build(deps-dev): Bump miniflare from 4.20260721.0 to 4.20260722.0

[dependabot]

Bumps miniflare from 4.20260721.0 to 4.20260722.0.

Release notes

Sourced from miniflare's releases.

miniflare@4.20260722.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

Changelog

Sourced from miniflare's changelog.

4.20260722.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• c4bacec Recover from workerd crashes in Miniflare (#14792)
• 95b026e [miniflare] Update sharp to 0.35.2 (#14493)
• c079ba3 [miniflare] Report correct byte limit in Queues batch-size error (#14772)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​miniflare@​4.20260722.0

View full report