[v3] Upgrade Sharp to 0.35 to avoid automatic source builds with global libvips

IPX 3 currently pulls in Sharp 0.34, and that can cause an unrelated global package installation to fail when the machine already has a compatible copy of libvips installed.

We hit this through the Netlify CLI dependency tree:

netlify-cli@27.1.1
└─ @netlify/images@1.3.12
   └─ ipx@3.1.1
      └─ sharp@0.34.5

On Linux x64 with Node 24.19.0 and a system copy of libvips, this command failed:

npm install -g netlify-cli

Sharp detected the global libvips installation and automatically switched to a source build:

sharp: Attempting to build from source via node-gyp
sharp: Please add node-addon-api to your dependencies

Setting SHARP_IGNORE_GLOBAL_LIBVIPS=1 allowed the installation to finish, which confirmed that global-libvips detection triggered the source build.

Sharp 0.35 removed the install script and made source compilation opt-in. IPX 4 beta already uses sharp@^0.35.3, but we don’t want to move @netlify/images to a beta dependency to fix this installation problem.

Compatibility check

I tested IPX 3.1.1 with Sharp 0.35.3 forced through an npm override in a separate copy of the Netlify primitives repository.

@netlify/images built, and all 13 tests passed. Those tests included local image transformations and HTTP-backed image transformations.

The override left the dependency tree in an invalid semver state because IPX 3 declares Sharp 0.34, so it was only a compatibility test. We need an IPX release with a valid Sharp 0.35 dependency range before we can use this in production.

Request

Would you be open to a release from the IPX v3 branch that updates Sharp to ^0.35.3?

Sharp 0.35 requires Node 20.9 or newer, so this release would also need to record that Node requirement.

Related issues and context:

• https://github.com/netlify/primitives/issues/748
• https://github.com/lovell/sharp/issues/4498
• https://github.com/lovell/sharp/blob/v0.35.0/docs/src/content/docs/changelog/v0.35.0.md

Start in the IPX v3 branch by locating the Sharp dependency declaration and the metadata that records supported Node versions. Run the existing test suite, including the 13 compatibility tests described in the issue; done means Sharp accepts ^0.35.3, the Node 20.9 requirement is recorded, and the tests pass.