build(deps): bump the npm-minor-and-patch group with 4 updates

[dependabot]

Bumps the npm-minor-and-patch group with 4 updates: @inquirer/prompts, fs-extra, ora and sharp.

Updates @inquirer/prompts from 8.4.1 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

• Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

• Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
• Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

• Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
• Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
• Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

• Fix: Windows rendering bug
• Fix: Preserve exact literal types in choices array (Typescript only)
• Fix: Allow input default value to be of type undefined (Typescript only)
• Bump dependencies

@​inquirer/prompts@​8.4.2

• Fix: some Windows terminals would freeze and not react to keypresses.

Commits

• bfd8710 chore: Publish new release
• 55cc5f3 feat: add reusable package lint CLI
• 3af9ed0 test(inquirer): capture prompt runner output
• 4381857 fix(@​inquirer/input): remove stale lint suppression
• 45df331 fix(@​inquirer/external-editor): harden editor temp files
• adef323 chore: limit CI token permissions
• b43359d chore: Publish new release
• 24ecae2 chore: fix yarn.lock
• b078d97 fix: validate package engine compatibility
• 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
• Additional commits viewable in compare view

Updates fs-extra from 11.3.4 to 11.4.0

Changelog

Sourced from fs-extra's changelog.

11.4.0 / 2026-07-23

• Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

11.3.6 / 2026-06-29

• Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
• Docs typo fixed (#1074)

11.3.5 / 2026-05-06

• Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
• Fix error handling in timestamp preservation code (#1065, #1069)
• Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

Commits

• 53a8d1a 11.4.0
• 9c2d3c9 Throw EEXIST when ensureSymlink dest is a broken symlink (#1076)
• 62a4e72 11.3.6
• 01c0ca6 Fix copy/move recursing into source through a symlinked dest ancestor (#1073)
• 7268250 docs: fix typo in README.md (seperate → separately) (#1074)
• 2fd7b6c chore: Add Node 26 to the test matrix (#1072)
• 8a88f58 11.3.5
• 81a1311 Mirror all utimesMillis() tests for utimesMillisSync() (#1070)
• b7ab7f8 Properly handle close errors in utimesMillis*() (#1069)
• 1c248ed Fix file descriptor leak in utimesMillisSync (#1066)
• Additional commits viewable in compare view

Updates ora from 9.3.0 to 9.4.1

Release notes

Sourced from ora's releases.

v9.4.1

• Fix type definitions (#257) 431ebc4
• Fix failText type to accept unknown instead of Error, matching the actual promise rejection value bc3a283

---

sindresorhus/ora@v9.4.0...v9.4.1

v9.4.0

• Add successSymbol and failSymbol options to oraPromise 3d2e0a9

---

sindresorhus/ora@v9.3.0...v9.4.0

Commits

• 79cd8c1 9.4.1
• bc3a283 Minor tweaks
• 431ebc4 Fix type definitions (#257)
• 46a6703 9.4.0
• 3d2e0a9 Add successSymbol and failSymbol options to oraPromise
• f70f613 Test tweaks
• 7cf29a7 Validate some options better
• See full diff in compare view

Updates sharp from 0.35.0 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions