security: Libvips Native Vulnerabilities Remediation

[Aditya8369]

1. Package Lock Resolution Verification
   Checked package-lock.json for all sharp and @img/sharp-libvips-* package entries.
   sharp: All 17 target platform packages (e.g. @img/sharp-win32-x64, @img/sharp-linux-x64, @img/sharp-darwin-arm64, etc.) resolve strictly to version 0.35.3.
   @img/sharp-libvips-*: All 10 native platform packages (e.g. @img/sharp-libvips-linux-x64, @img/sharp-libvips-darwin-arm64, @img/sharp-libvips-linux-arm64, etc.) resolve strictly to version 1.3.2.
2. pnpm-lock.yaml Removal Verification
   Verified that pnpm-lock.yaml is permanently absent from the repository workspace.
3. Syntax Fix & Vulnerability Audit Validation
   Fixed a formatting syntax error in package.json
   inside the overrides block (missing trailing comma and duplicate key).
   Executed npm audit:

closes #1563

Summary by CodeRabbit

• Chores
  • Updated an internal build-time package version.
• Refactor
  • Improved code formatting for background processing without changing functionality.

[vercel]

@Aditya8369 is attempting to deploy a commit to the csxark's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

🎉 Thank You for Your Contribution

Hello @Aditya8369,

Thank you for submitting a Pull Request to CryptoViz. We appreciate the time and effort you've invested in contributing to the project.

Your Pull Request has been received successfully and will be reviewed by the maintainers as soon as possible.

📋 Pull Request Checklist

• ✅ Linked the related issue
• ✅ No merge conflicts
• ✅ Synced with the latest main branch
• ✅ Build passes successfully
• ✅ All tests pass

Ensuring these requirements are met helps streamline the review process and enables maintainers to review your contribution more efficiently.

❤️ Support CryptoViz

If you find CryptoViz helpful, consider supporting the project by:

• ⭐ Starring the repository
• 🍴 Forking the repository
• 👤 Following Ark on GitHub
• 💼 Connecting on LinkedIn
• 🌐 Visiting the Portfolio

Your support helps increase the project's visibility and encourages continued development. Thank you for being a part of the CryptoViz community!

Thank you once again for contributing to CryptoViz. We appreciate your support and look forward to reviewing your contribution.

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f17fbd5b-75a3-489b-a584-d8b70e034f72

📥 Commits

Reviewing files that changed from the base of the PR and between 264d746 and 3988f68.

📒 Files selected for processing (2)

• lib/workers/cryptoWorkerClient.ts
• package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c1cbd8f-37fe-4070-9360-759f13c6c4ee

📥 Commits

Reviewing files that changed from the base of the PR and between 264d746 and 3988f68.

📒 Files selected for processing (2)

• lib/workers/cryptoWorkerClient.ts
• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change reformats worker initialization and updates the postcss override in package.json. No worker behavior or public declarations change.

Changes

Worker formatting

Layer / File(s)	Summary
Worker initialization formatting lib/workers/cryptoWorkerClient.ts	The Worker creation and onmessage handler assignment now use separate lines. Behavior is unchanged.

Dependency override

Layer / File(s)	Summary
PostCSS override update package.json	The postcss override updates from ^8.5.15 to ^8.5.26. The nanoid entry is reordered after it.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 3988f

This PR updates vulnerable dependency resolutions and makes a localized worker initialization change without altering public behavior or system boundaries. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: csxark, jidnyasa-p

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title claims remediation of Libvips native vulnerabilities, but the summarized changes only reformat worker initialization and update the postcss override. No sharp, @img/sharp-libvips-*, `p…	Update the title to describe the actual changes, or include the required Sharp/Libvips dependency and lockfile remediation changes.
Linked Issues check	⚠️ Warning	The pull request does not demonstrate the requirements in issue #1563. The summary does not show removal of pnpm-lock.yaml, regeneration of package-lock.json, or upgrades to sharp@0.35.3 and `@i…	Add the required lockfile changes and verify the patched Sharp and Libvips versions, removal of pnpm-lock.yaml, and resolution of GHSA-3759-38w2-5q59.
Out of Scope Changes check	⚠️ Warning	The worker reformatting is unrelated to issue #1563. The postcss override update is also unrelated to the stated Sharp/Libvips remediation, while the required security changes are not shown.	Remove the unrelated worker and postcss changes, or provide a linked objective for them. Keep this pull request focused on the Sharp/Libvips dependency and lockfile remediation.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Title check

Explanation

The title claims remediation of Libvips native vulnerabilities, but the summarized changes only reformat worker initialization and update the postcss override. No sharp, @img/sharp-libvips-*, package-lock.json, or pnpm-lock.yaml change is shown.

Full details: Linked Issues check

Explanation

The pull request does not demonstrate the requirements in issue #1563. The summary does not show removal of pnpm-lock.yaml, regeneration of package-lock.json, or upgrades to sharp@0.35.3 and @img/sharp-libvips-* 1.3.2.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 Pull Request Merged

Hello @Aditya8369,

Thank you for your contribution to CryptoViz. Your Pull Request has been reviewed and successfully merged into the project.

We sincerely appreciate the time and effort you invested in improving the project. Contributions like yours help make CryptoViz better for the entire community.

We look forward to your future contributions and hope to collaborate with you again.

❤️ Support CryptoViz

If you find CryptoViz helpful, consider supporting the project by:

• ⭐ Starring the repository
• 🍴 Forking the repository
• 👤 Following Ark on GitHub
• 💼 Connecting on LinkedIn
• 🌐 Visiting the Portfolio

Your support helps increase the project's visibility and encourages continued development. Thank you for being a part of the CryptoViz community!