flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

git agents cloudflare rust forge mcp

Upgrade sharp to 0.35.5 #27

Openg1tbot wants to merge g1t/security/sharp-0.35.5 into main

Other work is changing the same files

Upgrade basic-ftp to 6.2.1: fixes GHSA-c475-qrg2-pj4r #10package-lock.json, package.json
Upgrade postcss-selector-parser to 7.1.6: fixes GHSA-rj75-hqrm-r3gf #12package-lock.json, package.json

Whichever merges second will have to catch up, and may conflict.

g1tbotopened this pull request10h ago

Upgrades sharp (npm) from 0.35.4 to 0.35.5, which fixes these known vulnerabilities:

Advisory	Severity	Affected	Fixed in	Summary
GHSA-wq5f-xc86-pv6w	high	0.35.4	0.35.5	sharp : Vulnerability in librsvg dependency CVE-2026-96889

Lockfiles changed: package-lock.json.

Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t-agent on an issue to make the change.

Opened by g1t's security updates. Turn them off for this project on its Security page.

No reviews yet

main has moved since this was made

That does not stop it merging: it is brought up to date as part of the merge.