[Snyk] Security upgrade sharp from 0.32.6 to 0.35.0

[sestinj]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• core/vendor/modules/@xenova/transformers/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Integer Overflow SNYK-JS-SHARP-18184259	636
	Heap-based Buffer Overflow SNYK-JS-SHARP-18184418	636

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Heap-based Buffer Overflow

[sestinj]

This upgrade from sharp v0.32.6 to v0.35.0 contains multiple significant breaking changes, including runtime requirements, API removals, and behavioral modifications. A thorough review and code update are required.

Key Breaking Changes:

• Node.js Version Requirement: Support for Node.js 18 has been dropped. Version 0.35.0 now requires Node.js >= 20.9.0. [1, 4] The previous version 0.33.0 had already dropped support for Node.js 14 and 16. [4]
• API Removals and Renaming: Several deprecated properties and methods have been removed and will cause your application to fail if used. [1]
  • The failOnError constructor property is removed.
  • The paletteBitDepth property in the metadata response is removed.
  • Deprecated properties within the sharpen operation are removed.
  • The format jp2k has been renamed to jp2 for API consistency.
• Behavioral Changes:
  • In v0.34.0, removeAlpha was changed to ensure it removes all alpha channels, which may alter output. [2, 3]
  • Also in v0.34.0, non-animated GIF output now defaults to no-loop instead of looping forever. [2, 3]
• Installation and Build Process:
  • Starting with v0.33.0, sharp overhauled its installation process for prebuilt binaries, which may affect your build and deployment pipeline, especially if using pnpm. [8, 12]
  • In v0.35.0, the install script has been removed entirely. [1]

Recommendation:
Due to the mandatory Node.js version upgrade and multiple API removals, this upgrade must be handled with care. Developers should:

1. Ensure the target environment runs Node.js >= 20.9.0.
2. Search the codebase for removed APIs (failOnError, paletteBitDepth, sharpen properties, format.jp2k) and update them.
3. Verify that image processing logic is not negatively impacted by the behavioral changes to removeAlpha and GIF generation.
4. Test the package installation thoroughly in your CI/CD environment.

Source: Sharp Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.