[deps] Patch sharp and source-map-js advisories

[deku2026]

Problem

CI on baseline 5421c3789240093b2fce36322c2eb7773325ec7b (workflow_dispatch run 37726628268) fails only in Repository security: npm audit --audit-level=high reports 5 high findings:

• GHSA-wq5f-xc86-pv6w: sharp < 0.35.5 (bundled librsvg). First patched version 0.35.5. Locked sharp 0.35.4 comes in through @cloudflare/vitest-plugin -> miniflare@5.20260926.1-alpha, which pins sharp: 0.35.4 exactly. The newest published miniflare (5.20261006.0-alpha) pins it too.
• GHSA-68fv-2mgg-jv7q: source-map-js >= 1.0.0, < 1.2.2. First patched version 1.2.2. It comes in through vitest -> vite -> postcss (^1.2.1).

Change

The fix upgrades the packages. It adds no threshold, no exception and no audit configuration.

• package.json gets an exact npm override, "overrides": { "sharp": "0.35.5" }. The 25 sharp platform packages move from 0.35.4 to 0.35.5 and the libvips binaries from 1.3.3 to 1.3.4. Names and licences are unchanged.
• package-lock.json locks source-map-js 1.2.2, which is inside postcss's existing range. This lock-only bump follows the Web [deps] Patch sharp and source-map-js advisories #33 precedent.
• No package is added or removed. Direct dependencies and the Wrangler, esbuild, Contracts and protobuf versions are unchanged.

Records required by docs/dependency-policy.md and the provenance gates:

• eng/policy/dependency-reviews/sharp-source-map-js-r1.json is a new immutable receipt. It has supersedes/previous set to gov-10-naming-r1, plus the review and the package coordinates. Historical receipts are unchanged.
• eng/policy/dependency-policy.json is refreshed: sourceCommit is the baseline, the closure has the 28 changed coordinates, the inputs and review are rebound to the new manifest, lock and r10 hashes, and reviewRecord, artifactRecords and native.evidence point at the new files.
• eng/provenance/artifact-profiles/ai-worker-r10.json and eng/provenance/records/ai-worker-bundle-r10.json are immutable successors of r9. The profile differs only in id, ownerCommit and lockSha256, because the Worker output is unchanged. files.json is updated and NOTICE.txt was regenerated with the renderer.
• .gitleaks.toml: the existing allowlist for the verified protobuf api_pb.js SHA-256 now covers profile r10 as well.

Validation

Run locally with the pinned Node 24.21.0 and npm 11.19.0:

• npm ci --ignore-scripts succeeds.
• npm audit --audit-level=high finds 0 vulnerabilities.
• npm ls sharp source-map-js shows sharp@0.35.5 overridden and source-map-js@1.2.2.
• npm run check:dependencies passes.
• npm run check passes: dependency fixtures, project, provenance, architecture, format, lint, typecheck, 157 vitest tests and 70 tooling tests.

Not run locally: the candidate build and gitleaks. The hosted CI jobs cover them on this head. No runtime, live-service, image-binding or inference test is claimed. sharp and source-map-js are development tools only and are not Worker inputs.

Task: targeted dependency-security fix deps-ai (worker w-c20261008-ai-deps). There is no delivery-graph task ID, so there is no claim epoch.

🤖 Generated with Claude Code

[deku2026]

Review requested at exact head 73c6cfd (worker w-c20261008-ai-deps; targeted deps fix, no delivery-graph claim). Hosted CI run 37728204458 is green on this head: Source and offline units, Repository security (npm audit high = 0, gitleaks no leaks), Dependency review, CodeQL (actions, javascript-typescript), Build candidate, Verify. The deploy jobs are skipped on PRs.

[deku2026]

Reviewed 73c6cfd for [deps] AI advisories: approved

Independent review by r-c20261008-ai-deps, done in a throwaway worktree at the exact head against base 5421c37.

• Lock delta: exactly 28 version moves, with no packages added or removed and the root entry unchanged. sharp and its 25 @img/sharp-* platform packages move from 0.35.4 to 0.35.5. The 12 libvips binaries move from 1.3.3 to 1.3.4. source-map-js moves from 1.2.1 to 1.2.2. All of them resolve from registry.npmjs.org with sha512 integrity, and every licence string is unchanged. The only other field changes are the internal sibling version pins. The integrity of sharp 0.35.5 and source-map-js 1.2.2 matches npm view dist.integrity.
• Advisories (GitHub advisory API): GHSA-wq5f-xc86-pv6w covers sharp <0.35.5, with 0.35.5 as the first patched version. GHSA-68fv-2mgg-jv7q covers source-map-js >=1.0.0 <1.2.2, with 1.2.2 as the first patched version.
• Override: overrides.sharp: "0.35.5" is exact and minimal. Both miniflare 5.20260926.1-alpha and the current latest, 5.20261006.0-alpha, pin sharp 0.35.4 exactly. The change from 0.35.4 to 0.35.5 is a patch release with the same dependencies (semver, @img/colour, detect-libc) and the same engines field (node >=20.9.0). source-map-js 1.2.2 stays inside postcss's ^1.2.1 range. Runtime-compat note: sharp is used only by miniflare's local Images-binding emulation. wrangler.json declares no images binding and sharp is not a Worker input. That runtime path was not exercised here and stays untested.
• r10: the profile differs from r9 only in id, ownerCommit and lockSha256. lockSha256 854086386385f3decbdf13b84dea41f8e6a8c1cbde4a88d26fd7f476a5264d99 matches my recomputed hash of package-lock.json. The record changes from r9 only in its id, commit, profile hash, supersedes link and reviewer text. All input hashes in the receipt match the files.
• Receipt chain and provenance: I called the repo's own auditProvenance directly. It passed with 22 records, active ai-worker-bundle-r10, comparison commit 5421c37, and no NOTICE drift, so NOTICE.txt is byte-correct. runPolicy passed 27 rules. test:dependencies passed 15/15, including the actual repository admission test.
• gitleaks: the new path regex matches only r1 through r10 (r0, r11, r100 and .bak names do not match). The target rule and the single line regex are unchanged, and r10 contains exactly that one line. The hosted gitleaks scan reported "no leaks found".
• Local run: npm ci was clean. npm audit --audit-level=high found 0 vulnerabilities. check:dependencies, format:check, lint, typecheck, vitest (157/157) and test:tooling (70/70) all passed. node eng/project.mjs check stopped locally at the pinned-toolchain assertion because only Node 24.20.0 and npm 12.0.2 are available here, against pins of 24.21.0 and 11.x. I ran its provenance and policy parts separately, and they passed. Hosted run 37728204458 at this head is green, including the full npm run check, npm audit and gitleaks.

No blocking findings. I have not merged this PR.