[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.156.0 → 4.158.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.158.0

Compare Source

Minor Changes

• #​16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #​16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

  Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

  shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

  yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

• #​16688 fa3edb3 Thanks @​FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

  Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

• #​16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16695 b2061f4 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261103.1	^5.20261104.1
  workerd	1.20261103.1	1.20261104.1

• #​16306 36e64f2 Thanks @​efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

  When a remote bindings request reached a workers.dev host protected by Access without valid Access credentials (for example, Access was added after the dev server started, the CF_Authorization cookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed with TypeError: Too many redirects and an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.

  The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.

• Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

  • miniflare@5.20261104.0-beta

v4.157.0

Compare Source

Minor Changes

• #​16660 34f34b3 Thanks @​punkeel! - Allow opting into zstd compression for Wrangler-built container image layers with WRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd.

Patch Changes

• #​16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16011 44d1ee4 Thanks @​wra-sol! - Offer to delete a Worker's Container applications when running wrangler delete

  Previously, wrangler delete removed only the Worker, leaving the Container applications that wrangler deploy created for it running and billing. It now offers to delete them as well. With --force, or in CI and other non-interactive contexts, it lists them instead so they can be removed with wrangler containers delete <id>.

• #​16670 b14b9dc Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261102.1	^5.20261103.1
  workerd	1.20261102.1	1.20261103.1

• Updated dependencies [b14b9dc, b14b9dc, d2eda1c, 2750917]:

  • miniflare@5.20261103.0-beta

v4.156.2

Compare Source

Patch Changes

• #​16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16642 d38cb02 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261101.1	^5.20261102.1
  workerd	1.20261101.1	1.20261102.1

• #​16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

  Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

  import {
    getNodeCompat,
    type NodeJSCompatMode,
  } from "@cloudflare/workers-utils/node-compat";
  import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";

  Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

  The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.

• #​16531 e5b1798 Thanks @​dario-piotrowicz! - Avoid unrelated route permission checks when comparing dashboard configuration

  When a Worker was last updated from the dashboard, wrangler deploy and wrangler versions upload fetched route and custom-domain metadata even when the command could not change it. Wrangler now fetches only the route categories configured for deployment, allowing Worker-scoped Editor tokens to upload Workers without routes or custom domains.

• Updated dependencies [d38cb02, d38cb02, 51bbf8b]:

  • miniflare@5.20261102.0-beta

v4.156.1

Compare Source

Patch Changes

• #​16594 effe4ed Thanks @​jaeminbird! - Fix wrangler types --check reporting CRLF types files as out of date

  When worker-configuration.d.ts was checked out with CRLF line endings (for example with Git's core.autocrlf=true, the default on Windows), the runtime header kept a trailing \r and never matched the expected header. wrangler types --check then always failed, wrangler dev always warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.

• #​16635 76e18a8 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16635 76e18a8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261023.1	^5.20261101.1
  workerd	1.20261023.1	1.20261101.1

• #​16535 5740867 Thanks @​petebacondarwin! - Keep Pages development asset lookups within the configured directory

  Validate resolved asset paths relative to the Pages output directory, preventing neighboring files and directories with a shared name prefix from being served. This also applies to the Vitest Pages ASSETS helper. Assets inside the directory and existing not-found fallbacks retain their behavior.

• #​16366 d174de8 Thanks @​MattieTK! - Deploy the requested directory when wrangler pages deploy <directory> is run as a Workers static-assets deploy

  When wrangler pages deploy <directory> was carried out as a Workers static-assets deploy, the <directory> argument was only used to check for unsupported Pages features and was then dropped. Autoconfig detected an assets directory of its own instead, and when the project root contained an index.html it chose the whole project root, even when a narrower directory such as public had been requested. Source files and configuration outside the requested directory that were not excluded by .assetsignore could then be uploaded as public static assets.

  The requested directory is now validated before files are written and passed through to the deploy. Unconfigured projects are set up for static assets even when framework dependencies are present; existing Workers configs receive an --assets or legacy --site override. Projects configured through the Cloudflare Vite plugin alone keep their configuration and scripts, using the requested directory and an explicit or default compatibility date just for this deploy. Successful deployments without a config file are recorded in the project's .wrangler/deployments directory for that account and Worker, surviving dependency reinstalls. Repeat deploys verify the recorded version still belongs to the target Worker before allowing an update, preserving protection against name collisions and replacements.

• #​16562 aece4df Thanks @​audricbizouarn-dashdoc! - Retry transient failures when starting a Workers assets upload session

  Asset manifest registration now uses the same bounded API retry policy as Worker uploads, including support for Retry-After. Temporary server errors no longer immediately abort an otherwise valid deployment. Persistent failures still surface the original error after the retry limit; this does not repair server-side issues affecting a specific Worker.

• #​16603 2667a9f Thanks @​petebacondarwin! - Fix repeated slashes in URL paths bypassing Pages Functions middleware

  Pages Functions now collapse repeated slashes when looking up middleware, so requests such as //secure/one run the same middleware as /secure/one. The original request URL and function-route matching are preserved. Middleware receives a functionPath prefix from the original URL so imported assets can still resolve their relative paths.

• #​16525 ed7fb41 Thanks @​petebacondarwin! - Validate OAuth error callbacks against the pending login

  All authorization callbacks, including ones without a code or error, now require the matching login state. Unrelated callbacks leave the login running so the authorization page can complete it, and control characters in provider error messages are displayed as escaped text.

• #​16597 f9dbb22 Thanks @​guybedford! - Fix WebAssembly stack frames printing as at [object Object] in source-mapped errors

  WebAssembly frames in source-mapped error stack traces now show their original function and location instead of [object Object].

• Updated dependencies [76e18a8, 76e18a8, 009ca6e]:

  • miniflare@5.20261101.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	papermc-website	38ba201	Commit Preview URL Branch Preview URL	Nov 09 2026, 01:37 PM