Repository navigation
fix(deps): bump tar, hono, @hono/node-server, adm-zip, sharp and postcss-selector-parser - #7656
Conversation
…css-selector-parser Raise the direct ranges so the workspace and published packages resolve patched releases: tar 7.5.22, hono 4.13.16, @hono/node-server 2.1.6, adm-zip 0.6.1, sharp 0.35.5 and postcss-selector-parser 7.1.7. The CLI's on-demand sharp install moves to 0.35.5 with them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Edit accuracy: accurate 267 (base branch 267), smooth 92 of thoseThe gate passes. Quarantined, measured but not gated (8)
Unstable (1)
|
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at 85655b9bfd98c295c5194c2bf24ddfe139e006d5. No blockers found in the code review.
The patch raises the six dependency floors in every declaring workspace manifest, keeps Sharp optional, and updates the on-demand Sharp pin to the same 0.35.5 version. Parsed lock comparison is limited to those packages and Sharp's matching platform binaries; no major-version changes or unrelated additions. The changed dependency edges satisfy parent ranges. The Lambda runtime locks contain none of these packages and remain unchanged.
The Hono/node-server changes fit the actual routing, SSE, body-limit and Node adapter uses. The application does not use Hono's mount, CORS or serveStatic APIs; its static handlers are custom. Per upstream release notes, node-server rejects raw backslashes in paths while still accepting percent-encoded backslashes and backslashes in query strings. The ZIP preflight and bounded Lottie validation remain in place. Tar's new default 1000× decompression-ratio ceiling intentionally rejects extreme archives; both transport roundtrips pass. Hono release, node-server release.
Validation at this head: frozen install and full build pass; changed source lint and source/manifest formatting pass. CLI regression selection: 122/122; AWS/GCP transport tests: 40/40; engine file-server tests: 27/27; full studio-server suite: 1872 passed, 2 skipped. bun audit --json reproduces 117→72, with none of the six target packages remaining. Hosted CI: 95 successful, eight skipped, no pending or failed jobs. Native Sharp 0.35.5/libvips 8.18.7 also passes SVG rasterization, resize and PNG decoding on this Linux host. I did not test native binaries on other platforms or rerun every package suite locally.
Need: yes, security floors for published runtime dependencies · Size: ok · Reuse: existing optional-package loader, transport and server helpers · Simpler: already minimal · Structure: fine (checked shared optional installer and existing route/transport boundaries; no split)
Risk: medium — runtime server, archive and native image dependency updates.
Verdict: COMMENT — no blockers found.
Reasoning: The dependency contracts and install pins remain consistent, with relevant build, routing and archive coverage.
— Rames
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at 85655b9bfd98c295c5194c2bf24ddfe139e006d5. Approved; no blockers found.
The head is unchanged from my detailed review below. Rechecked the full review/comment lists and current CI: 95 successful checks, eight skipped, none failed or pending. No new findings were raised. The existing validation applies to this exact head: frozen install, full build, lint/format, 2,061 local tests passed (two skipped), native Sharp SVG/resize/PNG smoke, and audit 117→72. The dependency and lockfile changes remain scoped, including the matching on-demand Sharp pin. Tar’s new 1,000× decompression ceiling is an intentional behavior change covered by normal transport roundtrips.
Need: yes, security floors for published runtime dependencies · Size: ok · Reuse: existing optional-package loader, transport and server helpers · Simpler: already minimal · Structure: fine (checked shared optional installer and existing route/transport boundaries; no split)
Risk: medium — runtime server, archive and native image dependency updates.
Verdict: APPROVE.
Reasoning: Dependency contracts and install pins are consistent; the earlier compatibility review and validation remain valid at the unchanged head. Native binaries on other platforms were not tested locally.
— Rames
What
Bumps six runtime dependencies that
bun auditflags in the workspace:tar^7.5.22)tar)hono^4.13.16)@hono/node-server^2.1.6)adm-zip^0.6.1)sharp(optional)^0.35.5)postcss-selector-parser^7.1.7)The CLI's on-demand sharp install (
SHARP_VERSION, used when a host bundles the CLI without sharp) moves from 0.35.3 to 0.35.5 too, and the dependency-compat test floors follow the new ranges.Why
Dependabot reads only the
package.jsonranges for the bun workspace, so it doesn't flag these: every existing range already admitted a patched version, butbun.lockstill resolves vulnerable ones. Raising the ranges also means consumers of the published@hyperframes/*packages can't resolve the vulnerable versions.Advisories cleared (all 45
bun auditentries for these six packages):.lottiefiles with adm-zip.bun auditon the workspace: 117 → 72 (3 → 2 critical, 48 → 39 high, 57 → 24 moderate, 9 → 7 low). None of the six packages appear in the after report.Related work
Refs #3933. That Renovate "prod patch updates" PR has merge conflicts. It raises
taronly in aws-lambda (not gcp-cloud-run) and coversadm-zip, but nothono,@hono/node-server,sharporpostcss-selector-parser. Because hono and@hono/node-serverneed minor bumps, its patch-only group can't reach them. This PR supersedes it for these packages. The rest of #3933 is unrelated and stays for maintainers to decide.How
tar7.5.22 rather than 7.5.23 (2 days old),hono4.13.16 rather than 4.13.17/18, andpostcss-selector-parser7.1.7 rather than 7.1.8/7.2.x.bun install(bun 1.4.4 perengines.bun), then dropped the unrelated workspaceversionchurn bun wrote intobun.lock. The lock diff is now only these packages and sharp's@img/*platform binaries.bun install --frozen-lockfileaccepts it.runtime-lock/*/package-lock.jsonfiles, the registry source locks, orpackages/studio/frontend/bun.lock.hono 4.12 → 4.13 review. I read the release notes from 4.12.19 to 4.13.16 against the hono APIs we use:
Honorouting,streamSSE,bodyLimit,HTTPException, and@hono/node-serverserve/createAdaptorServer/HttpBindings. Changes with behavioral impact:QUERY. We don't usecors().UnsupportedPathErrorwhen a route is registered rather than on first match. Every route table is built in tests, and none threw.serveStaticserves only GET/HEAD and rejects a%left after decoding. Not used; the file servers are custom handlers.app.mount()is deprecated,getPathis disallowed withstrict: false, and the cache-key format changed. None of these are used.@hono/node-server2.1.6 returns 400 for a raw backslash in the request path. The engine/producer file servers are loaded by Chrome, which normalizes\to/before sending. The Windows render jobs exercise this path.Test plan
Run locally with
NODE_ENV=testafterbun run build:bun install --frozen-lockfile;bun whyfor each package shows a single resolution at the new versionbun auditbefore/after (above)test:unitpasses; the bun:testserverandfileServer*files pass 107/107fileServertests pass 27/27server/,optionalPackagesanddependency-compatsuites pass. The failures left are environmental: their errors point to ffmpeg/ffprobe, Chrome andlsof, none of which this sandbox has (init,whisper/transcribe, the|chrome|browser tests,portUtilsPID provenance). Hosted CI covers themstageArm64Imagefailures come fromzipnot being installed herebun run lint;bun run format:check🤖 Generated with Claude Code