Skip to content

Bump sharp, @cloudflare/vite-plugin and nitro - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-87806aac36
Open

Bump sharp, @cloudflare/vite-plugin and nitro#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-87806aac36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor

Bumps sharp to 0.35.4 and updates ancestor dependencies sharp, @cloudflare/vite-plugin and nitro. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

... (truncated)

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.40.0 to 1.54.7

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.7

Patch Changes

@​cloudflare/vite-plugin@​1.54.6

Patch Changes

@​cloudflare/vite-plugin@​1.54.5

Patch Changes

  • #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

    When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

  • Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

@​cloudflare/vite-plugin@​1.54.4

Patch Changes

@​cloudflare/vite-plugin@​1.54.3

Patch Changes

@​cloudflare/vite-plugin@​1.54.2

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.7

Patch Changes

1.54.6

Patch Changes

1.54.5

Patch Changes

  • #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

    When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

  • Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

1.54.4

Patch Changes

1.54.3

Patch Changes

... (truncated)

Commits

Updates nitro from 3.0.260603-beta to 3.0.260903-beta

Release notes

Sourced from nitro's releases.

v3.0.260903-beta

[!NOTE] Thi release focuses on security hardenings, bug fixes, better observability, and a more reliable development experience.

Many of new improvements are from major dependency upgrades (h3, srvx, rou3, ocache, db0, env-runner, unctx and unwasm) plus the work in Nitro to adopt them. The sections below group the changes by what they mean for your app.

🚀 What’s new

🧭 Routing and route rules

Nitro migrated to the new route rules engine from h3, backed by rou3 v0.9. See the Nitro routing guide and h3 route rules guide. (#4411)

  • Rules are matched on the canonical path, with sibling routes ordered by specificity. (#4396)
  • GET routes automatically answer HEAD requests.
  • New cors rule replaces manual CORS wiring: { "/api/**": { cors: true } }.
  • basicAuth route rules are replaced by middleware (see After you upgrade).

💾 Caching

defineCachedHandler, defineCachedFunction and cache route rules now run on ocache v0.3 (up from 0.1), which brings safer defaults, bounded memory and several new capabilities. Please review your caching configuration — defaults changed. See Review your caching configuration and the Nitro caching guide.

🗄️ Database

Nitro now uses db0 v0.4. Database client libraries are passed explicitly to connectors; Nitro handles this for configured connectors and prompts to install what is missing. New in this line: neon, prisma and libsql-core connectors, Kysely integration, database capabilities metadata, and tracing channel support. See the Nitro database guide, db0 connectors, and db0 integrations.

🔌 WebSockets

WebSocket support moves to crossws 0.4.12 (from 0.4.6), which adds a batch of features usable from Nitro WebSocket handlers. See the Nitro WebSocket guide.

  • Liveness: universal idleTimeout to detect half-open connections, application-level ping/pong hooks and peer.ping(). (#201, #202)
  • Backpressure: peer.bufferedAmount (docs) and opt-in subprotocol negotiation. (#195, #203)
  • Pub/sub: a sync backplane to share channels across instances (docs), plus auth and context support. (#192, #112)

🔭 Observability and tracing

🔒 Security

  • h3 has undergone several rounds of security hardening audits (path normalization, forwarded headers, host header handling, cookies, CORS, basic auth, JSON-RPC, session sealing).
  • Development task endpoints (/_nitro/tasks and /_nitro/tasks/:name) now accept only local requests. This prevents remote clients with access to the dev server from listing or invoking tasks. (#4389)
  • Cached responses no longer replay cookies by default.
  • Better static file responses: conditional requests with ETag and Last-Modified, byte ranges, optional Cache-Control, and additional path-traversal hardening.

⚡ Faster and more reliable

  • Improved alias resolution, development sourcemaps, request middleware, and logging.
  • Development worker reloads are serialized and cleanly awaited, stale module caches are cleared, (vite) aliases apply in the correct order, base paths are respected, and ?import requests remain handled by Vite.
  • Static presets no longer create an unnecessary server bundle.

... (truncated)

Commits
  • 0509fb9 v3.0.260903-beta
  • 7687569 chore: update srvx
  • 7f05b81 chore: update h3
  • a28ca29 fix(deps): auto-install in agent and non-tty environments
  • 8157e00 fix(storage, database): import connector libs from their real specifier
  • a44368a fix(vercel): prevent caching missing public assets (#4474)
  • dee9d46 fix(cloudflare): do not rewrite createRequire or node imports inside strings ...
  • 066510f fix(vercel, netlify, edgeone): expand ** anywhere in redirect and proxy tar...
  • 68d7580 refactor!: remove type generation (#4577)
  • 8a53625 fix(rollup): escape dynamic route segments in chunk names (#4508)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump sharp, @cloudflare/vite-plugin and nitro
9c5e477 
Bumps [sharp](https://github.com/lovell/sharp) to 0.35.4 and updates ancestor dependencies [sharp](https://github.com/lovell/sharp), [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) and [nitro](https://github.com/nitrojs/nitro). These dependencies need to be updated together.


Updates `sharp` from 0.34.5 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.4)

Updates `@cloudflare/vite-plugin` from 1.40.0 to 1.54.7
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.54.7/packages/vite-plugin-cloudflare)

Updates `nitro` from 3.0.260603-beta to 3.0.260903-beta
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v3.0.260603-beta...v3.0.260903-beta)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: indirect
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.54.7
  dependency-type: direct:production
- dependency-name: nitro
  dependency-version: 3.0.260903-beta
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@vercel

vercel Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
roi-muse-maker Error Error Sep 11, 2026 3:43am UTC

@netlify

netlify Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ Deploy Preview for roi-companion failed.

Name Link
🔨 Latest commit 9c5e477
🔍 Latest deploy log https://app.netlify.com/projects/roi-companion/deploys/6aa378c121798d0008641bab

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants