deps(dashboard): pin sharp forward without taking Next 16 with it - #86
Merged
Conversation
Dependabot #85 is titled as a sharp bump and is actually a Next 16 major. Its own body says the two "need to be updated together", and the diff moves next from 15.5.21 to 16.3.2. It fails CI already: `next lint` was removed in 16, so the lint step reads "lint" as a directory and exits 1. The advisory it fixes is real (high, libvips CVE-2026-33327 and friends) and unreachable here. sharp is an optional transitive of next and its only caller is the image optimizer, which `next.config.js` disables with `images: { unoptimized: true }` and which cannot run in a static export at all. `next/image` is used once, in mission-control.tsx, and resolves to a plain img. So an npm override forces sharp to 0.35.3 while next stays at 15.5.21. The alert closes, the framework does not move, and Next 16 becomes a decision taken deliberately rather than one arrived at through a transitive dependency of a package this build never invokes. The override is a pin rather than a fix and should be removed when Next ships a 15.x that depends on sharp 0.35 itself, or when the Next 16 migration happens on purpose. Noted in package.json rather than left for somebody to find. Verified: sharp resolves 0.35.3, next stays 15.5.21, typecheck clean, lint clean, 99 tests pass, static export builds both routes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit message said the pin was noted in package.json. It was not, because JSON has no comments and I did not stop to solve that before claiming it. An overridesNote key does the job: npm ignores unknown top-level fields, and the next person to read the file finds the reason and the removal condition without going through git log. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Alternative to #85. Read this before merging that one.
#85 is not what its title says
It is titled "bump sharp and next". The diff is:
That is a major framework upgrade, hours after the Next 15 migration, arriving through a transitive dependency. Dependabot's own body says the two "need to be updated together".
It already fails CI.
next lintwas removed in Next 16, so the lint step readslintas a directory:Merging it means also migrating
next lint→ ESLint CLI, and probablyeslint@8→eslint@9with a matchingeslint-config-next@16.The advisory is real and unreachable here
The sharp alert is genuine: high severity, inherited libvips CVEs. But sharp is an optional transitive of next, and its only caller is Next's image optimizer, which:
next.config.jsdisables viaimages: { unoptimized: true }output: "export"requires it disabled)next/imageis used once, inmission-control.tsx, and resolves to a plain<img>.So the vulnerable code is installed and never invoked.
What this PR does instead
An npm
overridesentry forces sharp to 0.35.3 while next stays at 15.5.21:The alert closes, the framework does not move, and Next 16 becomes a decision taken deliberately rather than one arrived at through a dependency this build never calls.
The override is a pin, not a fix, so
package.jsoncarries anoverridesNotewith the reason and the removal condition. npm ignores unknown top-level keys; verified install still resolves correctly with it present.Verified
tsc --noEmitcleanRecommendation
Merge this, close #85, and schedule Next 16 as its own piece of work when it is worth doing. If you would rather do Next 16 now, close this instead and I will do the lint migration properly, but it should be a choice rather than a side effect.
🤖 Generated with Claude Code