v1.5.8

A security patch for the 1.5 line, clearing two npm advisories reported against the web image. Neither was exploitable in v1.5.7 — both are bumped so a scan of the published image comes back clean.

Security

• sharp 0.35.3 → 0.35.4, clearing GHSA-rgj7-g3m4-5g8c (HIGH) — vulnerabilities in libheif.

  sharp is present in the terrapod-web image because Next.js bundles it for image optimisation. Terrapod never invokes that path: there is no next/image usage anywhere in the frontend, no remotePatterns or domains configured, and no image-upload surface. The affected HEIF decoder is therefore never handed input. It is bumped because the package is physically in the image, so an operator scanning it sees a HIGH regardless of reachability — and checking that is work we would rather do once, here, than ask everyone to repeat.

• js-yaml 4.3.1 → 4.3.2, clearing GHSA-2883-xcg3-v3hh (HIGH) — CPU exhaustion via YAML merge keys.

  Build-time only. js-yaml is not present in any published image; it appears in the lockfile as a transitive dependency of the build tooling, which is where a source scan sees it.

Both were already pinned upward via npm overrides, and package.json is unchanged — the declared ranges already admitted the fixed versions, so this is a lockfile bump alone.

Upgrading

A drop-in change: no API, wire-protocol, configuration, Helm-value or database-schema change, and nothing to do but take the new images.

Status

Stable, and in security-fix-only support. 1.6 is the current line; it receives the same fix as v1.6.3.

Full Changelog: v1.5.7...v1.5.8