Skip to content

[Docs Site] Bump sharp from 0.35.1 to 0.35.2 - #32318

Merged
mvvmm merged 1 commit into
productionfrom
dependabot/npm_and_yarn/sharp-0.35.3
Jul 28, 2026
Merged

[Docs Site] Bump sharp from 0.35.1 to 0.35.2#32318
mvvmm merged 1 commit into
productionfrom
dependabot/npm_and_yarn/sharp-0.35.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Contributor

Bumps sharp from 0.35.1 to 0.35.2.

Release notes

Sourced from sharp's releases.

v0.35.2

v0.35.2-rc.2

  • TypeScript: Add mediaType to metadata response. #4492

  • Improve WebAssembly fallback detection. #4513

  • Improve code bundler support with stub binaries. #4543

  • Verify GIF effort option is an integer. #4544 @​metsw24-max

  • Verify recomb matrix entries are numbers. #4545 @​metsw24-max

  • TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits
  • c9622a3 Release v0.35.2
  • cd4568f Upgrade to sharp-libvips v1.3.1
  • 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
  • 61210b4 Verify convolve kernel values are numbers (#4549)
  • 1cb27dc Prerelease v0.35.2-rc.2
  • c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
  • 29d1e9e Prerelease v0.35.2-rc.1
  • bbba0a1 Improve code bundler support with stub binaries
  • ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
  • 0f594dd Prerelease v0.35.2-rc.0
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from a team as a code owner July 25, 2026 08:50
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 25, 2026
@cloudflare-docs-bot

cloudflare-docs-bot Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Dependabot review

Package Impact Recommendation
sharp 0.35.1 → 0.35.2 🟡 Low ✅ Merge

Overall: ✅ Merge + spot-check

sharp is a direct devDependency used only through Astro's built-in image service in astro.config.ts. version 0.35.2 is a patch release that upgrades sharp-libvips to v1.3.1, adds stricter input validations (GIF effort, recomb, convolve, dilate/erode), exposes mediaType metadata, improves WebAssembly fallback detection, bundles stub binaries for code bundlers, and switches TypeScript ESM types from a namespace to named exports. The docs repo has no direct import sharp calls and uses none of the changed methods directly, so behavioral risk is low. However, because sharp is used at build time for site images, a quick full-build verification and spot-check of a few image-heavy pages is prudent to catch any unexpected native-binary or output changes.

Package details

sharp: 0.35.1 → 0.35.2

Type: bug fix
Dependency type: direct

What changed

  • Upgraded bundled sharp-libvips to v1.3.1 (native binary/libvips dependencies).
  • TypeScript metadata response now includes mediaType.
  • Improved WebAssembly fallback detection.
  • Added code-bundler stub-binary support.
  • GIF effort option is now validated as an integer.
  • recomb matrix entries are now validated as numbers.
  • dilate/erode width is bounded to avoid mask-size overflow.
  • convolve kernel values are now validated as numbers.
  • ESM TypeScript types replaced the namespace with named exports.

Usage in this repo
Configured in astro.config.ts as Astro's image service: image.service.entrypoint: 'astro/assets/services/sharp' with limitInputPixels: false. No direct import sharp callsites or advanced sharp API usage were found in src/, worker/, or bin/; Astro’s build-time image optimization pipeline is the consumer.

Impact: 🟡 Low — The changed sharp APIs are not invoked directly by this repo; the only usage is through Astro's high-level image-service abstraction during build. The patch is mostly bug fixes and internal binary upgrades, so the chance of breaking visitor-visible output is low, but it is still exercised for all optimized images.


@dependabot dependabot Bot changed the title [Docs Site] Bump sharp from 0.34.5 to 0.35.3 [Docs Site] Bump sharp from 0.35.1 to 0.35.2 Jul 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sharp-0.35.3 branch from aae569c to 20cda1b Compare July 27, 2026 20:14
@dependabot
dependabot Bot requested a review from a team as a code owner July 27, 2026 20:14
@github-actions

Copy link
Copy Markdown
Contributor

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern Owners
package.json @cloudflare/content-engineering
* @cloudflare/product-owners

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps [sharp](https://github.com/lovell/sharp) from 0.35.1 to 0.35.2.
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.1...v0.35.2)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/sharp-0.35.3 branch from 20cda1b to 3315a71 Compare July 28, 2026 14:16
@mvvmm
mvvmm merged commit 6a335e4 into production Jul 28, 2026
13 checks passed
@mvvmm
mvvmm deleted the dependabot/npm_and_yarn/sharp-0.35.3 branch July 28, 2026 14:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants