[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.158.0 → 4.162.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.162.0

Compare Source

Minor Changes

• #​16735 f005593 Thanks @​leostera! - Use the local simulator for Artifacts bindings that omit remote

  Behavior change: Artifacts bindings now default to the local simulator during development, like KV, R2 and D1. Previously, an omitted remote in Wrangler and the Vite plugin used the deployed Artifacts resource. If you want deployed repos in wrangler dev or vite dev, set "remote": true on the binding (dev: { remote: true } in cloudflare.config.ts). Artifacts is in beta, so this ships as a minor release.

  While remote is omitted, wrangler dev, getPlatformProxy() and the Vite plugin warn when remote bindings are enabled, once for each binding rather than on every config reload: "Artifacts binding REPOS uses the local simulator by default. Set remote: true to use deployed repos, or remote: false to silence this warning." Workers Vitest and wrangler dev --local already used the simulator, so they don't warn. Local Artifacts needs no Cloudflare credentials, but requires Git 2.32 or newer on the host.

• #​16749 032f8c2 Thanks @​vaishnav-mk! - Reject settings on a workflows binding to a Workflow declared in exports

  A workflows binding can still bind a Workflow that the Worker declares in exports, but it can no longer set limits, concurrency, schedules, default_retention, or jurisdiction for it. Set them on the export instead. Previously the binding and the export could both set them as long as they agreed, so configurations that set them on the binding now stop with an error that says which setting to move.

• #​16749 032f8c2 Thanks @​vaishnav-mk! - Upload Workflow export settings with the Worker

  wrangler deploy and wrangler versions upload now include the settings of each workflow export (limits, concurrency, schedules, default_retention, and jurisdiction) in the upload, instead of sending only its type and name. Uploads of a Worker with workflow exports also send a Cloudflare-Workers-Script-Api-Date header, which lets the Workers API provision Workflow exports from these settings as part of the upload. wrangler deploy and wrangler triggers deploy still create or update each Workflow through the Workflows API afterwards, as before.

  If provisioning a scheduled Workflow fails because the account is on the free plan, wrangler deploy now explains that scheduled Workflows require a paid Workers plan.

Patch Changes

• #​16849 3cea40b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-12

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16886 63eb6da Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-13

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16849 3cea40b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261110.1	^5.20261112.1
  workerd	1.20261110.1	1.20261112.1

• #​16886 63eb6da Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261112.1	^5.20261113.1
  workerd	1.20261112.1	1.20261113.1

• #​16864 3b1b408 Thanks @​MattieTK! - Fix packages with nested package.json files missing from deploy metadata

  Packages such as hono, stripe and @modelcontextprotocol/sdk were silently omitted from the package dependency metadata reported during wrangler deploy and wrangler versions upload. These packages are now included with their installed versions. Autoconfig and codemods also detect their installed versions correctly.

• #​16862 c889551 Thanks @​petebacondarwin! - Fix requests hanging when a local Worker reload finishes before an inflight request fails

  Wrangler now immediately processes retriable requests when the replacement Worker is already ready. Previously, these requests could remain queued until another request arrived, particularly on Windows where connection failures can take longer to report.

• Updated dependencies [f005593, 61eacca, 856842e, 856842e, 3cea40b, 63eb6da, 3cea40b, 63eb6da]:

  • miniflare@5.20261113.0-beta

v4.161.0

Compare Source

Minor Changes

• #​16840 8b2a363 Thanks @​jamesopstad! - Write source maps in Build Output with sources relative to each source map file

  This changes the experimental Build Output that wrangler build --experimental-cf-build-output and cf-wrangler build write. Their source maps were prepared as if for upload, with sources relative to the project root. For Workers that Wrangler does not bundle, leading ../ segments were also removed, which lost the location of some files. They now point from each source map's location in bundle/ to the original files, like the source maps the Vite plugin writes.

Patch Changes

• #​16833 5f539b5 Thanks @​jamesopstad! - Name cf commands and cloudflare.config.ts settings in remote bindings errors from cf-wrangler

  When cf runs development through the cf-wrangler delegate and remote bindings cannot be authenticated, the error now tells you to run cf auth whoami, cf auth logout and cf auth login instead of the Wrangler commands, and the Cloudflare Access hint names cf. The Flagship error for a binding whose app has not been created now names the binding's id setting instead of app_id, and suggests cf flagship apps create. wrangler dev still names Wrangler's commands and settings.

• #​16527 dc47e6d Thanks @​petebacondarwin! - Normalize relative redirect pathnames consistently across Pages and Workers assets

  Relative _redirects targets now use shared pathname normalization after placeholder replacement, keeping repeated separators within the site's path. Explicit external targets (including scheme-less URLs such as //example.com/path), query values and fragments retain their contents.

• #​16559 575d136 Thanks @​edmundhung! - Update @netlify/build-info to 11.3.1

• #​16838 3626ee8 Thanks @​jamesopstad! - Keep the remote bindings session when you remove the last remote binding

  When you removed the last remote binding while wrangler dev was running, Wrangler restarted the remote bindings session with credentials that ignored --profile and the account_id in your Wrangler config. So it could use a different account or ask you to choose one. Wrangler now keeps the existing session, and starts a new one with your current credentials when you add a remote binding again.

• Updated dependencies [dc47e6d]:

  • miniflare@5.20261110.2-beta

v4.160.1

Compare Source

Patch Changes

• Updated dependencies [877b249, 69e650c]:
  • miniflare@5.20261110.1-beta

v4.160.0

Compare Source

Minor Changes

• #​16760 cb9534f Thanks @​petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

  cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

  Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.

• #​16739 6af492e Thanks @​GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

  Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

• #​16810 cdc970b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16810 cdc970b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261109.1	^5.20261110.1
  workerd	1.20261109.1	1.20261110.1

• #​16709 022ee9d Thanks @​petebacondarwin! - Keep local Container images available for upload retries

  Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.

• #​16740 44b39b0 Thanks @​GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

  Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.

• #​16758 325dc69 Thanks @​petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

  Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

  Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.

• Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:

  • miniflare@5.20261110.0-beta

v4.159.0

Compare Source

Minor Changes

• #​16737 a589d23 Thanks @​jamesopstad! - Store experimental cf-wrangler dev state in .cloudflare/state

  Persist local resource data in .cloudflare/state relative to the configuration file. Direct Wrangler usage continues to default to .wrangler/state.

• #​16663 fe69809 Thanks @​FlorentCollin! - Add --compatibility flag to wrangler d1 export

  You can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:

  wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_only

  It accepts d1 (the default) and sqlite3_cli_only. With sqlite3_cli_only, the dump matches the output of the sqlite3 .dump command, including virtual tables. D1 cannot import this dump. sqlite3_cli_only is only supported for remote exports.

• #​16599 dee7a1d Thanks @​petebacondarwin! - Support CLOUDFLARE_AUTH_PROFILE for shared authentication profile selection

  Cloudflare tooling can pass a selected profile to child processes through CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. The cf-wrangler development delegate also initializes cf authentication so it reads the selected cf credentials.

  Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and cf-wrangler keeps its authentication scoped to the delegate invocation.

• #​15615 c64fdfb Thanks @​svetch! - Support jurisdiction when automatically provisioning D1 databases

  Set jurisdiction on a D1 binding without a database_id to create the database in that jurisdiction during deployment. For example, {"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]} creates an EU-jurisdiction database.

• #​16066 4112820 Thanks @​petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker types

  Use wrangler types --include-main-module=false when the Worker entrypoint is generated build output that should not be type-checked as application source. The corresponding includeMainModule option is available in the experimental type-generation API. The option is preserved by --check and automatic regeneration. Omitting the import opts out of module-derived ctx.exports typing while preserving runtime types, environment bindings, and Durable Object namespace declarations.

  New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.

Patch Changes

• #​16648 56459a5 Thanks @​dario-piotrowicz! - Update bundled third-party dependencies with known security fixes

  Local development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.

  Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.

• #​16746 abf924e Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-06

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16792 de10016 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-09

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16746 abf924e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261104.1	^5.20261106.1
  workerd	1.20261104.1	1.20261106.1

• #​16792 de10016 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261106.1	^5.20261109.1
  workerd	1.20261106.1	1.20261109.1

• #​16726 2fb01e7 Thanks @​pratham-jain33! - Warn when cron triggers are configured alongside --dispatch-namespace

  When deploying a user Worker to a dispatch namespace (Workers for Platforms), cron triggers are not supported, but Wrangler previously dropped them silently: schedules configured via triggers.crons in the Wrangler config file or the --triggers CLI flag never ran and no warning was shown. Wrangler now warns that cron triggers will be ignored when deploying with --dispatch-namespace.

• #​16748 dc4e093 Thanks @​shbernal! - Stop wrangler email routing addresses create from claiming a verification email was sent for addresses that are already verified

  Cloudflare doesn't send a verification email when the destination address is already verified on the account, such as the account owner's own email. The command now shows the verification timestamp in that case. It only mentions a verification email when the address is still pending.

• #​15621 cff83d0 Thanks @​petebacondarwin! - Report a failed Wrangler command when the CLI child is terminated by a signal

  Wrangler's executable previously translated signal termination into exit code 0, which could cause callers to report a successful deployment after the operating system stopped Wrangler. Signal exits now use the conventional nonzero shell status.

• #​16413 3ef2afd Thanks @​ghostwriternr! - Remove Container networking sidecars and snapshot clone volumes in local development

  Wrangler and the Vite plugin removed only the application containers of Container-enabled Durable Objects, found by image tag, and left behind the networking sidecars and snapshot clone volumes that workerd also creates. They now leave cleanup to Miniflare, which removes all of these when the Container configuration changes, such as after a rebuild, when local development stops, and when the process exits.

• #​16066 4112820 Thanks @​petebacondarwin! - Preserve environment inputs when automatically regenerating Worker types

  Automatic type regeneration now reuses the recorded --env and --env-file options. This keeps environment-specific bindings and secret declarations consistent with the generated header and subsequent wrangler types --check runs.

• #​15621 cff83d0 Thanks @​petebacondarwin! - Avoid materializing unused multipart request bodies

  Wrangler no longer creates a full text copy of multipart API request bodies when debug logs are disabled or sanitized. This substantially reduces peak memory use when uploading large batches of static assets while preserving request-body output when unsanitized debug logging is explicitly enabled.

• #​16664 9b6582c Thanks @​dario-piotrowicz! - Stop getPlatformProxy() asset misses from recursively calling its own listener

  Requests for assets that do not exist now return a 404 response without hanging or exhausting local development resources.

• Updated dependencies [fea323a, 56459a5, abf924e, de10016, abf924e, de10016, 66bc0d6]:

  • miniflare@5.20261109.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	netbox-discord	3fc5338	Nov 13 2026, 05:51 PM