# What changed in sharp

> 77 changes in sharp 0.34 to 0.35 from its official release notes, upgrade guides and advisories: 15 breaking, 3 deprecations, 6 security, 15 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/sharp/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## sharp 0.35

### Breaking changes

- Tightens validation of extend values. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Rejects infinite values during number validation. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- The GIF effort option now requires an integer. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- TypeScript ESM declarations use named exports instead of a namespace. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- The deprecated failOnError constructor property was removed. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- The format.jp2k API name was renamed to format.jp2 for API consistency. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- The HEIF primary item is now used as the default page or frame. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds limitInputChannels with a default value of 5. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- The deprecated paletteBitDepth property was removed from metadata responses. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Support for Node.js 18 was dropped; Node.js >= 20.9.0 is now required. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- The install script was removed; compiling from source is now opt-in via the build script. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Prebuilt binaries now use static paths to aid code bundling. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Deprecated properties were removed from the sharpen operation. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- TIFF output bitdepth is now limited to 1, 2, or 4. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)

### Security

- sharp : Vulnerability in librsvg dependency CVE-2026-96889 (0.35.5) — [security advisory](https://github.com/advisories/GHSA-WQ5F-XC86-PV6W)
- sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 (0.35.4) — [security advisory](https://github.com/advisories/GHSA-RGJ7-G3M4-5G8C)
- Bounds clahe height to avoid signed overflow. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Bounds clahe width to avoid signed overflow. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Bounds trim margin to avoid signed overflow. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 (0.35.0) — [security advisory](https://github.com/advisories/GHSA-F88M-G3JW-G9CJ)

### Deprecations

- Emits a warning when using binaries provided by Electron on Linux. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Windows 32-bit prebuilt binaries are deprecated. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)

### New APIs and options

- TypeScript now allows multi-frame options for JXL output. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Adds hasAlpha to output info so callers can inspect whether the output has an alpha channel. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- TypeScript metadata responses now include mediaType. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- Adds the tune option for controlling AVIF quality metrics. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- The package now supports ECMAScript Modules (ESM). (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Prebuilt WebAssembly binaries are now available for FreeBSD. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds the tune option for controlling HEIF quality metrics. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds keepGainMap for processing HDR JPEG images with embedded gain maps. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds output as a TypedArray backed by a transferable ArrayBuffer. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds a margin option to the trim operation. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds exact to control transparent pixel colour values. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds withDensity to set output density in EXIF metadata. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- Adds withGainMap for processing HDR JPEG images with embedded gain maps. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)

### Behavior and default changes

- Allows larger accepted dimensions when extending an image. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- The tiff.subifd input option is now used. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- Default concurrency increases when MALLOC_ARENA_MAX is detected. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Metadata responses now include the image Media Type (MIME Type). (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- WebAssembly binaries are no longer considered experimental. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)

### Tooling

- Code bundler support improves through stub binaries. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- Type definitions are now published for both ESM and CJS, improving TypeScript support across module formats. (0.35.1) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.1)

### Fixes and other changes

- Adds an upper-bounds check on the length of GIF delay arrays. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Improves gain map support for extract operations. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Adds an upper-bounds check on the length of linear arrays. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Removes a non-existent named export from the TypeScript surface. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Improves gain map support for rotate operations. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Improves error handling when the WebAssembly fallback also fails. (0.35.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.5)
- Composite left and top positions are now bounded to the coordinate limit. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- info.pages is now correct when limiting the input page range. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- Input streams are better supported when they finish before output is requested. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- Palette bit depth is rounded up for PNG and GIF colours. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- Resize dimensions are now bounded to the coordinate limit. (0.35.4) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.4)
- Tightens affine matrix verification. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Verifies that background colour values are numbers. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Verifies the cache memory limit to avoid overflow. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Bounds create input dimensions to the coordinate limit. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Bounds extract regions to the libvips coordinate limit. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Improves code bundler support by resolving the path to the libvips binary. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Bounds raw input dimensions to the coordinate limit. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Tightens recomb matrix verification. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Tightens verification of text dimensions. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Tightens verification of TIFF tile dimensions. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Returns the more precise Buffer<ArrayBuffer> TypeScript type from toBuffer. (0.35.3) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.3)
- Convolution kernel values are now validated as numbers. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- Dilation and erosion width is bounded to prevent mask-size overflow. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- Recombination matrix entries are now validated as numbers. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- WebAssembly fallback detection is improved. (0.35.2) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.2)
- The WebAssembly wrapper file is now published, enabling the packaged WebAssembly interface to be used. (0.35.1) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.1)
- TypeScript FormatEnum keys now match the formats supported by the API. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)
- pkg-config path discovery was improved. (0.35.0) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.35.0)

## sharp 0.34

### Deprecations

- The --build-from-source flag is deprecated. (0.34.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.34.5)

### New APIs and options

- Output can now be produced in BigTIFF format. (0.34.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.34.5)
- Experimental support adds prebuilt binaries for Linux RISC-V 64-bit systems. (0.34.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.34.5)

### Tooling

- Building from source is supported with npm 12 and later. (0.34.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.34.5)

### Fixes and other changes

- Error messages are improved when operations issue only warnings. (0.34.5) — [release notes](https://github.com/lovell/sharp/releases/tag/v0.34.5)