Skip to content

Bump sharp and @cloudflare/vite-plugin - #66

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-66fc7b3843
Open

Bump sharp and @cloudflare/vite-plugin#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-66fc7b3843

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps sharp to 0.35.5 and updates ancestor dependency @cloudflare/vite-plugin. These dependencies need to be updated together.

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.54.3 to 1.63.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.63.1

Patch Changes

  • #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

    Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

    The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

  • #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written

    Worker builds no longer lower explicit resource management into helper code, so Workers that use it ship about 1.7 KB less. workerd supports the syntax natively. On Vite 8 the plugin builds Workers at an es2026 target, so Oxc leaves the syntax alone. On Vite 6 and 7, where esbuild has no es2026 target, the Worker environments tell esbuild that using is supported instead. Client builds keep their own targets: the plugin changes only the Worker environments.

  • #16145 e820406 Thanks @​cpojer! - Honor the source-map setting in release builds

    Omit the plugin's JavaScript and declaration source maps when building with SOURCEMAPS=false, reducing the installed package size. Normal development builds keep source maps, and application source-map settings are unchanged.

  • Updated dependencies [2d1d563, 85b14e7, e6f7663, fe607f9, ad7ff45, 8de6b3c, ae29445, 757faa6, cc8e969, 417b186, 93c1069, 6947df3, 82acf3c, 9a58244]:

@​cloudflare/vite-plugin@​1.63.0

Minor Changes

  • #16030 aa2f9b7 Thanks @​edmundhung! - Add email-protected Quick Tunnels to the Cloudflare Vite plugin

    Set tunnel.allowedMail to a list of email addresses or domain patterns to require email authentication when exposing a Vite development or preview server through a Quick Tunnel.

Patch Changes

@​cloudflare/vite-plugin@​1.62.5

Patch Changes

@​cloudflare/vite-plugin@​1.62.4

Patch Changes

@​cloudflare/vite-plugin@​1.62.3

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.63.1

Patch Changes

  • #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

    Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

    The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

  • #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written

    Worker builds no longer lower explicit resource management into helper code, so Workers that use it ship about 1.7 KB less. workerd supports the syntax natively. On Vite 8 the plugin builds Workers at an es2026 target, so Oxc leaves the syntax alone. On Vite 6 and 7, where esbuild has no es2026 target, the Worker environments tell esbuild that using is supported instead. Client builds keep their own targets: the plugin changes only the Worker environments.

  • #16145 e820406 Thanks @​cpojer! - Honor the source-map setting in release builds

    Omit the plugin's JavaScript and declaration source maps when building with SOURCEMAPS=false, reducing the installed package size. Normal development builds keep source maps, and application source-map settings are unchanged.

  • Updated dependencies [2d1d563, 85b14e7, e6f7663, fe607f9, ad7ff45, 8de6b3c, ae29445, 757faa6, cc8e969, 417b186, 93c1069, 6947df3, 82acf3c, 9a58244]:

1.63.0

Minor Changes

  • #16030 aa2f9b7 Thanks @​edmundhung! - Add email-protected Quick Tunnels to the Cloudflare Vite plugin

    Set tunnel.allowedMail to a list of email addresses or domain patterns to require email authentication when exposing a Vite development or preview server through a Quick Tunnel.

Patch Changes

1.62.5

Patch Changes

1.62.4

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump sharp and @cloudflare/vite-plugin
ad7bd57 
Bumps [sharp](https://github.com/lovell/sharp) to 0.35.5 and updates ancestor dependency [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare). These dependencies need to be updated together.


Updates `sharp` from 0.35.4 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.4...v0.35.5)

Updates `@cloudflare/vite-plugin` from 1.54.3 to 1.63.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.63.1/packages/vite-plugin-cloudflare)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: indirect
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.63.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026
@coderabbitai

coderabbitai Bot commented Oct 12, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 64df5adc-ce38-4e6d-92b3-f56a6867c0b1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants