35.4" | ||
|
|
||
| sharp@^0.34.5: |
There was a problem hiding this comment.
High severity vulnerability introduced by a package you're using:
Line 25101 lists a dependency (sharp) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader (vipsload, CVE-2026-33327), an integer overflow in the GIF loader (gifload, CVE-2026-33328) causing a denial of service on 32-bit hosts only, a heap-based buffer overflow in the TIFF loader (tiffload, CVE-2026-35591) when handling JPEG or JPEG2000-encoded tiles, and an out-of-bounds read in the EXIF directory decoder (CVE-2026-35590). An attacker who can supply a crafted image can crash the process or corrupt heap memory. Because sharp selects the libvips loader by sniffing the input bytes, no call site can be shown to be safe, and the EXIF flaw is reachable from the JPEG, TIFF, WebP, PNG and HEIF loaders as well. Upgrade to sharp 0.35.0 or later, which bundles libvips 8.18.3. Blocking the affected loaders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }) is only a partial stopgap and does not mitigate the EXIF out-of-bounds read (CVE-2026-35590), for which no workaround exists.
References: GHSA
To resolve this comment:
Upgrade this dependency to at least version 0.35.0 at yarn.lock.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
size-limit report 📦
|
Summary
Batched dev dependency security fixes. One commit per vulnerability.
Fixes
next15.5.21 → 15.5.24 — GHSA-p293-qw3h-jr36 (CVE-2026-75604) (critical) — https://github.com/getsentry/sentry-javascript/security/dependabot/2526next15.5.21 → 15.5.24 — GHSA-2xp9-vwfh-vxw4 (critical) — https://github.com/getsentry/sentry-javascript/security/dependabot/2527astro7.2.4 → 7.2.8 — GHSA-26w7-cxv4-gfx2 (critical) — https://github.com/getsentry/sentry-javascript/security/dependabot/2524Both
nextadvisories are patched by the same release (15.5.24), so they share one commit.The
nextbump covers thepackages/nextjsdev dependency (plus the rootyarn.lock) and the four Next 15 e2e test apps. Fornextjs-15-basepathandnextjs-15-t3the existing carets (^15,^15.5.13) already resolved to a patched version at install time, but the range floors were raised to^15.5.24so the manifests themselves are no longer in the advisory range.packages/nextjs'snextpeerDependency range (^14.0 || ^15.0.0-rc.0 || ^16.0.0-0) is deliberately left untouched —yarn-update-dependencyrewrites it to a single pinned range, which would silently drop Next 14 and 16 support for SDK users. Only the dev dependency was bumped.No
resolutionsentries were added.Skipped — needs human
astroinpackages/astro(dev dependency^4.16.19) — 7.2.8 is the only patched release, so fixing requires a major bump 4 → 7 — https://github.com/getsentry/sentry-javascript/security/dependabot/2524astroin theastro-4,astro-5,astro-5-cf-workers,astro-6andastro-6-cf-workerse2e apps — each app exists to test that specific major; the only patched release is 7.2.8, so the fix would mean bumping away from the major under test — https://github.com/getsentry/sentry-javascript/security/dependabot/2524nextin thenextjs-14,nextjs-app-dir,nextjs-pages-dir,supabase-nextjsandnextjs-orpce2e apps (pinned14.2.35) — the patched release is 15.5.24, so a major bump 14 → 15 would be needed and these apps exist to test Next 14 — https://github.com/getsentry/sentry-javascript/security/dependabot/2526, https://github.com/getsentry/sentry-javascript/security/dependabot/2527These are all dev/CI-only manifests, so the remaining exposure is confined to CI and never reaches shipped SDK code. They likely want a dismissal (
tolerable_risk) rather than a bump, but that call is left to a human.🤖 Generated with Claude Code