chore(deps): bump sharp and promptfoo in /tests

[dependabot]

Bumps sharp to 0.35.3 and updates ancestor dependency promptfoo. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates promptfoo from 0.121.3 to 0.121.19

Release notes

Sourced from promptfoo's releases.

0.121.19

0.121.19 (2026-07-14)

Features

• providers: add Bedrock GPT-5.6 frontier support (#10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#10041) (e6f06da)
• providers: add Open Interpreter provider (#10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#9980) (a643f8b)
• providers: support GPT-5.6 GA (#10040) (3280625)
• redteam: account for generation-phase token usage (#9967) (e0d1698)
• redteam: add goblin strategy (#10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#9867) (f189f84)
• code-scan: harden action supply chain (#9991) (17e90eb)
• db: protect user database from test runners (#9590) (aabb699)
• deps: update anthropic packages (#10037) (fed1d2a)
• deps: update anthropic packages (#10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#10052) (fe22aa7)
• deps: update opentelemetry (#10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#9994) (6e9e2ee)
• providers: address xAI response edge cases (#10072) (0300eb0)
• providers: avoid app-server config recursion (#10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#10027) (051914a)
• providers: report cached request counts in token usage (#9970) (2392ce3)
• providers: stringify simulated user provider outputs (#10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#10074) (53d7586)
• redteam: pass target output to structured graders (#10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#10015) (3957d90)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.121.19 (2026-07-14)

Features

• providers: add Bedrock GPT-5.6 frontier support (#10081) (a97c8eb)
• providers: add Meta Model API (Muse Spark) provider (#10041) (e6f06da)
• providers: add Open Interpreter provider (#10079) (c4d9028)
• providers: add xAI Grok 4.5 support (#10032) (83cedf0)
• providers: honor CLAUDE_CONFIG_DIR for Claude Code creds (#9980) (a643f8b)
• providers: support GPT-5.6 GA (#10040) (3280625)
• redteam: account for generation-phase token usage (#9967) (e0d1698)
• redteam: add goblin strategy (#10057) (c0c86f1)
• types: optional token-usage fields on public types/schemas (#9962) (7365c32)
• util: add token-usage helpers (error/generation accumulation) (#9969) (79ebc2d)

Bug Fixes

• assertions: allow numeric 0 as contains/icontains value (#10012) (06d8105)
• assertions: return pass:false for tool calls missing a function object (#10076) (ffd8922)
• azure: avoid crash on empty choices array when reading logprobs (#9867) (f189f84)
• code-scan: harden action supply chain (#9991) (17e90eb)
• db: protect user database from test runners (#9590) (aabb699)
• deps: update anthropic packages (#10037) (fed1d2a)
• deps: update anthropic packages (#10066) (24a3ef1)
• deps: update dependency js-yaml to v5.2.1 (#10052) (fe22aa7)
• deps: update opentelemetry (#10067) (03e3f2a)
• eval: combineFilterConditions doesn't recognize lowercase 'or' (#10087) (25fedb6)
• matchers: count missing faithfulness verdicts as unsupported (#9984) (ce4a3d3)
• matchers: preserve reserved grader vars in model-graded matchers (#10042) (9f6afcc)
• matchers: preserve reserved rag grader vars (#9994) (6e9e2ee)
• providers: address xAI response edge cases (#10072) (0300eb0)
• providers: avoid app-server config recursion (#10078) (61a043f)
• providers: bill GPT-5.6 image input tokens (#10050) (ab52ee0)
• providers: clamp DeepSeek cached tokens in cost calc (#9908) (eca0cdc)
• providers: correct Codex SDK provider config handling (#9963) (a311483)
• providers: guard array access in Bedrock Titan and Cohere output handlers (#9897) (9a2aa85)
• providers: handle TrueFoundry guardrail blocks (#10021) (a9cfc86)
• providers: preserve TrueFoundry filter errors (#10027) (051914a)
• providers: report cached request counts in token usage (#9970) (2392ce3)
• providers: stringify simulated user provider outputs (#10019) (46ee400)
• redteam: add missing lowercase f to homoglyph map (#10071) (fe3151e)
• redteam: clean up Hydra and Hex handling (#10077) (ef61281)
• redteam: encode hex strategy payloads as UTF-8 bytes (#10073) (080dc99)
• redteam: match cross-session leaks case-insensitively (#10074) (53d7586)
• redteam: pass target output to structured graders (#10068) (c5f205d)
• redteam: preserve punctuation in Pig Latin encoding (#10025) (fe6bf3a)
• redteam: stop empty prompts at metadata boundaries (#10015) (3957d90)
• util: handle even backslashes before slash comments (#10030) (fd607d1)
• util: handle single-quoted escaped paths (#10080) (01694e7)
• util: remove unused NormalizedTokenUsage export (#10065) (402a84d)

... (truncated)

Commits

• 1ede17a chore(main): release 0.121.19 (#10026)
• 25fedb6 fix(eval): combineFilterConditions doesn't recognize lowercase 'or' (#10087)
• 69a094a docs(site): fix leetspeak strategy examples (#10088)
• 0ac2f15 chore(deps): update dependency protobufjs to v8.6.6 (#10085)
• 1a511ca chore(deps): update dependency @​anthropic-ai/claude-agent-sdk to v0.3.201 (#1...
• c4d9028 feat(providers): add Open Interpreter provider (#10079)
• 01694e7 fix(util): handle single-quoted escaped paths (#10080)
• ef61281 fix(redteam): clean up Hydra and Hex handling (#10077)
• ffd8922 fix(assertions): return pass:false for tool calls missing a function object (...
• 61a043f fix(providers): avoid app-server config recursion (#10078)
• Additional commits viewable in compare view

---

Note

Low Risk
Dev-only dependency bumps in the eval test package; no production runtime or repo application code is modified.

Overview
Updates tests dev tooling only: promptfoo is bumped from 0.121.3 to ^0.121.19 in package.json, with matching package-lock.json resolution.

sharp moves 0.34.5 → 0.35.3 as a transitive optional dependency of promptfoo (replacing the older copy still referenced under @huggingface/transformers). No application source or eval config files change—only lockfile/manifest versions.

^{Reviewed by Cursor Bugbot for commit 6ed7e33. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	0/100 (0/4)	-100
agentcontrol/configs-update	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/configs-variations	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/tools	75/100 (3/4)	0/100 (0/4)	-75
feature-flags/flag-and-release-change	-	0/100 (0/4)	new
feature-flags/flag-release	-	0/100 (0/5)	new
feature-flags/launchdarkly-flag-command	-	0/100 (0/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	0/100 (0/4)	-100
feature-flags/launchdarkly-flag-drift	-	0/100 (0/4)	new
feature-flags/should-flag-change	-	0/100 (0/10)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.