Update npm dependencies to v4.100.0 (main) by renovate[bot] · Pull Request #527 · conforma/conforma.github.io

renovate · 2026-02-26T03:42:31Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
wrangler (source)	`4.59.1` → `4.100.0`

Release Notes

cloudflare/workers-sdk (wrangler)

`v4.100.0`

Compare Source

Minor Changes

#14119 2047a32 Thanks @tahmid-23! - Serve local R2 bucket objects publicly via the dev server

When running wrangler dev locally, objects in each local R2 binding are now reachable under /cdn-cgi/local/r2/public/<bucket-id>/<key> on the existing dev server, simulating a public bucket. The <bucket-id> is the bucket's bucket_name when set, otherwise its binding. Bindings configured with remote: true are not exposed.
#14202 e8561c2 Thanks @jamesopstad! - Add experimental --x-new-config flag for authoring config in TypeScript

This is an experimental, opt-in feature. When enabled, wrangler dev, wrangler build, wrangler deploy, wrangler versions upload, and wrangler versions deploy load the Worker's configuration from a cloudflare.config.ts file instead of wrangler.json / wrangler.jsonc / wrangler.toml. Additionally, an optional wrangler.config.ts file can be provided for Wrangler-specific dev/build configuration.
- cloudflare.config.ts (required) — Worker runtime configuration (bindings, triggers, observability, placement, limits, compatibility, routes, etc.). Authored via defineWorker from wrangler/experimental-config.
- wrangler.config.ts (optional) — Tooling / bundling / dev-server configuration (noBundle, minify, alias, define, rules, tsconfig, build, dev, assetsDirectory, etc.). Authored via defineWranglerConfig from wrangler/experimental-config.
Per-environment configuration is via ctx.mode branching inside the function form of either file.

Example cloudflare.config.ts:
```
import { defineWorker, bindings } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export default defineWorker((ctx) => ({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
	env: {
		MY_KV: bindings.kv(),
		MY_TEXT: bindings.text(`The mode is ${ctx.mode}`),
	},
}));
```
Example wrangler.config.ts:
```
import { defineWranglerConfig } from "wrangler/experimental-config";

export default defineWranglerConfig({
  minify: true,
  assetsDirectory: "./public",
});
```
Because this is experimental, the flag, the config formats, and the wrangler/experimental-config exports may change in any release.

Patch Changes

#14185 98c9afe Thanks @penalosa! - Use the shared env-credential resolver from @cloudflare/workers-auth

No user-facing behaviour change. Credential resolution order (global API key + email → CLOUDFLARE_API_TOKEN → stored OAuth token) is preserved.
#14184 e305126 Thanks @penalosa! - Add an experimental cf-wrangler delegate entrypoint for projects that can't use @cloudflare/vite-plugin (service workers, old compatibility dates, Python, Rust, etc.).

cf-wrangler dev starts the same local dev server as wrangler dev — it sits directly on wrangler's internal dev server, so the bundling and runtime behaviour are identical — but exposes a deliberately narrow CLI surface (--mode, --port, --host, --local) for a parent CLI to delegate to, and other dev server config options are read from the wrangler config file.

This replaces the separate @cloudflare/wrangler-bundler package. This is an internal integration point and is not intended to be run directly by users.
#14246 f3990b2 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260609.1 1.20260610.1
#14256 4597f08 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260610.1 1.20260611.1
#14243 25722ac Thanks @com6056! - Fix a memory leak that could make long-running headless wrangler dev sessions unresponsive

Long-running wrangler dev sessions with no DevTools attached (for example using the containers feature under sustained traffic) could gradually consume unbounded memory and eventually stop accepting connections. The inspector proxy now only enables network tracking while a DevTools client is connected, so the buildup no longer happens. Interactive debugging is unaffected. Fixes #14191.
#14230 41f75c0 Thanks @dario-piotrowicz! - Improve D1 error messages for missing or conflicting options

Error messages for d1 execute, d1 export, d1 time-travel restore, and d1 insights now clearly state which option is missing or conflicting, explain why the combination is invalid, and suggest how to fix the issue.

Additionally, duration validation errors in d1 insights are now thrown as UserError instead of plain Error, ensuring they are displayed cleanly to users rather than as unexpected crashes.
#14213 10b5538 Thanks @dario-piotrowicz! - Improve authentication error messages with specific failure reasons

When authentication fails (e.g. during wrangler dev --remote or when using remote bindings), the error message now explains exactly what went wrong -- whether no credentials were found, the token expired, or the environment is non-interactive -- and lists actionable steps to fix it, including a wrangler whoami tip.

Previously, auth failures could produce multiple confusing errors (e.g. "Failed to fetch auth token: 400 Bad Request" followed by "Failed to start the remote proxy session"). Now a single, clear error is shown.
#14233 818c105 Thanks @dario-piotrowicz! - Improve R2 Sippy error messages

Now error messages in wrangler r2 bucket sippy follow a consistent pattern: they describe what is missing, name the exact --flag to use, and provide context (e.g. example values, links to the dashboard). Previously, many errors said only "Error: must provide --flag." with no guidance on what the flag does or how to obtain the value.
#14259 2ae6099 Thanks @emily-shen! - Move worker build step earlier in deploy/upload step, before upload specific config validation
Updated dependencies [f3990b2, 4597f08, 2047a32]:
- miniflare@4.20260611.0

`v4.99.0`

Compare Source

Minor Changes

#14169 0706fbf Thanks @edmundhung! - Introduce createTestHarness() for integration testing Workers

It runs Workers in a local preview environment using production build output and works with both Wrangler projects and Workers built by the Cloudflare Vite plugin.

Use it from any Node.js test runner to send requests to individual Workers, trigger scheduled events, reset the server between tests, and mock outbound requests with libraries that intercept globalThis.fetch(), such as MSW.

You can also capture structured logs from your Workers with getLogs(), or dump out a diagnostic timeline with debug() when tests fail:
```
import { createTestHarness } from "wrangler";

const server = createTestHarness({
  workers: [
    { configPath: "./dist/web_worker/wrangler.json" },
    { configPath: "./dist/api_worker/wrangler.json" },
  ],
});

await server.listen();
await server.fetch("http://example.com");

const apiWorker = server.getWorker("api-worker");
await apiWorker.fetch("http://example.com/users/123");
await apiWorker.scheduled({ cron: "0 0 * * *" });

server.getLogs();

if (testFailed) {
  server.debug();
}

await server.reset();
await server.close();
```
#14174 8cf8c61 Thanks @oliy! - Surface pipeline status and failure reasons in wrangler pipelines list and wrangler pipelines get

wrangler pipelines list now includes a Status column, and when any pipelines are in a failed state it prints a summary of each failing pipeline along with the reason reported by the API.

wrangler pipelines get now shows the pipeline Status in the general details and, for failed pipelines, highlights the failure with the reason returned by the server so it is clear why a pipeline is not running.
#14211 a61ac29 Thanks @james-elicx! - Add --version-tag support to wrangler versions deploy to deploy a version by its tag

You can now roll out or roll back a version by the tag it was uploaded with (e.g. a commit SHA passed to --tag at upload time) instead of first looking up its Version ID:

wrangler versions deploy --version-tag <sha>@100%

The tag is resolved to a Version ID against the worker's deployable versions, and the <version-tag>@<percentage> shorthand works just like the existing <version-id>@<percentage> notation, including splitting traffic across multiple --version-tag values. If a tag matches no deployable version, or matches more than one, the command errors and asks you to deploy by Version ID directly. Note that tags can only be resolved against recent (deployable) versions — older versions that have aged out of that window must still be deployed by Version ID.

Patch Changes

#14163 23aecac Thanks @emily-shen! - Print deploy warnings even in non-interactive contexts when strict mode is off

Currently, wrangler deploy checks whether the incoming deploy configuration has destructive conflicts with the current configuration. Previously, we only performed this check in interactive contexts, or if the --strict flag was passed in. Now this warning is always printed, and it remains non-blocking in non-interactive contexts.
#14173 b932e47 Thanks @gpanders! - Handle API validation errors from wrangler containers ssh

Wrangler now lets the Containers API validate SSH instance IDs and preserves raw API error bodies such as INVALID_INSTANCE_ID when reporting validation failures.
#14192 d076bcc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260603.1 1.20260605.1
#14217 24497d0 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260605.1 1.20260608.1
#14231 4bb572f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260608.1 1.20260609.1
#14195 165adb2 Thanks @dario-piotrowicz! - Show actionable error message when authentication fails during remote dev

When wrangler dev with remote bindings encountered an authentication error (expired token, revoked OAuth, or invalid API token), the user saw a generic "A request to the Cloudflare API failed" message with no indication that authentication was the problem.

Now, authentication failures during remote dev display a clear error message with actionable steps.
#14034 776098c Thanks @matingathani! - Fix wrangler types --check reporting types as out of date in multi-worker setups

Previously, running wrangler types --check -c primary/wrangler.jsonc in a multi-worker project would incorrectly report types as out of date, even when they were current. This happened because the secondary worker config paths (passed via additional -c flags during generation) were not stored in the generated types file header, so --check had no way to resolve the secondary workers' service bindings when verifying the hash.

The fix stores secondary config paths in the generated file's header comment so that --check can recover them automatically. Users no longer need to re-pass every -c flag when running --check — only the primary config is required.
#14053 7993711 Thanks @fallintoplace! - Prevent delete-only wrangler secret bulk input from creating a new Worker

Previously, wrangler secret bulk could create a draft Worker when the input only deleted secrets and the target Worker name did not exist. Delete-only bulk secret operations now leave Worker-not-found as an error instead of creating a new Worker.
#14055 8923f97 Thanks @dario-piotrowicz! - Preserve all deployment-affecting CLI flags in the interactive deploy config flow

When running wrangler deploy without a config file and going through the interactive setup flow, CLI flags beyond --compatibility-flags (such as --routes/--route, --domains/--domain, --triggers, --var, --define, --alias, --jsx-factory, --jsx-fragment, --tsconfig, --minify, --upload-source-maps, --no-bundle, --logpush, --keep-vars, --legacy-env, and --dispatch-namespace) were silently dropped. These flags are now persisted to the generated wrangler.jsonc config file (where a config field equivalent exists) and included in the suggested CLI command when the user declines config file generation.
#14196 b205fb7 Thanks @odiak! - Validate JSON stdin values for wrangler secret bulk

JSON input piped through stdin now validates that secret values are strings or null before sending them to the API, matching the existing behavior for file input.
Updated dependencies [d076bcc, 24497d0, 4bb572f, 48c4ff0]:
- miniflare@4.20260609.0

`v4.98.0`

Compare Source

Minor Changes

#14089 c6c61b5 Thanks @alsuren! - Add migrations_pattern to D1 database bindings

The D1 binding now accepts an optional migrations_pattern field, allowing you to point wrangler d1 migrations apply and wrangler d1 migrations list at migration files in nested layouts (e.g. ORM-generated folders like migrations/0000_init/migration.sql).

migrations_pattern is a glob (relative to the wrangler config file) and defaults to ${migrations_dir}/*.sql, which preserves today's behaviour. Files that do not match the pattern are not executed.
```
{
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "my-db",
      "database_id": "...",
      "migrations_dir": "migrations",
      "migrations_pattern": "migrations/*/migration.sql"
    }
  ]
}
```
When no migrations match the configured pattern but files matching the common migrations/*/migration.sql (drizzle-style) layout do exist, Wrangler logs a hint suggesting migrations_pattern as an opt-in.

wrangler d1 migrations create now returns an actionable error if the generated migration filename would not match the configured pattern.
#14153 7a6b1a4 Thanks @dario-piotrowicz! - Generalize wrangler deploy and wrangler versions upload positional argument from [script] to [path]

Both wrangler deploy and wrangler versions upload now accept a generic [path] positional argument that can point to either a Worker entry-point file or a directory of static assets. The type is auto-detected. For example:
- File: wrangler deploy ./src/index.ts deploys a Worker (same as before)
- Directory: wrangler deploy ./public deploys a static assets site (no interactive confirmation prompt)
The --script named option is now hidden and deprecated for both commands. It continues to work for backwards compatibility but only accepts file paths. Passing a directory to --script now produces a clear error message suggesting the positional path argument or --assets flag instead.
#13863 3b8b80a Thanks @aslakhellesoy! - getPlatformProxy() now passes through workflow bindings that have a script_name

Workflows without a script_name are still stripped (and warned about) because the engine for an internal workflow can't run inside the empty proxy worker that backs getPlatformProxy(). Workflows with a script_name are handed to miniflare unchanged; miniflare reroutes the engine's USER_WORKFLOW binding through the dev-registry-proxy when the target worker is running in another Miniflare instance — the same mechanism Durable Objects already use.

This means SvelteKit/Remix (and similar split-process setups) can call platform.env.MY_WORKFLOW.create({ ... }) directly from their server-side request handlers in dev, as long as the workflow class is exposed by another worker registered in the dev registry.

Closes #7459.
#14164 b502d54 Thanks @G4brym! - Rename the web_search binding kind to websearch

Pre-launch rename of the public binding type from web_search to websearch so the on-the-wire shape matches the product name (Web Search). The wrangler config key, the binding-type string sent to the Cloudflare API, and the miniflare option key all move from web_search / webSearch to websearch.

Update your wrangler config:
```
- "web_search": { "binding": "WEBSEARCH" }
+ "websearch": { "binding": "WEBSEARCH" }
```
The runtime WebSearch type exposed on env.WEBSEARCH is unchanged.

Patch Changes

#14089 c6c61b5 Thanks @alsuren! - Restore the D1 executeSql logger level via try/finally

wrangler d1 execute --json and the internal executeSql helper temporarily lower the global logger to "error" to keep human-readable output out of the JSON payload. Previously the level was restored only on the happy path, so any early return or thrown error left the singleton logger muted, silencing later logger.warn/logger.log output (notably from migration helpers that wrap executeSql and are commonly mocked in tests).

The level swap is now wrapped in try/finally so it is always restored.
#14175 a3eea27 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260601.1 1.20260603.1
#14121 7539a9b Thanks @petebacondarwin! - Extract the OAuth 2.0 + PKCE flow into a new @cloudflare/workers-auth package.

The OAuth login / logout / refresh logic, the auth-config TOML file IO, the OAuth token exchange + local callback server, and the Cloudflare Access detection helpers that previously lived in packages/wrangler/src/user/ have moved to the new internal-only @cloudflare/workers-auth package. Wrangler now wires the OAuth flow up via a small glue module that injects its logger, browser opener, interactivity detector, and config cache via a dependency- injection context.

What stays in wrangler:
- The yargs login / logout / whoami / auth token commands
- Environment-based credential resolution (CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY / CLOUDFLARE_EMAIL, etc.)
- Cloudflare account selection (requireAuth, getOrSelectAccountId)
- The OAuth scope catalog (passed into the OAuth flow as a generic string[])
- whoami / account fetching
No behavior change for end users. The on-disk TOML format and location remain identical, and all telemetry message labels are preserved verbatim.

@cloudflare/workers-auth is published with prerelease: true and is not intended for external use — its APIs may change without notice.
#14162 0bb2d55 Thanks @dario-piotrowicz! - In non-interactive mode remove the skills installation message

When Wrangler run in non interactive mode and it detected agents that it could install skills for, it would print a message such as:

Cloudflare agent skills are available for: <DETECTED_AGENTS>. Run wrangler in an interactive terminal to install them, or use '--install-skills' to install without prompting.

This message seems to be confusing and unhelpful so it has now been removed.
#14165 8400fb9 Thanks @NuroDev! - Limit wrangler versions list to the 10 most recent deployable versions

The versions API ignores pagination when filtering to deployable versions, so Wrangler now caps the command output client-side. This keeps the command aligned with its help text and avoids overwhelming terminal output for Workers with many versions.
#14151 7949f81 Thanks @dario-piotrowicz! - Skip stale bundles during dev server reload to avoid redundant restarts

When rapidly saving a wrangler config file with remote bindings, each save would trigger a full reload cycle (remote connection setup, miniflare restart), causing many sequential "Reloading local server... / Establishing remote connection..." messages (while blocking the user). The runtime controllers now check whether a newer bundle has been queued at each expensive async boundary and bail out early if the current bundle is stale. This ensures that only the latest config change triggers a reload, making wrangler dev much more responsive during repeated config edits.
#14072 d462013 Thanks @himanshu-cf! - Update wrangler secret bulk command description to reflect create/update/delete capabilities

The help text for wrangler secret bulk now accurately describes that the command can create, update, or delete multiple secrets in a single request, with up to 100 secrets per command. The file argument description also clarifies that setting a key to null in JSON will delete it, and that deletion is not supported with .env files.
#13979 c2280cd Thanks @matingathani! - Warn when a named environment silently inherits custom_domain routes from the top-level config

When an env.<name> block does not override routes, it inherits the top-level routes array. If that array contains entries with custom_domain: true, every deploy to the named environment will silently reassign the custom domain away from the top-level Worker and towards the env Worker, causing routing drift. Wrangler now emits a warning in this situation and suggests adding "routes": [] to the env block to prevent inheritance.
#14170 ea12b58 Thanks @petebacondarwin! - Tighten on-disk permissions of the OAuth credentials file to 0600

The user auth config file written by wrangler login (typically ~/.config/.wrangler/config/default.toml on Linux/macOS, or <environment>.toml for non-production Cloudflare API environments) is now written with mode 0600 and re-chmod-ed on every save. This prevents other local users on shared hosts from reading the stored OAuth tokens. Existing files with looser permissions written by older Wrangler versions are tightened the next time Wrangler refreshes the token or the user logs in again. The change is a no-op on Windows, which does not honour POSIX mode bits.
#14022 acf7817 Thanks @petebacondarwin! - Show the actual OAuth error instead of hanging when wrangler login is rejected by the OAuth provider (for example with invalid_scope).

Previously, if the OAuth callback returned with an error other than access_denied, Wrangler would never respond to the browser. Because server.close()'s callback only fires once all open connections have ended, the login command would hang until the 120 second OAuth timeout — at which point it would print a generic timeout message rather than the actual OAuth failure. The same gap existed for the case where the OAuth provider redirected back without an authorisation code, and for failures during the auth-code-to-access-token exchange.

The OAuth provider's error_description (RFC 6749 §4.1.2.1) is now also surfaced, so the message includes the specific reason for the failure rather than just the bare error code. For example, a misconfigured staging scope now surfaces as:
```
OAuth error: invalid_scope
  The OAuth 2.0 Client is not allowed to request scope 'browser:write'.
```
instead of hanging silently.
Updated dependencies [a3eea27, 1fdd8de, b502d54, 3b8b80a]:
- miniflare@4.20260603.0

`v4.97.0`

Compare Source

Minor Changes

#13996 94b29f7 Thanks @vaishnav-mk! - Add restart-from-step options to wrangler workflows instances restart

You can now restart a Workflow instance from a specific step using --from-step-name, with optional --from-step-count and --from-step-type disambiguation. These options work for both remote Workflow instances and local wrangler dev --local sessions.

Patch Changes

#14141 b210c5e Thanks @MattieTK! - Add re-authentication hint to account fetch error messages

When Wrangler fails to automatically retrieve account IDs, the error messages now suggest running wrangler login as a troubleshooting step. This addresses confusion for users who encounter these errors after OAuth system changes or other authentication issues.
#14078 aec1bb8 Thanks @MattieTK! - Bump am-i-vibing from 0.1.1 to 0.4.0

This updates the agentic environment detection library to the latest version, which includes improved detection coverage for newer AI coding agents.
#14147 e06cbb7 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260529.1 1.20260601.1
#14027 9a26191 Thanks @matingathani! - Gracefully handle EMFILE error when assets directory exceeds OS watcher limit

Previously, when wrangler dev was pointed at an assets directory with more than ~4,096 subdirectories, the chokidar file watcher threw an EMFILE: too many open files error that was not caught, causing an infinite error loop that made the dev server unresponsive.

Now the error is caught and wrangler:
1. Logs a clear warning explaining the platform watcher limit was hit
2. Recommends reducing the number of subdirectories by flattening or restructuring the assets directory
3. Disables the assets watcher gracefully so the dev server continues working without hot-reload
#14041 5565823 Thanks @matingathani! - Fix wrangler complete printing the AI skills prompt into shell completion output

Previously, running eval "$(wrangler complete zsh)" (or any other shell) would fail with errors like zsh: command not found: --install-skills because the interactive AI agent skills installation prompt was included in the completion script output.

The skills prompt is now skipped when running wrangler complete, so the generated completion script is clean and can be sourced correctly.
#13881 890fca7 Thanks @matingathani! - Show a clear error when --metadata is not valid JSON instead of silently ignoring the value
#14149 6fc9777 Thanks @mattjohnsonpint! - Fix wrangler deploy --upload-source-maps silently skipping source maps when the entry file ends with magic comments after //# sourceMappingURL=

Wrangler previously assumed the //# sourceMappingURL= comment was the last non-empty line of a module. Tools like sentry-cli sourcemaps inject append a //# debugId= comment after it, which silently caused source maps to be omitted from the upload form, most commonly when deploying with --no-bundle --upload-source-maps. Wrangler now scans trailing magic comments (lines starting with //# or //@) and detects the //# sourceMappingURL= comment regardless of which other magic comments follow it.
#14105 337e912 Thanks @dario-piotrowicz! - Remove trailing periods from URLs in terminal output

URLs printed to the terminal with a sentence-ending period (e.g. https://example.com/path.) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.
#14150 8e7b74f Thanks @avenceslau! - Fix Workflows schedules deploy payload to match the control plane API

When deploying a Workflow with a schedules binding property, Wrangler sent the cron expressions as a list of strings. The Workflows API expects a list of objects of the form { cron: string }, so the request was rejected. Wrangler now maps each configured cron expression to { cron } (normalizing a single string or an array) when building the request. The user-facing config still accepts a string or an array of strings.
#14084 e86489a Thanks @dario-piotrowicz! - Fix JSON variable bindings in wrangler init --from-dash and remote config diff

When fetching a remote Worker's configuration, JSON variable bindings (e.g. {"my_value": 5}) were incorrectly serialized as { "name": "MY_JSON", "json": {"my_value": 5} } instead of { "MY_JSON": {"my_value": 5} }. This affected two areas:
- wrangler init --from-dash would generate a wrangler.json with broken vars entries
- Remote config diff checks would always report JSON bindings as changed, since the malformed remote representation could never match the local config
Both issues are now fixed and remote JSON bindings are now correctly mapped.
#14155 42288d4 Thanks @dario-piotrowicz! - Include agent skill installation status in all telemetry events

The agent skill installation status is now consistently included in all telemetry events, not just a subset of them.
#14063 65b5f9e Thanks @emily-shen! - Move fetch helpers into @cloudflare/workers-utils

Shared Cloudflare API fetch helper types and plumbing now live in @cloudflare/workers-utils so Wrangler and other clients can use the same implementation.
#14112 3a746ac Thanks @penalosa! - Pin non-bundled runtime dependencies to exact versions

Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new pnpm check:pinned-deps lint enforces this for all published packages (and for the shared pnpm catalog) going forward.
#14124 64ef9fd Thanks @odiak! - Fix wrangler secret bulk dropping newlines from .env input read from stdin

Previously, .env input piped through stdin was concatenated without line breaks, so only the first secret could be parsed correctly. Stdin input now preserves line separators before parsing.
Updated dependencies [e06cbb7, 4ef790b, 337e912, 3a746ac]:
- miniflare@4.20260601.0

`v4.96.0`

Compare Source

Minor Changes

#14087 e3c862a Thanks @edmundhung! - Add support for the new web_search binding kind.

Cloudflare Web Search is a managed, zero-setup web discovery primitive for agents and Workers. Declare the binding as a single object in wrangler.jsonc:
```
{
  "web_search": { "binding": "WEBSEARCH" }
}
```
There is exactly one shared web corpus, so there is no namespace, instance, or other field to specify -- only the variable name. The binding exposes a single search() method that returns URLs and catalog metadata for a query. Web Search is discovery-only -- to read a result's content the caller invokes the global fetch() API against the result's url.

The binding is always remote in local development: Miniflare proxies to the production Web Search service via the remote-bindings transport. Adds the websearch.run OAuth scope to wrangler login.

Also adds a wrangler websearch search command for running ad-hoc queries from the CLI:
```
npx wrangler websearch search "cloudflare workers"
npx wrangler websearch search "cloudflare workers" --limit 5
npx wrangler websearch search "cloudflare workers" --json
```
--limit is optional (defaults to 10, capped at 20). --json prints the raw response; without it the results render as a pretty table.
#13610 cbb39bd Thanks @petebacondarwin! - Add support for agent_memory bindings

Agent Memory bindings allow Workers to connect to Cloudflare's Agent Memory service for storing and retrieving agent conversation state. This binding is remote-only, meaning it always connects to the Cloudflare API during wrangler dev rather than using a local simulation.

To configure an agent_memory binding, add the following to your wrangler.json:
```
{
  "agent_memory": [
    {
      "binding": "MY_MEMORY",
      "namespace": "my-namespace"
    }
  ]
}
```
Wrangler will automatically provision the namespace during deployment if it does not already exist. Type generation via wrangler types is also supported.

This change also adds the agent-memory:write OAuth scope to Wrangler's default login scopes, so wrangler login can request the permissions needed to provision and manage Agent Memory namespaces.

#13610 cbb39bd Thanks @petebacondarwin! - Add wrangler agent-memory namespace commands

The following commands have been added for managing Agent Memory namespaces:

wrangler agent-memory namespace create <namespace>
wrangler agent-memory namespace list [--json]
wrangler agent-memory namespace get <namespace_name> [--json]
wrangler agent-memory namespace delete <namespace_name> [--force]

#14087 e3c862a Thanks @edmundhung! - Add confirmation prompt to wrangler containers images delete

Previously, running wrangler containers images delete IMAGE:TAG would delete the image immediately with no confirmation. The command now prompts for confirmation before deleting. Use -y or --skip-confirmation to bypass the prompt in non-interactive or scripted environments.
#14087 e3c862a Thanks @edmundhung! - Rename pipeline field to stream in pipeline bindings configuration

The pipeline field inside pipelines bindings has been renamed to stream to align with the updated API wire format. The old pipeline field is still accepted but deprecated and will emit a warning.

Before:
```
// wrangler.json
{
  "pipelines": [
    {
      "binding": "MY_PIPELINE",
      "pipeline": "my-stream-name"
    }
  ]
}
```
After:
```
// wrangler.json
{
  "pipelines": [
    {
      "binding": "MY_PIPELINE",
      "stream": "my-stream-name"
    }
  ]
}
```
#14087 e3c862a Thanks @edmundhung! - Allow pipeline, stream, and sink commands to resolve resources by name with pagination-aware lookups.
#14087 e3c862a Thanks @edmundhung! - Support deleting secrets via wrangler secret bulk

You can now delete secrets in bulk by setting their value to null in the JSON input file:
```
{ "SECRET_TO_DELETE": null, "SECRET_TO_UPDATE": "new-value" }
```
#14091 4c0da7b Thanks @gpanders! - Add ProxyCommand support for wrangler containers ssh

wrangler containers ssh now automatically switches to a stdio proxy when invoked by OpenSSH's ProxyCommand, and --stdio can force this mode. This lets users connect with ssh <instance_id> when their SSH config uses Wrangler as the proxy command.
#13892 13cbadb Thanks @penalosa! - Remove the deprecated experimental.testMode option from unstable_dev

experimental.testMode previously only affected the default logLevel (warn when testMode: true, log otherwise) and has been flagged for removal in its type-definition comment since it landed. It is now removed, and unstable_dev's default log level matches wrangler dev's (log).

Callers that explicitly passed testMode: true to get quieter logs should now set logLevel: "warn" directly.

Patch Changes

#14016 408432a Thanks @petebacondarwin! - report all failing triggers from a single deploy

wrangler deploy deploys several kinds of trigger in parallel (routes, custom domains, schedules, queue producers/consumers, workflows). Previously, if one of those API calls failed, the first rejection short-circuited the rest, no other deployments were reported, and (in the case of custom-domain confirmation conflicts) some failures were silently logged to stdout without the deploy actually failing.

wrangler deploy now waits for every trigger deployment to settle, prints every successfully-deployed target (so you still see what landed), and then throws a single error listing every trigger that failed.

Note that this also turns the previously-silent "user declined to override a conflicting Custom Domain" case into a hard failure of wrangler deploy, which matches what was always implied by the message ("Publishing to Custom Domain ... was skipped, fix conflict and try again").
#14125 1103c07 Thanks @dario-piotrowicz! - Bump rosie-skills from 0.7.6 to 0.8.1 and bundle it into the Wrangler output

The new version of rosie-skills is a pure-TypeScript rewrite that removes the previously necessary ~600kb WASM binary. The package now ships only JavaScript with one minimal dependencies (modern-tar).

Additionally, rosie-skills is now bundled directly into Wrangler's distributable rather than kept as an external runtime dependency. This eliminates the supply chain concern raised in #14110: there is no separate package to resolve at install time, since all code is inlined into Wrangler's build output.
#14135 5b5cbd3 Thanks @Refaerds! - Update the generated type for browser bindings to BrowserRun

When running wrangler types, browser bindings were previously typed as the generic Fetcher. They now generate the more specific and accurate BrowserRun type.
#14087 e3c862a Thanks @edmundhung! - Bump rosie-skills package from 0.6.3 to 0.7.6
#14087 e3c862a Thanks @edmundhung! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260526.1 1.20260527.1
#14076 97d7d81 Thanks @dependabot! - Update dependencies of "m

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-02-26T03:44:07Z

🚀 Preview is available at https://039f4b07.enterprise-contract.pages.dev

github-actions · 2026-02-26T17:35:05Z

🚀 Preview is available at https://08300ee1.enterprise-contract.pages.dev

github-actions · 2026-03-04T00:40:10Z

🚀 Preview is available at https://6626ba07.enterprise-contract.pages.dev

github-actions · 2026-03-05T23:55:35Z

🚀 Preview is available at https://547ec4d3.enterprise-contract.pages.dev

github-actions · 2026-03-09T12:49:51Z

🚀 Preview is available at https://777ca95c.enterprise-contract.pages.dev

github-actions · 2026-03-10T23:04:30Z

🚀 Preview is available at https://41dff465.enterprise-contract.pages.dev

github-actions · 2026-03-13T09:55:22Z

🚀 Preview is available at https://604b8a26.enterprise-contract.pages.dev

github-actions · 2026-03-24T13:28:28Z

🚀 Preview is available at https://cfdb8b39.enterprise-contract.pages.dev

github-actions · 2026-03-27T18:35:59Z

🚀 Preview is available at https://360d8039.enterprise-contract.pages.dev

github-actions · 2026-03-31T14:03:19Z

🚀 Preview is available at https://bf28eac1.enterprise-contract.pages.dev

github-actions · 2026-05-14T13:08:29Z

🚀 Preview is available at https://0fc38ee8.enterprise-contract.pages.dev

github-actions · 2026-05-15T14:17:36Z

🚀 Preview is available at https://3ae6f59b.enterprise-contract.pages.dev

github-actions · 2026-05-19T10:48:44Z

🚀 Preview is available at https://3264d610.enterprise-contract.pages.dev

github-actions · 2026-05-26T21:46:38Z

🚀 Preview is available at https://ffdc1ecf.enterprise-contract.pages.dev

github-actions · 2026-06-01T21:05:37Z

🚀 Preview is available at https://b1164918.enterprise-contract.pages.dev

github-actions · 2026-06-02T17:49:14Z

🚀 Preview is available at https://6f8212b2.enterprise-contract.pages.dev

github-actions · 2026-06-04T16:33:59Z

🚀 Preview is available at https://bdb9556c.enterprise-contract.pages.dev

github-actions · 2026-06-09T16:40:18Z

🚀 Preview is available at https://f78e0c08.enterprise-contract.pages.dev

github-actions · 2026-06-11T20:04:55Z

🚀 Preview is available at https://32a0d9d9.enterprise-contract.pages.dev

renovate Bot added main renovate labels Feb 26, 2026

github-actions Bot added the size: XL label Feb 26, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 4de6708 to 8f5d08f Compare February 26, 2026 17:33

renovate Bot changed the title ~~Update dependency wrangler to v4.68.1 (main)~~ Update dependency wrangler to v4.69.0 (main) Feb 26, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 8f5d08f to 063bccc Compare March 4, 2026 00:38

renovate Bot changed the title ~~Update dependency wrangler to v4.69.0 (main)~~ Update dependency wrangler to v4.70.0 (main) Mar 4, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 063bccc to d1bb21f Compare March 5, 2026 23:53

renovate Bot changed the title ~~Update dependency wrangler to v4.70.0 (main)~~ Update dependency wrangler to v4.71.0 (main) Mar 5, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from d1bb21f to 085816e Compare March 9, 2026 12:48

renovate Bot changed the title ~~Update dependency wrangler to v4.71.0 (main)~~ Update npm dependencies (main) (minor) Mar 9, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 085816e to 04a82b2 Compare March 10, 2026 23:02

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 04a82b2 to d42d94a Compare March 13, 2026 09:53

renovate Bot force-pushed the renovate/main-npm-dependencies branch 3 times, most recently from d3d3ce0 to 8b18491 Compare March 20, 2026 09:56

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 8b18491 to 7fc3e4c Compare March 24, 2026 13:26

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 7fc3e4c to ab5547c Compare March 27, 2026 18:34

renovate Bot force-pushed the renovate/main-npm-dependencies branch from ab5547c to aa15d89 Compare March 31, 2026 14:01

renovate Bot force-pushed the renovate/main-npm-dependencies branch from aa15d89 to f3e5e17 Compare April 1, 2026 12:31

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 8569b96 to 4e5d93c Compare May 15, 2026 14:16

renovate Bot changed the title ~~Update dependency wrangler to v4.91.0 (main)~~ Update dependency wrangler to v4.92.0 (main) May 15, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 4e5d93c to b88f076 Compare May 19, 2026 10:47

renovate Bot changed the title ~~Update dependency wrangler to v4.92.0 (main)~~ Update dependency wrangler to v4.93.0 (main) May 19, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from b88f076 to 994354d Compare May 21, 2026 13:45

renovate Bot changed the title ~~Update dependency wrangler to v4.93.0 (main)~~ Update dependency wrangler to v4.93.1 (main) May 21, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 994354d to fcd30b5 Compare May 22, 2026 16:09

renovate Bot changed the title ~~Update dependency wrangler to v4.93.1 (main)~~ Update dependency wrangler to v4.94.0 (main) May 22, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from fcd30b5 to 3ad8f2b Compare May 26, 2026 21:44

renovate Bot changed the title ~~Update dependency wrangler to v4.94.0 (main)~~ Update dependency wrangler to v4.95.0 (main) May 26, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 3ad8f2b to bcfadd1 Compare June 1, 2026 21:04

renovate Bot changed the title ~~Update dependency wrangler to v4.95.0 (main)~~ Update dependency wrangler to v4.96.0 (main) Jun 1, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from bcfadd1 to b1c72ed Compare June 2, 2026 17:47

renovate Bot changed the title ~~Update dependency wrangler to v4.96.0 (main)~~ Update npm dependencies to v4.97.0 (main) Jun 2, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from b1c72ed to 9ae7400 Compare June 4, 2026 16:32

renovate Bot changed the title ~~Update npm dependencies to v4.97.0 (main)~~ Update npm dependencies to v4.98.0 (main) Jun 4, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 9ae7400 to f52b2c6 Compare June 9, 2026 16:38

renovate Bot changed the title ~~Update npm dependencies to v4.98.0 (main)~~ Update npm dependencies to v4.99.0 (main) Jun 9, 2026

Update npm dependencies to v4.100.0

18f1f73

renovate Bot force-pushed the renovate/main-npm-dependencies branch from f52b2c6 to 18f1f73 Compare June 11, 2026 20:03

renovate Bot changed the title ~~Update npm dependencies to v4.99.0 (main)~~ Update npm dependencies to v4.100.0 (main) Jun 11, 2026

Conversation

renovate Bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.100.0

Minor Changes

Patch Changes

v4.99.0

Minor Changes

Patch Changes

v4.98.0

Minor Changes

Patch Changes

v4.97.0

Minor Changes

Patch Changes

v4.96.0

Minor Changes

Patch Changes

Configuration

Uh oh!

github-actions Bot commented Feb 26, 2026

Uh oh!

github-actions Bot commented Feb 26, 2026

Uh oh!

github-actions Bot commented Mar 4, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 10, 2026

Uh oh!

github-actions Bot commented Mar 13, 2026

Uh oh!

github-actions Bot commented Mar 24, 2026

Uh oh!

github-actions Bot commented Mar 27, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 15, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 26, 2026 •

edited

Loading

`v4.100.0`

`v4.99.0`

`v4.98.0`

`v4.97.0`

`v4.96.0`