[bryan-minimal]

next FTBFS on both arches since the pnpm 12.5.1 bump (#764) rebuilt it:

.././common.h:23:2: error: #error "libvips version 8.18.7+ is required"
make: *** [sharp-linux-x64-0.35.5.target.mk:143: ...common.o] Error 1

Cause: not pnpm. packages/next/build.sh installs sharp unpinned (npm install --ignore-scripts sharp node-addon-api node-gyp) and source-builds it against our system libvips. sharp 0.35.5 was published 2026-09-27 13:46 UTC and raised config.libvips from >=8.18.6 to >=8.18.7; we ship libvips 8.18.6. #764 was tested on 09-24/25, when 0.35.4 was the newest release, so the same build passed then. Any rebuild of next since 09-27 afternoon would have failed.

Fix: pin exact versions: sharp@0.35.4 (satisfies next 16.3.6's own optionalDependencies.sharp: ^0.35.4 and accepts libvips 8.18.6), node-addon-api@8.9.2, node-gyp@13.0.2 (what the failing build resolved; both compiled fine up to the libvips check). Exact pins are also what the reproducibility rules require: an unpinned install can't produce byte-identical builds. A comment ties SHARP_VERSION to packages/libvips.

Follow-up (separate PR): libvips 8.18.7 is out (2026-09-26); bump it, then SHARP_VERSION=0.35.5.

Unresolved / needs a reviewer: not built locally (no local builds); this PR's CI and buildbot are the verification. The existing sharp_uses_system_libvips test (expects vips 8.18.x) is unchanged and still holds.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Pinned image-processing build dependencies to specific versions for more consistent builds.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 43e5fa6d-652e-4afa-b67a-a3d4302be47f

📥 Commits

Reviewing files that changed from the base of the PR and between 3ee4ba6 and d48ea36.

📒 Files selected for processing (1)

• packages/next/build.sh

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The Next.js build script now installs fixed versions of sharp, node-addon-api, and node-gyp. Comments describe the compatibility of sharp 0.35.4 with the build’s libvips version.

Changes

Next.js build dependencies

Layer / File(s)	Summary
Pin sharp build dependencies packages/next/build.sh	The installation pins sharp to 0.35.4, node-addon-api to 8.9.2, and node-gyp to 13.0.2. Comments note that sharp 0.35.5 requires libvips 8.18.7 or newer, while the build uses libvips 8.18.6.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to d48ea

The version pins address the reported build compatibility problem. No actionable issue is established, though CI and buildbot should confirm the build.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: pinning sharp to 0.35.4. It also states the compatibility reason and the build failure it addresses.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[bryan-minimal]

Superseded: the same pin (a98197b) landed with the pnpm bump in #764 (2d07baa).