v1.3.1

v1.3.1

Security dependency release.

Dependencies

• Bump sharp 0.35.4 → 0.35.5 (security): fixes CVE-2026-96889, a
  use-after-free in the bundled librsvg dependency reachable via SVG
  decoding. Comics-Now processes raster images only, and this bump replaces
  the affected native library.

Note

• One Dependabot alert remains open: sprintf-js (medium, denial of
  service through unbounded precision specifiers). No patched version
  exists upstream (first_patched_version: none); it will be picked up
  automatically once a fix ships.

All changes passed the full test suite (71 suites / 528 tests) before
release.