[dependabot]

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
@types/node	26.6.3	26.6.5
sharp	0.35.4	0.35.5
wrangler	4.141.0	4.151.1

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates wrangler from 4.141.0 to 4.151.1

Release notes

Sourced from wrangler's releases.

wrangler@4.151.1

Patch Changes

• #15541 e13d5cc Thanks @​mack-erel! - Keep remote dev sessions alive through transient network failures

  wrangler dev --remote and getPlatformProxy() refresh their preview token before it expires, but a single failed refresh — for example while the network was briefly down — stopped refreshing for good, leaving the session broken until restart. A failed refresh now retries every minute until it succeeds. Rebuilds also no longer push the refresh past the session's expiry.

• #16284 42c6912 Thanks @​karloper! - Fix wrangler rollback reporting success after the changed secrets confirmation is declined

  Previously, declining the "The following secrets have changed…" confirmation printed "Aborting rollback..." and then also printed a success message and the target version as the "Current Version ID", even though no deployment was made and the original version was still live. Wrangler now stops after aborting, so the output matches what is actually deployed.

• #13742 4a5377f Thanks @​edmundhung! - Hide the wrangler dev hotkey bar when Turborepo does not forward input

• Updated dependencies [e1d1b77]:

  • miniflare@5.20261012.1-beta

wrangler@4.151.0

Minor Changes

• #16245 d6b1c82 Thanks @​WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

  Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

• #16220 97b2fb1 Thanks @​FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

  Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.

• Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:

  • miniflare@5.20261012.0-beta

wrangler@4.150.0

Minor Changes

• #16231 091e5ec Thanks @​WalshyDev! - Upload source maps by default for wrangler deploy, wrangler versions upload and wrangler preview

  When upload_source_maps isn't set in config or via --upload-source-maps, Wrangler now generates and uploads source maps so stack traces in logs and wrangler tail point at your original source without extra setup. In this default mode, source maps that can't be resolved (for example inline data: maps or missing .map files from a custom build) are skipped rather than failing the upload. Setting upload_source_maps = true keeps the existing strict behaviour, and upload_source_maps = false (or --no-upload-source-maps for deploy and versions upload) opts out.

  wrangler build --experimental-cf-build-output is unchanged and still only includes source maps when upload_source_maps = true.

• #16128 daae435 Thanks @​redsteadz! - Stop wrangler deploy, wrangler versions upload and wrangler preview in projects that build for the Cloudflare CLI (cf)

  If your project builds through cf, deploying it with Wrangler reads a different configuration, so it could update the wrong Worker or fail without explaining why. These commands now stop before uploading anything, name the .cloudflare/output directory they found, and tell you to run cf deploy instead. If that directory is just left over from an earlier build, deleting it restores the Wrangler workflow.

  Ordinary Wrangler projects are unaffected, and --dry-run still works on deploy and versions upload. This is a new guard for the experimental Build Output Specification rather than a fix, and it gives three stable commands a failure mode they did not have before, so it is a minor.

Patch Changes

• #16161 fcf625d Thanks @​dario-piotrowicz! - Clarify the Worker not found error during CI deploy validation

... (truncated)

Commits

• e7f9e4e Version Packages (#16287)
• 4a5377f [wrangler] Hide unusable dev hotkeys under Turborepo (#13742)
• 42c6912 [wrangler] Don't report rollback success after declining changed secrets conf...
• e13d5cc [remote-bindings] Retry proactive preview token refresh after a transient fai...
• b81efbc Version Packages (#16241)
• d6b1c82 Generate source maps by default for Vite plugin Workers and Build Output (#16...
• fb3d9c8 Version Packages (#16162)
• 091e5ec [wrangler] Upload source maps by default (#16231)
• ea64ec4 [wrangler] Preserve D1 migration paths during redirected provisioning (#15517)
• d232454 [wrangler] Preserve public HTTPS response URLs behind TLS-terminating proxies...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions