chore(deps): bump sharp and next in /web

[dependabot]

Bumps sharp to 0.35.3 and updates ancestor dependency next. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates next from 16.3.0-canary.19 to 16.3.0-preview.9

Release notes

Sourced from next's releases.

v16.3.0-preview.9

Misc Changes

• [Bench] Add client-trace attribution pass and document metrics to render-pipeline: #95828
• Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules: #96030
• Turbopack: Use Arc and Box to make InvalidatorMap slightly more efficient: #95987
• Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the next-custom-transforms: #96035
• [Cache Components] Exclude dynamic params from prerenders when no generateStaticParams values is provided: #95872
• Gate partialFallback behavior behind partialPrefetching flag: #96074
• [turbopack] Fix deployment skew protection for component chunks: #96079
• Turbopack: stop copying sourcesContent into every serialized source map: #95934
• Upgrade React from 81e442ea-20260721 to 711c445b-20260722: #96066
• fix: cache miss in App Shell for cached pages with gSP: #95665
• skill(cc-adoption): add dev-only validation sweep reference: #96057
• Refine Cache Components and Partial Prefetching adoption skills: #95817
• [test] Move the dev-only use cache test suite to test/development: #96023
• Fix stale dev 'use cache' for cookieless requests and route handlers: #96022
• [test] Add failing tests for stale route handler and page cached data: #96021
• Add a dedicated HMR message for static params changes: #96020
• Emit the static paths HMR update after updating the cache: #96019
• [test] Add source-mapping coverage of React's fake stack frame scripts in use cache: #95945
• Fix basePath fallback parameter parsing: #95966
• Restore canary version 16.3.0-canary.93 after v16.3.0-preview.8 preview release

Credits

Huge thanks to @​gaearon, @​bgw, @​gnoff, @​acdlite, @​sampoder, @​vercel-release-bot, @​lubieowoce, @​aurorascharff, @​unstubbable, and @​timneutkens for helping!

v16.3.0-preview.8

Misc Changes

• Always consult npm_config_user_agent first: #95879
• Rewrite next-cache-components-optimizer around a test-driven instant() loop: #94721
• docs: attribute App Shell prefetch to Partial Prefetching: #96003
• Turbopack: Remove chunk group id from value of chunk groups map: #95142
• [ci] Enforce minimumReleaseAge in e2e tests that install external dependencies: #95628
• Turbopack: Fix missing canonicalization of paths and always use verbatim paths internally for Windows: #95668
• Revert "[turbopack] Don't SSR on pages only navigated to through a soft nav (#95539)": #96028
• Turbopack: Use Arc<PathBuf> for keys in turbo-task-fs's per-path MutexMap: #95951
• chore(deps): bump sharp@0.35.3: #95507
• [turbopack] Tree-shake CJS exports that use the Object.defineProperty syntax: #95994
• Restore canary version 16.3.0-canary.92 after v16.3.0-preview.7 preview release

Credits

Huge thanks to @​eps1lon, @​gaojude, @​icyJoseph, @​bgw, @​sampoder, and @​styfle for helping!

v16.3.0-preview.7

Example Changes

... (truncated)

Commits

• 838bd19 v16.3.0-preview.9
• 5f688d2 [Bench] Add client-trace attribution pass and document metrics to render-pipe...
• 89c9487 Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules (#96030)
• 8882653 Turbopack: Use Arc<PathMap> and Box<Path> to make InvalidatorMap slightly mor...
• 5639c4e Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the `nex...
• b2144dd v16.3.0-canary.94
• 6a39e9d [Cache Components] Exclude dynamic params from prerenders when no generateSta...
• 203177b Gate partialFallback behavior behind partialPrefetching flag (#96074)
• 5b9d43b [turbopack] Fix deployment skew protection for component chunks (#96079)
• 3d01800 Turbopack: stop copying sourcesContent into every serialized source map (#95934)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.