sharp/svgo security bumps on Current (80a99eb) are unreleased; published 2.4.1 still pins 0.34.5 / 4.0.1

[Geoegroeg]

Thanks for this integration — we use it on a static Astro site and it has been solid.

Summary

80a99eb (2026-07-22) bumped sharp 0.34.5 → 0.35.3 and svgo 4.0.1 → 4.0.2 on Current. Those bumps are not yet published: the newest releases are astro-compress@2.4.1 and @playform/compress@0.2.3, both from 2026-04-07, and both still pin the older versions.

Because the pins are exact rather than ranges, downstream projects cannot pick those patches up through normal dependency resolution.

Why it matters

Both currently-published pins carry advisories:

package	published pin	advisory range	patched in
sharp	0.34.5	<0.35.0 — inherited libvips CVE-2026-33327 / 33328 / 35590 / 35591	0.35.0
svgo	4.0.1	>=4.0.0 <4.0.2 — removeScripts leaves some executable scripts intact	4.0.2

On a stock Astro 7 project this shows up as three high-severity npm audit findings attributed to astro-compress. npm's suggested remediation is to downgrade to astro-compress@2.3.8, which does not actually resolve them.

Ask

1. A release cut from Current would fix this for everyone, since the dependency bumps are already committed.
2. Optionally, caret ranges for sharp and svgo (^0.35.3 / ^4.0.2), so future patch-level security fixes reach users without needing a release at all. Exact pins buy reproducibility, and Adapt to astro's sharp version either on preinstall or postinstall #329 suggests aligning sharp with Astro's own copy has been a deliberate consideration — so please treat this second point as a suggestion rather than a request.

Data point: the newer versions appear safe to ship

We are working around this with npm overrides forcing sharp@^0.35.3 and svgo@^4.0.2 underneath astro-compress@2.4.1. That combination works:

• build succeeds on astro@7.1.6 / vite@8.2.0
• compressed output is byte-identical to the pinned versions — 76 images totalling 4,392 KB before and after
• SVG compression unchanged at 45.6 KB across 17 files

So 2.4.1's code looks fully compatible with both newer majors, which hopefully makes the release low-risk.

Environment: astro@7.1.6, astro-compress@2.4.1, Node 26.5.0, Windows.

[NikolaRHristov]

Hey @Geoegroeg, thank you for detailed report and test.

Will release shortly.