chore(deps): bump sharp from 0.33.5 to 0.35.0 - #76
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sharp](https://github.com/lovell/sharp) from 0.33.5 to 0.35.0. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.33.5...v0.35.0) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Deploying extforge with
|
| Latest commit: |
a35c82c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://bb434595.extforge.pages.dev |
| Branch Preview URL: | https://dependabot-npm-and-yarn-shar-2296.extforge.pages.dev |
15 tasks
arshad-shah
added a commit
that referenced
this pull request
Sep 1, 2026
Closes the remaining pre-v1 gates from #35. Adds a major changeset — there are no breaking changes from 0.6.x; what v1 adds is the promise that the documented surface stays put. API freeze - New reference/stability page assigns every export, command, flag, config field and runtime global to a tier: Stable, Experimental, or Internal. - createBuildContext, classifyChange, generateHMRClientCode, writeManifest and PluginRunner carry @internal tags naming what to use instead. - extforge/testing ships experimental; the Chrome fakes track a surface MV3 keeps extending. __EXTFORGE_HMR_QUIET__ is stable, __EXTFORGE_HMR__ internal. extforge/plugins is stable — its apiVersion: 1 discriminator lets a future incompatible API ship as apiVersion: 2 alongside it. - Node policy written down: >=22.12, supported through Active and Maintenance LTS; dropping an EOL major is a minor release. ESLint + Prettier -> Biome - One tool for lint and format. Every suppression ported with its rationale; the no-console whitelist survives as per-file overrides. - Real findings fixed rather than silenced: storage's private useChrome() renamed (not a hook), memoization via assignment-in-expression removed, forEach callbacks no longer return values, and the deliberately-excluded React dep note became a real suppression — ESLint never had the react-hooks plugin installed, so it was never enforced. Dependencies - Everything on latest across the root package, docs-site, tests-e2e and the examples, plus all SHA-pinned actions. Supersedes #49-#54, #62-#64, #69-#76. - TypeScript stays on 6.0.3: TS 7 typechecks but breaks the .d.ts bundle, since tsup's rollup-plugin-dts binds to a compiler API TS 7 does not expose. - Peer ranges untouched — they are consumer compatibility floors. - New pnpm overrides pin postcss, nanoid, js-yaml and svgo, which Astro and Starlight pull in vulnerable and would fail the audit gate. Cross-browser gate - pnpm check:cross-browser builds every example for Chrome, Firefox, Edge and Safari and asserts each manifest carries that browser's shape. Runs in CI. Live-browser e2e remains Chromium-only. Also removes the stale [Unreleased] changelog section, whose contents shipped in 0.3.0 and 0.4.0, and hardens the plugin doc generator's markdown escaping against a CodeQL-flagged ordering bug.
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps sharp from 0.33.5 to 0.35.0.
Release notes
Sourced from sharp's releases.
... (truncated)
Commits
2ed5af4Release v0.35.04475cf1Tests: update locator hash for sharp-libvips v1.3.0deb22ddUpgrade to sharp-libvips v1.3.007f1be9Prerelease v0.35.0-rc.8df1109bPrerelease v0.35.0-rc.7aca49b3Upgrade to libvips v8.18.3e9e86f5Type-check density option before range validation (#4536)2f0bcf0Docs: update supported image formats98e03b8Revert "Guard heif bitdepth property for prebuilt binaries"e4ea2f3CI: Ignore package minimum age in smoke testsMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.