You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/04/07 23:57:34 UTC
[PR] Fix build-bootstrap by resolving ICU dependency for dart-sass (tooling-trusted-releases)
andrewmusselman opened a new pull request, #1143:
URL: https://github.com/apache/tooling-trusted-releases/pull/1143
## Fix build-bootstrap by resolving ICU dependency for dart-sass
Fixes #1138
`make build-bootstrap` fails because `dart-sass` from Alpine edge/testing depends on `libicuuc.so.78`, but the Alpine 3.23 base image only ships ICU 76.
The fix adds edge/main as a repository alongside edge/testing in the same `apk add` command, so apk can resolve the ICU 78 dependency automatically.
### Security notes
- The only known ICU CVE (CVE-2025-5222) affects the `genrb` build tool, not the runtime libraries. The bootstrap container does not ship or use `genrb`.
- `npm audit` reports lodash-es vulnerabilities in the mermaid 11.4.1 dependency chain. Dependabot has an open PR bumping mermaid to 11.14.0 which resolves these.
## Rebase info
```bash
$ git fetch upstream main
From github.com:apache/tooling-trusted-releases
* branch main -> FETCH_HEAD
$ git rebase upstream/main
Current branch build-bootstrap-1138 is up to date.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [PR] Fix build-bootstrap by resolving ICU dependency for dart-sass (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed pull request #1143: Fix build-bootstrap by resolving ICU dependency for dart-sass
URL: https://github.com/apache/tooling-trusted-releases/pull/1143
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [PR] Fix build-bootstrap by resolving ICU dependency for dart-sass (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on PR #1143:
URL: https://github.com/apache/tooling-trusted-releases/pull/1143#issuecomment-4206714250
Blocked and deprecated by #1145. Let's fix this in the way suggested in there, unless we can figure out a better approach meanwhile.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org