build(deps): bump sharp and ipx

[dependabot]

Bumps sharp to 0.35.4 and updates ancestor dependency ipx. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates ipx from 3.1.1 to 4.0.0-beta.1

Release notes

Sourced from ipx's releases.

v4.0.0-beta.1

compare changes

🚀 Enhancements

• Add unflatten handler (#248)
• server: Add parseURL option to customize URL parsing (#320)
• server: Answer etag revalidation before image processing (52d0000)
• server: Send X-Content-Type-Options: nosniff header (85290d9)
• handlers: Add opacity and the missing sharp operation modifiers (#322)
• http: Support opt-in blockPrivateIPs (f23c374)
• fs: ⚠️ Reject symlinks resolving outside the served dir (488fcf5)

🩹 Fixes

• handlers: Parse all modulate args and add lightness (#317)
• Use svg pass-thru when requested format is svg (#262)
• Add extendWith arg to extend modifier (#315)
• ⚠️ Always sanitize svg sources (#319)
• handlers: Validate all modifier arguments (#321)
• handlers: Clamp output dimensions with maxOutputDimension option (013c144)
• storage/http: Return 400 for unparseable ids instead of 500 (aeaae5b)
• storage/http: ⚠️ Only follow redirects within the domain allowlist (97e6eb7)
• ipx: Compare handler order numerically when sorting (9446f68)
• handlers: Apply maxOutputDimension to extend after a resize (5606f0f)
• fs: Dir fall-through and maxAge handling (933b0d6)
• fs: Accept non-JSON env values and guard process access (725a63c)

💅 Refactors

• Use node:path (c73f3c1)

📖 Documentation

• Add samples (5204d9c)

📦 Build

• Add engines field to package.json (c7227fb)

🤖 CI

• Run tests on macos and windows too (8ddca9b)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Damian Głowala (@​DamianGlowala])
• Simon Garner (@​sgarner)
• Nathan Chase (@​nathanchase)

... (truncated)

Changelog

Sourced from ipx's changelog.

v4.0.0-beta.1

compare changes

🚀 Enhancements

• Add unflatten handler (#248)
• server: Add parseURL option to customize URL parsing (#320)
• server: Answer etag revalidation before image processing (52d0000)
• server: Send X-Content-Type-Options: nosniff header (85290d9)
• handlers: Add opacity and the missing sharp operation modifiers (#322)
• http: Support opt-in blockPrivateIPs (f23c374)
• fs: ⚠️ Reject symlinks resolving outside the served dir (488fcf5)

🩹 Fixes

• handlers: Parse all modulate args and add lightness (#317)
• Use svg pass-thru when requested format is svg (#262)
• Add extendWith arg to extend modifier (#315)
• ⚠️ Always sanitize svg sources (#319)
• handlers: Validate all modifier arguments (#321)
• handlers: Clamp output dimensions with maxOutputDimension option (013c144)
• storage/http: Return 400 for unparseable ids instead of 500 (aeaae5b)
• storage/http: ⚠️ Only follow redirects within the domain allowlist (97e6eb7)
• ipx: Compare handler order numerically when sorting (9446f68)
• handlers: Apply maxOutputDimension to extend after a resize (5606f0f)
• fs: Dir fall-through and maxAge handling (933b0d6)
• fs: Accept non-JSON env values and guard process access (725a63c)

💅 Refactors

• Use node:path (c73f3c1)

📖 Documentation

• Add samples (5204d9c)

📦 Build

• Add engines field to package.json (c7227fb)

🏡 Chore

• Update deps (ce3c31d)
• Add agents.md (b4357f9)
• Update readme (b30a407)
• Prepare for v4 beta (37c3415)

🤖 CI

... (truncated)

Commits

• 0c58063 chore(release): v4.0.0-beta.1
• 8ddca9b ci: run tests on macos and windows too
• c7227fb build: add engines field to package.json
• 725a63c fix(fs): accept non-JSON env values and guard process access
• 933b0d6 fix(fs): dir fall-through and maxAge handling
• c73f3c1 refactor: use node:path
• 37c3415 chore: prepare for v4 beta
• 488fcf5 feat(fs)!: reject symlinks resolving outside the served dir
• 5606f0f fix(handlers): apply maxOutputDimension to extend after a resize
• 9446f68 fix(ipx): compare handler order numerically when sorting
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1164b3e0-314b-4bb5-858f-8dfcfa017723

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}