fix: pin rollup binary and sharp to resolve npm install and GoCD GLIBC failures - #76
Merged
Merged
Conversation
npm's arborist crashes with 'Cannot read properties of null (reading edgesOut)' when resolving the peer dep graph for nuxt + @nuxt/image. The root cause is ipx@4.0.0-beta.1 (pulled in by @nuxt/image) requiring sharp as a peer dep — arborist dies mid-resolution building nuxt's peer set without a concrete version pinned. Adding sharp@0.35.3 to overrides gives the resolver a fixed answer upfront and plain npm install works without any flags.
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
✅ BUILD PASSED - All security checks passed |
OMpawar-21
approved these changes
Jul 30, 2026
maheshmotkar-cs
approved these changes
Jul 30, 2026
abhishek-ezhava-cstk
approved these changes
Jul 30, 2026
cs-raj
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problems Fixed
1. GoCD CI failure — GLIBC_2.32 not found
`@rollup/rollup-linux-x64-gnu@4.62.3` introduced a GLIBC_2.32 requirement. GoCD's Linux agent only has GLIBC_2.31, causing `nuxt prepare` to fail with:
```
GLIBC_2.32' not found (required by rollup-linux-x64-gnu/rollup.linux-x64-gnu.node)
```
Fix: Pin `@rollup/rollup-linux-x64-gnu` and `@rollup/rollup-linux-x64-musl` to `^4.62.2` in `optionalDependencies`. The committed `package-lock.json` locks both to exactly `4.62.2` (GLIBC_2.14 only), preventing npm from ever resolving to `4.62.3`.
2. npm install crash — `Cannot read properties of null (reading 'edgesOut')`
npm's arborist crashes on fresh installs due to `@nuxt/image` pulling in `ipx@4.0.0-beta.1`, which declares `sharp` as a peer dep. Without a concrete version pinned, arborist dies mid-resolution building nuxt's peer set.
Fix: Add `"sharp": "0.35.3"` to `overrides`, giving the resolver a fixed answer upfront.
Changes
1.1.21.1.3@contentstack/delivery-sdk^5.4.0^5.5.0@nuxt/image^2.0.0^2.1.0nuxt^4.5.0^4.5.1brace-expansionoverride5.0.75.0.9sharpoverride0.35.3@rollup/rollup-linux-x64-gnu^4.62.3^4.62.2@rollup/rollup-linux-x64-musl^4.62.3^4.62.2Test plan
npm installcompletes without errors (no--legacy-peer-depsneeded)npm run buildsucceedsnpm run devstarts without issues