{"schemaVersion":1,"status":{"id":"a8c756bb-256c-4f5a-8a71-f0bae7fbbe17","scanId":"b720d085-c7ac-4e74-a6b5-0de30a0fbe11","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T11:12:10.958Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"a8c756bb-256c-4f5a-8a71-f0bae7fbbe17","scanId":"b720d085-c7ac-4e74-a6b5-0de30a0fbe11","classifierRevision":"classifier_v2","observedAt":"2026-10-09T11:12:09.919Z","classifiedAt":"2026-10-09T11:12:10.963Z","artifact":{"name":"sharp","version":"0.35.5","integrity":"sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==","tarballUrl":"https://registry.npmjs.org/sharp/-/sharp-0.35.5.tgz"},"preparation":{"id":"ff54bd11-7531-40be-89fe-8d0be4345c4a","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"b0fc2654-3a81-409a-b2c9-7213b87d5fc3","generation":"044ca2bf-e43e-41b3-8a19-e83746d355fb","lockDigest":"d57829b55e2d1ddb85b3fbe1445cd345b016b69f24800538ca8809bc952424d9","treeDigest":"89b38f9de99e901bb3409e035abafd0fe0fe446d69a9b6219bf000318275efed","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":6,"omittedOptionalCount":26,"staticObservations":{"native":{"count":1,"paths":["node_modules/@img/sharp-linux-x64/lib/sharp-linux-x64-0.35.5.node"],"buildIndicators":["node_modules/sharp/src/binding.gyp"],"prerequisiteProven":false},"declared":{"main":"./dist/index.cjs","type":"commonjs","module":"./dist/index.mjs","engines":{"node":">=20.9.0"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"lint":"npm run lint-cpp && npm run lint-js && npm run lint-types && npm run lint-publish","test":"npm run lint && npm run test-unit","build":"node install/build.js","clean":"rm -rf src/build/ test/fixtures/output.*","lint-js":"biome lint","lint-cpp":"cpplint --quiet src/*.h src/*.cc","test-leak":"./test/leak/leak.sh","test-unit":"node --experimental-test-coverage test/unit.mjs","build:dist":"node scripts/build.mjs","docs-build":"node docs/build.mjs","docs-serve":"cd docs && npm start","lint-types":"tsd --files ./test/types/sharp.test-d.{cts,mts}","docs-publish":"cd docs && npm run build && npx firebase-tools deploy --project pixelplumbing --only hosting:pixelplumbing-sharp","lint-publish":"publint --strict","package-release-notes":"node npm/release-notes.js","package-wasm-wrappers":"node npm/wasm-wrappers.js","package-from-local-build":"node npm/from-local-build.js"},"dependencies":{"semver":"^7.8.5","@img/colour":"^1.1.0","detect-libc":"^2.1.2"},"devDependencies":{"icc":"^4.0.0","tsd":"^0.33.0","yauzl":"^3.4.0","emnapi":"^1.11.3","tar-fs":"^3.1.3","publint":"^0.3.24","node-gyp":"^12.4.0","@types/node":"*","exif-reader":"^2.0.3","@cpplint/cli":"^0.1.0","@biomejs/biome":"^2.5.14","node-addon-api":"^8.9.2","@emnapi/runtime":"^1.11.3","@img/sharp-libvips-dev":"1.3.4","@img/sharp-libvips-win32-x64":"1.3.4","@img/sharp-libvips-dev-wasm32":"1.3.4","@img/sharp-libvips-win32-ia32":"1.3.4","@img/sharp-libvips-win32-arm64":"1.3.4"},"optionalDependencies":{"@img/sharp-linux-arm":"0.35.5","@img/sharp-linux-x64":"0.35.5","@img/sharp-win32-x64":"0.35.5","@img/sharp-darwin-x64":"0.35.5","@img/sharp-win32-ia32":"0.35.5","@img/sharp-linux-arm64":"0.35.5","@img/sharp-linux-ppc64":"0.35.5","@img/sharp-linux-s390x":"0.35.5","@img/sharp-win32-arm64":"0.35.5","@img/sharp-darwin-arm64":"0.35.5","@img/sharp-linux-riscv64":"0.35.5","@img/sharp-linuxmusl-x64":"0.35.5","@img/sharp-freebsd-wasm32":"0.35.5","@img/sharp-linuxmusl-arm64":"0.35.5","@img/sharp-libvips-linux-arm":"1.3.4","@img/sharp-libvips-linux-x64":"1.3.4","@img/sharp-libvips-darwin-x64":"1.3.4","@img/sharp-libvips-linux-arm64":"1.3.4","@img/sharp-libvips-linux-ppc64":"1.3.4","@img/sharp-libvips-linux-s390x":"1.3.4","@img/sharp-libvips-darwin-arm64":"1.3.4","@img/sharp-webcontainers-wasm32":"0.35.5","@img/sharp-libvips-linux-riscv64":"1.3.4","@img/sharp-libvips-linuxmusl-x64":"1.3.4","@img/sharp-libvips-linuxmusl-arm64":"1.3.4"},"peerDependenciesMeta":{"@types/node":{"optional":true}}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"bfab88d7-3f4a-41b5-97a9-5aafd5bda511","revision":"production_ab51508deb208994caf81cb80f14b800","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:f2fcbb4dfbd6d5f57f4e43de97e70182d9982ac7cc0cc063dfff2cf1759a411d","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:9c1c93cc35d1408d26a61c4efccbde37c35425e362a2e723b885c3333d2be073","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:2343363679fb92d59a395ff081b783b5514f06295b1bc6d61baaeef17e793789","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:4292bb23555f98fb9dfc30fb447daa1c301686d89264fd8643ccb86bc0d53c29","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":0,"non_executable":0,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[]},"outcome":"pass","evidenceLevel":"smoke_tested","coverageComplete":true,"cells":[{"runId":"3737f8f6-6148-4474-80b9-ce351c119fe1","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":439.30402300017886,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":51.65366600000001,"resolvedTo":"file:///workspace/node_modules/sharp/dist/index.mjs","failure":null}],"sessions":[{"probeId":"ae18a5f1-99c7-4d19-8008-0166a26065f4","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":439.30402300017886}]},{"runId":"28eebbb0-623b-41ad-8a3e-d4ef20da9fd1","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":524.1458960000891,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":56.291641,"resolvedTo":"/workspace/node_modules/sharp/dist/index.cjs","failure":null}],"sessions":[{"probeId":"f9e0df58-e094-4d7f-816c-a7a12e57103f","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":524.1458960000891}]},{"runId":"fa336f24-bb59-4b3f-b3d1-73a4ed2b70e4","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"3dbe2c5c-95de-4d9e-a67e-ed0b4254bfba","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"a67fefa0-d8c2-4a5d-a396-a7f5b9cdd670","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":425.2231320000719,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":66.988328,"resolvedTo":"file:///workspace/node_modules/sharp/dist/index.mjs","failure":null}],"sessions":[{"probeId":"7246ba20-207f-438e-a7d7-61e30d5acdfe","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":425.2231320000719}]},{"runId":"0c5599d5-f229-4c3e-89dd-97d9d5baf17f","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":465.86358999996446,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":65.95092199999999,"resolvedTo":"/workspace/node_modules/sharp/dist/index.cjs","failure":null}],"sessions":[{"probeId":"018cddb8-bfd6-48f2-bb22-bd9110299f0b","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":465.86358999996446}]},{"runId":"60ac4cac-811e-416b-8d85-ebc39939a084","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"9d90e14c-b321-401f-93b8-685b99037315","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"ef4f69b8-0f0d-4c86-aa97-999b6a91d689","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":487.826388000045,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":43.961470000000006,"resolvedTo":"file:///workspace/node_modules/sharp/dist/index.mjs","failure":null}],"sessions":[{"probeId":"e7fd34e2-5234-4881-8118-6c45b1c87561","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":487.826388000045}]},{"runId":"87ab5b0f-25c2-448d-8a1c-577868a28e0b","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":330.42088599991985,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":50.868355,"resolvedTo":"/workspace/node_modules/sharp/dist/index.cjs","failure":null}],"sessions":[{"probeId":"ec255b1a-a37d-4b9a-b95b-ad272bb6ea2b","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":330.42088599991985}]},{"runId":"450e8869-6af7-4ad9-88ee-7bc072929d6e","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"f1128a48-14fe-4143-b283-0fb4d202d150","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"83e35acd-bdc7-4b86-a592-e6e42d515247","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":512.9488500000443,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":165.477474,"resolvedTo":"file:///workspace/node_modules/sharp/dist/index.mjs","failure":null}],"sessions":[{"probeId":"250145af-a449-4f39-bb16-2b7fab8af824","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":512.9488500000443}]},{"runId":"0085fa21-9d26-4c7b-990c-b252c633e27b","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":539.0661090000067,"failure":null,"entries":[{"index":0,"specifier":"sharp","displaySpecifier":"sharp","outcome":"pass","durationMs":89.89169599999998,"resolvedTo":"/workspace/node_modules/sharp/dist/index.cjs","failure":null}],"sessions":[{"probeId":"e7d32d4d-2441-4acf-ad15-0f359e5375a3","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":539.0661090000067}]},{"runId":"1b0bd512-6a24-4fd9-8ae2-d9d6e0898534","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"ef5fe914-3040-4513-a717-9ea354fdfc5e","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}