[Aikido] Fix security issue in sharp via minor version upgrade from 0.34.5 to 0.35.3

[aikido-autofix]

Upgrade sharp to fix high-severity vulnerabilities in libvips affecting GIF, TIFF, and VIPS image processing.

✅ Code not affected by breaking changes.

✅ No breaking changes from the sharp upgrade affect this codebase.

The search results show that:

• Sharp is present only as a transitive dependency (through Astro) in package-lock.json

• No source code files (.astro, .ts, .tsx, .js, .jsx) import or use sharp directly

• None of the deprecated features (failOnError, paletteBitDepth, deprecated sharpen properties, jp2k format) are used in the codebase

• The Node.js version requirement change (from >=18 to >=20.9.0) is compatible with the project's existing requirements, as Astro already requires Node.js 18.20.8 || ^20.3.0 || >=22.0.0

Since sharp is only used internally by Astro for image optimization and the codebase doesn't directly interact with sharp's API, the upgrade should not cause any issues.

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.3 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-f88m-g3jw-g9cj	HIGH	[sharp] Multiple high-severity vulnerabilities in upstream libvips dependency allow remote code execution when processing untrusted image input (GIF, TIFF, VIPS formats).

🤖 Remediation details

Fix GHSA-f88m-g3jw-g9cj: upgrade sharp transitive dependency to patched version

• Resolves a high-severity vulnerability in the transitive dependency sharp by bumping its parent astro in the root package.json.
• The lockfile (package-lock.json) is updated to reflect the new resolved versions of astro and sharp.

sharp

sharp is an optional transitive dependency pulled in by astro; it is not declared directly in the project's package.json. The installed version 0.34.5 is vulnerable under GHSA-f88m-g3jw-g9cj; the fix requires >= 0.35.0. The astro@5.x series constrains sharp to ^0.34.0, making it impossible to resolve a patched sharp without first upgrading astro. The declared spec for astro in the root package.json was therefore bumped from ^5.7.10 to ^7.0.4 — the first astro major line that widens its sharp range to ^0.34.0 || ^0.35.0 — allowing npm to resolve sharp to 0.35.3 after a lockfile refresh.

Version changes

Package	From	To	Why updated
astro	^5.7.10 (resolved 5.18.1)	^7.0.4 (resolved 7.2.1)	Parent bump required to allow patched sharp resolution
sharp	0.34.5	0.35.3	Transitive CVE fix (GHSA-f88m-g3jw-g9cj) after parent bump of astro