Update dependency wrangler to v4.160.0 #12
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/wrangler-4.x-lockfile"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.158.0→4.160.0Release Notes
cloudflare/workers-sdk (wrangler)
v4.160.0Compare Source
Minor Changes
#16760
cb9534fThanks @petebacondarwin! - Support forwarded Wrangler development server options in the experimentalcf-wranglerdelegatecf devcan now forward options such as--inspector-port 9229,--ip,--var, and--persist-toto the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery,--modeenvironment selection, local development, and its.cloudflare/statedefault. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.Place server options that overlap cf's global options after
--, for examplecf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.#16739
6af492eThanks @GregBrimble! - Add custom Cloudflare API headers throughCLOUDFLARE_API_HEADERSSet
CLOUDFLARE_API_HEADERSto a JSON object such as{"X-Custom-Header":"value"}to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.Patch Changes
#16810
cdc970bThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-10Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16810
cdc970bThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16709
022ee9dThanks @petebacondarwin! - Keep local Container images available for upload retriesKeep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.
#16740
44b39b0Thanks @GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.Apply the same filtering to request, response, and request-options diagnostics. Strip
X-Auth-KeyalongsideAuthorizationwhen forwarding local artifact Git requests.#16758
325dc69Thanks @petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spreadUse a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.
Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.
Updated dependencies [
cdc970b,cdc970b,4e7e9f1,267dadb,44b39b0]:v4.159.0Compare Source
Minor Changes
#16737
a589d23Thanks @jamesopstad! - Store experimentalcf-wrangler devstate in.cloudflare/statePersist local resource data in
.cloudflare/staterelative to the configuration file. Direct Wrangler usage continues to default to.wrangler/state.#16663
fe69809Thanks @FlorentCollin! - Add--compatibilityflag towrangler d1 exportYou can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:
wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_onlyIt accepts
d1(the default) andsqlite3_cli_only. Withsqlite3_cli_only, the dump matches the output of thesqlite3 .dumpcommand, including virtual tables. D1 cannot import this dump.sqlite3_cli_onlyis only supported for remote exports.#16599
dee7a1dThanks @petebacondarwin! - SupportCLOUDFLARE_AUTH_PROFILEfor shared authentication profile selectionCloudflare tooling can pass a selected profile to child processes through
CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. Thecf-wranglerdevelopment delegate also initializes cf authentication so it reads the selected cf credentials.Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and
cf-wranglerkeeps its authentication scoped to the delegate invocation.#15615
c64fdfbThanks @svetch! - Support jurisdiction when automatically provisioning D1 databasesSet
jurisdictionon a D1 binding without adatabase_idto create the database in that jurisdiction during deployment. For example,{"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]}creates an EU-jurisdiction database.#16066
4112820Thanks @petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker typesUse
wrangler types --include-main-module=falsewhen the Worker entrypoint is generated build output that should not be type-checked as application source. The correspondingincludeMainModuleoption is available in the experimental type-generation API. The option is preserved by--checkand automatic regeneration. Omitting the import opts out of module-derivedctx.exportstyping while preserving runtime types, environment bindings, and Durable Object namespace declarations.New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.
Patch Changes
#16648
56459a5Thanks @dario-piotrowicz! - Update bundled third-party dependencies with known security fixesLocal development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.
Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.
#16746
abf924eThanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-06Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16792
de10016Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-09Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16746
abf924eThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16792
de10016Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16726
2fb01e7Thanks @pratham-jain33! - Warn when cron triggers are configured alongside--dispatch-namespaceWhen deploying a user Worker to a dispatch namespace (Workers for Platforms), cron triggers are not supported, but Wrangler previously dropped them silently: schedules configured via
triggers.cronsin the Wrangler config file or the--triggersCLI flag never ran and no warning was shown. Wrangler now warns that cron triggers will be ignored when deploying with--dispatch-namespace.#16748
dc4e093Thanks @shbernal! - Stopwrangler email routing addresses createfrom claiming a verification email was sent for addresses that are already verifiedCloudflare doesn't send a verification email when the destination address is already verified on the account, such as the account owner's own email. The command now shows the verification timestamp in that case. It only mentions a verification email when the address is still pending.
#15621
cff83d0Thanks @petebacondarwin! - Report a failed Wrangler command when the CLI child is terminated by a signalWrangler's executable previously translated signal termination into exit code 0, which could cause callers to report a successful deployment after the operating system stopped Wrangler. Signal exits now use the conventional nonzero shell status.
#16413
3ef2afdThanks @ghostwriternr! - Remove Container networking sidecars and snapshot clone volumes in local developmentWrangler and the Vite plugin removed only the application containers of Container-enabled Durable Objects, found by image tag, and left behind the networking sidecars and snapshot clone volumes that workerd also creates. They now leave cleanup to Miniflare, which removes all of these when the Container configuration changes, such as after a rebuild, when local development stops, and when the process exits.
#16066
4112820Thanks @petebacondarwin! - Preserve environment inputs when automatically regenerating Worker typesAutomatic type regeneration now reuses the recorded
--envand--env-fileoptions. This keeps environment-specific bindings and secret declarations consistent with the generated header and subsequentwrangler types --checkruns.#15621
cff83d0Thanks @petebacondarwin! - Avoid materializing unused multipart request bodiesWrangler no longer creates a full text copy of multipart API request bodies when debug logs are disabled or sanitized. This substantially reduces peak memory use when uploading large batches of static assets while preserving request-body output when unsanitized debug logging is explicitly enabled.
#16664
9b6582cThanks @dario-piotrowicz! - StopgetPlatformProxy()asset misses from recursively calling its own listenerRequests for assets that do not exist now return a 404 response without hanging or exhausting local development resources.
Updated dependencies [
fea323a,56459a5,abf924e,de10016,abf924e,de10016,66bc0d6]:Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.