mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-07-25 13:56:10 +00:00
Sanaei
0b60154383
sharp <0.35.0 inherits four libvips CVEs (GHSA-f88m-g3jw-g9cj). It comes in as an optional dependency of next, which still declares ^0.34.5 on its current release, so only an override reaches the fixed line. Brings libvips 8.18.3 via @img/sharp-libvips-* 1.3.2.
13 lines
371 B
YAML
13 lines
371 B
YAML
allowBuilds:
|
|
esbuild: true
|
|
sharp: true
|
|
unrs-resolver: true
|
|
# Force any vulnerable transitive postcss (pulled in by next) up to a patched
|
|
# release — fixes GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (vulnerable < 8.5.10).
|
|
overrides:
|
|
'postcss@<8.5.10': '^8.5.15'
|
|
'sharp@<0.35.0': '^0.35.3'
|
|
minimumReleaseAgeExclude:
|
|
- '@mermaid-js/parser@1.2.0'
|
|
- mermaid@11.16.0
|