fix(deps): patch sharp and Joi; align Vitest on 4.1.11

[dependabot]

This security update keeps sharp and Joi patched and replaces the partial Vitest 5 upgrade with a compatible, patched Vitest 4 stack.

The original dependency graph paired Vitest/mocker 5.0.0 with UI and coverage 4.1.8, creating incompatible peer requirements. Vitest 4.1.11 includes the redirect-mock file-read security fix; the existing nested mock in AssetPanel also needs migration before Vitest 5.

Scope	Base	Updated
Root sharp	0.35.0	0.35.4
Root and config Joi, via wait-on	18.0.2	18.2.9
UI Vitest, UI and V8 coverage	4.1.8	4.1.11
Associated Vitest modules, including mocker	4.1.8	4.1.11

The sharp and Joi changes from Dependabot are preserved. Application code, tests and configuration are unchanged.

Validation on Linux x64, Node 24.19.0 and npm 11.9.0:

• npm audit reports zero vulnerable package entries in all three candidate lockfiles. The base reports 2 in root, 1 in config and 4 in the UI. These are package entries, not distinct vulnerability counts.
• All 11 content-sensitivity tests pass. A native smoke test loads sharp 0.35.4 / libvips 8.18.6 / libheif 1.23.2 and passes AVIF decoding, resizing and PNG encoding.
• Joi 18.2.9 and wait-on smoke tests pass in root and config.
• All 6 AssetPanel tests pass, including a run with the aligned V8 coverage provider. This is targeted coverage, not repository-wide coverage.
• No invalid Vitest peer remains in the candidate dependency graph.

Remaining merge evidence and blockers:

• Standard UI npm resolution fails on the pre-existing ESLint 10.9.1 / eslint-plugin-react-hooks 7.0.1 peer conflict, reproduced on the base. UI diagnostic installs used --force; no persistent bypass or CI relaxation is introduced.
• The broader UI run stops after 108 passing tests at removeRelationship is not defined. The same failure is reproduced with the base's Vitest 4.1.8, so the full suite has not passed.
• Build validation stops at TypeScript. Base and candidate have the same 2,147 diagnostics after matching dependency-install context and normalizing checkout paths; Vite build was not reached.
• Lifecycle scripts, Electron packaging, Windows and homelab execution remain untested.
• The original Sonar success does not establish a passing test/build pipeline. No relevant GitHub Actions success is claimed. Private Dependabot alert #461 details and closure state have not been verified.

Detailed validation, security advisories and tested dependency-file fingerprints.

Correction commit: 739b4c5. The PR remains open for a merge decision; the checks above do not establish full merge readiness.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud