chore(deps): bump sharp and miniflare

[dependabot]

Bumps sharp to 0.35.2 and updates ancestor dependency miniflare. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates miniflare from 4.20260424.0 to 4.20260722.0

Release notes

Sourced from miniflare's releases.

[email protected]

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

[email protected]

Minor Changes

• #14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

... (truncated)

Changelog

Sourced from miniflare's changelog.

4.20260722.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

4.20260721.0

Minor Changes

• #14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

... (truncated)

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• c4bacec Recover from workerd crashes in Miniflare (#14792)
• 95b026e [miniflare] Update sharp to 0.35.2 (#14493)
• c079ba3 [miniflare] Report correct byte limit in Queues batch-size error (#14772)
• 88f42e7 Version Packages (#14740)
• 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
• a7b9e65 [miniflare] Route storage/remote bindings through shared services via props (...
• 82918ad Version Packages (#14699)
• 3f3afbb [miniflare] Prevent Browser Rendering teardown hangs (#14727)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 2 untouched benchmarks

---

_{Comparing dependabot/npm_and_yarn/multi-f09669638b (6ec60c5) with main (5f2d6c9)}