npm / sharp
sharp
What changed in sharp 0.34 to 0.35, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
sharp 0.3572 changes
Breaking changes 15
Tightens validation of extend values.
Rejects infinite values during number validation.
The GIF effort option now requires an integer.
TypeScript ESM declarations use named exports instead of a namespace.
The deprecated failOnError constructor property was removed.
The format.jp2k API name was renamed to format.jp2 for API consistency.
The HEIF primary item is now used as the default page or frame.
Adds limitInputChannels with a default value of 5.
Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
The deprecated paletteBitDepth property was removed from metadata responses.
Support for Node.js 18 was dropped; Node.js >= 20.9.0 is now required.
The install script was removed; compiling from source is now opt-in via the build script.
Prebuilt binaries now use static paths to aid code bundling.
Deprecated properties were removed from the sharpen operation.
TIFF output bitdepth is now limited to 1, 2, or 4.
Security 6
sharp : Vulnerability in librsvg dependency CVE-2026-96889
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
Bounds clahe height to avoid signed overflow.
Bounds clahe width to avoid signed overflow.
Bounds trim margin to avoid signed overflow.
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
Deprecations 2
Emits a warning when using binaries provided by Electron on Linux.
Windows 32-bit prebuilt binaries are deprecated.
New APIs and options 13
TypeScript now allows multi-frame options for JXL output.
Adds hasAlpha to output info so callers can inspect whether the output has an alpha channel.
TypeScript metadata responses now include mediaType.
Adds the tune option for controlling AVIF quality metrics.
The package now supports ECMAScript Modules (ESM).
Prebuilt WebAssembly binaries are now available for FreeBSD.
Adds the tune option for controlling HEIF quality metrics.
Adds keepGainMap for processing HDR JPEG images with embedded gain maps.
Adds output as a TypedArray backed by a transferable ArrayBuffer.
Adds a margin option to the trim operation.
Adds exact to control transparent pixel colour values.
Adds withDensity to set output density in EXIF metadata.
Adds withGainMap for processing HDR JPEG images with embedded gain maps.
Behavior and default changes 5
Allows larger accepted dimensions when extending an image.
The tiff.subifd input option is now used.
Default concurrency increases when MALLOC_ARENA_MAX is detected.
Metadata responses now include the image Media Type (MIME Type).
WebAssembly binaries are no longer considered experimental.
Tooling 2
Code bundler support improves through stub binaries.
Type definitions are now published for both ESM and CJS, improving TypeScript support across module formats.
Fixes and other changes 29
Adds an upper-bounds check on the length of GIF delay arrays.
Improves gain map support for extract operations.
Adds an upper-bounds check on the length of linear arrays.
Removes a non-existent named export from the TypeScript surface.
Improves gain map support for rotate operations.
Improves error handling when the WebAssembly fallback also fails.
Composite left and top positions are now bounded to the coordinate limit.
info.pages is now correct when limiting the input page range.
Input streams are better supported when they finish before output is requested.
Palette bit depth is rounded up for PNG and GIF colours.
Resize dimensions are now bounded to the coordinate limit.
Tightens affine matrix verification.
Verifies that background colour values are numbers.
Verifies the cache memory limit to avoid overflow.
Bounds create input dimensions to the coordinate limit.
Bounds extract regions to the libvips coordinate limit.
Improves code bundler support by resolving the path to the libvips binary.
Bounds raw input dimensions to the coordinate limit.
Tightens recomb matrix verification.
Tightens verification of text dimensions.
Tightens verification of TIFF tile dimensions.
Returns the more precise Buffer<ArrayBuffer> TypeScript type from toBuffer.
Convolution kernel values are now validated as numbers.
Dilation and erosion width is bounded to prevent mask-size overflow.
Recombination matrix entries are now validated as numbers.
WebAssembly fallback detection is improved.
The WebAssembly wrapper file is now published, enabling the packaged WebAssembly interface to be used.
TypeScript FormatEnum keys now match the formats supported by the API.
pkg-config path discovery was improved.
sharp 0.345 changes
Deprecations 1
The --build-from-source flag is deprecated.
New APIs and options 2
Output can now be produced in BigTIFF format.
Experimental support adds prebuilt binaries for Linux RISC-V 64-bit systems.
Tooling 1
Building from source is supported with npm 12 and later.
Fixes and other changes 1
Error messages are improved when operations issue only warnings.