[Aikido] Fix security issue in sharp via minor version upgrade from 0.34.5 to 0.35.3

[aikido-autofix]

Upgrade sharp to fix high-severity vulnerabilities in libvips affecting GIF, TIFF, and VIPS image processing.

✅ Code not affected by breaking changes.

✅ No breaking changes from the sharp 0.34.5 to 0.35.0 upgrade affect this codebase.

The package sharp is present only as an optional dependency of Astro (found in package-lock.json), but:

• The codebase does not directly import or use sharp in any source files

• The codebase does not use Astro's Image or Picture components that would trigger sharp usage

• The codebase does not use any of the deprecated features (failOnError, paletteBitDepth, deprecated sharpen properties, or format.jp2k)

• The project already requires Node.js >= 22.18.0 (per package.json), which exceeds sharp 0.35.0's requirement of Node.js >= 20.9.0

Since sharp is not actively used in this codebase, none of the breaking changes (Node.js version requirement, removed deprecated APIs, or format renaming) will cause any issues.

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.3 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-f88m-g3jw-g9cj	HIGH	[sharp] Multiple high-severity vulnerabilities in upstream libvips dependency allow remote code execution when processing untrusted image input (GIF, TIFF, VIPS formats).

🤖 Remediation details

Fix GHSA-f88m-g3jw-g9cj: upgrade sharp to patched version via astro parent bump

• Resolves a HIGH-severity vulnerability in the transitive dependency sharp, which was being pulled in at the vulnerable version 0.34.5 through astro.
• Changes are applied to the root package.json (two declared dependency version specs updated) and reflected in package-lock.json (lockfile refreshed via npm install --package-lock-only).

sharp

sharp is a transitive optional dependency introduced by astro; it is not declared directly in the project's package.json. The installed version 0.34.5 falls within the vulnerable range addressed by GHSA-f88m-g3jw-g9cj, and the patched floor is 0.35.0. astro@6.x declared sharp as ^0.34.0, which could not resolve to 0.35.0; astro@7.0.4 widened the spec to ^0.34.0 || ^0.35.0, allowing npm to resolve sharp to 0.35.3. To land this fix, astro was bumped from ^6.1.6 to ^7.0.4 in package.json. Because @astrojs/vercel@10.x carries a peer-dependency constraint of astro ^6.0.0, it was also bumped to ^11.0.0 (which requires astro ^7.0.0) to maintain a consistent, peer-valid dependency tree alongside the astro major upgrade.

Version changes

Package	From	To	Why updated
astro	^6.1.6 (resolved 6.1.6)	^7.0.4 (resolved 7.2.4)	Parent bump required to fix transitive sharp CVE
@astrojs/vercel	^10.0.6 (resolved 10.0.6)	^11.0.0 (resolved 11.0.7)	Peer dep on astro ^6.0.0 incompatible with astro v7; v11 targets astro ^7.0.0
sharp	0.34.5	0.35.3	Transitive CVE fix — resolved to patched version after astro parent bump

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
visdom-main-page	Error		Aug 22, 2026 11:55pm