fix(deps): update dependency sharp to v0.35.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sharp (source, changelog)	0.34.5 → 0.35.4

---

Release Notes

lovell/sharp (sharp)

v0.35.4

Compare Source

:::note[Dependency versions]
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
:::

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit.
  #​4564
  @​metsw24-max

• Round palette bit depth up for png and gif colours.
  #​4569
  @​metsw24-max

• Ensure tiff.subifd input option is used.
  #​4572
  @​metsw24-max

• Ensure info.pages is correct when limiting input page range.
  #​4578
  @​metsw24-max

• Improve support for input Streams finishing before output is requested.
  #​4584
  @​Jaybhade

v0.35.3

Compare Source

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info.
  #​4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer.
  #​4520
  @​Andarist

• Bound clahe width and height to avoid signed overflow.
  #​4551
  @​metsw24-max

• Bound trim margin to avoid signed overflow.
  #​4552
  @​metsw24-max

• Reject infinite values when validating numbers.
  #​4553
  @​metsw24-max

• Bound extract region to libvips coordinate limit.
  #​4555
  @​metsw24-max

• Verify background colour values are numbers.
  #​4556
  @​metsw24-max

• Bound create and raw input dimensions to coordinate limit.
  #​4558
  @​metsw24-max

• Tighten recomb and affine matrix verification.
  #​4560
  @​chatman-media

• Verify cache memory limit to avoid overflow.
  #​4561
  @​metsw24-max

v0.35.2

Compare Source

v0.35.1

Compare Source

• TypeScript: Ensure type definitions are published for both ESM and CJS.
  #​4537

• WebAssembly: Ensure wrapper file is published.
  #​4538

v0.35.0

Compare Source

• Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

• Breaking: Remove install script from package.json file.
  Compiling from source is now opt-in via the build script.

• Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

• Breaking: Add limitInputChannels with a default value of 5.

• Breaking: Remove deprecated failOnError constructor property.

• Breaking: Remove deprecated paletteBitDepth from metadata response.

• Breaking: Remove deprecated properties from sharpen operation.

• Breaking: Rename format.jp2k as format.jp2 for API consistency.

• Upgrade to libvips v8.18.3 for upstream bug fixes.

• Remove experimental status from WebAssembly binaries.

• Add prebuilt binaries for FreeBSD (WebAssembly).

• Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

• Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

• Add AVIF/HEIF tune option for control over quality metrics.
  #​4227

• Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps.
  #​4314

• Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer.
  #​4355

• Require prebuilt binaries using static paths to aid code bundling.
  #​4380

• TypeScript: Ensure FormatEnum keys match reality.
  #​4475

• Add margin option to trim operation.
  #​4480
  @​eddienubes

• Ensure HEIF primary item is used as default page/frame.
  #​4487

• Add image Media Type (MIME Type) to metadata response.
  #​4492

• Add withDensity to set output density in EXIF metadata.
  #​4496

• Improve pkg-config path discovery.
  #​4504

• Add WebP exact option for control over transparent pixel colour values.

• Add support for ECMAScript Modules (ESM).
  #​4509
  @​florian-lefebvre

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code EMISSINGTARGET
npm error Missing target in lock file: "dev-docs" is referenced by "node_modules/dev-docs" but does not exist.
npm error To fix:
npm error 1. rm package-lock.json
npm error 2. npm install
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-03T22_17_26_308Z-debug-0.log