[dependabot]

Bumps sharp to 0.35.5 and updates ancestor dependencies sharp, @cloudflare/vitest-plugin and wrangler. These dependencies need to be updated together.

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates @cloudflare/vitest-plugin from 1.3.6 to 1.4.8

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

@​cloudflare/vitest-plugin@​1.4.6

Patch Changes

• #15708 3464abc Thanks @​samstarling! - Dispose Workflow step results and introspection modifiers after use

  Release RPC resources deterministically during local Workflow execution and introspection. This prevents undisposed RPC warnings and requests being cancelled after their execution context has ended. Live step results retain their original data shape, including typed-array offsets and backing buffers. Callbacks that finish after a step times out also release their results, cancelling unused streams without delaying retries.

  Disposing an introspector still aborts the instance if modifier acquisition failed, without introducing a teardown error. Non-stream results containing function-valued array properties are rejected according to the serialisable-output contract, instead of silently discarding those properties during storage normalisation.

• #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

  Bun's fetch() ignores the undici dispatcheroven-sh/bun#39247createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

• Updated dependencies [4508172, 61fc739, 3464abc, a88cac4, 262021d]:

  • wrangler@4.151.3
  • miniflare@5.20261019.1-beta

@​cloudflare/vitest-plugin@​1.4.5

Patch Changes

• #16135 329d757 Thanks @​Zyles! - Fix test runs slowing down file after file, and stalling, with isolate: false

  With isolate: false, Vitest hands a worker's module runner to the pool again for every test file the worker runs, and the pool wrapped the runner's module fetches in one more layer each time, so imports got slower with every file until runs stalled. The pool now patches each module runner once.

• Updated dependencies [37ab91c, 0ae7926]:

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

1.4.7

Patch Changes

• Updated dependencies [80a9f96, 08f22d3, 2878645, a4eb57d, 182d6de]:
  • wrangler@4.152.0
  • miniflare@5.20261019.2-beta

1.4.6

Patch Changes

• #15708 3464abc Thanks @​samstarling! - Dispose Workflow step results and introspection modifiers after use

  Release RPC resources deterministically during local Workflow execution and introspection. This prevents undisposed RPC warnings and requests being cancelled after their execution context has ended. Live step results retain their original data shape, including typed-array offsets and backing buffers. Callbacks that finish after a step times out also release their results, cancelling unused streams without delaying retries.

  Disposing an introspector still aborts the instance if modifier acquisition failed, without introducing a teardown error. Non-stream results containing function-valued array properties are rejected according to the serialisable-output contract, instead of silently discarding those properties during storage normalisation.

• #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

  Bun's fetch() ignores the undici dispatcheroven-sh/bun#39247createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

• Updated dependencies [4508172, 61fc739, 3464abc, a88cac4, 262021d]:

  • wrangler@4.151.3

... (truncated)

Commits

• 1b3bde1 Version Packages (#16429)
• 28cca4c [vitest-plugin] Pass the import kind to Vite so require() picks the `requir...
• dfd962f Version Packages (#16377)
• 7d57659 Version Packages (#16358)
• 017bf9b chore(vitest): migrate remaining workspace tests to v5 (#16259)
• 601ca30 Version Packages (#16313)
• 329d757 [vitest-plugin] Patch a reused worker's module runner once (#16135)
• e7f9e4e Version Packages (#16287)
• e389dd7 Version Packages (#16283)
• 5f12934 [vitest-plugin] Fix filesystem module caching (#16163)
• Additional commits viewable in compare view

Updates wrangler from 4.147.0 to 4.153.0

Release notes

Sourced from wrangler's releases.

wrangler@4.153.0

Minor Changes

• #14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261019.1	^5.20261022.1
  workerd	1.20261019.1	1.20261022.1

• #16437 e651d7c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261022.1	^5.20261023.1
  workerd	1.20261022.1	1.20261023.1

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16485 b7e762d Thanks @​Cherry! - Fix the Windows keyring install when the config path contains a space

  On Windows, wrangler login --use-keyring could not set up keyring storage when the configuration path contained a space, such as a C:\Users\John Smith profile, so credentials fell back to the plaintext file. Keyring setup now works for those paths and credentials are stored encrypted.

... (truncated)

Commits

• 1b3bde1 Version Packages (#16429)
• 23ef63a [wrangler] Expand dotenv values in secrets files (#15955)
• e0c034a [wrangler] Make inspector test resilient to message ordering (#16478)
• c0e915f [wrangler] Add --infer-origin-from-routes flag to opt out of route-based orig...
• c709bff [wrangler] Fix kv key list returning only the first 1000 keys in local mode (...
• dfd962f Version Packages (#16377)
• 2878645 [wrangler] Report the R2 location returned when creating a bucket (#16361)
• 182d6de [workers-utils,deploy-helpers,config,codemods,wrangler] Add a jurisdiction se...
• 80a9f96 [wrangler] Print auth token --json output regardless of WRANGLER_LOG (#16388)
• 279c5d5 [vite-plugin] Upgrade Vite to 8.3.4 and remove workaround patch (#16371)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Tip

Tidebot — ✅ Merged
2 of 2 green · 5c76eee · full status

[struktly-tidebot]

Tip

✅ Merged
Nothing further for Tidebot to do here.

Commit 5c76eee · Checks 2 of 2 green · Labels approved dependencies javascript lgtm size/xl

All checks (2)

	Check	Result	Time
✅	check	passed	18s
✅	workflow-policy / validate workflows	passed	7s