[dependabot]

Bumps sharp to 0.35.5 and updates ancestor dependency @cloudflare/vite-plugin. These dependencies need to be updated together.

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.54.3 to 1.66.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

@​cloudflare/vite-plugin@​1.65.0

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

... (truncated)

Commits

• ae80956 [vite-plugin] Version v1 maintenance release (#16544)
• 046db08 [vite-plugin] Update v1 development registry and runtime (#16539)
• 79678c4 [vite-plugin] Update v1 to the October 23 runtime (#16444)
• d3b872f [vite-plugin] Route v1 DevTools WebSocket upgrades explicitly (#16540)
• 436fa9a [vite-plugin] Preserve WebSockets owned by other v1 listeners (#16504)
• ca116f9 [vite-plugin] Clear v1 Worker exports between dev servers (#16503)
• 109844e [vite-plugin] Preserve repeated request cookies in v1 (#16501)
• 4ce6176 [vite-plugin] Preserve Worker response status text in v1 (#16493)
• 1d5354b [vite-plugin] Resolve Durable Object runtime imports in v1 (#16479)
• 49a4610 [vite-plugin] Version v1 maintenance release (#16433)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dfa3609a-1211-434e-8bf3-70abc55e7dfc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Dependabot couldn't fetch all your path-based dependencies. Because of this, Dependabot cannot update this pull request.