[roely15mol]

Hi @kingsword09,

First off, thank you for creating and maintaining this project! We really enjoy using the ZCode CLI in our developer workflows and sandboxed agent environments.

While running security scans with Trivy against container installations, we encountered vulnerability findings stemming from older bundled sub-dependencies:

• sharp (0.34.5) flags GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w, and GHSA-f88m-g3jw-g9cj (libheif/librsvg/libvips CVEs). Adding an override for "sharp": ">=0.35.5" (matching the existing undici override pattern in package.json) resolves these scanner errors.
• Also updated direct dependencies:
  • @earendil-works/pi-tui: ^1.3.0 -> ^1.4.0
  • yaml: ^2.8.1 -> ^2.9.0
  • acorn: ^8.15.0 -> ^8.18.0

Validation:

• bun run typecheck passes cleanly
• bun run build succeeds
• bun.lock updated cleanly via bun install

Thanks again for the great work on zcode-cli!

[kingsword09]

Thanks for the contribution and for flagging these security findings!

After reviewing the changes, I don’t think we should merge this PR as-is:

• The root sharp override does not update the copies bundled under vendor/packages/*/node_modules. Those are copied directly from the upstream Desktop artifact, outside the root dependency graph, so the affected copies would remain in the published package.
• The pi-tui upgrade also needs to update packages/zcode-tui/package.json:10. The current mismatch causes our release package validation to fail.
• The lockfile already resolves acorn to 8.18.0 and yaml to 2.9.0, so those range changes do not change the installed versions.

For the bundled sharp dependencies, I’d prefer to pursue a fix in the upstream Desktop/plugin packaging pipeline, then adopt and validate the corrected artifact here. This doesn’t mean the scanner findings are invalid—only that the override in this PR doesn’t address them.

If you’d like to continue with the pi-tui upgrade, please split it into a focused PR with both manifests kept consistent. Reporting the bundled sharp findings upstream would also be helpful.

Thanks again for bringing this to our attention!

[roely15mol]

Thanks again for the thorough review, @kingsword09 — all points taken. Closing this in favor of the split-out work:

• Focused pi-tui upgrade with both manifests kept in sync: fix(deps): bump @earendil-works/pi-tui to ^1.4.0 (both manifests in sync) #233
• Bundled sharp@0.34.5 findings written up for the upstream Desktop/plugin packaging pipeline: Bundled sharp 0.34.5 in vendor/packages/*/node_modules triggers known CVE findings (libvips / libheif / librsvg) #234

Happy to help validate a corrected Desktop artifact with our Trivy setup whenever one is available.