fix: Address LGPL License concerns

[mfortman11]

Address LGPL License concerns around sharp (a package brought in by next.js but we don't use)

Summary by CodeRabbit

• Chores
  • Disabled built-in image optimization to simplify the build environment.

[coderabbitai]

Walkthrough

Next.js image optimization is disabled via configuration, and a local no-op sharp stub package replaces the native dependency. The stub module exports an empty object, and a package.json override routes dependency resolution to the stub tarball instead of the real package.

Changes

Sharp dependency removal

Layer / File(s)	Summary
Sharp stub package definition frontend/stubs/sharp/package.json, frontend/stubs/sharp/index.js	A no-op stub package manifest defines sharp at version 0.34.5 with entry point index.js, and the module exports an empty object to satisfy imports without including native libvips binaries.
Disable image optimization and wire stub frontend/next.config.ts, frontend/package.json	Next.js configuration sets images.unoptimized: true to bypass image optimization, and a dependency override routes sharp resolution to the local stub tarball.

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested Labels

bug

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'fix: Address LGPL License concerns' is vague and generic, failing to indicate that the PR specifically removes the sharp dependency via a Next.js config change and stub package.	Consider a more specific title like 'fix: Remove sharp dependency to address LGPL license concerns' or 'fix: Disable image optimization to avoid sharp native dependency'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch LGPL-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

frontend/stubs/sharp/index.js (1)

6-6: ⚡ Quick win

Make the stub fail fast with a clear error if ever invoked.

module.exports = {} can produce opaque runtime errors (... is not a function) if any code path unexpectedly calls sharp. Exporting a throwing proxy/function makes accidental usage immediately diagnosable.

Proposed refactor

-module.exports = {};
+const fail = () => {
+  throw new Error(
+    "sharp stub invoked: image optimization should be disabled (images.unoptimized=true).",
+  );
+};
+
+module.exports = new Proxy(fail, {
+  apply: fail,
+  get: () => fail,
+});

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/stubs/sharp/index.js` at line 6, Replace the empty stub export with
a fail-fast stub so any accidental import/use of sharp surfaces a clear error;
update module.exports (the exported value from frontend/stubs/sharp/index.js) to
be a function or a Proxy that throws a descriptive Error when called or when any
property is accessed (e.g., "sharp is not available in this environment — stub
invoked"), so attempts to invoke methods or access properties immediately throw
instead of producing opaque "is not a function" errors.

frontend/package.json (1)

87-87: ⚡ Quick win

sharp override tgz is git-tracked; CI-missing risk is largely mitigated—consider less brittle folder override

frontend/package.json points sharp to file:./stubs/sharp-0.34.5.tgz (line 87), and the tgz is present in the repo’s git-tracked files. The “artifact missing on clean clones/CI” concern doesn’t apply; the remaining downside is tight coupling to that exact tgz filename/version.

Safer/future-proof option

-    "sharp": "file:./stubs/sharp-0.34.5.tgz"
+    "sharp": "file:./stubs/sharp"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/package.json` at line 87, The package.json currently pins the sharp
dependency to a specific tarball filename ("sharp":
"file:./stubs/sharp-0.34.5.tgz"), which tightly couples consumers to that exact
filename; change the dependency reference to a stable path/alias (for example
point to a generic stub file name such as "file:./stubs/sharp.tgz" or a stub
directory like "file:./stubs/sharp" and ensure the repository-stored artifact is
renamed/moved accordingly) so CI/clean clones remain resilient to minor tarball
renames while keeping the tracked stub in the repo; update the sharp entry in
package.json to the new path and move/rename the tracked tarball under ./stubs
to match.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@frontend/package.json`:
- Line 87: The package.json currently pins the sharp dependency to a specific
tarball filename ("sharp": "file:./stubs/sharp-0.34.5.tgz"), which tightly
couples consumers to that exact filename; change the dependency reference to a
stable path/alias (for example point to a generic stub file name such as
"file:./stubs/sharp.tgz" or a stub directory like "file:./stubs/sharp" and
ensure the repository-stored artifact is renamed/moved accordingly) so CI/clean
clones remain resilient to minor tarball renames while keeping the tracked stub
in the repo; update the sharp entry in package.json to the new path and
move/rename the tracked tarball under ./stubs to match.

In `@frontend/stubs/sharp/index.js`:
- Line 6: Replace the empty stub export with a fail-fast stub so any accidental
import/use of sharp surfaces a clear error; update module.exports (the exported
value from frontend/stubs/sharp/index.js) to be a function or a Proxy that
throws a descriptive Error when called or when any property is accessed (e.g.,
"sharp is not available in this environment — stub invoked"), so attempts to
invoke methods or access properties immediately throw instead of producing
opaque "is not a function" errors.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 990883c6-255a-438f-b8e9-09f8f6cf34ee

📥 Commits

Reviewing files that changed from the base of the PR and between 488a6a8 and f4b53f1.

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• frontend/next.config.ts
• frontend/package.json
• frontend/stubs/sharp-0.34.5.tgz
• frontend/stubs/sharp/index.js
• frontend/stubs/sharp/package.json

[edwinjosechittilappilly]

lgtm