[dependabot]

Bumps sharp to 0.35.5 and updates ancestor dependency wrangler. These dependencies need to be updated together.

Updates sharp from 0.35.2 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates wrangler from 4.125.0 to 4.151.1

Release notes

Sourced from wrangler's releases.

wrangler@4.151.1

Patch Changes

• #15541 e13d5cc Thanks @​mack-erel! - Keep remote dev sessions alive through transient network failures

  wrangler dev --remote and getPlatformProxy() refresh their preview token before it expires, but a single failed refresh — for example while the network was briefly down — stopped refreshing for good, leaving the session broken until restart. A failed refresh now retries every minute until it succeeds. Rebuilds also no longer push the refresh past the session's expiry.

• #16284 42c6912 Thanks @​karloper! - Fix wrangler rollback reporting success after the changed secrets confirmation is declined

  Previously, declining the "The following secrets have changed…" confirmation printed "Aborting rollback..." and then also printed a success message and the target version as the "Current Version ID", even though no deployment was made and the original version was still live. Wrangler now stops after aborting, so the output matches what is actually deployed.

• #13742 4a5377f Thanks @​edmundhung! - Hide the wrangler dev hotkey bar when Turborepo does not forward input

• Updated dependencies [e1d1b77]:

  • miniflare@5.20261012.1-beta

wrangler@4.151.0

Minor Changes

• #16245 d6b1c82 Thanks @​WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

  Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

• #16220 97b2fb1 Thanks @​FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

  Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.

• Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:

  • miniflare@5.20261012.0-beta

wrangler@4.150.0

Minor Changes

• #16231 091e5ec Thanks @​WalshyDev! - Upload source maps by default for wrangler deploy, wrangler versions upload and wrangler preview

  When upload_source_maps isn't set in config or via --upload-source-maps, Wrangler now generates and uploads source maps so stack traces in logs and wrangler tail point at your original source without extra setup. In this default mode, source maps that can't be resolved (for example inline data: maps or missing .map files from a custom build) are skipped rather than failing the upload. Setting upload_source_maps = true keeps the existing strict behaviour, and upload_source_maps = false (or --no-upload-source-maps for deploy and versions upload) opts out.

  wrangler build --experimental-cf-build-output is unchanged and still only includes source maps when upload_source_maps = true.

• #16128 daae435 Thanks @​redsteadz! - Stop wrangler deploy, wrangler versions upload and wrangler preview in projects that build for the Cloudflare CLI (cf)

  If your project builds through cf, deploying it with Wrangler reads a different configuration, so it could update the wrong Worker or fail without explaining why. These commands now stop before uploading anything, name the .cloudflare/output directory they found, and tell you to run cf deploy instead. If that directory is just left over from an earlier build, deleting it restores the Wrangler workflow.

  Ordinary Wrangler projects are unaffected, and --dry-run still works on deploy and versions upload. This is a new guard for the experimental Build Output Specification rather than a fix, and it gives three stable commands a failure mode they did not have before, so it is a minor.

Patch Changes

• #16161 fcf625d Thanks @​dario-piotrowicz! - Clarify the Worker not found error during CI deploy validation

... (truncated)

Commits

• e7f9e4e Version Packages (#16287)
• 4a5377f [wrangler] Hide unusable dev hotkeys under Turborepo (#13742)
• 42c6912 [wrangler] Don't report rollback success after declining changed secrets conf...
• e13d5cc [remote-bindings] Retry proactive preview token refresh after a transient fai...
• b81efbc Version Packages (#16241)
• d6b1c82 Generate source maps by default for Vite plugin Workers and Build Output (#16...
• fb3d9c8 Version Packages (#16162)
• 091e5ec [wrangler] Upload source maps by default (#16231)
• ea64ec4 [wrangler] Preserve D1 migration paths during redirected provisioning (#15517)
• d232454 [wrangler] Preserve public HTTPS response URLs behind TLS-terminating proxies...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	heffdotdev	c377afc	Commit Preview URL Branch Preview URL	Oct 18 2026, 04:44 PM