fix(deps): isolate sharp 0.35.4 security lockfile update

[zedarvates]

The root lockfile resolves sharp 0.35.0, which is affected by the libheif advisory GHSA-rgj7-g3m4-5g8c. The first patched sharp release is 0.35.4; its prebuilt libraries provide libheif 1.23.2.

This draft changes only package-lock.json: sharp 0.35.0 → 0.35.4, the associated native packages to 0.35.4, and their libvips packages 1.3.0 → 1.3.3. All 27 changed package entries belong to this dependency family. The manifest's existing ^0.35.0 range accepts the patched resolution. Joi, Vitest, other lockfiles, and application code are unchanged. This is a focused alternative for the sharp portion of #55.

Validation on a complete checkout based on 5b6c83bd26f60f7eb5e4da53f958f2d3b06edb4a, with Linux x64/glibc 2.39, Node 24.19.0 and npm 11.9.0:

Check	Result
Fresh ELECTRON_SKIP_BINARY_DOWNLOAD=1 npm ci --no-audit --no-fund	Passed, 753 packages installed; Electron application binary download excluded
Native runtime assertions	sharp 0.35.4, libvips 8.18.6, libheif 1.23.2 actually loaded
Existing addons/content_sensitivity/tests/test_censorship.js	11 passed, 0 failed; sharp preload prevents its optional-image test from silently skipping
Additional image smoke checks	7 passed: PNG/JPEG/WebP/AVIF through StoryCore censorImage and full PNG decoding; custom-region extraction/composition; pixelateFile disk round trip; malformed input rejection
Root lockfile npm audit --package-lock-only --json, before/after	sharp advisory present before and absent after; high findings 1 → 0; existing moderate Joi finding unchanged
Scope and formatting	Only the root lockfile changed; git diff --check passed

The image checks establish execution and output compatibility; they do not assess censorship strength. The npm audit result is scoped to the root dependency graph and is not a clean audit of the whole repository.

Reproduce the existing targeted suite with a required native-library preflight:

ELECTRON_SKIP_BINARY_DOWNLOAD=1 npm ci --no-audit --no-fund
node -e 'const a=require("node:assert/strict"),s=require("sharp"); a.equal(s.versions.sharp,"0.35.4"); a.equal(s.versions.heif,"1.23.2"); console.log(s.versions); require("./addons/content_sensitivity/tests/test_censorship.js")'
npm audit --package-lock-only --json
git diff --check

The audit command still exits 1 for the unchanged Joi finding.

Tested lockfile SHA-256: 44561b67b05de02fa0f91c78fdd36361450eb69fb10edaddddf3aba02e9f1402.
Published lockfile Git blob: f91c26855f4067f134b11a308672ecfda174e847.
Published head: 215fe134b028962404a8a230df5ce95828c2a277. Its complete Git tree (5e260447b4440e11afa1c32b7c42d9658d66be03) was fetched and verified identical to the locally tested tree.

Before a merge decision: directly confirm the package, manifest and advisory on repository Dependabot alert #463. Its page returned a signed-out 404 in this session, and the secure sign-in attempt reported that this ChatGPT client does not support secure browser authentication. The exact alert mapping therefore remains unverified; the fix above is independently supported by the maintainer advisory and the before/after npm audit. No pull-request Actions runs were reported for the published head at verification time. The existing Actions workflow at this base only covers Harbour paths and does not run these root/addon checks. Full Electron packaging and Windows/macOS runtime validation have not been performed. No merge or auto-merge is requested.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud