build(deps): bump sharp, @cloudflare/vitest-pool-workers and wrangler

[dependabot]

Bumps sharp to 0.35.2 and updates ancestor dependencies sharp, @cloudflare/vitest-pool-workers and wrangler. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.18 to 0.19.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

• #14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

  Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

• #14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

  When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

• Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

  • wrangler@4.115.0
  • miniflare@4.20260722.1

@​cloudflare/vitest-pool-workers@​0.18.8

Patch Changes

• #14793 7b3fea6 Thanks @​trafgals! - Prevent worker disposal errors from failing otherwise successful test runs

  Errors raised while disposing test Workers are now logged for diagnostics rather than overriding the test result. Set NODE_DEBUG=vitest-pool-workers to view these errors.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@4.114.0
  • miniflare@4.20260722.0

@​cloudflare/vitest-pool-workers@​0.18.7

Patch Changes

• #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

• #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

• #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

• #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

  The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

  These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

• Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

  • miniflare@4.20260721.0
  • wrangler@4.113.0

@​cloudflare/vitest-pool-workers@​0.18.6

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.19.0

Minor Changes

• #14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

  Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

• #14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

  When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

• Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

  • wrangler@4.115.0
  • miniflare@4.20260722.1

0.18.8

Patch Changes

• #14793 7b3fea6 Thanks @​trafgals! - Prevent worker disposal errors from failing otherwise successful test runs

  Errors raised while disposing test Workers are now logged for diagnostics rather than overriding the test result. Set NODE_DEBUG=vitest-pool-workers to view these errors.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@4.114.0
  • miniflare@4.20260722.0

0.18.7

Patch Changes

• #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

• #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

• #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

• #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

  The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

  These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

• Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

  • miniflare@4.20260721.0
  • wrangler@4.113.0

... (truncated)

Commits

• 760a85b Version Packages (#14824)
• e6480e3 [vitest-pool-workers] Make workerd verbose logging configurable (#14879)
• edc203e [vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect exception lo...
• 16b3d5a Version Packages (#14799)
• 7b3fea6 fix(vitest-pool-workers): tolerate dispose rejections in pool worker stop() (...
• 88f42e7 Version Packages (#14740)
• 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
• 538e867 [vitest-pool-workers] Treat webSocket* as optional Durable Object handlers ...
• de34449 [vitest-pool-workers] Fix module fallback failure on non-ASCII workspace path...
• 5eac99e [vitest-pool-workers] Support streaming tails to the main worker (#14739)
• Additional commits viewable in compare view

Updates wrangler from 4.103.0 to 4.115.0

Release notes

Sourced from wrangler's releases.

wrangler@4.115.0

Minor Changes

• #14807 4dfb96e Thanks @​oOPa! - Add hidden --jurisdiction option to wrangler kv namespace create for internal testing

  This option creates a KV namespace within a specific jurisdiction (for example us, eu, or fedramp), backing it with jurisdiction-scoped storage. It is experimental and currently gated to allow-listed accounts, so it is hidden from --help until the feature is generally available.

• #14280 465c0fb Thanks @​tahmid-23! - Add experimental local_dev.experimental_s3_credentials to r2_buckets config

  When set, the R2 bucket is served over a local S3-compatible API at /cdn-cgi/local/r2/s3/<bucket-id> during local development, authenticated with the configured AWS SigV4 credentials. <bucket-id> is the bucket's bucket_name, or the binding name if bucket_name is not set:

  {
    "r2_buckets": [
      {
        "binding": "BUCKET",
        "bucket_name": "my-bucket",
        "local_dev": {
          "experimental_s3_credentials": {
            "accessKeyId": "local-access-key-id",
            "secretAccessKey": "local-secret-access-key"
          }
        }
      }
    ]
  }

• #14877 552bcfc Thanks @​jasoncabot! - Respect and surface the Retry-After header on Cloudflare API responses

  Previously, if a Wrangler command (e.g. wrangler versions upload, wrangler deploy) hit the Cloudflare API's rate limit, the resulting error gave no indication of how long to wait before trying again, and 429 responses weren't retried at all (only 5xx errors were, with a fixed linear backoff).

  Now:

  • 429 Too Many Requests responses are automatically retried, alongside the existing 5xx retry behaviour.
  • If a retried response includes a Retry-After header, Wrangler waits for that duration instead of the default backoff, and logs a message indicating how long it's waiting. To avoid blocking for an excessive amount of time, waits longer than 60 seconds fail fast instead — the surfaced Retry-After value lets the caller schedule its own retry.
  • If a retryable error is ultimately surfaced to the user (e.g. because retries were exhausted), the error message includes a note with the Retry-After duration, and the command-failed entry written to the Wrangler output file (WRANGLER_OUTPUT_FILE_PATH/WRANGLER_OUTPUT_FILE_DIRECTORY) gains a retry_after_ms field. This lets scripts and CI/CD pipelines calling Wrangler repeatedly (for example, wrangler versions upload on every commit) read the wait duration directly instead of regex-parsing stderr.

  APIError.isRetryable() is unchanged (still 5xx only); retryOnAPIFailure() separately retries 429s. retryAfterMs, when present, is honoured for any retried error, not just 429s.

  retryAfterMs is also now populated on APIErrors raised from direct R2 object requests, the Browser Rendering API, and errors surfaced from commands using the official cloudflare SDK client.

• #14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

  Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

  This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

... (truncated)

Commits

• 760a85b Version Packages (#14824)
• ee4472a [wrangler] Remove jurisdiction field from kv_namespaces in wrangler config (#...
• 552bcfc [wrangler] Respect and surface 429 errors from HTTP requests (#14877)
• e353367 fix output comparisons for e2e tests (#14884)
• 4dfb96e [wrangler] Support jurisdictions for KV namespaces (#14807)
• 09b8a44 [wrangler] Split cloudchamber curl headers on the first colon only (#14815)
• 465c0fb [miniflare] Expose R2 via an S3-compatible API locally (#14280)
• b737676 [wrangler] Derive old log file age from filename timestamp (#14801)
• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• Additional commits viewable in compare view