fix(agentex-ui): bump sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj) by scale-prodsec[bot] · Pull Request #371 · scaleapi/scale-agentex

scale-prodsec · 2026-07-22T15:14:14Z

Summary

Remediates GHSA-f88m-g3jw-g9cj (HIGH) in sharp, reported by Trivy against the agentex-ui image.

sharp < 0.35.0 inherits four libvips vulnerabilities:

CVE-2026-33327
CVE-2026-33328
CVE-2026-35590
CVE-2026-35591

sharp 0.35.0+ bundles the fixed libvips 8.18.3.

	Before	After
`sharp`	0.34.3	0.35.3
bundled libvips (`@img/sharp-libvips-*`)	1.2.0 (libvips 8.17.x)	1.3.2 (libvips 8.18.3)

Change

sharp is a transitive optionalDependency of next@15.5.18 (declared ^0.34.3, which caps at <0.35.0). It is not a direct dependency and is not imported by application code. It is pinned via the existing npm overrides block in agentex-ui/package.json:

"overrides": {
  "sharp": "^0.35.0"
}

^0.35.0 resolves to the current latest 0.35.3. agentex-ui/package-lock.json was regenerated with npm 10 (matching CI's Node 20 toolchain); the diff is strictly the sharp transitive closure (the @img/sharp-* platform binaries, @img/sharp-libvips-*, @img/colour replacing color, and sharp's own semver/detect-libc floor bumps). No lockfileVersion/format migration, no file-mode changes, no application-code changes.

Transitive-pin safety

next@15.5.18's image optimizer instantiates sharp as sharp(buffer, { limitInputPixels, sequentialRead }) — neither option was removed in 0.35.0. The APIs removed in 0.35.0 (failOnError constructor prop, paletteBitDepth metadata, format.jp2k rename) are not used by next 15.5.18, and the app declares no direct sharp usage nor next/image usage. sharp 0.35.0 requires Node ≥ 20.9.0, satisfied by the node:20-trixie-slim build/runtime base.

Validation

npm ci in agentex-ui/ — passes (lockfile in sync; CI's exact install gate)
npm run typecheck (tsc --noEmit) — passes
Diff-scope verified: only sharp and its closure changed; color family removed cleanly (was consumed only by sharp)

Linear

Resolves GFDVR-20651 — [Trivy] Remediate sharp vulnerabilities
Covers child GFDVR-20652 — GHSA-f88m-g3jw-g9cj in sharp@0.34.3

🤖 Generated with Claude Code

Greptile Summary

Remediates GHSA-f88m-g3jw-g9cj (HIGH) by bumping the transitive sharp dependency from 0.34.3 to 0.35.3, which bundles libvips 8.18.3 and fixes four libvips CVEs (CVE-2026-33327, -33328, -35590, -35591). The pin is applied via npm overrides in package.json, which is the appropriate mechanism for transitive-only dependencies.

package.json: Adds "sharp": "^0.35.0" to the existing overrides block alongside the existing cross-spawn, postcss, and tar overrides.
package-lock.json: All @img/sharp-* platform binaries move from 0.34.3 → 0.35.3 and @img/sharp-libvips-* from 1.2.0 → 1.3.2; color is cleanly replaced by @img/colour; minor floor bumps to detect-libc and semver. No application code or lockfileVersion changes.

Confidence Score: 5/5

Safe to merge — this is a targeted transitive dependency pin with no application code changes and a well-scoped lockfile diff.

The change is limited to a transitive sharp bump via npm overrides. No application code is touched, the lockfile diff is internally consistent (all @img/sharp-* and @img/sharp-libvips-* entries move together), and the removed color package is correctly replaced by @img/colour as expected in sharp 0.35.x. The new Node ≥ 20.9.0 engine constraint is satisfied by the project's existing node:20 runtime base.

Files Needing Attention: No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Adds `"sharp": "^0.35.0"` to the existing npm `overrides` block — the correct mechanism for pinning a transitive optional dependency without declaring it as a direct dependency.
agentex-ui/package-lock.json	Lockfile regenerated to reflect `sharp` 0.34.3 → 0.35.3 and the full transitive closure: `@img/sharp-` platform binaries bumped to 0.35.3, `@img/sharp-libvips-` to 1.3.2, `color` replaced by `@img/colour`, `detect-libc` 2.0.4 → 2.1.2, `semver` 7.7.2 → 7.8.5, and new platform entries added (riscv64, freebsd-wasm32, webcontainers-wasm32). Changes are internally consistent and scoped exclusively to the sharp closure.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into scale-prodsec/g..." | Re-trigger Greptile}

sharp <0.35.0 inherits four libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591) via GHSA-f88m-g3jw-g9cj (HIGH). sharp 0.35.0+ bundles the fixed libvips 8.18.3. sharp is a transitive optionalDependency of next@15.5.18 (declared ^0.34.3). Pinned via npm overrides to ^0.35.0, which resolves to 0.35.3 (libvips 1.3.2 = 8.18.3). next 15.5.18's image-optimizer only calls sharp(buffer, { limitInputPixels, sequentialRead }); none of the APIs removed in 0.35.0 (failOnError, paletteBitDepth, format.jp2k) are used, and the app declares no direct sharp/next-image usage. npm ci and tsc --noEmit pass. Resolves GFDVR-20651 / GFDVR-20652.

…api#254) > **Stacked on [scaleapi#286](scaleapi#286 (isolate docs build from the workspace lock) — merge that first. This PR is only the doc-path changes; scaleapi#286 makes the doc build resolve `agentex-sdk>=0.12.0` in an isolated env, so `agentex.protocol.*` resolves without touching backend deps. ## Summary Updates the agentex mkdocs site to use the new canonical `agentex.protocol.acp` import paths for protocol-shape types (`RPCMethod`, `CreateTaskParams`, `SendMessageParams`, `SendEventParams`, `CancelTaskParams`). Companion to [scaleapi/scale-agentex-python#371](scaleapi/scale-agentex-python#371), which moved these types out of `agentex.lib.types.*` into the new slim-safe `agentex.protocol.*` package. The old path still works via a back-compat shim — this PR isn't fixing a breakage, it's making sure scaffolded user code following these docs starts on the canonical path. Requested in [a review comment on scaleapi#371](scaleapi/scale-agentex-python#371 (review)). ## Changes 10 markdown files in `agentex/docs/`: | Pattern | Count | |---|---| | `from agentex.lib.types.acp import ...` → `from agentex.protocol.acp import ...` | 8 code samples | | `::: agentex.lib.types.acp.X` → `::: agentex.protocol.acp.X` | 2 mkdocstrings cross-refs (in `agent_types/sync.md` and `api/types.md`) | No content / behavior changes; same classes, new import path. ## What's not touched Other `agentex.lib.types.*` modules (`tracing`, `agent_card`, `credentials`, `fastacp`, `llm_messages`, `converters`) stay on the old path because they have heavier transitive deps and weren't migrated by scaleapi#371. No doc references to those needed updates. ## Test plan - [x] Isolated `mkdocs build` renders green against `agentex-sdk` 0.12.0 (verified locally via the scaleapi#286 build path). - [x] `::: agentex.protocol.acp.*` mkdocstrings directives resolve at the new path. 🧑‍💻🤖 — posted via [Claude Code](https://claude.com/claude-code)   <h3>Greptile Summary</h3> This PR updates 10 documentation markdown files to use the new canonical `agentex.protocol.acp` import paths, replacing the old `agentex.lib.types.acp` references in both Python code samples and mkdocstrings directives. - Replaces `from agentex.lib.types.acp import ...` with `from agentex.protocol.acp import ...` in 10 code sample blocks across 8 files. - Updates 13 mkdocstrings `::: agentex.lib.types.acp.X` directives to `::: agentex.protocol.acp.X` across 5 files, covering `CreateTaskParams`, `SendMessageParams`, `SendEventParams`, and `CancelTaskParams`. - A grep confirms no remaining `agentex.lib.types.acp` references exist anywhere in the docs tree after this PR. <details><summary><h3>Confidence Score: 5/5</h3></summary> Safe to merge — purely mechanical doc path updates with no remaining old-path references in the docs tree. All 23 occurrences of agentex.lib.types.acp across 10 files have been correctly replaced with agentex.protocol.acp. A grep of the entire docs directory confirms zero leftover old-path references. No logic, behavior, or non-doc files are touched. No files require special attention. </details> <h3>Important Files Changed</h3> | Filename | Overview | |----------|----------| | agentex/docs/docs/api/types.md | 4 mkdocstrings directives updated from old to new canonical path; no issues. | | agentex/docs/docs/agent_types/async/base.md | 1 import and 3 mkdocstrings directives updated; no issues. | | agentex/docs/docs/agent_types/async/temporal.md | 1 import and 2 mkdocstrings directives updated; no issues. | | agentex/docs/docs/acp/agentic/base.md | 3 mkdocstrings directives updated; no issues. | | agentex/docs/docs/getting_started/project_structure.md | 3 import statements updated across different agent-type examples; no issues. | | agentex/docs/docs/agent_types/sync.md | 1 import and 1 mkdocstrings directive updated; no issues. | | agentex/docs/docs/api/overview.md | 1 import statement updated; no issues. | | agentex/docs/docs/concepts/streaming.md | 1 import statement updated; no issues. | | agentex/docs/docs/acp/agentic/temporal.md | 1 import statement updated; no issues. | | agentex/docs/docs/temporal_development/openai_integration.md | 1 import statement updated; no issues. | </details> <details><summary><h3>Flowchart</h3></summary> ```mermaid %%{init: {'theme': 'neutral'}}%% flowchart TD A["Doc code samples & mkdocstrings refs\n(10 markdown files)"] --> B{"Import path"} B -- "Before" --> C["agentex.lib.types.acp\n(back-compat shim)"] B -- "After" --> D["agentex.protocol.acp\n(canonical path)"] D --> E["CreateTaskParams"] D --> F["SendMessageParams"] D --> G["SendEventParams"] D --> H["CancelTaskParams"] ``` </details> <sub>Reviews (5): Last reviewed commit: ["docs(agentex): use canonical agentex.pro..."](scaleapi@5a42081) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=34170925)</sub>  Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scale-prodsec Bot requested a review from a team as a code owner July 22, 2026 15:14

scale-ballen enabled auto-merge (squash) July 22, 2026 16:18

deepthi-rao-scale approved these changes Jul 28, 2026

View reviewed changes

danielmillerp approved these changes Jul 28, 2026

View reviewed changes

scale-ballen disabled auto-merge July 28, 2026 18:29

Merge branch 'main' into scale-prodsec/gfdvr-20651-sharp-0350

1464c66

scale-ballen merged commit ffa5f94 into main Jul 28, 2026
15 checks passed

scale-ballen deleted the scale-prodsec/gfdvr-20651-sharp-0350 branch July 28, 2026 18:31

github-actions Bot mentioned this pull request Jul 28, 2026

chore(main): release 0.2.0 #326

Open

Navigation Menu

fix(agentex-ui): bump sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj) - #371

fix(agentex-ui): bump sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj)#371
scale-ballen merged 2 commits into
mainfrom
scale-prodsec/gfdvr-20651-sharp-0350

scale-prodsec Bot commented Jul 22, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

scale-prodsec Bot commented Jul 22, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change

Transitive-pin safety

Validation

Linear

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

scale-prodsec Bot commented Jul 22, 2026 •

edited by greptile-apps Bot

Loading