fix(agentex-ui): bump sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj)

[scale-prodsec]

Summary

Remediates GHSA-f88m-g3jw-g9cj (HIGH) in sharp, reported by Trivy against the agentex-ui image.

sharp < 0.35.0 inherits four libvips vulnerabilities:

• CVE-2026-33327
• CVE-2026-33328
• CVE-2026-35590
• CVE-2026-35591

sharp 0.35.0+ bundles the fixed libvips 8.18.3.

	Before	After
sharp	0.34.3	0.35.3
bundled libvips (@img/sharp-libvips-*)	1.2.0 (libvips 8.17.x)	1.3.2 (libvips 8.18.3)

Change

sharp is a transitive optionalDependency of next@15.5.18 (declared ^0.34.3, which caps at <0.35.0). It is not a direct dependency and is not imported by application code. It is pinned via the existing npm overrides block in agentex-ui/package.json:

"overrides": {
  "sharp": "^0.35.0"
}

^0.35.0 resolves to the current latest 0.35.3. agentex-ui/package-lock.json was regenerated with npm 10 (matching CI's Node 20 toolchain); the diff is strictly the sharp transitive closure (the @img/sharp-* platform binaries, @img/sharp-libvips-*, @img/colour replacing color, and sharp's own semver/detect-libc floor bumps). No lockfileVersion/format migration, no file-mode changes, no application-code changes.

Transitive-pin safety

next@15.5.18's image optimizer instantiates sharp as sharp(buffer, { limitInputPixels, sequentialRead }) — neither option was removed in 0.35.0. The APIs removed in 0.35.0 (failOnError constructor prop, paletteBitDepth metadata, format.jp2k rename) are not used by next 15.5.18, and the app declares no direct sharp usage nor next/image usage. sharp 0.35.0 requires Node ≥ 20.9.0, satisfied by the node:20-trixie-slim build/runtime base.

Validation

• npm ci in agentex-ui/ — passes (lockfile in sync; CI's exact install gate)
• npm run typecheck (tsc --noEmit) — passes
• Diff-scope verified: only sharp and its closure changed; color family removed cleanly (was consumed only by sharp)

Linear

Resolves GFDVR-20651 — [Trivy] Remediate sharp vulnerabilities
Covers child GFDVR-20652 — GHSA-f88m-g3jw-g9cj in sharp@0.34.3

🤖 Generated with Claude Code

Greptile Summary

Remediates GHSA-f88m-g3jw-g9cj (HIGH) by bumping the transitive sharp dependency from 0.34.3 to 0.35.3, which bundles libvips 8.18.3 and fixes four libvips CVEs (CVE-2026-33327, -33328, -35590, -35591). The pin is applied via npm overrides in package.json, which is the appropriate mechanism for transitive-only dependencies.

• package.json: Adds "sharp": "^0.35.0" to the existing overrides block alongside the existing cross-spawn, postcss, and tar overrides.
• package-lock.json: All @img/sharp-* platform binaries move from 0.34.3 → 0.35.3 and @img/sharp-libvips-* from 1.2.0 → 1.3.2; color is cleanly replaced by @img/colour; minor floor bumps to detect-libc and semver. No application code or lockfileVersion changes.

Confidence Score: 5/5

Safe to merge — this is a targeted transitive dependency pin with no application code changes and a well-scoped lockfile diff.

The change is limited to a transitive sharp bump via npm overrides. No application code is touched, the lockfile diff is internally consistent (all @img/sharp-* and @img/sharp-libvips-* entries move together), and the removed color package is correctly replaced by @img/colour as expected in sharp 0.35.x. The new Node ≥ 20.9.0 engine constraint is satisfied by the project's existing node:20 runtime base.

Files Needing Attention: No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Adds "sharp": "^0.35.0" to the existing npm overrides block — the correct mechanism for pinning a transitive optional dependency without declaring it as a direct dependency.
agentex-ui/package-lock.json	Lockfile regenerated to reflect sharp 0.34.3 → 0.35.3 and the full transitive closure: @img/sharp-* platform binaries bumped to 0.35.3, @img/sharp-libvips-* to 1.3.2, color replaced by @img/colour, detect-libc 2.0.4 → 2.1.2, semver 7.7.2 → 7.8.5, and new platform entries added (riscv64, freebsd-wasm32, webcontainers-wasm32). Changes are internally consistent and scoped exclusively to the sharp closure.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into scale-prodsec/g..." | Re-trigger Greptile}