chore(deps): update dependency wrangler to v4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	3.114.17 → 4.113.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.113.0

Compare Source

Minor Changes

• #​14471 f03b108 Thanks @​DiogoSantoss! - Apply Email Routing addresses during Worker trigger deployment

  Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy, wrangler triggers deploy, and clients of @cloudflare/deploy-helpers. After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone (+ added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules.

• #​14679 deae171 Thanks @​dario-piotrowicz! - Add exclude_packages option to dependencies_instrumentation configuration

  The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads.

  // wrangler.json
  {
    "dependencies_instrumentation": {
      "exclude_packages": ["@​internal/*", "secret-tool"]
    }
  }

• #​14721 4e92e32 Thanks @​dmmulroy! - Support Artifacts sources when creating Queue event subscriptions

  wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API.

• #​13352 d1d6945 Thanks @​penalosa! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings

  Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled.

• #​14688 a0c8bb1 Thanks @​NuroDev! - Print Local Explorer API details for headless agent-driven wrangler dev sessions

  When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI.

• #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export const settings = defineSettings({
  	accountId: "<your-account-id>",
  });
  
  export default defineWorker({
  	name: "my-worker",
  	entrypoint,
  	compatibilityDate: "2026-05-18",
  });

  This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

• #​14595 2b390d7 Thanks @​colinhacks! - Recognise nub as a package manager

  wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

• #​14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

• #​14715 42af66d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260714.1	^5.20260721.1
  workerd	1.20260714.1	1.20260721.1

• #​14744 a0a091b Thanks @​penalosa! - Drop the "Experimental:" prefix from the resource provisioning header now that automatic provisioning is generally available. The deploy output now reads The following bindings need to be provisioned:.

• #​14720 0df3d43 Thanks @​penalosa! - Fix remote binding previews for accounts without a workers.dev subdomain

  Wrangler now automatically registers a workers.dev subdomain when one is required to start a remote binding preview.

• #​14773 d83a476 Thanks @​chinesepowered! - Fix stray characters in the Workers Sites asset-key-too-long error

  The error thrown when an asset path key exceeds the 512-character limit ended with a stray ", copy-paste artifact, so the message printed to users terminated with ...#kv-limits", and the trailing documentation URL was malformed. The message now ends cleanly at the URL.

• #​14766 4815711 Thanks @​gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

  A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

  The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

• #​14448 c82d96b Thanks @​GregBrimble! - Use the new PATCH APIs for versioned secret commands

  Wrangler now updates versioned Worker secrets by patching the latest Worker version instead of downloading the latest version contents and uploading a full replacement version. This avoids reconstructing Worker configuration in Wrangler, which should reduce bugs when Workers use less common features. For example, this avoids regressions like the previous placement preservation bug fixed in #​13843.

• #​14617 f75ae5d Thanks @​martijnwalraven! - Derive nodejsCompatMode from the effective compatibility inputs in unstable_startWorker()

  The CLI computes the node-compat mode from the effective compatibility date and flags (args.* ?? parsedConfig.*), but the programmatic path used input.build.nodejsCompatMode raw — leaving it unset meant a worker's nodejs_compat flag (from its config file or from input-level compatibilityFlags) was silently ignored, so bundling failed to resolve node builtins that wrangler dev handles. startWorker now derives the mode the same way when the caller does not provide one: input-level compatibilityDate/compatibilityFlags first, then the resolved config, with no-bundle taken from the resolved build.bundle semantics. Passing an explicit null still disables it.

• Updated dependencies [42af66d, 4815711, 34430b3]:

  • miniflare@​4.20260721.0

v4.112.0

Compare Source

Minor Changes

• #​14470 3de70df Thanks @​DiogoSantoss! - Add a top-level addresses field to Wrangler configuration for Email Routing

  You can now declare the inbound email addresses handled by your Worker directly in wrangler.json:

  {
    "name": "my-worker",
    "main": "src/index.ts",
    "compatibility_date": "2026-05-21",
    "addresses": ["support@example.com", "*@​example.com"]
  }

• #​14706 cb6c3f9 Thanks @​edmundhung! - Add Durable Object storage access to createTestHarness()

  You can now execute SQL against a SQLite-backed Durable Object to seed or assert the storage state.

  const server = createTestHarness({
    workers: [{ configPath: "./wrangler.json" }],
  });
  await server.listen();
  
  const worker = server.getWorker();
  const storage = await worker.getDurableObjectStorage("COUNTER", {
    name: "user-123",
  });
  
  await worker.fetch("/counter/user-123");
  
  const rows = await storage.exec(
    "SELECT value FROM counters WHERE id = ?",
    "user-123"
  );
  expect(rows).toEqual([{ value: 1 }]);

• #​14562 9f04a7e Thanks @​martijnwalraven! - Emit a typed runtimeError event on the unstable_startWorker DevEnv for uncaught Worker exceptions

  Uncaught Worker exceptions were only source-mapped and printed, so programmatic consumers had to scrape terminal output to observe them. The DevEnv now re-emits a RuntimeErrorEvent (like reloadComplete) carrying the exception text and source-mapped stack — fed from Miniflare's pretty-error seam via the new handleUncaughtError option for exceptions the runtime catches, and from the inspector for those it does not.

Patch Changes

• #​14682 d39ae01 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260710.1	^5.20260714.1
  workerd	1.20260710.1	1.20260714.1

• #​14725 c79504f Thanks @​edmundhung! - Support containers in createTestHarness()

  Workers configured with containers can now be tested using createTestHarness(). The harness builds configured images and makes container-backed Durable Objects available during integration tests.

• #​14696 c7dbe1a Thanks @​martijnwalraven! - Type unstable_startWorker, DevEnv.startWorker, and ConfigController.set/patch against WranglerStartDevWorkerInput, so the wrangler-specific dev.structuredLogsHandler field the runtime already honors is expressible through the public API. Previously the public signatures took the base StartDevWorkerInput, and callers passing the handler needed a cast while internal callers (the test harness) routed the wider type around the signature.

• #​14494 4e1a7a7 Thanks @​petebacondarwin! - Register a workers.dev subdomain before uploading a new Worker

  Deploying a Worker for the first time on an account that has no workers.dev subdomain failed with an opaque API error raised by the upload request itself (code 10063, "You need a workers.dev subdomain in order to proceed"). Wrangler now checks for a workers.dev subdomain before uploading a brand-new Worker that publishes to workers.dev and prompts you to register one, so you get a clear, actionable message instead of a cryptic API failure. The check is skipped for deploys that don't target workers.dev (routes-only deploys, or workers_dev: false) and for existing Workers, since their account already has a subdomain.

• Updated dependencies [34e696d, d39ae01, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, 3f3afbb, e6fbc4e]:

  • miniflare@​4.20260714.0

v4.111.0

Compare Source

Minor Changes

• #​14602 7692a61 Thanks @​edmundhung! - Add Durable Object eviction support to createTestHarness

  You can now gracefully evict a running Durable Object by class name or binding name to verify how it recovers after its instance is torn down:

  const worker = server.getWorker();
  await worker.evictDurableObject("Counter", { name: "user-123" });

• #​14620 899c297 Thanks @​penalosa! - Remove support for service environments and the legacy_env configuration field

  Service environments have been removed. Wrangler now always deploys each environment as its own Worker named <name>-<environment>, which matches the behaviour of the previous default (legacy_env = true). The --legacy-env CLI flag has been removed, and the legacy_env configuration field is no longer supported — including it in your configuration file will now raise an error.

  Because legacy_env = true was already the default, removing the field will not change how your Worker is deployed. If you were relying on service environments (legacy_env = false), each environment will now be deployed as a standalone Worker instead of as an environment of a single Worker. See https://developers.cloudflare.com/workers/wrangler/environments/ for more information.

• #​14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types under --x-new-config, with a new dev.types.includeRuntime option

  When running wrangler dev --x-new-config, the runtime types generated from your compatibility date and flags are now appended to worker-configuration.d.ts, alongside the types inferred from cloudflare.config.ts. This is controlled by a new dev.types.includeRuntime option in wrangler.config.ts, which defaults to true.

  This applies to the experimental new config path only and does not change type generation for existing wrangler.jsonc/wrangler.toml projects.

Patch Changes

• #​14627 ed33326 Thanks @​tpmmorris! - Add convenient logging for worker emails in the project directory. In addition to the system's temp directory, logs for emails sent by workers are also written to a local temp directory defined by the calling process, e.g for an simple text email sent via Wrangler this is .wrangler/tmp/email/<session>/email-text/<message-uuid>.txt (and related files) in the project root. Callers of Miniflare can control this location via the new defaultProjectTmpPath option, which Wrangler and Vite plugin now set automatically.

• #​14642 018574b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260708.1	^5.20260710.1
  workerd	1.20260708.1	1.20260710.1

• #​14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

  Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

  Note that the profile directory is resolved based on the Vite project root.

• #​14658 cdf3148 Thanks @​ATKasem! - Fix wrangler dev corrupting external hostnames in proxied response headers

  When a Worker was run with routes configured, wrangler dev's proxy rewrote the host inside URL-valued headers (such as Location) using a boundary-less substring replace. Any host that merely contained the route host as a substring was corrupted — e.g. with an example.com route, a Location: https://books.example.com/read/ch01 header became https://books.127.0.0.1:8788/read/ch01, and https://myexample.com/path became https://my127.0.0.1:8788/path.

  The proxy now only rewrites absolute URLs whose host is exactly the proxied host, swapping the scheme and host together (which also fixes a related case where an https: scheme survived on a plain-HTTP dev address). Unrelated hosts and subdomains pass through untouched.

• #​14601 3015320 Thanks @​MattieTK! - Improve the agent-facing --force guidance for Pages-to-Workers delegation

  When an AI agent opts out of the Pages-to-Workers delegation by passing --force to wrangler pages deploy or wrangler pages project create, Wrangler now prints a notice at the end of a successful command explaining that --force only needs to be passed once: the project then exists, so subsequent commands are no longer delegated and do not need the flag.

• #​14569 9da77ac Thanks @​dario-piotrowicz! - Suggest similar commands when a typo is detected

  When an unknown command or subcommand is entered, wrangler now suggests the closest matching command if one exists within a reasonable edit distance. For example, running wrangler whoamio will display Did you mean "wrangler whoami"?, and running wrangler kv namespase will display Did you mean "wrangler kv namespace"?.

• Updated dependencies [7692a61, ed33326, 018574b, 7692a61]:

  • miniflare@​4.20260710.0

v4.110.0

Compare Source

Minor Changes

• #​14591 0283a1f Thanks @​dario-piotrowicz! - Send npm package dependency metadata with worker uploads

  Wrangler now collects npm package dependency information from the project's package.json at deploy and version upload time, and includes it in the upload metadata sent to the Cloudflare API. This enables dependency analytics and future features like vulnerability alerting.

  The collected data includes the package name, the version constraint from package.json, and the exact installed version from node_modules. Both dependencies and devDependencies are included, while workspace packages, local packages, and unresolvable packages are excluded. The list is capped at 200 entries per upload.

  To opt out, set dependencies_instrumentation.enabled to false in your Wrangler configuration file:

  {
    "dependencies_instrumentation": {
      "enabled": false
    }
  }

• #​14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

  A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

  await step.do(
    "call flaky API",
    {
      retries: {
        limit: 5,
        backoff: "constant",
        delay: ({ ctx }) => ctx.attempt * 1000,
      },
    },
    async () => {
      /* ... */
    }
  );

  The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

Patch Changes

• #​14589 7b28392 Thanks @​jamesopstad! - Fix runtime type caching when wrangler dev auto-regenerates types

  When dev.generate_types (or wrangler dev --types) regenerated an out-of-date worker-configuration.d.ts, the written file omitted the // Begin runtime types marker (and the /* eslint-disable */ header) that wrangler types writes. As a result, later runs could not detect the cached runtime types and always regenerated them. The auto-regenerated file now matches wrangler types output, restoring the cache.

• Updated dependencies [1b965c5]:

  • miniflare@​4.20260708.1

v4.109.0

Compare Source

Minor Changes

• #​14489 e3f0cd6 Thanks @​edmundhung! - Add listDurableObjectIds() to createTestHarness Worker handles

  Tests using createTestHarness can now list persisted Durable Object instance IDs for a Durable Object binding. This helps integration tests discover objects created by app behavior without adding test-only endpoints.

• #​14465 2fedb1f Thanks @​vaishnav-mk! - Add rollback support when terminating Workflow instances

  WorkflowInstance.terminate({ rollback: true }) now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via wrangler workflows instances terminate --rollback, including local mode.

  The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.

• #​14511 17d2fc1 Thanks @​juleslemee! - Add wrangler turnstile widget commands for managing Turnstile widgets

  You can now create, list, inspect, update, and delete Turnstile widgets from the CLI:

  wrangler turnstile widget create <name> --domain example.com --mode managed
  wrangler turnstile widget list
  wrangler turnstile widget get <sitekey>
  wrangler turnstile widget update <sitekey> --name "Renamed"
  wrangler turnstile widget delete <sitekey>
  

  All five subcommands accept --json for machine-readable output (get prints a formatted view by default; the rest print a short human summary). --domain accepts comma-separated values, e.g. --domain a.com,b.com. delete --json requires --skip-confirmation/-y to keep output pipeable.

  create prints the sitekey, the secret, and the canonical challenges.cloudflare.com/turnstile/v0/siteverify endpoint for backend verification. The hint is backend-agnostic; it doesn't assume Workers. The secret is redacted from list and update output but remains available via get for retrieval later. delete prompts for confirmation; pass --skip-confirmation/-y to bypass.

  The OAuth flow now requests the challenge-widgets.write scope (the existing Bach-derived scope for Turnstile widget CRUD). Existing OAuth sessions need to run wrangler login again to pick it up. API token users need a token with the Account.Turnstile:Edit permission.

Patch Changes

• #​14596 8511ddf Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260706.1	1.20260708.1
  @​cloudflare/workers-types	^5.20260706.1	^5.20260708.1

• #​14604 9f74a5f Thanks @​vaishnav-mk! - Improve the deploy error for cron-triggered Workflows on free plans

  Wrangler now explains that Workflow schedules require a paid Workers plan instead of showing only the generic Workflows API request failure.

• #​14616 c782e2a Thanks @​penalosa! - Fix wrangler deploy aborting in CI for autoconfigured projects

  A recent change guarded non-interactive deploys against overwriting a same-named Worker whenever there was no config file naming it. This was too broad: a plain wrangler deploy run in CI without a config file (for example an autoconfigured project whose generated config PR has not been merged) would fail with "A Worker named ... already exists in your account", even though re-deploying to that Worker is the intended behaviour.

  The guard is now limited to the Pages-to-Workers delegation, where the target name is a Pages project name that must not clobber an unrelated Worker. Plain deploys once again deploy normally.

• Updated dependencies [e3f0cd6, 8511ddf, 2fedb1f]:

  • miniflare@​4.20260708.0

v4.108.0

Compare Source

Minor Changes

• #​14312 54f74b8 Thanks @​MattieTK! - Delegate agent-driven static Pages deploys to Workers

  When wrangler pages deploy or wrangler pages project create is run by an AI coding agent against a brand-new, purely static project, Wrangler now delegates it to Workers static assets (using autoconfig) instead of Cloudflare Pages. Accounts that already have Cloudflare Pages projects, non-agent (human) sessions, and projects using Pages features that can't be carried across to Workers (Pages Functions, a _worker.js, or a _routes.json file) are unaffected and continue to use Pages. Passing --force to either command opts out of the delegation and deploys to Pages directly. Once the Workers deploy starts it is not silently swapped back to Pages: if it fails, the error is surfaced and the --force opt-out is suggested.

Patch Changes

• #​14567 0852346 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler", "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260702.1	1.20260706.1
  @​cloudflare/workers-types	4.20260702.1	5.20260706.1

• #​14312 54f74b8 Thanks @​MattieTK! - Avoid silently overwriting an existing Worker during non-interactive deploys that cannot prove they own the name

  A non-interactive deploy (an agent, CI, or the agent-delegated wrangler pages deploy) has no way to prompt before overwriting a Worker, so it now stops if the target name is already taken and this run cannot show it owns that Worker. This applies when there is no Wrangler configuration file naming the Worker and either the name was generated automatically or the deploy is the Pages-to-Workers delegation (where the name carried across is a Pages project name, not proof of Worker ownership). The check reuses the service metadata the deploy already fetches, so it adds no extra API calls.

  Deploys are unaffected when a configuration file names the Worker (so repeat deployments continue to update it), and interactive deploys keep their existing confirmation flow. To update an existing Worker in one of the guarded cases, add a Wrangler configuration file naming it, or deploy under a different name.

• Updated dependencies [0852346]:

  • miniflare@​4.20260706.0

v4.107.1

Compare Source

Patch Changes

• #​14514 d88555e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260701.1	1.20260702.1

• #​14564 5fd8bee Thanks @​jibin7jose! - Fix an issue where wrangler dev would not override config vars with values from .dev.vars during local development when the secrets field was defined in the configuration file.

• #​14332 5d9990e Thanks @​Divkix! - Fix misleading error guidance when deploying a new Worker with secrets.required

  When a Worker declares secrets.required and has never been deployed before, the previous error message suggested running wrangler secret put <NAME>, which doesn't work because the Worker doesn't exist yet.

  The one path that does work — wrangler deploy --secrets-file <path> — was not mentioned anywhere in the error output.

  The pre-deploy error now explains that wrangler secret put cannot be used for a new Worker, and directs users to the --secrets-file flag instead. The post-deploy error for existing Workers now also mentions --secrets-file alongside wrangler secret put.

• #​14507 bf49a41 Thanks @​joey727! - Fix a potential crash when displaying certain CLI output

  Previously, some CLI output with no content lines could cause a crash. This is now handled correctly.

• #​14492 1ac96a1 Thanks @​penalosa! - Replace the CommonJS xdg-app-paths dependency with a vendored pure-ESM implementation

  xdg-app-paths (and its xdg-portable/os-paths dependencies) are CommonJS only, which caused "Dynamic require of 'path' is not supported" errors when the surrounding code was bundled to ESM. The global config/cache directory resolution is now provided by a small, dependency-free pure-ESM module in @cloudflare/workers-utils that reproduces the previous path resolution exactly (verified against the real package in unit tests), so existing config and credential locations are unchanged. This also drops the transitive fsevents optional dependency that xdg-app-paths pulled in.

  Miniflare and create-cloudflare now consume the shared helpers from @cloudflare/workers-utils instead of maintaining their own copies, importing node-only leaf entry points (@cloudflare/workers-utils/fs-helpers, @cloudflare/workers-utils/global-wrangler-config-path) where ESM bundling is required.

• #​14572 f416dd9 Thanks @​petebacondarwin! - Key local rate limit counters by namespace_id instead of binding name

  wrangler dev and Miniflare previously tracked each rate limit binding's counter by its binding name, so two bindings that referenced the same namespace_id were treated as separate limiters. Counters are now keyed by namespace_id, matching production: bindings that share a namespace_id share a limit, while distinct namespaces stay isolated. This also re-enables rate limit bindings in multiworker wrangler dev sessions, where they were previously stripped from secondary Workers to avoid a startup crash.

• #​14570 1ca8d8f Thanks @​penalosa! - Upgrade signal-exit from v3 to v4

  The bundled signal-exit dependency was CJS-only. Upgrading to v4 (which ships a dual ESM/CJS build) unblocks ESM output. Exit-cleanup behaviour is unchanged, though v4 no longer registers handlers for a few signals that are no longer supported by the OS (SIGUNUSED on Linux; SIGABRT/SIGALRM on Windows).

• #​14561 b973ed3 Thanks @​martijnwalraven! - Emit an error event for watch-mode rebuild failures in unstable_startWorker

  Initial build failures already dispatch an error event (surfaced as buildFailed on the DevEnv bus), but watch-mode rebuild failures were only logged from inside the esbuild plugin, so programmatic consumers had no way to observe them while dev kept serving the previous bundle. Rebuild failures now route through the same error path as initial-build failures: terminal output is unchanged and buildFailed fires symmetrically.

• Updated dependencies [e7e5780, d88555e, 1ac96a1, f416dd9, 16fbf81]:

  • miniflare@​4.20260702.0

v4.107.0

Compare Source

Minor Changes

• #​14474 aa5d580 Thanks @​WillTaylorDev! - Add cache options for WorkerEntrypoint exports

  You can now set cache options on WorkerEntrypoint exports and configure cross-version cache behavior globally:

  // wrangler.json
  {
    "cache": { "enabled": true, "cross_version_cache": true },
    "exports": {
      "default": {
        "type": "worker",
        "cache": { "enabled": false }
      },
      "Admin": {
        "type": "worker",
        "cache": { "enabled": true }
      }
    }
  }

  Wrangler sends the exports config to the deploy and version upload APIs alongside the global cache.enabled and cache.cross_version_cache settings. The platform resolves those global settings plus cache overrides on exports and validates which entrypoint names are cacheable.

• #​14382 fd92d56 Thanks @​petebacondarwin! - Add support for declarative Durable Object exports

  wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

  Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:

  {
    "exports": {
      // Provision a new Durable Object class (`MyDO`)
      "MyDO": { "type": "durable-object", "storage": "sqlite" },
      // Delete Durable Object class (`OldGone`)
      "OldGone": { "type": "durable-object", "state": "deleted" },
      // Rename a Durable Object class (from `OldName` to `NewName`)
      "OldName": {
        "type": "durable-object",
        "state": "renamed",
        "renamed_to": "NewName"
      },
      "NewName": { "type": "durable-object", "storage": "sqlite" },
      // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
      "Outgoing": {
        "type": "durable-object",
        "state": "transferred",
        "transferred_to": "target-worker"
      },
      // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
      "Incoming": {
        "type": "durable-object",
        "state": "expecting-transfer",
        "storage": "sqlite",
        "transfer_from": "source-worker"
      }
    }
  }

  When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

  The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

  wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

  Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

  Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

  @cloudflare/vitest-pool-workers also picks up Durable Object configuration from exports, so tests against an exports-only Worker run with the correct local SQLite storage and can reach unbound Durable Object classes via ctx.exports.X.

  wrangler types is also aware of exports. Live entries (including expecting-transfer, the receiving side of a two-phase transfer) are added to Cloudflare.GlobalProps.durableNamespaces, which types ctx.exports.X for unbound Durable Objects declared only via exports.

• #​14423 be3f792 Thanks @​akshitsinha! - Add wrangler flagship commands for managing Flagship apps and feature flags.

  The new wrangler flagship apps and wrangler flagship flags command groups let you create, list, get, inspect, update, set, split, rollout, enable, disable, evaluate, and delete Flagship apps and flags from the CLI, including targeting rules, variations, percentage rollouts, evaluation context, and flag changelogs.

• #​14156 e1532eb Thanks @​petebacondarwin! - Add opt-in OS keychain storage for OAuth credentials

  By default wrangler stores your OAuth tokens in a plaintext file, and that is unchanged. You can now opt in to encrypting them at rest instead: wrangler login --use-keyring writes the tokens to an AES-256-GCM-encrypted file whose key is held in your OS keyring (macOS Keychain, libsecret on Linux, or Windows Credential Manager). Existing plaintext credentials are migrated automatically on first use.

  Toggle it with any of:

  • wrangler login --use-keyring / --no-use-keyring
  • wrangler auth keyring enable / disable (or wrangler auth keyring to print the current setting) — useful if you only use named profiles and never run the global wrangler login
  • CLOUDFLARE_AUTH_USE_KEYRING=true|false to override the saved preference for a single command

  Opting out deletes the encrypted credentials rather than decrypting them back to disk, so you re-authenticate afterwards. The preference applies to every auth profile, and each named profile gets its own encrypted file and key.

  Per-platform requirements: macOS uses the built-in security tool (nothing to install); Linux uses secret-tool from libsecret-tools (wrangler prints an install hint if it is missing); Windows lazily installs @napi-rs/keyring (~1.9 MB) on first opt-in, and errors with instructions in non-interactive/CI contexts.

  CLOUDFLARE_API_TOKEN and CLOUDFLARE_API_KEY/CLOUDFLARE_EMAIL continue to take priority over any stored OAuth credentials.

Patch Changes

• #​14502 6b0ce98 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260630.1	1.20260701.1

• #​14306 bfe48db Thanks @​matingathani! - Remove deprecated --experimental-vm-modules flag and prevent silent exit on unexpected errors

  wrangler was silently exiting with code 1 on Node.js v26 with no error message shown. This release fixes two independent issues that caused this behaviour:

  1. A stale Node.js flag that caused unexpected behaviour on Node.js v26 has been removed.

  2. If an error occurs in a situation where the normal error reporting path itself fails, wrangler now always prints the original error to stderr so the cause is visible rather than silently disappearing.

• #​14481 0277bfa Thanks @​dario-piotrowicz! - Improve error message when deploying to a non-existent Pages project in non-interactive mode

  Previously, running wrangler pages deploy with a --project-name that doesn't exist in a non-interactive context (e.g. CI, piped input) would fail with a generic "project not found" or "This command cannot be run in a non-interactive context" error. Now it provides a specific error message explaining that the project doesn't exist and suggests how to create it. The error also suggests using wrangler deploy to deploy a Worker instead.

• #​14305 [98793d8](https://redirect.github.co

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

size-limit report 📦

Path	Size
src/_worker.ts	6.73 KB (0%)