anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #429] [CLOSED] 🔴 Fix HIGH Severity CVE-2023-4863 #9612

New Issue
Closed
opened 2026-02-16 18:13:51 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:13:51 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/anomalyco/opencode/pull/429
Author: @ColeMurray
Created: 6/26/2025
Status: ❌ Closed

Base: dev ← Head: fix/security-npm-cve-2023-4863-20250626-124752

📝 Commits (1)

  • 1c32ef6 Fix HIGH Severity CVE-2023-4863

📊 Changes

2 files changed (+4 additions, -4 deletions)

View changed files

📝 bun.lock (+3 -3)
📝 packages/web/package.json (+1 -1)

📄 Description

🔒 Security Patch for CVE-2023-4863

This PR was automatically generated by Waclaude Security Scanner to fix a Severity.HIGH severity vulnerability.

Vulnerability Details

  • Type: CVE-2023-4863
  • File: bun.lock
  • Line(s): None
  • Scanner: npm_audit
  • CWE: CWE-20 (Improper Input Validation)
  • Confidence: high

Fix Description

Verification Results

  • ✅ Syntax: VerificationStatus.PASSED
  • ⚠️ Tests: VerificationStatus.SKIPPED
  • ✅ Security: VerificationStatus.PASSED

Vulnerability Description

Affected: Anyone processing untrusted input with sharp versions before 0.32.6.

Important Note

This patch was generated by AI and requires human review before merging. Please verify:

  • The fix correctly addresses the vulnerability
  • No functionality is broken
  • Code style matches project conventions
  • No new vulnerabilities are introduced

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/anomalyco/opencode/pull/429 **Author:** [@ColeMurray](https://github.com/ColeMurray) **Created:** 6/26/2025 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/security-npm-cve-2023-4863-20250626-124752` --- ### 📝 Commits (1) - [`1c32ef6`](https://github.com/anomalyco/opencode/commit/1c32ef6910f45917e0e6920748e13618b2271d4c) Fix HIGH Severity CVE-2023-4863 ### 📊 Changes **2 files changed** (+4 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `bun.lock` (+3 -3) 📝 `packages/web/package.json` (+1 -1) </details> ### 📄 Description 🔒 **Security Patch for CVE-2023-4863** This PR was automatically generated by [**Waclaude Security Scanner**](https://waclaude.com) to fix a **Severity.HIGH** severity vulnerability. ### Vulnerability Details * **Type:** CVE-2023-4863 * **File:** bun.lock * **Line(s):** None * **Scanner:** npm\_audit * **CWE:** CWE-20 (Improper Input Validation) * **Confidence:** high ### Fix Description * Version `0.32.6` is the first version after the vulnerability ([[GHSA-54xq-cgqr-rpm3](https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3)](https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3)). * Intentionally pinned to version `0.32.6` without caret (`^`) to maintain exact control and prevent unintended upgrades. * Directly addresses the high-severity vulnerability. * Minimal precise version bump ensures security fix with the lowest risk of breaking changes. ### Verification Results * ✅ **Syntax:** VerificationStatus.PASSED * ⚠️ **Tests:** VerificationStatus.SKIPPED * ✅ **Security:** VerificationStatus.PASSED ### Vulnerability Description * **Advisory:** [[GHSA-54xq-cgqr-rpm3](https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3)](https://github.com/lovell/sharp/security/advisories/GHSA-54xq-cgqr-rpm3) * **Package:** sharp * **Severity:** high * **Direct dependency:** Yes * **Vulnerable versions:** `>= 0, < 0.32.6` * **Fix available:** Yes (`0.32.6`) **Affected:** Anyone processing untrusted input with sharp versions before `0.32.6`. ### Important Note This patch was generated by AI and requires human review before merging. Please verify: * The fix correctly addresses the vulnerability * No functionality is broken * Code style matches project conventions * No new vulnerabilities are introduced --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 18:13:51 -05:00
yindo closed this issue 2026-02-16 18:13:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#9612
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?