fix(deps): bump sharp to 0.35.3 and js-yaml to 4.3.0 for security advisories (#5848)

* fix(deps): bump sharp to 0.35.3 and js-yaml to 4.3.0 for security advisories

* chore: fix import order in file-reader

Author: waleedlatif1

apps/sim/lib/copilot/vfs/file-reader.ts

@@ -1,6 +1,7 @@
 import { type Span, trace } from '@opentelemetry/api'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import type { SharpConstructor } from 'sharp'
 import {
   CopilotVfsOutcome,
   CopilotVfsReadOutcome,
@@ -106,7 +107,7 @@ async function prepareImageForVision(
         const mediaType = detectImageMime(buffer, claimedType)
         span.setAttribute(TraceAttr.CopilotVfsInputMediaTypeDetected, mediaType)
 
-        let sharpModule: typeof import('sharp')
+        let sharpModule: SharpConstructor
         try {
           sharpModule = (await import('sharp')).default
         } catch (err) {

apps/sim/package.json

@@ -164,7 +164,7 @@
     "isolated-vm": "6.0.2",
     "jose": "6.0.11",
     "js-tiktoken": "1.0.21",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "json5": "2.2.3",
     "jszip": "3.10.1",
     "lru-cache": "11.3.6",
@@ -204,7 +204,7 @@
     "resend": "^4.1.2",
     "rss-parser": "3.13.0",
     "safe-regex2": "5.1.0",
-    "sharp": "0.34.3",
+    "sharp": "0.35.3",
     "socket.io-client": "4.8.1",
     "ssh2": "^1.17.0",
     "streamdown": "2.5.0",