chore(deps)(deps): bump sharp and astro

[dependabot]

Bumps sharp to 0.35.3 and updates ancestor dependency astro. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates astro from 6.4.8 to 7.1.4

Release notes

Sourced from astro's releases.

astro@7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

• #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

• #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

• #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

• #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

• #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

astro@7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

• #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

• #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

• #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

• #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

• #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

... (truncated)

Commits

• 112d3ea [ci] release (#17469)
• 82bf7e2 fix(astro): hide console window for background dev server on Windows (#17517)
• 0fc519d fix(css): preserve styles for child components of client:only islands during ...
• d4f266d fix(build): deduplicate CSS assets between prerender and SSR environments (#1...
• fbffc96 Fix Container API build errors when using the Cloudflare adapter's workerd pr...
• eaa1fb0 Fix glob() loader watcher ignoring negation patterns, causing unrelated files...
• 704e570 Fix tsconfig path aliases not resolving in astro.config.ts (#17418) (#17511)
• 898f008 chore: use star import consistently (#17473)
• 8e2b64b [ci] format
• f1448de fix(sessions): route session diagnostics through AstroLogger and reset partia...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

Security review — PR #218

Result: No high-confidence vulnerabilities introduced by this PR.

This is a dependency-only change (astro ^6.4.8 → ^7.1.4 plus lockfile refresh). No application source, config, or workflow files were modified.

---

Confirmed: security posture improves

npm audit on a clean npm ci install shows three high-severity Astro XSS advisories on astro@6.4.8 (base) that are absent on astro@7.1.4 (this PR):

1. Reflected XSS via unescaped View Transition animation properties
2. XSS via unescaped spread attribute names in renderHTMLElement (CVE-2026-59729; incomplete fix for CVE-2026-54298)
3. XSS via unescaped transition:* directive values on hydrated islands

Upgrading to 7.1.4 (≥ 7.0.6) addresses these framework-level issues.

---

Pre-existing supply-chain note (not introduced here)

The PR title mentions sharp, but the resolved transitive version is unchanged at sharp@0.34.5 on both base and head. npm audit still reports inherited libvips CVEs (GHSA-f88m-g3jw-g9cj; fixed in sharp ≥ 0.35.0). This is a residual, pre-existing build-time advisory — not a regression from this diff.

Exposure context: The site is static SSG (no output: 'server', no middleware). Production is GitHub Pages static assets; sharp is only reachable during local/CI astro build/dev, not in the deployed runtime. No astro:assets / <Image> usage was found in src/.

---

Uncertain / low-risk observations (no action required for merge from a security standpoint)

Area	Assessment
Injection / auth bypass / SSRF / XSS in app code	No code changes; no new attack surface in application logic
Astro 7 supply chain	Major bump pulls in new build-time native/WASM packages (@astrojs/compiler-rs, @astrojs/compiler-binding, markdown-satteri). Expected for a framework major; no suspicious or unexpected packages observed
SSR-specific Astro CVEs (image SSRF, middleware auth bypass)	Not applicable to this static deployment model

---

Optional follow-up (out of scope for this PR)

• Track a separate Dependabot bump to sharp ≥ 0.35.0 when Astro resolves it transitively.
• Run the full test suite (make test / CI) before merge — major-version framework upgrades are a functional, not security, gate.

---

Automated security review — dependency diff + npm audit comparison + static-site exposure analysis.

  

_{Sent by Cursor Automation: Find vulnerabilities}