build(deps): bump sharp and wrangler

[dependabot]

Bumps sharp to 0.35.4 and updates ancestor dependency wrangler. These dependencies need to be updated together.

Updates sharp from 0.35.2 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates wrangler from 4.129.1 to 4.136.1

Release notes

Sourced from wrangler's releases.

wrangler@4.136.1

Patch Changes

• #15744 0ed4c54 Thanks @​podonnell-dev! - Improve wrangler preview onboarding guidance

  Wrangler now displays placeholder replacement guidance directly beneath the suggested Preview configuration instead of as a separate warning. JSON output continues to include the guidance in its structured onboarding messages.

• #15678 703922d Thanks @​christhorwarth! - Read workers.dev URLs from the Worker resource during deployment

  Wrangler no longer requires account-level subdomain permission to display Worker and version-preview URLs. It now uses the Worker-scoped URL fields while preserving account-level registration for accounts without a workers.dev subdomain.

• Updated dependencies [14d946d]:

  • @​cloudflare/unenv-preset@​2.16.2

wrangler@4.136.0

Minor Changes

• #15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

  The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

• #15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

  Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export default defineConfig({
  accountId: "...",
  complianceRegion: "public",
  worker: {
  name: "my-worker",
  compatibilityDate: "2026-09-18",
  entrypoint,
  },
  });

• #15720 35668d7 Thanks @​alexkli! - Add experimental --zone and --zone-id flags to wrangler deploy and wrangler triggers deploy to attach a zone to routes passed via --route

  Routes passed on the command line were always sent to the Cloudflare API as bare patterns. Zones with an SSL for SaaS entitlement reject such routes with error 10082 ("When using wildcard host ssl for saas entitlement you must specify the zone per route using zone_id or zone_name"), and until now the only way to set a zone was in the config file, which --route overrides.

  The new flags are experimental and must be enabled with --experimental-route-zones (alias --x-route-zones). Pass a single zone to apply it to all routes, or one zone per route in the same order as the --route flags:

  wrangler deploy --x-route-zones --route "app.example.com/*" --route "api.example.com/*" --zone example.com

  wrangler deploy --x-route-zones --route "a.example.com/*" --zone example.com --route "b.example.net/*" --zone example.net

  --zone sets zone_name and --zone-id sets zone_id on each route. The two flags cannot be combined, and passing more than one zone requires exactly one per --route. Routes without zone flags behave exactly as before.

... (truncated)

Commits

• 6e77127 Version Packages (#15747)
• b168333 chore(deps): upgrade oxfmt to 0.68.0 (#15746)
• 0ed4c54 WC-6017 [wrangler] previews: adjust copy (#15744)
• 703922d [wrangler] Read workers.dev URLs from Worker resource (#15678)
• 264fb44 Version Packages (#15710)
• 3c75cad Define experimental Cloudflare configuration with a single default export (#1...
• 35668d7 [wrangler] Add --zone/--zone-id flags to pair zones with --route (#15720)
• 0751490 [wrangler] Fix cf builds for root static projects (#15471)
• 95af41d [vitest-plugin] Support nested D1 migration layouts in readD1Migrations (#15707)
• 91e2f86 [wrangler] Allow Containers without EXPOSE (#15711)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.