chore: upgrade sharp to 0.35.4 to address GHSA-rgj7-g3m4-5g8c, CVE-2026-84383, GHSA-2jg2-4ch7-h545

[claude]

Fixes SOU-2196

Summary

Refreshes the yarn.lock entries for sharp from 0.35.3 to 0.35.4 to address GHSA-rgj7-g3m4-5g8c, which covers the bundled libheif vulnerabilities CVE-2026-84383 (GHSA-g89c-p67h-r497) and GHSA-2jg2-4ch7-h545. Two of these are rated Critical upstream and can lead to remote code execution on glibc-based Linux when decoding untrusted HEIF/AVIF input.

sharp 0.35.4 ships the prebuilt @img/sharp-libvips-* binaries at 1.3.3, which bundle the patched libheif 1.23.2.

This is a lockfile-only change. packages/web declares sharp: ^0.35.3 and the root sharp@npm:^0.34.5 resolution maps to ^0.35.3; both already admit 0.35.4, so no package.json change and no new resolutions override are needed.

Verification

yarn why sharp — every instance, including the ones Next.js requests, resolves to the patched version:

├─ @sourcebot/web@workspace:packages/web
│  └─ sharp@npm:0.35.4 (via npm:^0.35.3)
├─ next@npm:16.3.3
│  └─ sharp@npm:0.35.4 (via npm:^0.35.3)
├─ next@npm:16.3.3 [1a4ed]
│  └─ sharp@npm:0.35.4 (via npm:^0.35.3)
└─ next@npm:16.3.3 [7c8a9]
   └─ sharp@npm:0.35.4 (via npm:^0.35.3)

Confirmed the patched libheif is actually what loads at runtime:

$ yarn node -e "const sharp=require('sharp'); console.log(sharp.versions.sharp, sharp.versions.vips, sharp.versions.heif)"
sharp 0.35.4 vips 8.18.6 heif 1.23.2

• yarn install clean
• yarn test — 2153 tests passed across all 4 workspaces

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only dependency bump with no application code changes; residual risk is limited to native image-processing behavior in Next.js/sharp paths after deploy.

Overview
Bumps sharp from 0.35.3 to 0.35.4 via yarn.lock only (existing ^0.35.3 ranges already allow this). The lockfile refresh also moves bundled @img/sharp-libvips-* prebuilds to 1.3.3 (patched libheif).

This addresses GHSA-rgj7-g3m4-5g8c and related CVE-2026-84383 / GHSA-2jg2-4ch7-h545 (critical RCE risk when decoding untrusted HEIF/AVIF on glibc Linux). CHANGELOG adds a Fixed entry for the upgrade.

^{Reviewed by Cursor Bugbot for commit c713234. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades sharp from 0.35.3 to 0.35.4 in yarn.lock and adds a CHANGELOG entry. This fixes GHSA-rgj7-g3m4-5g8c plus the related CVE-2026-84383 and GHSA-2jg2-4ch7-h545, which are critical remote code execution risks when decoding untrusted HEIF/AVIF input on glibc-based Linux.

• Lockfile-only change; existing ^0.35.3 ranges already admit 0.35.4, so no package.json edits or resolutions overrides are needed.
• 0.35.4 ships @img/sharp-libvips-* 1.3.3 binaries bundling patched libheif 1.23.2.
• All resolved instances, including Next.js's, land on 0.35.4.
• yarn install is clean and the full test suite (2153 tests) passes.

^{Written for commit c713234. Summary will update on new commits.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2174
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	bundled LICENSE file in node_modules (full Apache-2.0 text); npm registry declares Apache-2.0 for sibling version 4.0.1
khroma	2.1.0	UNKNOWN	MIT	bundled license file in node_modules (MIT text, Copyright Fabio Spampinato)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	bundled LICENSE file in node_modules (full Apache-2.0 text); npm registry declares Apache-2.0 for sibling version 1.1.3
map-stream	0.1.0	UNKNOWN	MIT	bundled LICENCE file in node_modules (MIT text); npm registry declares MIT
memorystream	0.3.1	UNKNOWN	MIT	extracted from object - npm registry licenses: [{type: "MIT"}]; confirmed by bundled LICENSE file (MIT text)
pause-stream	0.0.11	MIT,Apache2	MIT OR Apache-2.0	extracted from array license field ["MIT","Apache2"]; bundled LICENSE states "Dual Licensed MIT and Apache 2"
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0 AND MIT	bundled LICENSE file (Apache-2.0 grant plus bundled third-party MIT notices); npm registry declares "(Apache-2.0 AND MIT)"
valid-url	1.0.9	UNKNOWN	MIT	bundled LICENSE file in node_modules (MIT text)