next@16.2.11 bundles vulnerable sharp <0.35.0 (GHSA-f88m-g3jw-g9cj)

Link to the code that reproduces this issue

https://github.com/advisories/GHSA-f88m-g3jw-g9cj

To Reproduce

1. Create an empty folder and with the following package.json:

   {
     "name": "next-sharp-audit-example",
     "private": true,
     "dependencies": {
       "next": "16.2.11",
       "react": "^19.0.0",
       "react-dom": "^19.0.0"
     }
   }

2. Install dependencies

npm install

3. Inspect the resolved dependency tree

npm ls sharp next

4. Run an audit

npm audit

Current vs. Expected behavior

Current

next@16.2.11 resolves sharp@0.34.5. Running npm audit reports GHSA-f88m-g3jw-g9cj.

Expected

A release should resolve a non-vulnerable sharp version or guidance should exist for a supported workaround.

Provide environment information

## Environment

- Next.js version: 16.2.11
- Node.js version: 22.x
- npm version: 10.x
- OS: macOS

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

No response

Start with the reproduction package.json and run npm install, npm ls sharp next, and npm audit using Next.js 16.2.11. Trace why sharp@0.34.5 is resolved and check the dependency or release configuration responsible; done means the supported Next.js release resolves a non-vulnerable sharp version or documents a supported workaround for GHSA-f88m-g3jw-g9cj.