[GHSA-f88m-g3jw-g9cj] Add CVE-2026-69242 inherited from libvips

[SirHegel]

Summary

Updates the existing sharp advisory to reflect the upstream addition of CVE-2026-69242.

The source advisory was updated on 2026-08-14. It now lists three High-severity inherited libvips vulnerabilities and uses the new highest CVSS v4 score of 8.4.

This pull request:

• adds CVE-2026-69242 to the summary
• updates “two” to “three” High-severity vulnerabilities
• updates the CVSS v4 vector to the upstream 8.4 vector
• adds the primary libvips advisory reference
• updates modified to the source advisory timestamp

It does not change the affected sharp range, patched version, aliases, CWE, or qualitative severity.

Public sources

• sharp advisory: GHSA-f88m-g3jw-g9cj
• libvips advisory: GHSA-9rwc-f68v-4482
• libvips fix: libvips/libvips@c72f509
• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-69242

Validation

• one advisory and one JSON file only
• jq parse and semantic assertions: pass
• git diff --check: pass
• check-jsonschema 0.38.0 against the upstream OSSF OSV schema: pass
• exact GHSA and CVE search found no existing issue or pull request in this repository

AI assistance disclosure

AI assistance was used to compare already-public upstream records and prepare validation commands. The JSON diff, timestamps, CVSS vector and every cited source were reviewed directly before submission.