fix(dashboard): bump sharp to 0.35.4, fixing libvips CVEs (GHSA-f88m-g3jw-g9cj)

[mrbobbytables]

Summary

Fixes #770.

npm audit --omit=dev in dashboard/ flagged sharp <0.35.0, which inherits libvips vulnerabilities CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 (GHSA-f88m-g3jw-g9cj). sharp is transitive via astro's built-in image pipeline (not a direct dashboard/package.json dependency).

nanoid <3.3.18 (GHSA-2v37-7h3g-55p8), the other advisory named in #770, was already fixed on main by #778 — main currently resolves nanoid to 3.3.18.

Change

Ran npm audit fix in dashboard/. This resolved sharp to 0.35.4 non-breaking — package.json is unchanged, only package-lock.json updates the resolved subdependency tree.

Verification

cd dashboard && rm -rf node_modules && npm ci   # succeeds
npm run build                                    # astro build + pagefind index succeed
npm audit --omit=dev                             # found 0 vulnerabilities

Note on base branch

This repo has no v4 branch upstream (confirmed via gh api repos/projectbluefin/testsuite/branches — only main and topic branches exist; main is the default branch). This PR targets main, consistent with the note already made in #784.

— hive: backend=copilot model=claude-sonnet-5

🐝 Hive Agent: contributor | SHA: a21941a8

[kubestellar-hive]

Approved by @castrojo for Hive auto-merge on green CI.

[hanthor]

Superseded by #802 / #803, and the lockfile carries more than the title says

I read the resolved versions out of each branch's dashboard/package-lock.json:

main : astro=7.2.6 sharp=0.34.5 fast-uri=3.1.5
PR789: astro=7.2.6 sharp=0.35.4 fast-uri=3.1.7
PR803: astro=7.2.6 sharp=0.35.4 fast-uri=3.1.5
PR802: astro=7.2.8 sharp=0.35.4 fast-uri=3.1.5

Two things follow:

1. #802 already gets you sharp 0.35.4. astro 7.2.8 raises its minimum sharp to 0.35.4 (withastro/astro#17837), so #802 closes GHSA-f88m-g3jw-g9cj on its own. #803 is the dependabot equivalent of this PR. Either of those makes this redundant.
2. This branch also bumps fast-uri 3.1.5 → 3.1.7, which is not mentioned in the title or description. That is #781's change. npm audit fix picked it up incidentally. Not dangerous, but it makes the diff wider than "bump sharp".

It would also go red on a re-run

This PR touches only dashboard/package-lock.json, so it does not refresh the coverage snapshot. main is currently stale on that gate (see #807), and the dependabot PRs each carry a second commit test: refresh generated coverage snapshot that covers it. The green checks here are from 2026-09-06 and predate the breakage.

The nanoid observation in the description checks out — main resolves nanoid to 3.3.18.

Recommend closing in favour of #802 (which subsumes both the astro patch bump and the sharp fix).

---

Generated by Claude Code