chore: merge upstream tag 'v18.0.0'

[ReenigneArcher]

Description

Integrates SponsorKit v18.0.0 after the previous v17.1.1 sync. The upstream commit is 14d0ea2d8043d893483d12dff13eeacaf0059456; the downstream base is 3a4e0fff1dbb94e9dc7dfba229d5d2b4775687b8.

• Add Ko-fi webhook collection and sponsorship rendering, using CONTRIBKIT_* environment variables and contribkit's separate credential handling.
• Allocate crop IDs per SVG render and report OpenCollective GraphQL errors before reading response data.
• Carry the upstream sharp dependency floor and runtime dependency declarations into the npm lockfile.
• Preserve contribkit branding, contributor providers, bounded concurrency, Patreon API v2 fixes, npm/Vite builds, release configuration, and shared CI. Run the upstream Vitest tests alongside the existing Jest regression tests.

Breaking changes: Node.js now requires ^22.18.0 || ^24.11.0 || >=26.0.0. Direct callers of genSvgImage and generateBadge must supply a crop ID; built-in renderers allocate these through SvgComposer.getNextCropId().

Local validation: 8 Jest tests and 52 Vitest tests pass, as do ESLint, TypeScript checking, production JS/declaration builds, packaged CLI/export smoke checks, and npm publish --dry-run --tag upstream-sync-validation. The explicit dry-run tag accommodates the repository's unreleased 0.0.0 package version.

Published through Git as merge 8a9eeca08aadb219a55adc9a74ccf99e3ea20978 with subject chore: merge upstream tag 'v18.0.0'. Its first parent is downstream base 3a4e0fff1dbb94e9dc7dfba229d5d2b4775687b8, its second parent is upstream tag commit 14d0ea2d8043d893483d12dff13eeacaf0059456, and its tree 0527b05c8191458f4798f4f55fc8698140814fbf exactly matches green PR head b6f427ee7f594d686de4c50bdb96051563c668d4. Remote master and upstream ancestry are verified. The organization administrator explicitly authorized and configured the repository-rule bypass. This validation PR is closed because the tested tree has been integrated through Git; Post-push master CI passed: the CI-Node workflow (including build and draft-release creation), CodeQL actions and JavaScript analyses, and SonarCloud Code Analysis all succeeded. The master Sonar quality gate is OK with zero open issues.

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

See our AI usage policy.

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[codecov]

Bundle Report

Changes will decrease total bundle size by 18.23kB (-7.84%) ⬇️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
contribkit-esm	214.28kB	-18.23kB (-7.84%) ⬇️

Affected Assets, Files, and Routes:

view changes for bundle: contribkit-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
chunks/src-*.mjs (Deleted)	-13.08kB	0 bytes	-100.0% 🗑️
chunks/types-*.mjs	-3.15kB	76.14kB	-3.97%
cli.mjs	1.11kB	17.08kB	6.98% ⚠️
index.mjs	325 bytes	1.53kB	26.95% ⚠️
chunks/p-*.mjs (Deleted)	-3.45kB	0 bytes	-100.0% 🗑️

Files in chunks/types-*.mjs:

• ./package.json → Total Size: 70 bytes

• ./src/configs/index.ts → Total Size: 2.2kB

• ./src/providers/opencollective.ts → Total Size: 13.39kB

• ./src/providers/kofi.ts → Total Size: 8.41kB

• ./src/configs/credentials.ts → Total Size: 1.36kB

• ./src/configs/env.ts → Total Size: 2.22kB

• ./src/types.ts → Total Size: 94 bytes

• ./src/processing/svg.ts → Total Size: 3.71kB

• ./src/providers/index.ts → Total Size: 2.02kB

Files in cli.mjs:

• ./src/cli.ts → Total Size: 2.43kB

• ./src/renders/circles.ts → Total Size: 1.61kB

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (3a4e0ff) to head (b6f427e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@      Coverage Diff      @@
##   master   #158   +/-   ##
=============================
=============================

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3a4e0ff...b6f427e. Read the comment docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud