CVE-2023-4863 - Upgrade Sharp

[Asheboy]

Link to reproduction

No response

Describe the Bug

CVE-2023-4863 affects libwebp which, if using the pre-built binaries, affects Sharp. See lovell/sharp#3798 for details.

To Reproduce

I ran npx create-payload-app and the following:

[ 16:05:04 ] ❯ yarn why payload
yarn why v1.22.19
[1/4] Why do we have the module "payload"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "[email protected]"
info Has been hoisted to "payload"
info This module exists because it's specified in "dependencies".
info Disk size without dependencies: "20.28MB"
info Disk size with unique dependencies: "194.75MB"
info Disk size with transitive dependencies: "275.79MB"
info Number of shared dependencies: 187
Done in 1.98s.

✦ [ 15:59:54 ] ❯ yarn why sharp
yarn why v1.22.19
[1/4] Why do we have the module "sharp"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "payload" depends on it
   - Hoisted from "payload#sharp"
info Disk size without dependencies: "17.09MB"
info Disk size with unique dependencies: "18.07MB"
info Disk size with transitive dependencies: "19.53MB"
info Number of shared dependencies: 25
Done in 0.53s.

Payload Version

2.0.10

Adapters and Plugins

sharp

[github-actions]

This issue has been automatically locked.
Please open a new issue if this issue persists with any additional detail.