fix: update sharp to resolve GHSA-f88m-g3jw-g9cj

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

sharp is a transitive optional dependency of next (next declares sharp: ^0.34.5), so Dependabot cannot bump it on its own. Fixed by adding an npm overrides entry pinning sharp to ^0.35.0, then regenerating package-lock.json. This pulls sharp 0.34.5 -> 0.35.3 and the bundled @img/sharp-libvips-* binaries 1.2.4 -> 1.3.2 (libvips 8.18.3), which is where the actual CVEs live.

• Dependency: sharp updated 0.34.5 -> 0.35.3 (via overrides), @img/sharp-libvips-* 1.2.4 -> 1.3.2
• Advisory: GHSA-f88m-g3jw-g9cj (inherited libvips CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591)
• Dependabot alert: https://github.com/warpdotdev/oz-workspace/security/dependabot/106
• Verification:
  • npm audit no longer reports sharp (it was previously the only high-severity sharp finding)
  • npm ci resolves cleanly; npm ls sharp -> next@16.2.11 -> sharp@0.35.3
  • Runtime load check: require('sharp').versions -> sharp 0.35.3 / vips 8.18.3
  • npm run lint — 0 errors (6 pre-existing warnings)
  • npx tsc --noEmit — clean
  • npm run build — succeeds, all 35 pages generated

Highlight the risky code / where the dependency was used

sharp is not imported anywhere in this repo directly. It is only consumed by Next.js for server-side image optimization. The only image usage is app/page.tsx:4 (next/image). Risk is limited to image optimization behavior at runtime — worth a quick smoke test of any page rendering optimized images.

Special instructions for this PR

The change lives in the overrides block of package.json. Because ^0.35.0 is outside next's declared ^0.34.5 range, npm will keep this pin until next itself widens its range — at that point the override can be dropped. sharp 0.35 is a minor bump with no API changes relevant to Next.js image optimization, and the production build confirms compatibility.

AFTER YOU MERGE

No post-merge steps.