[Aikido] Fix security issue in sharp via minor version upgrade from 0.34.5 to 0.35.3

[aikido-autofix]

Upgrade sharp to fix high-severity vulnerabilities in libvips affecting GIF, TIFF, and VIPS image processing.

✅ Code not affected by breaking changes.

✅ No breaking changes from the sharp upgrade affect this codebase. While sharp is listed as an optional dependency of Astro, there is no direct usage of sharp in the codebase - no imports, no method calls to sharp's API, and no configuration using sharp-specific features. Additionally, the project already requires Node.js >= 22.12.0 (per Astro's requirements), which exceeds sharp 0.35.0's new minimum requirement of Node.js >= 20.9.0. None of the deprecated features (failOnError, paletteBitDepth, deprecated sharpen properties, or jp2k format) are used in the codebase.

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.3 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-f88m-g3jw-g9cj	HIGH	[sharp] Multiple high-severity vulnerabilities in upstream libvips dependency allow remote code execution when processing untrusted image input (GIF, TIFF, VIPS formats).

🤖 Remediation details

Fix GHSA-f88m-g3jw-g9cj: bump sharp transitive dependency to patched version

Short summary

This PR fixes a high-severity vulnerability in the sharp image-processing package by upgrading it from 0.34.5 to 0.35.3. Because sharp is a transitive optional dependency (not a direct dependency), the fix required bumping the parent astro to a major version that widens its sharp range to include ^0.35.0, followed by a lockfile refresh to resolve sharp to the patched version. Changes affect package.json (declared astro version spec) and package-lock.json (resolved versions of astro, sharp, and related transitive packages).

sharp

sharp is pulled in as an optional transitive dependency of astro and was not directly declared in package.json. The installed version 0.34.5 falls within the vulnerable range; the fix requires >= 0.35.0. The astro@5.x series pins sharp to ^0.34.0, which cannot resolve to 0.35.x, so a parent bump was necessary. astro was updated in package.json from ^5.7.10 to ^7.0.4 — the first astro release that declares sharp: "^0.34.0 || ^0.35.0" — allowing npm update sharp --package-lock-only to resolve sharp to 0.35.3, satisfying the patched version requirement.

Version changes

Package	From	To	Why updated
astro	^5.7.10 (resolved 5.18.1)	^7.0.4 (resolved 7.2.1)	Parent bump required to widen sharp range to include ^0.35.0
sharp	0.34.5	0.35.3	Transitive CVE fix after parent bump of astro