[Snyk] Security upgrade sharp from 0.17.3 to 0.19.0

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	No	No Known Exploit
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	No	No Known Exploit
	711/1000 Why? Recently disclosed, Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: sharp

The new version differs by 111 commits.

• da5deb8 Release v0.19.0
• 8fca89e Update documentation hostname
• d5295a2 Doc refresh for #1079
• c4df115 Expose IPTC and XMP metadata when available (#1079)
• 8afcb16 Update performance benchmark results for v0.19.0
• 3764d63 Add valgrind suppressions for Node 8
• c82914d Doc refresh and devDependencies version bumps
• 84ba921 Unpin tar dep as race condition is fixed - see 053e727
• 8e74668 Update linter plus related spacing fixes
• 707c05b Update libvips dependency minimum to v8.6.1
• 9bd2cec Update benchmark test dependencies
• 358b8fe Refresh Lambda install docs to recommend use of Docker
• 7115ae5 Prevent toFile ext taking precedence over toFormat #1037
• 13997ca Run unit test files sequentially through valgrind
• 9fa04a0 Attach event listener to clone only for Stream #995
• 0894145 Changelog and doc refresh for #1038
• 927b777 Add gravity support to embed feature (#1038)
• 1d7a0ea Changelog and doc refresh for #915
• d6aee8e Add pixel-derived image statistics via vips_stats (#915)
• dfaa39f Enable OS X CI
• 8fe3b59 Update test fixtures for https://github.com/jcupitt/libvips/commit/e9b7231ac0ab1fde2c995a6e8bf14d989b408ab0
• 47237b1 Add expected min libvips version to error messages
• 053e727 Pin tar dependency as latest version has a race condition with Node 4
• 2ce9e81 Wait for close event before decompressing tarball

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic