From 72a23bd5f023ccc90f6b4cdd17e94bac32054bf3 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:58:51 -0700 Subject: [PATCH] fix(selfhost): stop pinning sharp's Dockerfile install, let overrides resolve it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #8112. release-selfhost.yml's multi-arch build started failing on every release attempt with "npm error code EOVERRIDE: Override for sharp@0.34.5 conflicts with direct dependency". The Dockerfile hardcodes a standalone `npm install sharp@` (esbuild marks sharp external in the self-host bundle, so it can't ship inside dist/server.mjs); #7970's dependency bump moved package.json's sharp to ^0.35.0 and added a matching overrides.sharp entry, but a Dependabot-style bump has no way to also update a version hardcoded inside a Dockerfile RUN command, so this line silently drifted. Re-pinning to the exact resolved version (sharp@0.35.3) still fails identically: recent npm treats an explicit CLI version and an `overrides` entry for the SAME package as two competing authorities and refuses to pick between them, regardless of whether the versions actually agree. Verified locally (both a standalone `npm install` and a full `docker build --no-cache --target runtime-base`) that dropping the version entirely and letting npm resolve from package.json's overrides — the real source of truth for this version, already kept current by Dependabot/Renovate — builds cleanly to the same 0.35.3. --- Dockerfile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b7db9948bc..ed371d4e47 100644 --- a/Dockerfile +++ b/Dockerfile @@ -75,7 +75,14 @@ RUN if [ "$INSTALL_VISUAL_REVIEW" = "true" ]; then npm install puppeteer-core@22 # is safe here: sharp's own platform binary ships as an npm `optionalDependencies` entry # (@img/sharp--) that npm's normal os/cpu-matched install resolves on its own, not via # sharp's postinstall script. -RUN npm install sharp@0.34.5 --ignore-scripts +# UNVERSIONED deliberately (#8112): an explicit `sharp@` here — even one that matches package.json's +# own `overrides.sharp` entry exactly — makes npm refuse with EOVERRIDE ("Override for sharp@X conflicts with +# direct dependency"), since an explicit CLI version and an `overrides` entry for the SAME package are treated +# as two competing authorities npm won't silently pick between. Letting npm resolve from `overrides` (the +# repo's actual source of truth for this version, kept in sync by Dependabot/Renovate) is what a hardcoded pin +# here can never be — this broke the release pipeline (#8112) exactly when `overrides.sharp` moved to ^0.35.0 +# and this line's own pin didn't move with it. +RUN npm install sharp --ignore-scripts # Data dir (the SQLite file) — owned by the unprivileged node user; mount a volume here to persist. RUN mkdir -p /data && chown -R node:node /data /app # Expose the optional user-installed CLIs only after all root build steps have completed, so a