fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
express (source)	4.22.1 → 4.22.2
sharp (source, changelog)	0.34.5 → 0.35.3
yargs (source)	17.7.2 → 17.7.3

---

Release Notes

expressjs/express (express)

v4.22.2

Compare Source

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in #​7021
• @​SAY-5 made their first contribution in #​7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

lovell/sharp (sharp)

v0.35.3

Compare Source

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info.
  #​4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer.
  #​4520
  @​Andarist

• Bound clahe width and height to avoid signed overflow.
  #​4551
  @​metsw24-max

• Bound trim margin to avoid signed overflow.
  #​4552
  @​metsw24-max

• Reject infinite values when validating numbers.
  #​4553
  @​metsw24-max

• Bound extract region to libvips coordinate limit.
  #​4555
  @​metsw24-max

• Verify background colour values are numbers.
  #​4556
  @​metsw24-max

• Bound create and raw input dimensions to coordinate limit.
  #​4558
  @​metsw24-max

• Tighten recomb and affine matrix verification.
  #​4560
  @​chatman-media

• Verify cache memory limit to avoid overflow.
  #​4561
  @​metsw24-max

v0.35.2

Compare Source

v0.35.1

Compare Source

• TypeScript: Ensure type definitions are published for both ESM and CJS.
  #​4537

• WebAssembly: Ensure wrapper file is published.
  #​4538

v0.35.0

Compare Source

• Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

• Breaking: Remove install script from package.json file.
  Compiling from source is now opt-in via the build script.

• Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

• Breaking: Add limitInputChannels with a default value of 5.

• Breaking: Remove deprecated failOnError constructor property.

• Breaking: Remove deprecated paletteBitDepth from metadata response.

• Breaking: Remove deprecated properties from sharpen operation.

• Breaking: Rename format.jp2k as format.jp2 for API consistency.

• Upgrade to libvips v8.18.3 for upstream bug fixes.

• Remove experimental status from WebAssembly binaries.

• Add prebuilt binaries for FreeBSD (WebAssembly).

• Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

• Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

• Add AVIF/HEIF tune option for control over quality metrics.
  #​4227

• Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps.
  #​4314

• Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer.
  #​4355

• Require prebuilt binaries using static paths to aid code bundling.
  #​4380

• TypeScript: Ensure FormatEnum keys match reality.
  #​4475

• Add margin option to trim operation.
  #​4480
  @​eddienubes

• Ensure HEIF primary item is used as default page/frame.
  #​4487

• Add image Media Type (MIME Type) to metadata response.
  #​4492

• Add withDensity to set output density in EXIF metadata.
  #​4496

• Improve pkg-config path discovery.
  #​4504

• Add WebP exact option for control over transparent pixel colour values.

• Add support for ECMAScript Modules (ESM).
  #​4509
  @​florian-lefebvre

yargs/yargs (yargs)

v17.7.3

Compare Source

Bug Fixes

• fix: use entry point with file extension for anything that supports exports (#​2514) (c7597e3)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "after 2pm on Saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.