chore(deps): bump sharp, wrangler and miniflare

[dependabot]

Bumps sharp to 0.35.4 and updates ancestor dependencies sharp, wrangler and miniflare. These dependencies need to be updated together.

Updates sharp from 0.35.2 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates wrangler from 4.124.0 to 4.131.0

Release notes

Sourced from wrangler's releases.

wrangler@4.131.0

Minor Changes

• #15480 36aed7f Thanks @​skepticfx! - Add Durable Object-managed Containers to top-level container configuration

  Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.

  Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.

  Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.

  With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.

  versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.

  EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.

• #15493 493e635 Thanks @​GregBrimble! - Remove wrangler preview settings commands

  The private-beta wrangler preview settings and wrangler preview settings update commands are no longer available.

Patch Changes

• #15411 0b43395 Thanks @​xgame92! - Fail wrangler versions upload early when a Worker has a pending Durable Object migration

  Wrangler now directs users to run wrangler deploy to apply the migration instead of sending a version upload request that the API will reject.

• #15518 9d75006 Thanks @​taylorlee! - Detect named-only module Worker entrypoints correctly

  Wrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy addEventListener registration identifies Service Worker format.

• #15581 b605aa6 Thanks @​MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commands

  The legacy forced result counted every agent-driven Pages command using --force, including commands that could never have been delegated. Wrangler now emits eligible_forced only when --force prevents an otherwise eligible delegation, and records other agent commands as ineligible with a bounded reason and whether force was used.

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #15554 bff525d Thanks @​XiaoZ-0218! - Add the missing transferred_classes migration to the config schema

... (truncated)

Commits

• 41d7366 Version Packages (#15568)
• b605aa6 [wrangler] Correct Pages delegation analytics (#15581)
• 96688b3 fix(deps): bump shell-quote to patch CVE-2026-9277 / CVE-2026-13311 (#15584)
• 24ef86b [wrangler] Handle dynamic retry delays in workflows instances describe (#15569)
• 36aed7f CC-8364 Add top-level Durable Object-managed Containers (#15480)
• f8aea7e Replace remaining preview_defaults references with previews_base_config (...
• 9d75006 [wrangler] Fix named-only module Worker format detection (#15518)
• 128235a [wrangler] Fix types --strict-vars=false emitting invalid TypeScript for an...
• bff525d fix(wrangler): include transferred_classes in DurableObjectMigration schema (...
• 493e635 Remove the wrangler preview settings and wrangler preview settings update...
• Additional commits viewable in compare view

Updates miniflare from 4.20260730.0 to 5.20260910.0-alpha

Release notes

Sourced from miniflare's releases.

miniflare@5.20260910.0-alpha

Minor Changes

• #15578 15cd6e1 Thanks @​ThomasRubini! - Add Miniflare#dispatchConnect() for testing Worker TCP handlers

  Tests can now open a Node.js socket to a Worker's configured TCP trigger without reserving and connecting to a fixed port manually. Miniflare waits for startup, resolves OS-assigned ports, supports selecting Workers and triggers, and closes dispatched sockets during disposal.

Patch Changes

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #14814 a549e58 Thanks @​chinesepowered! - Match Content-Type case-insensitively when simulating Cloudflare's response compression

  Locally, responses were only compressed when the Content-Type matched the compressible media type list exactly. Because HTTP media types are case-insensitive and may carry whitespace before their parameters, headers such as Application/JSON or text/html ; charset=utf-8 were treated as non-compressible, diverging from production behaviour. The media type is now trimmed and lowercased before matching.

• #15540 dbb3ff4 Thanks @​NAVEENKUMARKR777! - Fix DevalueError: Cannot stringify arbitrary non-POJOs when passing a Headers instance to a proxied binding method

  R2Object#writeHttpMetadata(), R2Bucket#put()'s onlyIf option, and other proxied APIs that accept a Headers argument previously only worked if that Headers instance came from the exact same Headers implementation Miniflare uses internally (undici). In practice, user code almost always constructs Headers using the platform global instead (for example inside Next.js, Astro, Remix, or SvelteKit dev servers), which is backed by a different copy of undici and isn't instanceof the one Miniflare imports. This mismatch caused serialisation to fail with a confusing DevalueError, even though the exact same code worked fine when deployed.

  Headers, Request, and Response values are now also recognised by their Symbol.toStringTag, which is realm-independent, so any spec-compliant instance is accepted regardless of which copy of the class created it.

• #15485 fea3cd0 Thanks @​RealBhupesh! - Reject loopback server bind failures during Miniflare startup instead of leaving ready and dispose() hanging

  #startLoopbackServer now attaches an error listener before listen, matching the inspector proxy. When the configured host cannot be bound (e.g. 192.0.2.1), ready rejects and dispose() still settles even if the loopback server never started.

• #15580 6bd7b6c Thanks @​petebacondarwin! - Update sharp to 0.35.4

  This updates the image-processing dependency used by Miniflare's local Images binding to a version that addresses GHSA-rgj7-g3m4-5g8c, covering vulnerabilities in its bundled libheif library.

• #15515 be1caec Thanks @​Wichtowski! - Handle Miniflare listener startup failures consistently

  Loopback and inspector servers now remove startup-only error handlers after binding and close the server after bind failures. Inspector bind failures are observed immediately and propagated through readiness, URL access, and disposal.

• #15403 dbc9506 Thanks @​james-elicx! - Reduce the size of Miniflare's embedded asset and router Workers

  Miniflare does not configure Sentry credentials for its asset services, so their builds now replace the unused production Sentry setup with a no-op instead of bundling Toucan.

miniflare@5.20260908.0-alpha

Minor Changes

... (truncated)

Changelog

Sourced from miniflare's changelog.

5.20260910.0-alpha

Minor Changes

• #15578 15cd6e1 Thanks @​ThomasRubini! - Add Miniflare#dispatchConnect() for testing Worker TCP handlers

  Tests can now open a Node.js socket to a Worker's configured TCP trigger without reserving and connecting to a fixed port manually. Miniflare waits for startup, resolves OS-assigned ports, supports selecting Workers and triggers, and closes dispatched sockets during disposal.

Patch Changes

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #14814 a549e58 Thanks @​chinesepowered! - Match Content-Type case-insensitively when simulating Cloudflare's response compression

  Locally, responses were only compressed when the Content-Type matched the compressible media type list exactly. Because HTTP media types are case-insensitive and may carry whitespace before their parameters, headers such as Application/JSON or text/html ; charset=utf-8 were treated as non-compressible, diverging from production behaviour. The media type is now trimmed and lowercased before matching.

• #15540 dbb3ff4 Thanks @​NAVEENKUMARKR777! - Fix DevalueError: Cannot stringify arbitrary non-POJOs when passing a Headers instance to a proxied binding method

  R2Object#writeHttpMetadata(), R2Bucket#put()'s onlyIf option, and other proxied APIs that accept a Headers argument previously only worked if that Headers instance came from the exact same Headers implementation Miniflare uses internally (undici). In practice, user code almost always constructs Headers using the platform global instead (for example inside Next.js, Astro, Remix, or SvelteKit dev servers), which is backed by a different copy of undici and isn't instanceof the one Miniflare imports. This mismatch caused serialisation to fail with a confusing DevalueError, even though the exact same code worked fine when deployed.

  Headers, Request, and Response values are now also recognised by their Symbol.toStringTag, which is realm-independent, so any spec-compliant instance is accepted regardless of which copy of the class created it.

• #15485 fea3cd0 Thanks @​RealBhupesh! - Reject loopback server bind failures during Miniflare startup instead of leaving ready and dispose() hanging

  #startLoopbackServer now attaches an error listener before listen, matching the inspector proxy. When the configured host cannot be bound (e.g. 192.0.2.1), ready rejects and dispose() still settles even if the loopback server never started.

• #15580 6bd7b6c Thanks @​petebacondarwin! - Update sharp to 0.35.4

  This updates the image-processing dependency used by Miniflare's local Images binding to a version that addresses GHSA-rgj7-g3m4-5g8c, covering vulnerabilities in its bundled libheif library.

• #15515 be1caec Thanks @​Wichtowski! - Handle Miniflare listener startup failures consistently

  Loopback and inspector servers now remove startup-only error handlers after binding and close the server after bind failures. Inspector bind failures are observed immediately and propagated through readiness, URL access, and disposal.

• #15403 dbc9506 Thanks @​james-elicx! - Reduce the size of Miniflare's embedded asset and router Workers

  Miniflare does not configure Sentry credentials for its asset services, so their builds now replace the unused production Sentry setup with a no-op instead of bundling Toucan.

5.20260908.0-alpha

... (truncated)

Commits

• 41d7366 Version Packages (#15568)
• dbc9506 [miniflare] Reduce embedded asset worker bundle size (#15403)
• 6bd7b6c [miniflare] Update sharp to 0.35.4 (#15580)
• 15cd6e1 [miniflare] add dispatchConnect() helper for testing Worker TCP handlers (#15...
• be1caec [Miniflare] Clean up listener error handling (#15515)
• a549e58 [miniflare] Match Content-Type case-insensitively for compression (#14814)
• f45b596 [miniflare] Lazily initialize remote binding RPC sessions (#15432)
• dbb3ff4 [miniflare] Fix DevalueError when passing cross-realm Headers to proxied bind...
• fea3cd0 fix(miniflare): reject loopback bind failures during startup (#15485)
• 5705262 Version Packages (#15555)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~2 changed · 🔴 -0 removed · 0 flows · 2 files · commit 5f88b85

Architecture

2 components touched across 3 lanes.

Open the interactive canvas

Data flow

No data-flow sequence changed in this PR.

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn