[Snyk] Security upgrade sharp from 0.32.6 to 0.35.4

[sestinj]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• core/vendor/modules/@xenova/transformers/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Heap-based Buffer Overflow SNYK-JS-SHARP-19653587	731

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Heap-based Buffer Overflow

[sestinj]

This upgrade from sharp v0.32.6 to v0.35.4 includes multiple significant breaking changes across several minor versions. Developer action is required to ensure compatibility.

Key Breaking Changes:

• Node.js Version Requirement: Support for Node.js versions below 20.9.0 has been dropped. The target environment must be updated.

  • v0.33.0 dropped support for Node.js 14 and 16, requiring ^18.17.0 or >=20.3.0.
  • v0.35.0 dropped support for Node.js 18, requiring >=20.9.0.

• API Removals (v0.35.0):

  • The deprecated failOnError constructor property has been removed.
  • The deprecated paletteBitDepth property has been removed from the metadata response.
  • Deprecated properties from the sharpen operation have been removed.

• Behavioral and API Changes:

  • v0.34.0: Non-animated GIF output now defaults to no-loop instead of a permanent loop.
  • v0.34.0: The removeAlpha operation is now more effective, which may alter output for images with multiple alpha channels.
  • v0.35.0: The format.jp2k property has been renamed to format.jp2 for consistency.

Recommendation:

1. Verify Node.js Environment: Ensure your deployment environment runs Node.js v20.9.0 or newer.
2. Code Review: Search your codebase for the removed APIs (failOnError, paletteBitDepth, and old sharpen properties) and refactor as needed.
3. Test Visual Output: Pay close attention to GIF looping behavior and the visual quality of AVIF images, as the underlying metrics have changed.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.