build(deps): bump sharp from 0.34.5 to 0.35.4 in /dashboard

[dependabot]

Bumps sharp from 0.34.5 to 0.35.4.

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[kubestellar-hive]

🛑 Fix loop escalated — human attention needed

This PR has failed CI on 1 distinct fix attempts (new commits, still red). The hive has stopped dispatching further automated fixes for it.

Failing checks: Coverage snapshot fresh, pytest

Raw failure evidence (from check-run annotations):

pytest: Process completed with exit code 1.

Remove the needs-human label after addressing the root cause to return the PR to the automated fix lane.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[hanthor]

Correct, but #802 subsumes it

Resolved versions read out of each branch's dashboard/package-lock.json:

main : astro=7.2.6 sharp=0.34.5
PR803: astro=7.2.6 sharp=0.35.4
PR802: astro=7.2.8 sharp=0.35.4

astro 7.2.8 raises its minimum sharp to 0.35.4 (withastro/astro#17837), so #802 already carries this fix. Landing #802 closes GHSA-f88m-g3jw-g9cj without needing this PR; landing this one first just means #802 has to be rebased.

Two more sharp-0.35.4 PRs are open against the same lockfile — #789 (hand-run npm audit fix, which also silently bumps fast-uri to 3.1.7) and this one. Suggest consolidating on #802 and closing #789 and #803.

Credit where due

Unlike #789, this PR carries a second commit — 0e8a052 test: refresh generated coverage snapshot — which is exactly the fix in #807. main is currently failing the Coverage snapshot fresh gate and test_update_coverage_snapshot.py::TestRepositoryInvariant::test_committed_snapshot_is_current:

$ git rev-parse HEAD
db329ee6a053b0c655d335fcfd3d13e0db9d2ac1
$ python3 scripts/update_coverage_snapshot.py --check
STALE: docs/skills/test-authoring/suite-map/SKILL.md coverage snapshot is out of date.
exit=1

The diff in this PR's SKILL.md (415 → 413 active, common 101/20 → 99/22) is byte-identical to what scripts/update_coverage_snapshot.py regenerates on a clean main, so that half is verified correct. #800, #801 and #802 each carry the same commit.

---

Generated by Claude Code

[hanthor]

Clears a high advisory live on main — approving

high  sharp  <=0.35.4-rc.0   Vulnerabilities in libheif (GHSA-g89c-p67h-r497, GHSA-2jg2-4...)

0.35.4 is the fixed release; confirmed resident after install rather than inferred from the range:

$ node -e "require('./node_modules/sharp/package.json').version"
0.35.4

Part of a five-PR set (#802, #803, #800, #801, #781) that together takes dashboard/ from 1 critical + 4 high to found 0 vulnerabilities. I verified all five merge onto main with no conflicts before recommending them as a batch.

The class matters here: these are libheif CVEs reached through image decoding, and the dashboard processes images at build time — a reachable path, not a theoretical transitive finding.

All 6 checks green.

---

Generated by Claude Code