build(deps): bump sharp and @cloudflare/vite-plugin

[dependabot]

Bumps sharp and @cloudflare/vite-plugin. These dependencies needed to be updated together.
Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.43.0 to 1.53.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.53.1

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@4.125.0
  • miniflare@5.20260820.0-alpha

@​cloudflare/vite-plugin@​1.53.0

Minor Changes

• #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",
        "container": "my-container"
      }
    }
  }

  The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

  container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

  • a container reference names a container that does not exist
  • two Durable Object exports claim the same container
  • a container and a Durable Object export disagree about which one they are linked to
  • a container ends up linked to no Durable Object at all
  • two containers share a name
  • a container's class_name names a Durable Object whose storage is legacy-kv
  • two containers are attached to the same Durable Object

  That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

• #15238 3a4fc6b Thanks @​jamesopstad! - Honor access.dev when running Workers with @cloudflare/vite-plugin, so ctx.access.getIdentity() returns the configured identity.

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.53.1

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@4.125.0
  • miniflare@5.20260820.0-alpha

1.53.0

Minor Changes

• #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",
        "container": "my-container"
      }
    }
  }

  The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

  container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

  • a container reference names a container that does not exist
  • two Durable Object exports claim the same container
  • a container and a Durable Object export disagree about which one they are linked to
  • a container ends up linked to no Durable Object at all
  • two containers share a name
  • a container's class_name names a Durable Object whose storage is legacy-kv
  • two containers are attached to the same Durable Object

  That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

... (truncated)

Commits

• 38b4623 Version Packages (#15250)
• 8ee43f6 Version Packages (#15175)
• 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
• 3a4fc6b Pass access configuration to Router Worker (#15238)
• 8fb2b87 [wrangler] Use FedRAMP container registries (#15196)
• d4f441f [vite-plugin-cloudflare] Handle cancelled request bodies (#15028)
• 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
• 6529f0c [wrangler] Allow containers to be attached to Durable Objects via exports (...
• c576a82 Version Packages (#15154)
• e5d56e9 Version Packages (#15145)
• Additional commits viewable in compare view