chore(deps): bump sharp from 0.34.5 to 0.35.4

[dependabot]

Bumps sharp from 0.34.5 to 0.35.4.

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

[cursor]

PR Summary

Low Risk
Dependency-only bump; main caveat is sharp 0.35’s Node >=20.9.0 requirement and possible native-binary behavior changes in icon/build image paths.

Overview
Upgrades sharp from 0.34.5 to 0.35.4 in apps/marketing and scripts, with matching pnpm-lock.yaml updates (including refreshed @img/sharp-* and libvips 1.3.3 native optional deps).

Marketing keeps sharp for Astro’s image pipeline; scripts uses it directly (e.g. export-android-icons.ts) for SVG/PNG resize and export. No application code changes—dependency version only.

^{Reviewed by Cursor Bugbot for commit 4eb2363. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−20 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−8 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−12 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	−2 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−6 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+4 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 22b725b · PR result: 4eb2363 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[yordis]

@dependabot rebase