[cdbartholomew]

Routine dependency maintenance for hindsight-integrations/cloudflare-oauth-proxy/package-lock.json. It follows up on #5323 for an advisory published after that PR was opened.

Closes Dependabot alert #1846

• sharp 0.35.4 → 0.35.5, plus its @img/sharp-* platform packages and libvips 1.3.3 → 1.3.4. This is an in-range update under the existing "sharp": ">=0.35.4" override, and the only consumer is wrangler → miniflare.

Verification (npm 10.9.2, as CI)

• npm ci: OK
• npm run typecheck: clean
• npm test: 50/50 passed

[cdbartholomew]

Merging over a known, pre-existing build-docs failure. It is unrelated to this lockfile-only change.

build-docs fails at its first step, node hindsight-docs/scripts/check-integrations.mjs, before any dependency is installed:

[integrations] ❌ Changelog pages not linked from their doc page:
  agno — add [View Changelog →](/changelog/integrations/agno)

Why this is pre-existing:

• It reproduces on a clean checkout of main at 8830bbb (node hindsight-docs/scripts/check-integrations.mjs prints the same two lines). It was introduced when the agno changelog page landed on main without a link from the integration doc page. docs(agno): link the changelog from the integration page #5303 is the fix.
• The same job fails with the identical message on unrelated PRs that touch none of these files: fix(transfer): run the bank-write validator on document import into an existing bank (#5137) #5308 (job 112321153492), fix(consolidation): pin source_fact_ids to the batch and report actions that cite none (#5273) #5307 (job 112323143459), fix(llm): route OpenRouter structured-output calls only to upstreams that support response_format #5304 (job 112318987646) and fix(recall): don't decay the post-rerank temporal boost by rank (#4939) #5295 (run 37471346110).
• The job was re-run once on this PR and failed again with the same message.

Every other check that ran on this PR passed, including the job(s) that cover the changed lockfile.