chore: bump sharp to 0.35.4, align eslint-config-next, finish the rename

[zerotrustdavid]

Closes the last of the four advisories open before Dependabot #14, and clears the three stale references left by the repository rename.

sharp 0.34.5 → 0.35.4

Why this was still outstanding. #14 bumped next but not sharp. #15 carried the sharp half and was closed unmerged after conflicting with #14. next@16.3.3 declares optionalDependencies: sharp ^0.35.3, so Next got a patched nested copy while the root devDependency stayed at ^0.34.5 — which resolves to >=0.34.5 <0.35.0 and cannot admit it.

The lockfile on main carried two copies:

node_modules/sharp                    0.34.5   vulnerable
node_modules/next/node_modules/sharp  0.35.4   patched, used only by next

The vulnerable one was the copy that mattered. scripts/generate-brand-assets.mjs imports the bare specifier "sharp", which Node resolves to the root copy. The brand pipeline was running on the unpatched libvips.

Bumping the root declaration collapses both to a single 0.35.4.

	before	after
sharp copies	2	1
npm audit high	4 → 2 (after #14)	1

eslint-config-next 16.2.12 → 16.3.3

Pinned to an exact version, so it lagged next by a minor after #14. Aligned.

Rename

Three stale references, all cosmetic, neither affecting behaviour:

File	Was
package.json:2	"name": "invision-solutions-website"
.gitleaks.toml:1	comment header
.gitleaks.toml:2	title = "invision-solutions-website"

The package is private: true so the name is never published, and the gitleaks title is a label in scan output. Corrected here rather than left to drift.

The brand assets across a libvips major

sharp 0.35.4 brings libvips 8.18.6, and the fifteen files in public/brand/ are rasterised by it. This is the change that most plausibly alters published artwork.

All fifteen reproduce byte-identically.

That claim is worth something now, where it would not have been a week ago, for two reasons:

1. fix: resolve the brand webfont by family, and guard the assets in CI #17 repaired the generator, so npm run brand actually runs. It had been silently broken since before harden: remove the operational runbook, add CI, security headers and licence #13, which is why the same claim in that review was wrong.
2. fix: resolve the brand webfont by family, and guard the assets in CI #17 added the CI guard, so git diff --exit-code public/brand/ is enforced on every PR rather than depending on someone remembering to check.

The gate was manual when this PR was planned. It is no longer: the assertion runs in CI on this PR.

Remaining advisory, accepted

nanoid stays open. Installable 3.3.16, earliest fixed 3.3.18, constrained transitively by @tailwindcss/postcss and next. Dependabot states plainly that it cannot update it.

Build-time only, nothing in this project calls nanoid directly, and the advisory is an infinite loop when a custom generator is called with size zero. Accepted with the constraint named, not an oversight. Worth re-checking once postcss moves again; failing that, an overrides entry, which the alert itself suggests.

Verified

Check	Result
npm install	clean, single sharp at 0.35.4, libvips 8.18.6
npm run check:install-scripts	PASS
npm run lint	clean
npx tsc --noEmit	clean
npm run build	clean
npm run brand	15 files, byte-identical
npm audit	1 high (nanoid), down from 4

Re-verified on the current base after #17 and #18 merged, not only on the branch as first written.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
invisionsolutions	Ready	Preview	Aug 27, 2026 12:14am