fix(deps): update dependency gatsby-plugin-sharp to v4 [security] by renovate[bot] · Pull Request #413 · multei/web

renovate · 2026-02-04T00:25:23Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
gatsby-plugin-sharp (source)	`2.6.43` → `4.25.1`

Path traversal vulnerability in gatsby-plugin-sharp

CVE-2023-30548 / GHSA-h2pm-378c-pcxx

More information

Details

Impact

The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:


##### Create a new Gatsby project, and install gatsby-plugin-sharp
$ npm init gatsby
$ cd my-gatsby-site
$ npm install gatsby-plugin-sharp

##### Add the plugin to gatsby-config.js
module.exports = {
  plugins: [
    {
      resolve: `gatsby-plugin-sharp`,
    },
  ]
}

##### Start the Gatsby develop server
$ gatsby develop

##### Execute the path traversal vulnerability
$ curl "http://127.0.0.1:8000/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in gatsby-plugin-sharp@5.8.1 and gatsby-plugin-sharp@4.25.1 which mitigates the issue by ensuring that included paths remain within the project directory.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Patrick Rombouts and Bart Veneman [drukwerkdeal.nl] for bringing the issue to our attention.

For more information

Email us at security@gatsbyjs.com.

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

gatsbyjs/gatsby (gatsby-plugin-sharp)

Note: Version bump only for package gatsby-plugin-sharp

4.23.1 (2022-09-22)

Note: Version bump only for package gatsby-plugin-sharp

`v4.23.1`

Compare Source

Note: Version bump only for package gatsby-plugin-sharp

`v4.18.1`

Compare Source

🧾 Release notes

Bug Fixes

update dependency async to ^3.2.4 for gatsby-plugin-sharp #36032 (20c790a)

4.18.1 (2022-07-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.18.0`

Compare Source

🧾 Release notes

Bug Fixes

update dependency got to ^11.8.5 for gatsby-plugin-sharp #35800 (c2d3336)

`v4.17.0`

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sharp

4.16.1 (2022-06-08)

Note: Version bump only for package gatsby-plugin-sharp

`v4.16.1`

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sharp

4.16.1 (2022-06-08)

Note: Version bump only for package gatsby-plugin-sharp

`v4.16.0`

Compare Source

🧾 Release notes

Features

cache image metadata #35791 (7d93d2e)

Performance Improvements

downsize image before extracting dominant color #35814 (5e6c808)

4.15.1 (2022-06-01)

Note: Version bump only for package gatsby-plugin-sharp

`v4.15.1`

Compare Source

🧾 Release notes

Features

cache image metadata #35791 (7d93d2e)

Performance Improvements

downsize image before extracting dominant color #35814 (5e6c808)

4.15.1 (2022-06-01)

Note: Version bump only for package gatsby-plugin-sharp

`v4.15.0`

Compare Source

🧾 Release notes

Chores

remove old unused UUID dependency #35657 (d4aaa2a)

4.14.1 (2022-05-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.14.1`

Compare Source

🧾 Release notes

Chores

remove old unused UUID dependency #35657 (d4aaa2a)

4.14.1 (2022-05-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.14.0`

Compare Source

🧾 Release notes

Bug Fixes

update dependency fs-extra to ^10.1.0 #34976 (10752ed)
update dependency semver to ^7.3.7 #35543 (f593e00)

`v4.13.0`

Compare Source

🧾 Release notes

Features

enable tracedsvg #35328 (a246011)

4.12.1 (2022-04-13)

Note: Version bump only for package gatsby-plugin-sharp

`v4.12.1`

Compare Source

🧾 Release notes

Features

enable tracedsvg #35328 (a246011)

4.12.1 (2022-04-13)

Note: Version bump only for package gatsby-plugin-sharp

`v4.12.0`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #35296 (6f088aa)
windows quirks #35246 (392d6bc)

Chores

update sharp #35303 (d267bb3)

4.11.1 (2022-03-31)

Bug Fixes

windows quirks #35246 #35268 (a527891)

`v4.11.1`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #35296 (6f088aa)
windows quirks #35246 (392d6bc)

Chores

update sharp #35303 (d267bb3)

4.11.1 (2022-03-31)

Bug Fixes

windows quirks #35246 #35268 (a527891)

`v4.11.0`

Compare Source

🧾 Release notes

Refactoring

replace deprecated String.prototype.substr() #35205 (21f7c65)

4.10.2 (2022-03-23)

Note: Version bump only for package gatsby-plugin-sharp

4.10.1 (2022-03-18)

Note: Version bump only for package gatsby-plugin-sharp

`v4.10.2`

Compare Source

🧾 Release notes

Refactoring

replace deprecated String.prototype.substr() #35205 (21f7c65)

4.10.2 (2022-03-23)

Note: Version bump only for package gatsby-plugin-sharp

4.10.1 (2022-03-18)

Note: Version bump only for package gatsby-plugin-sharp

`v4.10.1`

Compare Source

🧾 Release notes

Refactoring

replace deprecated String.prototype.substr() #35205 (21f7c65)

Chores

Format changelog files (088f23b)

4.8.2 (2022-03-01)

Note: Version bump only for package gatsby-plugin-sharp

4.8.1 (2022-02-25)

Note: Version bump only for package gatsby-plugin-sharp

`v4.8.2`

Compare Source

🧾 Release notes

Chores

Format changelog files (088f23b)

4.8.2 (2022-03-01)

Note: Version bump only for package gatsby-plugin-sharp

4.8.1 (2022-02-25)

Note: Version bump only for package gatsby-plugin-sharp

`v4.8.1`

Compare Source

🧾 Release notes

Chores

Format changelog files (088f23b)

4.8.2 (2022-03-01)

Note: Version bump only for package gatsby-plugin-sharp

4.8.1 (2022-02-25)

Note: Version bump only for package gatsby-plugin-sharp

`v4.8.0`

Compare Source

🧾 Release notes

Bug Fixes

update dependency sharp to ^0.30.1 #34755 (326a483)

`v4.7.0`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #34656 (c70ab01)

`v4.6.0`

Compare Source

🧾 Release notes

Bug Fixes

add missing dependencies #28759 (d20c97b)

4.5.2 (2022-01-17)

Note: Version bump only for package gatsby-plugin-sharp

4.5.1 (2022-01-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.5.2`

Compare Source

🧾 Release notes

Bug Fixes

add missing dependencies #28759 (d20c97b)

4.5.2 (2022-01-17)

Note: Version bump only for package gatsby-plugin-sharp

4.5.1 (2022-01-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.5.1`

Compare Source

🧾 Release notes

Bug Fixes

add missing dependencies #28759 (d20c97b)

4.5.2 (2022-01-17)

Note: Version bump only for package gatsby-plugin-sharp

4.5.1 (2022-01-12)

Note: Version bump only for package gatsby-plugin-sharp

`v4.5.0`

Compare Source

🧾 Release notes

Chores

update dependency @types/sharp to ^0.29.5 #34356 (79186ab)

`v4.4.0`

Compare Source

🧾 Release notes

Bug Fixes

update dependency got to ^11.8.3 for gatsby-plugin-sharp #34130 (80ef329)

Chores

update sharp #34120 (df36406)

`v4.3.0`

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-plugin-sharp

`v4.2.0`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #33770 (e9f0f32)
update dependency sharp to ^0.29.2 #33766 (0dfbc48)

4.1.4 (2021-11-15)

Note: Version bump only for package gatsby-plugin-sharp

4.1.3 (2021-11-11)

Note: Version bump only for package gatsby-plugin-sharp

4.1.2 (2021-11-10)

Note: Version bump only for package gatsby-plugin-sharp

4.1.1 (2021-11-09)

Note: Version bump only for package gatsby-plugin-sharp

`v4.1.4`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #33770 (e9f0f32)
update dependency sharp to ^0.29.2 #33766 (0dfbc48)

4.1.4 (2021-11-15)

Note: Version bump only for package gatsby-plugin-sharp

4.1.3 (2021-11-11)

Note: Version bump only for package gatsby-plugin-sharp

4.1.2 (2021-11-10)

Note: Version bump only for package gatsby-plugin-sharp

4.1.1 (2021-11-09)

Note: Version bump only for package gatsby-plugin-sharp

`v4.1.3`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #33770 (e9f0f32)
update dependency sharp to ^0.29.2 #33766 (0dfbc48)

4.1.4 (2021-11-15)

Note: Version bump only for package gatsby-plugin-sharp

4.1.3 (2021-11-11)

Note: Version bump only for package gatsby-plugin-sharp

4.1.2 (2021-11-10)

Note: Version bump only for package gatsby-plugin-sharp

4.1.1 (2021-11-09)

Note: Version bump only for package gatsby-plugin-sharp

`v4.1.2`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #33770 (e9f0f32)
update dependency sharp to ^0.29.2 #33766 (0dfbc48)

4.1.4 (2021-11-15)

Note: Version bump only for package gatsby-plugin-sharp

4.1.3 (2021-11-11)

Note: Version bump only for package gatsby-plugin-sharp

4.1.2 (2021-11-10)

Note: Version bump only for package gatsby-plugin-sharp

4.1.1 (2021-11-09)

Note: Version bump only for package gatsby-plugin-sharp

`v4.1.1`

Compare Source

🧾 Release notes

Bug Fixes

update minor and patch dependencies for gatsby-plugin-sharp #33770 (e9f0f32)
update dependency sharp to ^0.29.2 #33766 (0dfbc48)

4.1.4 (2021-11-15)

Note: Version bump only for package gatsby-plugin-sharp

4.1.3 (2021-11-11)

Note: Version bump only for package gatsby-plugin-sharp

4.1.2 (2021-11-10)

Note: Version bump only for package gatsby-plugin-sharp

4.1.1 (2021-11-09)

Note: Version bump only for package gatsby-plugin-sharp

`v4.1.0`

Compare Source

🧾 Release notes

Bug Fixes

pass failOnError to sharp in getImageMetadata #33547 (82cd584)
pass input buffer instead of readStream when processing image jobs #33685 (b800559)

4.0.1 (2021-10-27)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33694 (9b3d44f)

`v4.0.1`

Compare Source

🧾 Release notes

Bug Fixes

pass failOnError to sharp in getImageMetadata #33547 (82cd584)
pass input buffer instead of readStream when processing image jobs #33685 (b800559)

4.0.1 (2021-10-27)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33694 (9b3d44f)

`v4.0.0`

Compare Source

🧾 Release notes

Bug Fixes

run sharp in 1 core when in gatsby worker #33505 (4658b80)

Chores

update sharp #33379 (eb70b46)
remove old unused code #33504 (31952b4)
Remove sizeByPixelDensity option #33468 (d467372)

3.14.3 (2021-11-02)

Note: Version bump only for package gatsby-plugin-sharp

3.14.2 (2021-10-28)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33703 (84053a2)

3.14.1 (2021-10-06)

Note: Version bump only for package gatsby-plugin-sharp

`v3.15.0`

Compare Source

`v3.14.3`

Compare Source

🧾 Release notes

Bug Fixes

run sharp in 1 core when in gatsby worker #33505 (4658b80)

Chores

update sharp #33379 (eb70b46)
remove old unused code #33504 (31952b4)
Remove sizeByPixelDensity option #33468 (d467372)

3.14.3 (2021-11-02)

Note: Version bump only for package gatsby-plugin-sharp

3.14.2 (2021-10-28)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33703 (84053a2)

3.14.1 (2021-10-06)

Note: Version bump only for package gatsby-plugin-sharp

`v3.14.2`

Compare Source

🧾 Release notes

Bug Fixes

run sharp in 1 core when in gatsby worker #33505 (4658b80)

Chores

update sharp #33379 (eb70b46)
remove old unused code #33504 (31952b4)
Remove sizeByPixelDensity option #33468 (d467372)

3.14.3 (2021-11-02)

Note: Version bump only for package gatsby-plugin-sharp

3.14.2 (2021-10-28)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33703 (84053a2)

3.14.1 (2021-10-06)

Note: Version bump only for package gatsby-plugin-sharp

`v3.14.1`

Compare Source

🧾 Release notes

Bug Fixes

run sharp in 1 core when in gatsby worker #33505 (4658b80)

Chores

update sharp #33379 (eb70b46)
remove old unused code #33504 (31952b4)
Remove sizeByPixelDensity option #33468 (d467372)

3.14.3 (2021-11-02)

Note: Version bump only for package gatsby-plugin-sharp

3.14.2 (2021-10-28)

Bug Fixes

pass input buffer instead of readStream when processing image jobs #33685 #33703 (84053a2)

3.14.1 (2021-10-06)

Note: Version bump only for package gatsby-plugin-sharp

`v3.14.0`

Compare Source

🧾 Release notes

Features

Use file streams instead of file paths #33029 (e6d9eb3)

Bug Fixes

Add TS type/v4 patches for unstable_onPluginInit #33062 (8901eb2)
update dependency async to ^3.2.1 for gatsby-plugin-sharp #32983 (6857e26)

Chores

update babel monorepo #32996 (048c7a7)
update semver #32979 (ecf1fa7)
upgrade got package #32928 (2ac366e)
update fs-extra (major) #32654 (eea2687)

Other Changes

Revert "chore(release): Publish next" (a0c4d44)

`v3.13.0`

Compare Source

🧾 Release notes

Features

reduce encoding time and install size #32851 #1 (ddcfbd8)

Chores

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-04T00:25:26Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: @multei/web@0.1.0
npm ERR! Found: react@17.0.1
npm ERR! node_modules/react
npm ERR!   react@"17.0.1" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^16.4.2" from gatsby@2.24.85
npm ERR! node_modules/gatsby
npm ERR!   gatsby@"2.24.85" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-07-12T17_59_26_307Z-debug-0.log

netlify · 2026-02-04T00:25:29Z

❌ Deploy preview failed at Netlify. @jimmyandrade take a look please

Name	Link
🔨 Latest commit	`e3826a1`
🔍 Latest deploy log	https://app.netlify.com/projects/multei/deploys/6a45a5d7d442cf000880e33f

renovate · 2026-07-16T13:07:48Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Copilot

Pull request overview

This PR updates the site’s Gatsby image-processing dependency (gatsby-plugin-sharp) to a patched release that addresses a reported path traversal vulnerability in gatsby develop.

Changes:

Bumps gatsby-plugin-sharp from 2.6.43 to 4.25.1 in package.json.
Targets the security fix referenced in GHSA-h2pm-378c-pcxx / CVE-2023-30548.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jimmyandrade · 2026-07-16T15:37:36Z

    "gatsby-plugin-prefetch-google-fonts": "1.4.3",
    "gatsby-plugin-react-helmet": "3.3.14",
-    "gatsby-plugin-sharp": "2.6.43",
+    "gatsby-plugin-sharp": "4.25.1",


Agreed. I am not applying this package-only bump as-is: gatsby-plugin-sharp@4.x belongs to the Gatsby 4 plugin family while this repo is still on Gatsby 2.x. This needs to be handled together with the Gatsby major upgrade path (see #421), not as an isolated plugin bump.

jimmyandrade · 2026-07-16T15:37:38Z

    "gatsby-plugin-prefetch-google-fonts": "1.4.3",
    "gatsby-plugin-react-helmet": "3.3.14",
-    "gatsby-plugin-sharp": "2.6.43",
+    "gatsby-plugin-sharp": "4.25.1",


Agreed. The lockfile is stale on the original Renovate branch. I am leaving this blocked rather than regenerating a lockfile for an incompatible Gatsby 4 plugin against the current Gatsby 2 stack.

jimmyandrade · 2026-07-16T15:37:39Z

Blocked in oldest-PR triage: gatsby-plugin-sharp@4 is not compatible with the current Gatsby 2 stack. This should be handled as part of the broader Gatsby major upgrade path (#421), not merged as an isolated package bump.

renovate Bot added dependencies renovate labels Feb 4, 2026

renovate Bot requested a review from jimmyandrade February 4, 2026 00:25

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security]~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed Feb 17, 2026

renovate Bot closed this Feb 17, 2026

renovate Bot deleted the renovate/npm-gatsby-plugin-sharp-vulnerability branch February 17, 2026 17:07

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] Feb 17, 2026

renovate Bot reopened this Feb 17, 2026

renovate Bot force-pushed the renovate/npm-gatsby-plugin-sharp-vulnerability branch 2 times, most recently from f004c40 to 1cf513f Compare February 17, 2026 23:54

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security]~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-gatsby-plugin-sharp-vulnerability branch 2 times, most recently from 1cf513f to ae3b0bb Compare March 30, 2026 18:06

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security]~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-gatsby-plugin-sharp-vulnerability branch 2 times, most recently from ae3b0bb to cbd935b Compare April 27, 2026 22:49

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security]~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed Jul 1, 2026

renovate Bot closed this Jul 1, 2026

fix(deps): update dependency gatsby-plugin-sharp to v4 [security]

e3826a1

renovate Bot changed the title ~~fix(deps): update dependency gatsby-plugin-sharp to v4 [security] - autoclosed~~ fix(deps): update dependency gatsby-plugin-sharp to v4 [security] Jul 1, 2026

renovate Bot reopened this Jul 1, 2026

renovate Bot force-pushed the renovate/npm-gatsby-plugin-sharp-vulnerability branch from e3826a1 to cbd935b Compare July 1, 2026 23:42

renovate Bot force-pushed the renovate/npm-gatsby-plugin-sharp-vulnerability branch from cbd935b to e3826a1 Compare July 1, 2026 23:42

jimmyandrade requested a review from Copilot July 16, 2026 13:41

Copilot started reviewing on behalf of jimmyandrade July 16, 2026 13:41 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

jimmyandrade self-assigned this Jul 16, 2026

jimmyandrade added the blocked label Jul 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency gatsby-plugin-sharp to v4 [security]#413

fix(deps): update dependency gatsby-plugin-sharp to v4 [security]#413
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-gatsby-plugin-sharp-vulnerability

renovate Bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jimmyandrade Jul 16, 2026

Uh oh!

jimmyandrade Jul 16, 2026

Uh oh!

jimmyandrade commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Path traversal vulnerability in gatsby-plugin-sharp

Details

Impact

Patches

Workarounds

Credits

For more information

Severity

References

Release Notes

4.23.1 (2022-09-22)

4.23.1 (2022-09-22)

Chores

Chores

Chores

Bug Fixes

Bug Fixes

4.18.1 (2022-07-12)

Bug Fixes

4.18.1 (2022-07-12)

Bug Fixes

4.16.1 (2022-06-08)

4.16.1 (2022-06-08)

Features

Performance Improvements

4.15.1 (2022-06-01)

Features

Performance Improvements

4.15.1 (2022-06-01)

Chores

4.14.1 (2022-05-12)

Chores

4.14.1 (2022-05-12)

Bug Fixes

Features

4.12.1 (2022-04-13)

Features

4.12.1 (2022-04-13)

Bug Fixes

Chores

4.11.1 (2022-03-31)

Bug Fixes

Bug Fixes

Chores

4.11.1 (2022-03-31)

Bug Fixes

Refactoring

4.10.2 (2022-03-23)

4.10.1 (2022-03-18)

Refactoring

4.10.2 (2022-03-23)

4.10.1 (2022-03-18)

Refactoring

4.10.2 (2022-03-23)

4.10.1 (2022-03-18)

Bug Fixes

4.9.1 (2022-03-09)

Bug Fixes

4.9.1 (2022-03-09)

Chores

4.8.2 (2022-03-01)

4.8.1 (2022-02-25)

Chores

4.8.2 (2022-03-01)

4.8.1 (2022-02-25)

Chores

4.8.2 (2022-03-01)

4.8.1 (2022-02-25)

Bug Fixes

Bug Fixes

Bug Fixes

4.5.2 (2022-01-17)

4.5.1 (2022-01-12)

Bug Fixes

4.5.2 (2022-01-17)

4.5.1 (2022-01-12)

renovate Bot commented Feb 4, 2026 •

edited

Loading