Repository navigation
chore(deps): update dependency wrangler to v4 - #555
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
size-limit report 📦
|
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
8 times, most recently
from
March 21, 2025 02:10
c81b62f to
61d49a9
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
9 times, most recently
from
March 28, 2025 02:41
c370a91 to
6d156e7
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
9 times, most recently
from
April 4, 2025 10:06
ebeecb1 to
69188a7
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
3 times, most recently
from
April 5, 2025 05:47
b2a5082 to
5afdbd1
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
10 times, most recently
from
April 20, 2025 05:13
dedb561 to
622eab4
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
13 times, most recently
from
April 27, 2025 05:54
f5d2e28 to
1347ae5
Compare
renovate
Bot
force-pushed
the
renovate/wrangler-4.x
branch
6 times, most recently
from
May 2, 2025 02:09
4004eb2 to
21d7980
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
3.114.17→4.162.0Release Notes
cloudflare/workers-sdk (wrangler)
v4.162.0Compare Source
Minor Changes
#16735
f005593Thanks @leostera! - Use the local simulator for Artifacts bindings that omitremoteBehavior change: Artifacts bindings now default to the local simulator during development, like KV, R2 and D1. Previously, an omitted
remotein Wrangler and the Vite plugin used the deployed Artifacts resource. If you want deployed repos inwrangler devorvite dev, set"remote": trueon the binding (dev: { remote: true }incloudflare.config.ts). Artifacts is in beta, so this ships as a minor release.While
remoteis omitted,wrangler dev,getPlatformProxy()and the Vite plugin warn when remote bindings are enabled, once for each binding rather than on every config reload: "Artifacts binding REPOS uses the local simulator by default. Setremote: trueto use deployed repos, orremote: falseto silence this warning." Workers Vitest andwrangler dev --localalready used the simulator, so they don't warn. Local Artifacts needs no Cloudflare credentials, but requires Git 2.32 or newer on the host.#16749
032f8c2Thanks @vaishnav-mk! - Reject settings on aworkflowsbinding to a Workflow declared inexportsA
workflowsbinding can still bind a Workflow that the Worker declares inexports, but it can no longer setlimits,concurrency,schedules,default_retention, orjurisdictionfor it. Set them on the export instead. Previously the binding and the export could both set them as long as they agreed, so configurations that set them on the binding now stop with an error that says which setting to move.#16749
032f8c2Thanks @vaishnav-mk! - Upload Workflow export settings with the Workerwrangler deployandwrangler versions uploadnow include the settings of eachworkflowexport (limits,concurrency,schedules,default_retention, andjurisdiction) in the upload, instead of sending only its type and name. Uploads of a Worker withworkflowexports also send aCloudflare-Workers-Script-Api-Dateheader, which lets the Workers API provision Workflow exports from these settings as part of the upload.wrangler deployandwrangler triggers deploystill create or update each Workflow through the Workflows API afterwards, as before.If provisioning a scheduled Workflow fails because the account is on the free plan,
wrangler deploynow explains that scheduled Workflows require a paid Workers plan.Patch Changes
#16849
3cea40bThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-12Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16886
63eb6daThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-13Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16849
3cea40bThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16886
63eb6daThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16864
3b1b408Thanks @MattieTK! - Fix packages with nestedpackage.jsonfiles missing from deploy metadataPackages such as
hono,stripeand@modelcontextprotocol/sdkwere silently omitted from the package dependency metadata reported duringwrangler deployandwrangler versions upload. These packages are now included with their installed versions. Autoconfig and codemods also detect their installed versions correctly.#16862
c889551Thanks @petebacondarwin! - Fix requests hanging when a local Worker reload finishes before an inflight request failsWrangler now immediately processes retriable requests when the replacement Worker is already ready. Previously, these requests could remain queued until another request arrived, particularly on Windows where connection failures can take longer to report.
Updated dependencies [
f005593,61eacca,856842e,856842e,3cea40b,63eb6da,3cea40b,63eb6da]:v4.161.0Compare Source
Minor Changes
#16840
8b2a363Thanks @jamesopstad! - Write source maps in Build Output withsourcesrelative to each source map fileThis changes the experimental Build Output that
wrangler build --experimental-cf-build-outputandcf-wrangler buildwrite. Their source maps were prepared as if for upload, withsourcesrelative to the project root. For Workers that Wrangler does not bundle, leading../segments were also removed, which lost the location of some files. They now point from each source map's location inbundle/to the original files, like the source maps the Vite plugin writes.Patch Changes
#16833
5f539b5Thanks @jamesopstad! - Namecfcommands andcloudflare.config.tssettings in remote bindings errors fromcf-wranglerWhen
cfruns development through thecf-wranglerdelegate and remote bindings cannot be authenticated, the error now tells you to runcf auth whoami,cf auth logoutandcf auth logininstead of the Wrangler commands, and the Cloudflare Access hint names cf. The Flagship error for a binding whose app has not been created now names the binding'sidsetting instead ofapp_id, and suggestscf flagship apps create.wrangler devstill names Wrangler's commands and settings.#16527
dc47e6dThanks @petebacondarwin! - Normalize relative redirect pathnames consistently across Pages and Workers assetsRelative
_redirectstargets now use shared pathname normalization after placeholder replacement, keeping repeated separators within the site's path. Explicit external targets (including scheme-less URLs such as//example.com/path), query values and fragments retain their contents.#16559
575d136Thanks @edmundhung! - Update@netlify/build-infoto 11.3.1#16838
3626ee8Thanks @jamesopstad! - Keep the remote bindings session when you remove the last remote bindingWhen you removed the last remote binding while
wrangler devwas running, Wrangler restarted the remote bindings session with credentials that ignored--profileand theaccount_idin your Wrangler config. So it could use a different account or ask you to choose one. Wrangler now keeps the existing session, and starts a new one with your current credentials when you add a remote binding again.Updated dependencies [
dc47e6d]:v4.160.1Compare Source
Patch Changes
877b249,69e650c]:v4.160.0Compare Source
Minor Changes
#16760
cb9534fThanks @petebacondarwin! - Support forwarded Wrangler development server options in the experimentalcf-wranglerdelegatecf devcan now forward options such as--inspector-port 9229,--ip,--var, and--persist-toto the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery,--modeenvironment selection, local development, and its.cloudflare/statedefault. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.Place server options that overlap cf's global options after
--, for examplecf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.#16739
6af492eThanks @GregBrimble! - Add custom Cloudflare API headers throughCLOUDFLARE_API_HEADERSSet
CLOUDFLARE_API_HEADERSto a JSON object such as{"X-Custom-Header":"value"}to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.Patch Changes
#16810
cdc970bThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-10Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16810
cdc970bThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16709
022ee9dThanks @petebacondarwin! - Keep local Container images available for upload retriesKeep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.
#16740
44b39b0Thanks @GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.Apply the same filtering to request, response, and request-options diagnostics. Strip
X-Auth-KeyalongsideAuthorizationwhen forwarding local artifact Git requests.#16758
325dc69Thanks @petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spreadUse a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.
Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.
Updated dependencies [
cdc970b,cdc970b,4e7e9f1,267dadb,44b39b0]:v4.159.0Compare Source
Minor Changes
#16737
a589d23Thanks @jamesopstad! - Store experimentalcf-wrangler devstate in.cloudflare/statePersist local resource data in
.cloudflare/staterelative to the configuration file. Direct Wrangler usage continues to default to.wrangler/state.#16663
fe69809Thanks @FlorentCollin! - Add--compatibilityflag towrangler d1 exportYou can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:
wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_onlyIt accepts
d1(the default) andsqlite3_cli_only. Withsqlite3_cli_only, the dump matches the output of thesqlite3 .dumpcommand, including virtual tables. D1 cannot import this dump.sqlite3_cli_onlyis only supported for remote exports.#16599
dee7a1dThanks @petebacondarwin! - SupportCLOUDFLARE_AUTH_PROFILEfor shared authentication profile selectionCloudflare tooling can pass a selected profile to child processes through
CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. Thecf-wranglerdevelopment delegate also initializes cf authentication so it reads the selected cf credentials.Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and
cf-wranglerkeeps its authentication scoped to the delegate invocation.#15615
c64fdfbThanks @svetch! - Support jurisdiction when automatically provisioning D1 databasesSet
jurisdictionon a D1 binding without adatabase_idto create the database in that jurisdiction during deployment. For example,{"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]}creates an EU-jurisdiction database.#16066
4112820Thanks @petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker typesUse
wrangler types --include-main-module=falsewhen the Worker entrypoint is generated build output that should not be type-checked as application source. The correspondingincludeMainModuleoption is available in the experimental type-generation API. The option is preserved by--checkand automatic regeneration. Omitting the import opts out of module-derivedctx.exportstyping while preserving runtime types, environment bindings, and Durable Object namespace declarations.New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.
Patch Changes
#16648
56459a5Thanks @dario-piotrowicz! - Update bundled third-party dependencies with known security fixesLocal development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.
Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.
#16746
abf924eThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-06Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16792
de10016Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-09Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16746
abf924eThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16792
de10016Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16726
2fb01e7Thanks @pratham-jain33! - Warn when cron triggers are configured alongside--dispatch-namespaceWhen deploying a user Worker to a dispatch namespace (Workers for Platforms), cron triggers are not supported, but Wrangler previously dropped them silently: schedules configured via
triggers.cronsin the Wrangler config file or the--triggersCLI flag never ran and no warning was shown. Wrangler now warns that cron triggers will be ignored when deploying with--dispatch-namespace.#16748
dc4e093Thanks @shbernal! - Stopwrangler email routing addresses createfrom claiming a verification email was sent for addresses that are already verifiedCloudflare doesn't send a verification email when the destination address is already verified on the account, such as the account owner's own email. The command now shows the verification timestamp in that case. It only mentions a verification email when the address is still pending.
#15621
cff83d0Thanks @petebacondarwin! - Report a failed Wrangler command when the CLI child is terminated by a signalWrangler's executable previously translated signal termination into exit code 0, which could cause callers to report a successful deployment after the operating system stopped Wrangler. Signal exits now use the conventional nonzero shell status.
#16413
3ef2afdThanks @ghostwriternr! - Remove Container networking sidecars and snapshot clone volumes in local developmentWrangler and the Vite plugin removed only the application containers of Container-enabled Durable Objects, found by image tag, and left behind the networking sidecars and snapshot clone volumes that workerd also creates. They now leave cleanup to Miniflare, which removes all of these when the Container configuration changes, such as after a rebuild, when local development stops, and when the process exits.
#16066
4112820Thanks @petebacondarwin! - Preserve environment inputs when automatically regenerating Worker typesAutomatic type regeneration now reuses the recorded
--envand--env-fileoptions. This keeps environment-specific bindings and secret declarations consistent with the generated header and subsequentwrangler types --checkruns.#15621
cff83d0Thanks @petebacondarwin! - Avoid materializing unused multipart request bodiesWrangler no longer creates a full text copy of multipart API request bodies when debug logs are disabled or sanitized. This substantially reduces peak memory use when uploading large batches of static assets while preserving request-body output when unsanitized debug logging is explicitly enabled.
#16664
9b6582cThanks @dario-piotrowicz! - StopgetPlatformProxy()asset misses from recursively calling its own listenerRequests for assets that do not exist now return a 404 response without hanging or exhausting local development resources.
Updated dependencies [
fea323a,56459a5,abf924e,de10016,abf924e,de10016,66bc0d6]:v4.158.0Compare Source
Minor Changes
#16186
f1d81a2Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers VitestSet
remote: falseon an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omittedremotecontinues to use the deployed resource, with a warning that changes affect real repositories;remote: trueexplicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite'sremoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator whenremoteis omitted, so tests do not change real repositories by accident; setremote: trueto test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.In Miniflare's own options, Artifacts bindings route like every other binding: only
dev.remote: truewith a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16700
dc35efbThanks @cjol! - Bump bundledfast-xml-parserfrom 4.4.1 to 4.5.5 to pick up security fixesMiniflare bundles
fast-xml-parserinto its local R2 S3 API, and Wrangler bundles it through the AWS SDK used bywrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.#16700
dc35efbThanks @cjol! - Bump bundledminimatchfrom 5.1.6 to 5.1.9 to pick up security fixesThese packages bundle
minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive**matching, which D1'smigrations_patternrelies on.#16700
dc35efbThanks @cjol! - Bump bundledshell-quotefrom 1.10.0 to 1.11.0 to pick up a security fixshell-quoteis bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.#16700
dc35efbThanks @cjol! - Bump bundledyamlfrom 2.8.1 to 2.9.0 to pick up a security fixyamlis bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.#16688
fa3edb3Thanks @FlorentCollin! - Use theaccount_idfrom the configuration file inwrangler d1 migrations list --remoteBefore this change, the command ignored the
account_idin the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configuredaccount_id, aswrangler d1 migrations applydoes.#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16695
b2061f4Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16306
36e64f2Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"When a remote bindings request reached a
workers.devhost protected by Access without valid Access credentials (for example, Access was added after the dev server started, theCF_Authorizationcookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed withTypeError: Too many redirectsand an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.
Updated dependencies [
dc35efb,dc35efb,dc35efb,dc35efb,dc35efb,b8387a5,4cde694,b2061f4,b2061f4,f1d81a2,4bb491b,36e64f2,92c4b97]:v4.157.0Compare Source
Minor Changes
34f34b3Thanks @punkeel! - Allow opting into zstd compression for Wrangler-built container image layers withWRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd.Patch Changes
#16670
b14b9dcThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-03Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16011
44d1ee4Thanks @wra-sol! - Offer to delete a Worker's Container applications when runningwrangler deletePreviously,
wrangler deleteremoved only the Worker, leaving the Container applications thatwrangler deploycreated for it running and billing. It now offers to delete them as well. With--force, or in CI and other non-interactive contexts, it lists them instead so they can be removed withwrangler containers delete <id>.#16670
b14b9dcThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
Updated dependencies [
b14b9dc,b14b9dc,d2eda1c,2750917]:v4.156.2Compare Source
Patch Changes
#16642
d38cb02Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-02Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16642
d38cb02Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16623
51bbf8bThanks @petebacondarwin! - Deprecate shared tooling helper exports from MiniflareMiniflare continues to export
getNodeCompat,NodeJSCompatMode, andgetFreshSourceMapSupportfor compatibility. These exports are deprecated and now use the implementations in@cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.
The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.
#16531
e5b1798Thanks @dario-piotrowicz! - Avoid unrelated route permission checks when comparing dashboard configurationWhen a Worker was last updated from the dashboard,
wrangler deployandwrangler versions uploadfetched route and custom-domain metadata even when the command could not change it. Wrangler now fetches only the route categories configured for deployment, allowing Worker-scoped Editor tokens to upload Workers without routes or custom domains.Updated dependencies [
d38cb02,d38cb02,51bbf8b]:v4.156.1Compare Source
Patch Changes
#16594
effe4edThanks @jaeminbird! - Fixwrangler types --checkreporting CRLF types files as out of dateWhen
worker-configuration.d.tswas checked out with CRLF line endings (for example with Git'score.autocrlf=true, the default on Windows), the runtime header kept a trailing\rand never matcheConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.