build(deps): bump sharp and miniflare

[dependabot]

Bumps sharp to 0.35.4 and updates ancestor dependency miniflare. These dependencies need to be updated together.

Updates sharp from 0.35.2 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates miniflare from 5.20260811.1-alpha to 5.20260916.0-alpha

Release notes

Sourced from miniflare's releases.

miniflare@5.20260916.0-alpha

Minor Changes

• #15483 71b6f10 Thanks @​tpmmorris! - Align Local Explorer Workflow instance status requests with production

  Local Explorer and Wrangler local mode now use the production-compatible status request field for pausing, resuming, restarting, and terminating Workflow instances. Direct Local Explorer API consumers must replace the previous action field with status.

  Successful Local Explorer status updates now return the production-compatible instance status and response timestamp instead of the local-only result.success acknowledgement.

Patch Changes

• #15665 ad23e6e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260915.1	^5.20260916.1
  workerd	1.20260915.1	1.20260916.1

• #15552 6f3d7b5 Thanks @​superbuilder-norm! - Prevent synchronous binding calls from failing intermittently under load

  Miniflare now keeps synchronous binding requests and responses correctly paired when background work is delayed. This prevents rare cascades of assertion failures in local development and CI, including when using synchronous D1 methods such as prepare() and bind().

miniflare@5.20260915.0-alpha

Minor Changes

• #15486 d3565a5 Thanks @​tpmmorris! - Add production-compatible KV bulk write and delete routes to Local Explorer

  API clients can now write and delete multiple local KV entries by changing only their Cloudflare API base URL. The new routes support production request and response shapes, including base64 values, expiration options, and metadata.

• #15453 ca71205 Thanks @​G4brym! - Remove the gated Web Search binding and Wrangler command

  The unreleased search binding and its experimental command have been removed from Wrangler, Miniflare, and configuration APIs.

Patch Changes

• #15633 7db596c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260911.1	^5.20260915.1
  workerd	1.20260911.1	1.20260915.1

• #15420 e35c4a1 Thanks @​manthaaaaan! - Fix Infinity/-Infinity being emitted as an invalid bare identifier in D1 export

• #15527 1015cfb Thanks @​devaniketh! - Scope Durable Object and Workflow local explorer peers by storageScope

... (truncated)

Changelog

Sourced from miniflare's changelog.

5.20260916.0-alpha

Minor Changes

• #15483 71b6f10 Thanks @​tpmmorris! - Align Local Explorer Workflow instance status requests with production

  Local Explorer and Wrangler local mode now use the production-compatible status request field for pausing, resuming, restarting, and terminating Workflow instances. Direct Local Explorer API consumers must replace the previous action field with status.

  Successful Local Explorer status updates now return the production-compatible instance status and response timestamp instead of the local-only result.success acknowledgement.

Patch Changes

• #15665 ad23e6e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260915.1	^5.20260916.1
  workerd	1.20260915.1	1.20260916.1

• #15552 6f3d7b5 Thanks @​superbuilder-norm! - Prevent synchronous binding calls from failing intermittently under load

  Miniflare now keeps synchronous binding requests and responses correctly paired when background work is delayed. This prevents rare cascades of assertion failures in local development and CI, including when using synchronous D1 methods such as prepare() and bind().

5.20260915.0-alpha

Minor Changes

• #15486 d3565a5 Thanks @​tpmmorris! - Add production-compatible KV bulk write and delete routes to Local Explorer

  API clients can now write and delete multiple local KV entries by changing only their Cloudflare API base URL. The new routes support production request and response shapes, including base64 values, expiration options, and metadata.

• #15453 ca71205 Thanks @​G4brym! - Remove the gated Web Search binding and Wrangler command

  The unreleased search binding and its experimental command have been removed from Wrangler, Miniflare, and configuration APIs.

Patch Changes

• #15633 7db596c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260911.1	^5.20260915.1
  workerd	1.20260911.1	1.20260915.1

• #15420 e35c4a1 Thanks @​manthaaaaan! - Fix Infinity/-Infinity being emitted as an invalid bare identifier in D1 export

... (truncated)

Commits

• f4229f1 Version Packages (#15657)
• 6f3d7b5 [miniflare] Fix the synchronous binding proxy desynchronising when its worker...
• 71b6f10 [miniflare] Align workflow status endpoint schema with production (#15483)
• bbf2f79 Version Packages (#15634)
• 7db596c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
• 1015cfb [miniflare] Scope Durable Object and Workflow local explorer peers by storage...
• e35c4a1 [miniflare] fix: emit valid SQL literal for Infinity/-Infinity in D1 export (...
• d3565a5 [miniflare] Add production KV bulk write and delete endpoints (#15486)
• ca71205 Remove Web Search binding and commands (#15453)
• 641df47 [miniflare] Reduce embedded worker bundle size by sharing Zod (#15397)
• Additional commits viewable in compare view