build(deps-dev): bump miniflare from 4.20260714.0 to 4.20260722.0

[dependabot]

Bumps miniflare from 4.20260714.0 to 4.20260722.0.

Release notes

Sourced from miniflare's releases.

miniflare@4.20260722.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

miniflare@4.20260721.0

Minor Changes

• #14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

... (truncated)

Changelog

Sourced from miniflare's changelog.

4.20260722.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14772 c079ba3 Thanks @​chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

  When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

• #14493 95b026e Thanks @​petebacondarwin! - Update sharp to 0.35.2

  sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

  This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

4.20260721.0

Minor Changes

• #14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

... (truncated)

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• c4bacec Recover from workerd crashes in Miniflare (#14792)
• 95b026e [miniflare] Update sharp to 0.35.2 (#14493)
• c079ba3 [miniflare] Report correct byte limit in Queues batch-size error (#14772)
• 88f42e7 Version Packages (#14740)
• 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
• a7b9e65 [miniflare] Route storage/remote bindings through shared services via props (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)