chore(deps-dev): bump the site-dependencies group in /site with 2 updates

[dependabot]

Bumps the site-dependencies group in /site with 2 updates: sharp and wrangler.

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates wrangler from 4.140.0 to 4.147.0

Release notes

Sourced from wrangler's releases.

wrangler@4.147.0

Minor Changes

• #15928 7f57b1c Thanks @ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

  Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Patch Changes

• #15974 7f700ef Thanks @martinezjandrew! - Fix wrangler containers list to report live instances

  The LIVE INSTANCES column now reports each application's active runtime instances instead of its configured instance count, matching the Cloudflare dashboard. JSON output continues to expose the configured count through the existing instances field.

• #15980 90e6a1b Thanks @martinezjandrew! - Accept Durable Object application IDs in Containers commands

  wrangler containers instances and wrangler containers delete now accept the 32-character hexadecimal application IDs returned for Durable Object-backed applications, in addition to legacy dashed UUIDs.

• #15871 6a4b0fe Thanks @tw4! - Retry transient API failures in wrangler workflows instances list and wrangler workflows instances describe

  Previously, a single temporary 5xx response or dropped connection made these read-only commands exit with an error, even though the next request would have succeeded. They now use Wrangler's existing bounded API retry handling. The read that resolves --id latest is retried too, which also benefits the other wrangler workflows instances commands that accept latest; the mutating requests they make afterwards are not retried. Persistent failures are still reported after the retries are exhausted, and under --json any retry notices are written to stderr so stdout stays valid JSON.

• Updated dependencies []:

  • miniflare@5.20261001.0-alpha

wrangler@4.146.0

Minor Changes

• #15777 464a582 Thanks @Naapperas! - Support the new Workflows createBatch() API in local development

  Local Workflows bindings now accept object-form batches that create instances from a count or a list of instance options. The result includes handles for created instances and indexed per-instance errors, matching the runtime API while preserving the deprecated array form.

• #15639 aee2842 Thanks @hugo-vicente11! - Add --allowed-mail to the experimental wrangler tunnel quick-start command

  The option forwards exact email addresses, comma-separated lists, and wildcard domains to cloudflared. It can be specified more than once to combine multiple recipient rules.

  Email-protected tunnels require cloudflared 2026.9.2 or later. Wrangler checks the selected binary before starting the tunnel and reports an upgrade error when it is incompatible.

Patch Changes

• #15992 b8e7cc3 Thanks @zebp! - Mark wrangler artifacts commands as open beta

  Artifacts has entered open beta, so the wrangler artifacts commands no longer display a "private beta" label in help output and warnings.

• #15984 9d7b08e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20260930.2	^5.20261001.1

... (truncated)

Commits

• 64c1337 Version Packages (#15996)
• 6a4b0fe [wrangler] Retry transient failures in workflows instances list and describe ...
• 7f700ef CC-8799: report active instead of configured instances in containers list (#1...
• 90e6a1b CC-8800: accept durable object app ids in container commands (#15980)
• b4954c1 Version Packages (#15983)
• b8e7cc3 [wrangler] Mark Artifacts commands as open beta (#15992)
• aee2842 [wrangler] Support email-protected Quick Tunnels (#15639)
• efd67e6 [wrangler] Keep colons in wrangler tail --header filter values (#15959)
• 89061a4 Version Packages (#15957)
• 4a5ab6c Preserve existing secret bindings during Worker deployments (#15964)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ·@·d·ependabot r·ebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• ·@·d·ependabot r·ebase will rebase this PR
• ·@·d·ependabot r·ecreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Integration review update (2026-10-07)

Head: 720dbd43a10d3d85bac4eababdf4dcafbad28008. The existing CI run is green for this head.

Review and merge this PR before #260. #260 now incorporates this exact head as a second parent and regenerates the combined lockfile with npm 11.21.0. It preserves Sharp 0.35.5 and Wrangler 4.147.0 while fixing the remaining http-cache-semantics/source-map-js advisories. The combined tree passes the full 58-test site suite and a zero-vulnerability audit, and preserves all 34 libc selectors. Those combined checks apply to #260's tree, not this PR alone.

Do not interpret this PR's earlier green CI as a clean security audit: the two build-tool transitive advisories remain here and are addressed in #260. See #260 for exact tested tree, commands, local limitations, new CI, and conflict-free integration evidence. Both PR bases remain main, and neither PR has been merged.

The conflict-free order assumes a merge commit preserves this head's ancestry. If this PR is squash/rebase-merged instead, #260 must be refreshed against the resulting main and revalidated before its merge; a local squash simulation still conflicts in package.json.

[johnny4young]

Review: site deps (sharp 0.35.4 → 0.35.5, wrangler 4.140.0 → 4.147.0)

Verdict: ready.

• Ran locally: npm ci and npm test in site/ on Node 22.22.0 passed: image generation, astro check, astro build, validate-build.mjs, and 58/58 Node tests.
• sharp 0.35.5: a patch release with libvips 1.3.4, bounds checks on linear and GIF delay arrays, and TypeScript typing fixes. No breaking changes. The overrides.sharp pin was bumped in step with devDependencies, which is correct.
• wrangler 4.147.0: minor versions within v4, used only by npm run deploy (Pages), so it doesn't affect the build.
• CI was green on 720dbd4.

🟡 Out of scope, but worth noting: npm audit reports two high advisories that are already on main:

• http-cache-semantics 4.2.0 (GHSA-ch52-4w7c-c8xp)
• source-map-js 1.2.1 (GHSA-68fv-2mgg-jv7q)

Both are transitive and used only at build time by the static site, so the real risk is low. They could be cleared with overrides, the same way nanoid/undici already are, or by the next Astro bump.

---

Generated by Claude Code