The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 22, 2026 5:20pm

PR Summary

Low Risk
Dependency patch upgrades with a small type-only sharp change; image pipeline logic is unchanged and was covered by existing tests.

Overview
Addresses Dependabot security alerts by upgrading js-yaml 4.2.0 → 4.3.0 (merge-key CPU exhaustion) and sharp 0.34.3 → 0.35.3 (libvips CVEs via updated native binaries). Lockfile changes follow the apps/sim dependency pins.

sharp 0.35 uses ESM-first typings where the default export is no longer typed as a callable module namespace. Copilot VFS image prep in file-reader.ts now types the lazy-loaded default as SharpConstructor (type-only import); runtime behavior is unchanged ((await import('sharp')).default).

^{Reviewed by Cursor Bugbot for commit 560b66d. Configure here.}

Greptile Summary

This PR updates two Sim dependencies to security-patched releases. The main changes are:

• Upgrade js-yaml from 4.2.0 to 4.3.0.
• Upgrade Sharp from 0.34.3 to 0.35.3 with new libvips binaries.
• Update the lazy Sharp loader’s constructor type.
• Refresh the Bun lockfile dependency graph.

Confidence Score: 4/5

The Sharp type export should be confirmed against a fresh install before merging.

• The runtime lazy-load behavior is unchanged.
• The direct dependency versions resolve to the intended patched releases.
• A missing named type export would block TypeScript and application builds.

apps/sim/lib/copilot/vfs/file-reader.ts

Important Files Changed

_{Reviews (1): Last reviewed commit: "chore: fix import order in file-reader" | Re-trigger Greptile}