Skip to content

build(deps): Bump sharp, shell-quote and smol-toml to patched versions - #6868

Open
antonis wants to merge 1 commit into
mainfrom
chore/bump-sharp-shellquote-smoltoml
Open

build(deps): Bump sharp, shell-quote and smol-toml to patched versions#6868
antonis wants to merge 1 commit into
mainfrom
chore/bump-sharp-shellquote-smoltoml

Conversation

@antonis

@antonis antonis commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📢 Type of change

  • Bugfix
  • New feature
  • Enhancement
  • Refactoring

📜 Description

Lockfile-only refresh moving three transitive dependencies onto their patched versions. All stay within the existing semver ranges — no package.json or resolutions changes.

Package Before → After Advisory Alert
sharp 0.35.4 → 0.35.5 librsvg dependency CVE-2026-96889 #702 (high)
shell-quote 1.10.0 → 1.12.0 quote() command injection via line terminator #701 (critical)
smol-toml 1.8.0 → 1.9.1 quadratic-time parse() DoS #699 (moderate)

💡 Motivation and Context

Resolves three open Dependabot alerts

💚 How did you test it?

  • CI

📝 Checklist

  • I added tests to verify changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • All tests passing.
  • Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
  • No breaking changes.

🔮 Next steps

@antonis @claude
build(deps): Bump sharp, shell-quote and smol-toml to patched versions
473729e 
Refresh yarn.lock to resolve Dependabot advisories in three transitive
dev/CI-tooling dependencies (none ship in @sentry/react-native):

- sharp: 0.35.4 -> 0.35.5 (librsvg CVE-2026-96889) [#702]
- shell-quote: 1.10.0 -> 1.12.0 (quote() command injection) [#701]
- smol-toml: 1.8.0 -> 1.9.1 (quadratic-time parse DoS) [#699]

Lockfile-only; all bumps stay within existing semver ranges.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

  • build(deps): Bump sharp, shell-quote and smol-toml to patched versions by antonis in #6868
  • chore(deps): update JavaScript SDK to v10.76.2 by antonis in #6866
  • ci(core): Guard the "sideEffects": false contract with a lint check by antonis in #6836
  • chore(deps): bump nx from 22.7.7 to 22.7.12 by dependabot in #6857
  • chore(deps): bump compression from 1.7.5 to 1.8.2 by dependabot in #6856
  • chore(deps): bump postcss-selector-parser from 7.1.4 to 7.1.6 by dependabot in #6855
  • chore(deps): bump source-map-js from 1.2.1 to 1.2.2 by dependabot in #6854
  • chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 by dependabot in #6853
  • chore(deps): bump handlebars from 4.7.9 to 4.7.10 by dependabot in #6862
  • chore(deps): update Wizard to v8.0.1 by github-actions in #6852

🤖 This preview updates automatically when you update the PR.

@antonis antonis added the ready-to-merge Triggers the full CI test suite label Oct 12, 2026
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3859.88 ms 1229.95 ms -2629.92 ms
Size 5.15 MiB 6.95 MiB 1.80 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
d038a14+dirty 3845.71 ms 1228.11 ms -2617.59 ms
1a5721e+dirty 3848.98 ms 1219.59 ms -2629.39 ms
2c735cc+dirty 1229.67 ms 1221.50 ms -8.17 ms
eb93136+dirty 3843.09 ms 1220.11 ms -2622.98 ms
68ae91b+dirty 3834.04 ms 1216.60 ms -2617.44 ms
f170ec3+dirty 3822.26 ms 1218.33 ms -2603.93 ms
ca9d079+dirty 3835.63 ms 1218.68 ms -2616.95 ms
5a21b51+dirty 3823.11 ms 1214.46 ms -2608.65 ms
f3215d3+dirty 3842.73 ms 1219.33 ms -2623.40 ms
faa5ba6+dirty 3859.57 ms 1244.43 ms -2615.15 ms

App size

Revision Plain With Sentry Diff
d038a14+dirty 5.15 MiB 6.67 MiB 1.51 MiB
1a5721e+dirty 4.98 MiB 6.51 MiB 1.53 MiB
2c735cc+dirty 3.38 MiB 4.74 MiB 1.35 MiB
eb93136+dirty 5.15 MiB 6.69 MiB 1.53 MiB
68ae91b+dirty 4.98 MiB 6.46 MiB 1.48 MiB
f170ec3+dirty 5.15 MiB 6.69 MiB 1.53 MiB
ca9d079+dirty 5.15 MiB 6.69 MiB 1.53 MiB
5a21b51+dirty 5.15 MiB 6.67 MiB 1.51 MiB
f3215d3+dirty 5.15 MiB 6.67 MiB 1.52 MiB
faa5ba6+dirty 5.15 MiB 6.95 MiB 1.80 MiB

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 448.68 ms 479.22 ms 30.54 ms
Size 50.56 MiB 56.62 MiB 6.06 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
5125c43+dirty 497.18 ms 543.78 ms 46.60 ms
fa21fca+dirty 453.80 ms 468.46 ms 14.66 ms
acd838e+dirty 422.63 ms 462.39 ms 39.76 ms
6acdf1d+dirty 513.58 ms 608.31 ms 94.72 ms
606fb09+dirty 436.49 ms 470.92 ms 34.43 ms
a5d243c+dirty 424.52 ms 485.18 ms 60.66 ms
7ac3378+dirty 404.78 ms 439.84 ms 35.06 ms
4e0b819+dirty 420.56 ms 470.08 ms 49.52 ms
21a1e70+dirty 405.72 ms 436.16 ms 30.44 ms
92aa6d3+dirty 449.12 ms 495.38 ms 46.26 ms

App size

Revision Plain With Sentry Diff
5125c43+dirty 48.30 MiB 53.54 MiB 5.24 MiB
fa21fca+dirty 49.74 MiB 55.37 MiB 5.63 MiB
acd838e+dirty 48.30 MiB 53.60 MiB 5.30 MiB
6acdf1d+dirty 49.74 MiB 55.09 MiB 5.34 MiB
606fb09+dirty 50.56 MiB 56.62 MiB 6.06 MiB
a5d243c+dirty 48.30 MiB 53.54 MiB 5.23 MiB
7ac3378+dirty 43.75 MiB 48.13 MiB 4.37 MiB
4e0b819+dirty 49.74 MiB 54.81 MiB 5.07 MiB
21a1e70+dirty 49.74 MiB 54.82 MiB 5.07 MiB
92aa6d3+dirty 50.56 MiB 56.51 MiB 5.95 MiB

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 414.04 ms 449.06 ms 35.02 ms
Size 50.56 MiB 56.62 MiB 6.06 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
04207c4+dirty 395.40 ms 456.55 ms 61.15 ms
0307fa4+dirty 476.48 ms 512.56 ms 36.08 ms
af33f3b+dirty 417.68 ms 448.04 ms 30.37 ms
0a147b2+dirty 442.80 ms 522.24 ms 79.44 ms
606fb09+dirty 493.77 ms 536.16 ms 42.39 ms
44abcc2+dirty 554.18 ms 578.85 ms 24.66 ms
ef27341+dirty 519.02 ms 553.42 ms 34.40 ms
853723c+dirty 415.82 ms 460.94 ms 45.12 ms
083e3ef+dirty 456.74 ms 508.20 ms 51.46 ms
3b6e9f9+dirty 442.39 ms 486.44 ms 44.05 ms

App size

Revision Plain With Sentry Diff
04207c4+dirty 43.94 MiB 48.98 MiB 5.04 MiB
0307fa4+dirty 49.74 MiB 54.81 MiB 5.07 MiB
af33f3b+dirty 49.74 MiB 55.09 MiB 5.35 MiB
0a147b2+dirty 49.74 MiB 55.08 MiB 5.34 MiB
606fb09+dirty 50.56 MiB 56.62 MiB 6.06 MiB
44abcc2+dirty 49.74 MiB 55.36 MiB 5.62 MiB
ef27341+dirty 48.30 MiB 53.54 MiB 5.24 MiB
853723c+dirty 48.30 MiB 53.58 MiB 5.28 MiB
083e3ef+dirty 49.74 MiB 55.36 MiB 5.61 MiB
3b6e9f9+dirty 48.30 MiB 53.54 MiB 5.23 MiB

@antonis
antonis marked this pull request as ready for review October 12, 2026 09:52
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3829.50 ms 1214.20 ms -2615.30 ms
Size 5.15 MiB 6.95 MiB 1.80 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
b04af96+dirty 3830.54 ms 1206.11 ms -2624.44 ms
0a9e622+dirty 3825.35 ms 1219.04 ms -2606.31 ms
5ca03f9+dirty 3873.76 ms 1236.26 ms -2637.51 ms
09a902f+dirty 3847.65 ms 1221.31 ms -2626.34 ms
64630e5+dirty 3845.49 ms 1215.19 ms -2630.30 ms
68672fc+dirty 3832.22 ms 1228.29 ms -2603.93 ms
7ac3378+dirty 1202.35 ms 1198.31 ms -4.04 ms
ecf47a2+dirty 3844.68 ms 1223.98 ms -2620.70 ms
ab203f9+dirty 3850.11 ms 1213.16 ms -2636.95 ms
5bef5f4+dirty 3858.24 ms 1224.53 ms -2633.71 ms

App size

Revision Plain With Sentry Diff
b04af96+dirty 4.98 MiB 6.54 MiB 1.56 MiB
0a9e622+dirty 4.98 MiB 6.51 MiB 1.53 MiB
5ca03f9+dirty 4.98 MiB 6.53 MiB 1.55 MiB
09a902f+dirty 4.98 MiB 6.46 MiB 1.49 MiB
64630e5+dirty 4.98 MiB 6.46 MiB 1.49 MiB
68672fc+dirty 5.15 MiB 6.71 MiB 1.55 MiB
7ac3378+dirty 3.38 MiB 4.76 MiB 1.38 MiB
ecf47a2+dirty 4.98 MiB 6.46 MiB 1.49 MiB
ab203f9+dirty 4.98 MiB 6.50 MiB 1.52 MiB
5bef5f4+dirty 5.15 MiB 6.89 MiB 1.74 MiB

lucas-zimerman
lucas-zimerman approved these changes Oct 12, 2026
View reviewed changes

@lucas-zimerman lucas-zimerman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucas-zimerman lucas-zimerman lucas-zimerman approved these changes
@alwx alwx Awaiting requested review from alwx alwx is a code owner

Assignees

No one assigned

Labels

ready-to-merge Triggers the full CI test suite

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@antonis @lucas-zimerman