[Snyk] Upgrade sharp from 0.29.3 to 0.34.4

[X-oss-byte]

Snyk has created this PR to upgrade sharp from 0.29.3 to 0.34.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 55 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Remote Code Execution (RCE) SNYK-JS-SHARP-2848109	539	No Known Exploit
	Heap-based Buffer Overflow SNYK-JS-SHARP-5922108	539	Mature

Release notes

Package name: sharp

• 0.34.4 - 2025-09-17
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.4-rc.4 - 2025-09-17
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.4-rc.3 - 2025-09-15
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.3 - 2025-07-10
  No content.
• 0.34.3-rc.1 - 2025-07-09
  No content.
• 0.34.3-rc.0 - 2025-06-14
  No content.
• 0.34.2 - 2025-05-20
  No content.
• 0.34.2-rc.0 - 2025-05-14
• 0.34.1 - 2025-04-07
• 0.34.0 - 2025-04-04
• 0.34.0-rc.1 - 2025-04-03
• 0.34.0-rc.0 - 2025-03-16
• 0.33.5 - 2024-08-16
• 0.33.5-rc.1 - 2024-08-14
• 0.33.5-rc.0 - 2024-08-13
• 0.33.4 - 2024-05-16
• 0.33.4-rc.0 - 2024-05-16
• 0.33.3 - 2024-03-23
• 0.33.3-rc.0 - 2024-03-22
• 0.33.2 - 2024-01-12
• 0.33.2-rc.1 - 2024-01-12
• 0.33.2-rc.0 - 2024-01-11
• 0.33.1 - 2023-12-17
• 0.33.1-rc.3 - 2023-12-17
• 0.33.1-rc.2 - 2023-12-17
• 0.33.1-rc.0 - 2023-12-12
• 0.33.0 - 2023-11-29
• 0.33.0-rc.2 - 2023-11-22
• 0.33.0-alpha.11 - 2023-11-10
• 0.33.0-alpha.10 - 2023-11-04
• 0.33.0-alpha.9 - 2023-10-13
• 0.33.0-alpha.8 - 2023-10-10
• 0.33.0-alpha.7 - 2023-10-10
• 0.33.0-alpha.6 - 2023-10-09
• 0.33.0-alpha.4 - 2023-10-06
• 0.33.0-alpha.3 - 2023-10-06
• 0.32.6 - 2023-09-18
• 0.32.5 - 2023-08-15
• 0.32.4 - 2023-07-21
• 0.32.3 - 2023-07-14
• 0.32.2 - 2023-07-11
• 0.32.1 - 2023-04-27
• 0.32.0 - 2023-03-24
• 0.31.3 - 2022-12-21
• 0.31.2 - 2022-11-04
• 0.31.1 - 2022-09-29
• 0.31.0 - 2022-09-05
• 0.30.7 - 2022-06-22
• 0.30.6 - 2022-05-30
• 0.30.5 - 2022-05-23
• 0.30.4 - 2022-04-18
• 0.30.3 - 2022-03-14
• 0.30.2 - 2022-03-02
• 0.30.1 - 2022-02-09
• 0.30.0 - 2022-02-01
• 0.29.3 - 2021-11-14

from sharp GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[vercel]

Deployment failed with the following error:

Could not parse File as JSON: vercel.json

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 94049ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
next-js-next-plugin-storybook	Error			Oct 14, 2025 8:47pm
next-js-next-plugin-storybook-g5dx	Error			Oct 14, 2025 8:47pm
next-js-next-plugin-storybook-y5ka	Error			Oct 14, 2025 8:47pm
next-x-storybook	Error			Oct 14, 2025 8:47pm