chore: bump sharp

[LesnyRumcajs]

Summary of changes

Changes introduced in this pull request:

• resolved a GH advisory we got sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
• it was a dep of miniflare so we had to bump it.

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

• I have performed a self-review of my own code,
• I have made corresponding changes to the documentation. All new code
  adheres to the team's
  documentation standards,
• I have added tests that prove my fix is effective or that my feature works
  (if possible),
• I have made sure the CHANGELOG is up-to-date. All user-facing changes
  should be reflected in this document.

Summary by CodeRabbit

• Chores
  • Updated Wrangler development tooling to a newer version.
  • Updated deployment workflows to use the current Wrangler version by default.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ca960867-fe09-4be7-a720-321ab1a0a460

📥 Commits

Reviewing files that changed from the base of the PR and between 8c50227 and d9c49a4.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• filecoin-project/lotus (manual)

💤 Files with no reviewable changes (1)

• .github/workflows/deploy.yml

---

📝 Walkthrough

Walkthrough

The pull request updates the Wrangler development dependency to ^4.114.0 and removes the fixed Wrangler version from the deployment workflow.

Changes

Wrangler dependency update

Layer / File(s)	Summary
Update Wrangler version package.json, .github/workflows/deploy.yml	Updates the wrangler development dependency to ^4.114.0. The dry-run and publish actions no longer set wranglerVersion to 4.86.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: akaladarshi, sudo-shashank

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary dependency change described in the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-dependabot-alert

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the Cloudflare dev/deploy toolchain dependency set (via Wrangler) to pull in a newer sharp/libvips stack and address reported security advisories.

Changes:

• Bumped wrangler in package.json from ^4.86.0 to ^4.114.0.
• Updated pnpm-lock.yaml accordingly, including sharp 0.34.5 -> 0.35.2 (and related transitive updates like miniflare, workerd, undici, esbuild).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps Wrangler version used by local/dev tooling.
pnpm-lock.yaml	Regenerates lockfile to reflect Wrangler bump and updated transitive dependencies (including sharp).

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 39.30%. Comparing base (82f0b68) to head (31bcbb5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #482   +/-   ##
=======================================
  Coverage   39.30%   39.30%           
=======================================
  Files          43       43           
  Lines        3010     3010           
=======================================
  Hits         1183     1183           
  Misses       1827     1827           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[akaladarshi]

@LesnyRumcajs Linter is failing