chore(deps): update dependency wrangler to v4 by renovate[bot] · Pull Request #555 · mchaNetwork/github-proxy

renovate · 2025-03-13T16:22:16Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	`3.114.17` → `4.156.0`

Release Notes

cloudflare/workers-sdk (wrangler)

`v4.156.0`

Compare Source

Minor Changes

#16532 25802bc Thanks @simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

#16369 ec0bea4 Thanks @MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.
#16367 b4653b4 Thanks @MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.
#16532 25802bc Thanks @simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.
#16013 8b64bec Thanks @swalker326! - Fix Durable Object self-references in tests and container validation

Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.
Updated dependencies [15fbaed, d8899ac]:
- miniflare@5.20261023.3-beta

`v4.155.0`

Compare Source

Minor Changes

#16536 a95d647 Thanks @WalshyDev! - Support remote Analytics Engine bindings in local development

Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.
```
{
  "analytics_engine_datasets": [
    {
      "binding": "EVENTS",
      "dataset": "my-dataset",
      "remote": true
    }
  ]
}
```

Patch Changes

#16526 dba0e81 Thanks @petebacondarwin! - Render terminal control characters as visible text in tail output

Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.
#16489 fc57bc0 Thanks @akshitsinha! - Keep Flagship flag metadata when updating flags

wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.
#16521 ec6eddd Thanks @petebacondarwin! - Validate .assetsignore encoding before building asset manifests

Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.
Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:
- miniflare@5.20261023.2-beta

`v4.154.0`

Compare Source

Minor Changes

#16494 0968b08 Thanks @petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

#16499 f3c13b3 Thanks @dinasaur404! - Preserve binding error codes and names in local development

Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

Node.js callers also keep custom error names such as ArtifactsError. Errors from remote bindings received inside a Worker keep their properties but are still named Error.
Updated dependencies [0968b08, f3c13b3]:
- miniflare@5.20261023.1-beta

`v4.153.0`

Minor Changes

#14865 c0e915f Thanks @TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.
#15955 23ef63a Thanks @ericclemmons! - Expand dotenv variable references in --secrets-file input

Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

#16403 5f82a56 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16437 e651d7c Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16403 5f82a56 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261019.1 ^5.20261022.1

workerd 1.20261019.1 1.20261022.1
#16437 e651d7c Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261022.1 ^5.20261023.1

workerd 1.20261022.1 1.20261023.1
#16476 8a30d8e Thanks @tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.
#16485 b7e762d Thanks @Cherry! - Fix the Windows keyring install when the config path contains a space

On Windows, wrangler login --use-keyring could not set up keyring storage when the configuration path contained a space, such as a C:\Users\John Smith profile, so credentials fell back to the plaintext file. Keyring setup now works for those paths and credentials are stored encrypted.
#16405 c709bff Thanks @ondraulehla! - Fix kv key list returning only the first 1000 keys in local mode

Listing a local namespace with more than 1000 keys stopped after the first 1000 without any warning, so the output looked complete when it wasn't. kv key list now returns every key in local mode, with or without --prefix.
#16490 bcd618d Thanks @petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.
Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, bcd618d]:
- miniflare@5.20261023.0-beta

`v4.152.0`

Minor Changes

#14900 08f22d3 Thanks @mack-erel! - Support remote Hyperdrive bindings in local development

{
  "hyperdrive": [
    {
      "binding": "HYPERDRIVE",
      "id": "<your-hyperdrive-id>",
      "remote": true
    }
  ]
}

#16357 182d6de Thanks @Naapperas! - Add a jurisdiction setting to Workflows

A Workflow defined by the Worker can now set the jurisdiction that its instances run and store their data in, on either a workflows binding or a workflow export:
```
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "jurisdiction": "eu"
    }
  ]
}
```
The accepted values are eu, fedramp, and us. wrangler deploy and wrangler triggers deploy send the jurisdiction when they create or update the Workflow. A Workflow's jurisdiction is set when it is created and cannot be changed afterwards, so wrangler deploy and wrangler versions upload stop before uploading when an existing Workflow has a different jurisdiction from the configured one. Leaving jurisdiction out keeps the Workflow's existing jurisdiction. @cloudflare/config adds the setting to exports.workflow(), cf migrate carries it over, and wrangler workflows describe prints it. Local development ignores it.

Patch Changes

#16388 80a9f96 Thanks @DevVettel! - Print wrangler auth token --json output regardless of WRANGLER_LOG

Previously the JSON was written through the normal log channel, so setting WRANGLER_LOG to warn, error or none made the command exit successfully with empty stdout. Tools that parse this output, such as the OpenNext Cloudflare adapter in CI, then failed to find any credentials. The JSON is now always printed, like other --json commands.
#16361 2878645 Thanks @GrosserNL! - Report the R2 bucket location returned by the API when creating a bucket

wrangler r2 bucket create --location printed the requested location hint even when R2 ignored it. Recreating a deleted bucket name keeps the original location, so the success message could claim a placement the bucket does not have. The command now uses the location from the create response: it mentions the hint only when that location matches, and otherwise reports the location R2 actually applied.
Updated dependencies [08f22d3, a4eb57d]:
- miniflare@5.20261019.2-beta

`v4.151.3`

Compare Source

Patch Changes

#15611 4508172 Thanks @taylorlee! - Allow wrangler dev to start module Workers without a default export

Previously, wrangler dev failed to start module Workers that exported only named entrypoints, such as RPC services, unless an unused default export was added. These Workers now start normally in local development without that workaround.
#16370 61fc739 Thanks @WalshyDev! - Fetch the remote config diff from the configured compliance region

When a Worker was last deployed from the dashboard, wrangler deploy and wrangler versions upload download its remote configuration to compare with the local one. These requests ignored the compliance_region field in the Wrangler configuration file and only honoured the CLOUDFLARE_COMPLIANCE_REGION environment variable. A FedRAMP High Worker configured through the config file would send them to api.cloudflare.com instead of api.fed.cloudflare.com, and the deploy would fail with authentication errors. They now use the same compliance region as the rest of the deploy.
#15846 a88cac4 Thanks @oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

Bun's fetch() ignores the undici dispatcher that Miniflare routes requests through (oven-sh/bun#39247). Under Bun, createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.
#16359 262021d Thanks @tw4! - Stop --strict deploys and version uploads from aborting when the API omits optional binding fields

Previously, wrangler deploy --strict and wrangler versions upload --strict could report a destructive change for an unchanged configuration, for example an R2 bucket in the default jurisdiction, because a field the API left out was compared as removed. Missing and unset optional fields are now treated as equal, so these commands proceed when the local configuration matches the deployed Worker.
Updated dependencies [3464abc]:
- miniflare@5.20261019.1-beta

`v4.151.2`

Compare Source

Patch Changes

#16307 37ab91c Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261006.1 ^5.20261016.1

workerd 1.20261012.1 1.20261016.1
#16352 0ae7926 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261016.1 ^5.20261019.1

workerd 1.20261016.1 1.20261019.1
Updated dependencies [37ab91c, 0ae7926]:
- miniflare@5.20261019.0-beta

`v4.151.1`

Compare Source

Patch Changes

#15541 e13d5cc Thanks @mack-erel! - Keep remote dev sessions alive through transient network failures

wrangler dev --remote and getPlatformProxy() refresh their preview token before it expires, but a single failed refresh — for example while the network was briefly down — stopped refreshing for good, leaving the session broken until restart. A failed refresh now retries every minute until it succeeds. Rebuilds also no longer push the refresh past the session's expiry.
#16284 42c6912 Thanks @karloper! - Fix wrangler rollback reporting success after the changed secrets confirmation is declined

Previously, declining the "The following secrets have changed…" confirmation printed "Aborting rollback..." and then also printed a success message and the target version as the "Current Version ID", even though no deployment was made and the original version was still live. Wrangler now stops after aborting, so the output matches what is actually deployed.
#13742 4a5377f Thanks @edmundhung! - Hide the wrangler dev hotkey bar when Turborepo does not forward input
Updated dependencies [e1d1b77]:
- miniflare@5.20261012.1-beta

`v4.151.0`

Compare Source

Minor Changes

#16245 d6b1c82 Thanks @WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

#16220 97b2fb1 Thanks @FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.
Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:
- miniflare@5.20261012.0-beta

`v4.150.0`

Compare Source

Minor Changes

#16231 091e5ec Thanks @WalshyDev! - Upload source maps by default for wrangler deploy, wrangler versions upload and wrangler preview

When upload_source_maps isn't set in config or via --upload-source-maps, Wrangler now generates and uploads source maps so stack traces in logs and wrangler tail point at your original source without extra setup. In this default mode, source maps that can't be resolved (for example inline data: maps or missing .map files from a custom build) are skipped rather than failing the upload. Setting upload_source_maps = true keeps the existing strict behaviour, and upload_source_maps = false (or --no-upload-source-maps for deploy and versions upload) opts out.

wrangler build --experimental-cf-build-output is unchanged and still only includes source maps when upload_source_maps = true.
#16128 daae435 Thanks @redsteadz! - Stop wrangler deploy, wrangler versions upload and wrangler preview in projects that build for the Cloudflare CLI (cf)

If your project builds through cf, deploying it with Wrangler reads a different configuration, so it could update the wrong Worker or fail without explaining why. These commands now stop before uploading anything, name the .cloudflare/output directory they found, and tell you to run cf deploy instead. If that directory is just left over from an earlier build, deleting it restores the Wrangler workflow.

Ordinary Wrangler projects are unaffected, and --dry-run still works on deploy and versions upload. This is a new guard for the experimental Build Output Specification rather than a fix, and it gives three stable commands a failure mode they did not have before, so it is a minor.

Patch Changes

#16161 fcf625d Thanks @dario-piotrowicz! - Clarify the Worker not found error during CI deploy validation

Wrangler now reports that the configured Worker could not be found in the account instead of incorrectly describing the failure as a name mismatch.
#16156 18f061c Thanks @armancharan! - Ignore .wrangler writes in the dev assets watcher

wrangler dev reloaded in a loop when assets.directory was the project root, because the assets watcher treated wrangler's own writes under .wrangler as asset changes and dropped in-flight requests. The watcher now ignores the project's .wrangler directory and dev.persist, except when that path is the assets directory.
#16025 61e07fd Thanks @kohjunhao! - Fix optional Docker lookups printing Docker CLI errors during successful builds

cf build looks for Container images left behind by earlier builds so it can remove them. This lookup is best effort, but when Docker could not be reached it still printed errors such as Cannot connect to the Docker daemon, even when the build succeeded and no image needed Docker. Docker commands whose output Wrangler reads no longer forward the Docker CLI's error output to the terminal. If one of these commands fails in a way that stops the command, the error message still includes the Docker CLI's output.
#16151 cafd3f9 Thanks @DevVettel! - Time out the OAuth token request instead of waiting indefinitely

The request that exchanges an authorization code or refresh token for an access token had no timeout, so a stalled connection (for example behind an HTTP proxy) could leave wrangler login hanging silently for many minutes after the browser step had succeeded. The request now gives up after 30 seconds and reports that the Cloudflare auth server could not be reached.
#15517 ea64ec4 Thanks @xgame92! - Preserve binding options when provisioning resources through a redirected config

Wrangler now writes provisioned resource identifiers to both the redirected and original config files without copying other binding options between them. This prevents generated relative paths such as D1 migrations_dir from replacing user-authored paths during Vite deployments.
#16219 d232454 Thanks @petebacondarwin! - Honor X-Forwarded-Proto for incoming development requests behind TLS-terminating proxies

Miniflare now uses the original client protocol when constructing URLs for network requests. This also prevents Wrangler from downgrading HTTPS URLs in response headers such as Location and WWW-Authenticate when a tunnel forwards requests over HTTP. Explicit programmatic request URLs and configured upstream origins remain authoritative.
Updated dependencies [5152bf8, 9f87de8, 9be5ec7, d232454]:
- miniflare@5.20261006.2-beta

`v4.149.0`

Compare Source

Minor Changes

#16036 9a58244 Thanks @edevil! - Support temporary event accounts in R2 and Containers commands

wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

wrangler r2 bucket create my-bucket --temporary --event-code <code>

R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

#16139 2d1d563 Thanks @cpojer! - Update esbuild to 0.28.2

Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.
#15632 85b14e7 Thanks @petebacondarwin! - Honor Retry-After directives during static asset uploads

Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.
#16098 fe607f9 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

sharp 0.35.4 0.35.5
#16093 ad7ff45 Thanks @DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.
#16102 757faa6 Thanks @tlq5l! - Keep Preview secrets when deploying to an existing Preview

Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.
#15617 93c1069 Thanks @jpatel3! - Stop the update check from recommending deprecated versions

Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.
#16003 6947df3 Thanks @oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.
#15958 82acf3c Thanks @breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

When a lifecycle rule was added with both expiration and Infrequent Access transition flags, both actions read their condition from the same list of flags, which checked --expire-days first. --expire-days 365 --ia-transition-days 30 therefore transitioned objects after 365 days instead of 30, and --expire-date 2027-01-01 --ia-transition-days 30 deleted objects after 30 days instead of on the given date. Expiration now only reads --expire-days/--expire-date, and transition only reads --ia-transition-days/--ia-transition-date.
Updated dependencies [2d1d563, e6f7663, fe607f9, 8de6b3c, ae29445, cc8e969, 417b186]:
- miniflare@5.20261006.1-alpha

`v4.148.0`

Compare Source

Minor Changes

#16051 b4e1299 Thanks @devteamaegis! - Add --source-namespace and --source-repo-name to wrangler queues subscription create for the artifacts.repo source

The Event Subscriptions API requires source.namespace and source.repo_name for artifacts.repo subscriptions, but Wrangler had no way to pass them, so --source artifacts.repo always failed with a validation error. Both flags are now required for this source, and wrangler queues subscription get shows the subscription's resource as <namespace>/<repo-name>.
#15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

Serve an asset directory from a public URL prefix without changing its on-disk layout:
```
{
  "assets": {
    "directory": "./public",
    "base_path": "/docs"
  }
}
```
Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.
#16005 4d308f6 Thanks @oOPa! - Add a --experimental-mode instant option to wrangler kv namespace create

This lets entitled accounts create Workers KV Instant namespaces while the feature is in private beta.
#16030 aa2f9b7 Thanks @edmundhung! - Add email-protected Quick Tunnels to wrangler dev

Pass one or more --tunnel-allowed-mail flags to require email authentication when exposing a local development server through a Quick Tunnel. Each value can be an exact email address or a domain pattern.
#15283 2dde890 Thanks @shubhxho! - Support deleting secrets with wrangler versions secret bulk

Set a secret's value to null in JSON input to remove it from the new Worker version. Bulk output now distinguishes between created and deleted secrets, so retrying wrangler secret bulk with wrangler versions secret bulk preserves requested deletions. Deploy the new version with wrangler versions deploy to apply the changes to production traffic.

Patch Changes

#15534 2b1a0ca Thanks @vahidshaik1901! - Improve guidance for conflicting Wrangler configuration files

When user and generated deploy configurations are found under different base paths, Wrangler now identifies the expected deploy configuration location, suggests how to resolve the conflict, and links to the relevant documentation.
#16014 c492d63 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261001.1 ^5.20261005.1

workerd 1.20261001.1 1.20261005.1
#16079 ba52118 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261005.1 ^5.20261006.1

workerd 1.20261005.1 1.20261006.1
#15573 14f0339 Thanks @xgame92! - Include default module rules in generated Worker types

wrangler types now declares the built-in Text, Data, and WebAssembly module patterns even when they are not repeated in the Wrangler configuration, keeping generated types aligned with deployment behavior.

Service-worker declaration files are emitted as global scripts so that the generated wildcard module types are visible to imports.

Directory-specific rules retain their scope when TypeScript can represent it; ambiguous relative imports use a union of the possible deployed module types.

When generating combined types for named environments, each environment's effective rules are resolved independently and differing import types are represented as unions.
[#15261](h

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-03-13T16:23:18Z

size-limit report 📦

Path	Size
src/_worker.ts	6.73 KB (0%)

renovate Bot force-pushed the renovate/wrangler-4.x branch 8 times, most recently from c81b62f to 61d49a9 Compare March 21, 2025 02:10

renovate Bot force-pushed the renovate/wrangler-4.x branch 9 times, most recently from c370a91 to 6d156e7 Compare March 28, 2025 02:41

renovate Bot force-pushed the renovate/wrangler-4.x branch 9 times, most recently from ebeecb1 to 69188a7 Compare April 4, 2025 10:06

renovate Bot force-pushed the renovate/wrangler-4.x branch 3 times, most recently from b2a5082 to 5afdbd1 Compare April 5, 2025 05:47

renovate Bot force-pushed the renovate/wrangler-4.x branch 10 times, most recently from dedb561 to 622eab4 Compare April 20, 2025 05:13

renovate Bot force-pushed the renovate/wrangler-4.x branch 13 times, most recently from f5d2e28 to 1347ae5 Compare April 27, 2025 05:54

renovate Bot force-pushed the renovate/wrangler-4.x branch 6 times, most recently from 4004eb2 to 21d7980 Compare May 2, 2025 02:09

chore(deps): update dependency wrangler to v4

893a7f4

Navigation Menu

Repository navigation

chore(deps): update dependency wrangler to v4 - #555

chore(deps): update dependency wrangler to v4#555
renovate[bot] wants to merge 1 commit into
trunkfrom
renovate/wrangler-4.x

renovate Bot commented Mar 13, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 13, 2025 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20261019.1	^5.20261022.1
workerd	1.20261019.1	1.20261022.1

Dependency	From	To
@cloudflare/workers-types	^5.20261022.1	^5.20261023.1
workerd	1.20261022.1	1.20261023.1

Dependency	From	To
@cloudflare/workers-types	^5.20261006.1	^5.20261016.1
workerd	1.20261012.1	1.20261016.1

Dependency	From	To
@cloudflare/workers-types	^5.20261001.1	^5.20261005.1
workerd	1.20261001.1	1.20261005.1

Conversation

renovate Bot commented Mar 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

github-actions Bot commented Mar 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 13, 2025 •

edited

Loading

github-actions Bot commented Mar 13, 2025 •

edited

Loading