Update dependency wrangler to v4.160.1 by renovate[bot] · Pull Request #9 · pkgforge-dev/domains.pkgforge.dev

renovate · 2026-11-02T07:56:03Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
wrangler (source)	`4.156.1` → `4.160.1`

Release Notes

cloudflare/workers-sdk (wrangler)

Minor Changes

#16760 cb9534f Thanks @petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.
#16739 6af492e Thanks @GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

#16810 cdc970b Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16810 cdc970b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261109.1 ^5.20261110.1

workerd 1.20261109.1 1.20261110.1
#16709 022ee9d Thanks @petebacondarwin! - Keep local Container images available for upload retries

Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.
#16740 44b39b0 Thanks @GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.
#16758 325dc69 Thanks @petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.
Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:
- miniflare@5.20261110.0-beta

`v4.159.0`

Compare Source

Minor Changes

#16737 a589d23 Thanks @jamesopstad! - Store experimental cf-wrangler dev state in .cloudflare/state

Persist local resource data in .cloudflare/state relative to the configuration file. Direct Wrangler usage continues to default to .wrangler/state.
#16663 fe69809 Thanks @FlorentCollin! - Add --compatibility flag to wrangler d1 export

You can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:

wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_only

It accepts d1 (the default) and sqlite3_cli_only. With sqlite3_cli_only, the dump matches the output of the sqlite3 .dump command, including virtual tables. D1 cannot import this dump. sqlite3_cli_only is only supported for remote exports.
#16599 dee7a1d Thanks @petebacondarwin! - Support CLOUDFLARE_AUTH_PROFILE for shared authentication profile selection

Cloudflare tooling can pass a selected profile to child processes through CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. The cf-wrangler development delegate also initializes cf authentication so it reads the selected cf credentials.

Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and cf-wrangler keeps its authentication scoped to the delegate invocation.
#15615 c64fdfb Thanks @svetch! - Support jurisdiction when automatically provisioning D1 databases

Set jurisdiction on a D1 binding without a database_id to create the database in that jurisdiction during deployment. For example, {"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]} creates an EU-jurisdiction database.
#16066 4112820 Thanks @petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker types

Use wrangler types --include-main-module=false when the Worker entrypoint is generated build output that should not be type-checked as application source. The corresponding includeMainModule option is available in the experimental type-generation API. The option is preserved by --check and automatic regeneration. Omitting the import opts out of module-derived ctx.exports typing while preserving runtime types, environment bindings, and Durable Object namespace declarations.

New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.

Patch Changes

#16648 56459a5 Thanks @dario-piotrowicz! - Update bundled third-party dependencies with known security fixes

Local development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.

Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.
#16746 abf924e Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-06

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16792 de10016 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-09

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16746 abf924e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261104.1 ^5.20261106.1

workerd 1.20261104.1 1.20261106.1
#16792 de10016 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261106.1 ^5.20261109.1

workerd 1.20261106.1 1.20261109.1
#16726 2fb01e7 Thanks @pratham-jain33! - Warn when cron triggers are configured alongside --dispatch-namespace

When deploying a user Worker to a dispatch namespace (Workers for Platforms), cron triggers are not supported, but Wrangler previously dropped them silently: schedules configured via triggers.crons in the Wrangler config file or the --triggers CLI flag never ran and no warning was shown. Wrangler now warns that cron triggers will be ignored when deploying with --dispatch-namespace.
#16748 dc4e093 Thanks @shbernal! - Stop wrangler email routing addresses create from claiming a verification email was sent for addresses that are already verified

Cloudflare doesn't send a verification email when the destination address is already verified on the account, such as the account owner's own email. The command now shows the verification timestamp in that case. It only mentions a verification email when the address is still pending.
#15621 cff83d0 Thanks @petebacondarwin! - Report a failed Wrangler command when the CLI child is terminated by a signal

Wrangler's executable previously translated signal termination into exit code 0, which could cause callers to report a successful deployment after the operating system stopped Wrangler. Signal exits now use the conventional nonzero shell status.
#16413 3ef2afd Thanks @ghostwriternr! - Remove Container networking sidecars and snapshot clone volumes in local development

Wrangler and the Vite plugin removed only the application containers of Container-enabled Durable Objects, found by image tag, and left behind the networking sidecars and snapshot clone volumes that workerd also creates. They now leave cleanup to Miniflare, which removes all of these when the Container configuration changes, such as after a rebuild, when local development stops, and when the process exits.
#16066 4112820 Thanks @petebacondarwin! - Preserve environment inputs when automatically regenerating Worker types

Automatic type regeneration now reuses the recorded --env and --env-file options. This keeps environment-specific bindings and secret declarations consistent with the generated header and subsequent wrangler types --check runs.
#15621 cff83d0 Thanks @petebacondarwin! - Avoid materializing unused multipart request bodies

Wrangler no longer creates a full text copy of multipart API request bodies when debug logs are disabled or sanitized. This substantially reduces peak memory use when uploading large batches of static assets while preserving request-body output when unsanitized debug logging is explicitly enabled.
#16664 9b6582c Thanks @dario-piotrowicz! - Stop getPlatformProxy() asset misses from recursively calling its own listener

Requests for assets that do not exist now return a 404 response without hanging or exhausting local development resources.
Updated dependencies [fea323a, 56459a5, abf924e, de10016, abf924e, de10016, 66bc0d6]:
- miniflare@5.20261109.0-beta

`v4.158.0`

Compare Source

Minor Changes

#16186 f1d81a2 Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

#16700 dc35efb Thanks @cjol! - Bump bundled brace-expansion to pick up security fixes

These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.
#16700 dc35efb Thanks @cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.
#16700 dc35efb Thanks @cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.
#16700 dc35efb Thanks @cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.
#16700 dc35efb Thanks @cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.
#16688 fa3edb3 Thanks @FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.
#16695 b2061f4 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16695 b2061f4 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261103.1 ^5.20261104.1

workerd 1.20261103.1 1.20261104.1
#16306 36e64f2 Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

When a remote bindings request reached a workers.dev host protected by Access without valid Access credentials (for example, Access was added after the dev server started, the CF_Authorization cookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed with TypeError: Too many redirects and an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.

The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.
Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:
- miniflare@5.20261104.0-beta

`v4.157.0`

Compare Source

Minor Changes

#16660 34f34b3 Thanks @punkeel! - Allow opting into zstd compression for Wrangler-built container image layers with WRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd.

Patch Changes

#16670 b14b9dc Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16011 44d1ee4 Thanks @wra-sol! - Offer to delete a Worker's Container applications when running wrangler delete

Previously, wrangler delete removed only the Worker, leaving the Container applications that wrangler deploy created for it running and billing. It now offers to delete them as well. With --force, or in CI and other non-interactive contexts, it lists them instead so they can be removed with wrangler containers delete <id>.
#16670 b14b9dc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261102.1 ^5.20261103.1

workerd 1.20261102.1 1.20261103.1
Updated dependencies [b14b9dc, b14b9dc, d2eda1c, 2750917]:
- miniflare@5.20261103.0-beta

`v4.156.2`

Compare Source

Patch Changes

#16642 d38cb02 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16642 d38cb02 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261101.1 ^5.20261102.1

workerd 1.20261101.1 1.20261102.1
#16623 51bbf8b Thanks @petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:
```
import {
  getNodeCompat,
  type NodeJSCompatMode,
} from "@cloudflare/workers-utils/node-compat";
import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";
```
Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.
#16531 e5b1798 Thanks @dario-piotrowicz! - Avoid unrelated route permission checks when comparing dashboard configuration

When a Worker was last updated from the dashboard, wrangler deploy and wrangler versions upload fetched route and custom-domain metadata even when the command could not change it. Wrangler now fetches only the route categories configured for deployment, allowing Worker-scoped Editor tokens to upload Workers without routes or custom domains.
Updated dependencies [d38cb02, d38cb02, 51bbf8b]:
- miniflare@5.20261102.0-beta

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-11-02T07:56:06Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: wrangler@4.160.1
npm error Found: @cloudflare/workers-types@5.20261102.1
npm error node_modules/@cloudflare/workers-types
npm error   dev @cloudflare/workers-types@"5.20261102.1" from the root project
npm error
npm error Could not resolve dependency:
npm error peerOptional @cloudflare/workers-types@"^5.20261110.1" from wrangler@4.160.1
npm error node_modules/wrangler
npm error   dev wrangler@"4.160.1" from the root project
npm error
npm error Conflicting peer dependency: @cloudflare/workers-types@5.20261112.1
npm error node_modules/@cloudflare/workers-types
npm error   peerOptional @cloudflare/workers-types@"^5.20261110.1" from wrangler@4.160.1
npm error   node_modules/wrangler
npm error     dev wrangler@"4.160.1" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-11-12T08_12_38_178Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-12T08_12_38_178Z-debug-0.log

renovate Bot force-pushed the renovate/wrangler-4.x branch from 99d2359 to 35ad13a Compare November 3, 2026 15:22

renovate Bot changed the title ~~Update dependency wrangler to v4.156.1~~ Update dependency wrangler to v4.157.0 Nov 3, 2026

renovate Bot force-pushed the renovate/wrangler-4.x branch from 35ad13a to 4a361c7 Compare November 7, 2026 20:13

renovate Bot changed the title ~~Update dependency wrangler to v4.157.0~~ Update dependency wrangler to v4.158.0 Nov 7, 2026

Update dependency wrangler to v4.160.1

acc7b82

renovate Bot force-pushed the renovate/wrangler-4.x branch from 4a361c7 to acc7b82 Compare November 12, 2026 08:12

renovate Bot changed the title ~~Update dependency wrangler to v4.158.0~~ Update dependency wrangler to v4.160.1 Nov 12, 2026

Navigation Menu

Repository navigation

Update dependency wrangler to v4.160.1 - #9

Update dependency wrangler to v4.160.1#9
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/wrangler-4.x

renovate Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20261109.1	^5.20261110.1
workerd	1.20261109.1	1.20261110.1

Dependency	From	To
@cloudflare/workers-types	^5.20261104.1	^5.20261106.1
workerd	1.20261104.1	1.20261106.1

Dependency	From	To
@cloudflare/workers-types	^5.20261103.1	^5.20261104.1
workerd	1.20261103.1	1.20261104.1

Dependency	From	To
@cloudflare/workers-types	^5.20261102.1	^5.20261103.1
workerd	1.20261102.1	1.20261103.1

Dependency	From	To
@cloudflare/workers-types	^5.20261101.1	^5.20261102.1
workerd	1.20261101.1	1.20261102.1

Conversation

renovate Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.160.1

Patch Changes

v4.160.0

Minor Changes

Patch Changes

v4.159.0

Minor Changes

Patch Changes

v4.158.0

Minor Changes

Patch Changes

v4.157.0

Minor Changes

Patch Changes

v4.156.2

Patch Changes

Configuration

Uh oh!

renovate Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 2, 2026 •

edited

Loading

`v4.160.1`

`v4.160.0`

`v4.159.0`

`v4.158.0`

`v4.157.0`

`v4.156.2`

renovate Bot commented Nov 2, 2026 •

edited

Loading