v0.4.5 - the install lock works behind PgBouncer

The module install lock now works behind PgBouncer in transaction mode, and sharp moves to 0.35.5. Upgrade with blysis update; no module needs updating.

The install lock could outlive the install

A module install holds a Postgres advisory lock so a second process cannot start one at the same time. It was a session lock, taken and released by two separate statements. Against Postgres directly those run on the same session. Behind a pooler in transaction mode, such as PgBouncer, each statement can run on a different server connection, so the release could miss the connection holding the lock. Every later install was then refused as "already running" until that connection closed.

The lock is now taken inside a transaction that stays open for the install, and releasing it ends that transaction, so the lock goes with it on whichever connection holds it. A connection whose transaction cannot be ended is closed rather than reused.

Security

• sharp 0.35.5 closes GHSA-wq5f-xc86-pv6w (CVE-2026-96889) in the librsvg it bundles.