Update npm dependencies (main) (minor) by renovate[bot] · Pull Request #527 · conforma/conforma.github.io

renovate · 2026-02-26T03:42:31Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
antora (source)	`3.1.12` → `3.2.0`
wrangler (source)	`4.59.1` → `4.128.0`

Release Notes

antora/antora (antora)

cloudflare/workers-sdk (wrangler)

`v4.128.0`

Compare Source

Minor Changes

#15454 dbbb795 Thanks @jamesopstad! - Move binding utilities into @cloudflare/workers-utils

Binding conversion, printing, and local-development validation are now exported from @cloudflare/workers-utils so they can be shared by Wrangler, the Cloudflare Vite plugin, and other consumers.

The corresponding exports have been removed from @cloudflare/deploy-helpers. Consumers should import them directly from @cloudflare/workers-utils instead.

Wrangler's unstable_printBindings API now accepts the bindings and an options object instead of five positional parameters.
#15353 87a7acf Thanks @pombosilva! - Add --date-start and --date-end filters to wrangler workflows instances list

You can now narrow an instance listing to a creation-time window:

wrangler workflows instances list my-workflow --date-start 2026-01-01 --date-end 2026-01-31

Either flag can be used independently. Both accept an ISO 8601 date or timestamp and are normalised to UTC before being sent, so a date-only value such as 2026-01-01 works as well as a full 2026-01-01T13:00:00Z. The bounds are inclusive and compose with the existing --status filter.
#15379 ea28cc3 Thanks @ibbykhazanchi! - Add query string redaction to Workers observability configuration

Set observability.redact_query_string in wrangler.json or observability.redactQueryString in the experimental cloudflare.config.ts format to remove query strings from request URLs in logs and traces.
#14915 707cb6f Thanks @longlho! - Include exact raw and gzip-compressed Worker bundle sizes in structured deploy and version-upload output.

Patch Changes

#15436 200780f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260828.1 ^5.20260831.1

workerd 1.20260828.1 1.20260831.1
#15406 b3f2628 Thanks @james-elicx! - Reduce the installed bundle sizes of Wrangler and Miniflare

Wrangler now resolves bundled workspace dependencies from source during monorepo builds so unused exports can be removed. Miniflare, its shared CLI and container dependencies now use granular @cloudflare/workers-utils entry points instead of loading the package barrel, reducing the raw Wrangler and Miniflare artifacts by 6.16 MiB (31.4%) and 1.06 MiB (22.9%) respectively without changing runtime behavior or installed dependencies.
#15398 1809c5e Thanks @james-elicx! - Reduce Wrangler's published package size

Stop including the unused build metafile in the npm package, reducing its unpacked size by approximately 3.1 MiB.
#15382 b3fb2bf Thanks @Om-singhaI! - Skip the skills install status lookup when telemetry is disabled

Telemetry events include a currentAgentSkillsInstalled property, and computing it can query the GitHub API. The lookup used to start before the telemetry permission was checked, so users who opted out via WRANGLER_SEND_METRICS, DO_NOT_TRACK, or send_metrics in their Wrangler config still triggered network requests on behalf of telemetry. The dispatcher now checks the permission first and only performs the lookup when telemetry is enabled.
Updated dependencies [200780f, b3f2628, 87a7acf]:
- miniflare@5.20260831.0-alpha

`v4.127.1`

Compare Source

Patch Changes

#15383 eb01850 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260826.1 ^5.20260827.1

workerd 1.20260826.1 1.20260827.1
#15393 e1df91a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260827.1 ^5.20260828.1

workerd 1.20260827.1 1.20260828.1
Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:
- miniflare@5.20260828.0-alpha

`v4.127.0`

Compare Source

Minor Changes

#15356 fe265f8 Thanks @rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.
```
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "concurrency": { "limit": 10 }
    }
  ]
}
```

Patch Changes

#15367 412c79e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260825.1 ^5.20260826.1

workerd 1.20260825.1 1.20260826.1
#15375 92874f6 Thanks @WillTaylorDev! - Upload wrangler preview modules as multipart form data

wrangler preview used to base64 the bundle, its modules, and any sourcemaps into a single JSON request body. Base64 inflates content by a third, so a Worker with a large sourcemap could exceed the API request size limit and fail to deploy.

The preview deployment request is now multipart/form-data. The deployment settings travel in a metadata part and each module follows as its own part carrying raw bytes, matching how wrangler deploy already uploads a Worker.
Updated dependencies [412c79e]:
- miniflare@5.20260826.0-alpha

`v4.126.0`

Compare Source

Minor Changes

#15332 d1cc3af Thanks @pombosilva! - Add default_retention to Workflow bindings for configuring how long instances are retained

Workflow instances are retained for an account-wide default period after they finish. You can now set a per-Workflow default in your Wrangler configuration, applied to instances that do not specify their own retention:
```
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "default_retention": {
        "success_retention": "3 days",
        "error_retention": "7 days"
      }
    }
  ]
}
```
Each side is optional and accepts either a duration string such as "3 days" or a whole number of milliseconds. Durations are interpreted by the Workflows API, which also caps them at your account's retention limit.

#15064 693ca29 Thanks @tpmmorris! - Include a chronological list of handler events in email test harness results, so programmatic local email tests can assert the order in which messages are received, forwarded, replied to, or rejected.

const result = await server.getWorker().email({
  from: "sender@example.com",
  to: "inbox@example.com",
  raw: [
    "From: Sender <sender@example.com>",
    "To: Inbox <inbox@example.com>",
    "Message-ID: <test@example.com>",
    "Subject: Test email",
    "",
    "Hello from the test harness",
  ].join("\r\n"),
});

expect(result.events).toEqual([
  { type: "received", timestamp: expect.any(String) },
  {
    type: "forward",
    timestamp: expect.any(String),
    messageId: expect.any(String),
  },
  {
    type: "reply",
    timestamp: expect.any(String),
    messageId: expect.any(String),
  },
]);

#15065 ad89456 Thanks @mtlemilio! - Add experimental wrangler hyperdrive planetscale signature for provisioning Cloudflare-billed PlanetScale databases

wrangler hyperdrive planetscale signature prints a signed authorization as JSON, proving to PlanetScale that Cloudflare will be billed for the database you are about to create:
```
npx wrangler hyperdrive planetscale signature | \
  pscale database create <name> \
    --org <org> \
    --engine postgresql \
    --cloudflare-billing @- \
    --format json
```
pscale database create defaults to Vitess, so pass --engine postgresql for a Postgres database, and --format json is recommended when the output is consumed by an agent.

This requires pscale v0.313.0 or newer. Wrangler authorizes the Cloudflare billing side only, so your PlanetScale credentials stay between you and pscale.

The signature is a cryptographically signed token that authorizes creating a database billed to your Cloudflare account. Treat it as a credential and do not share it. Piping it, as above, is recommended over passing it as a command line argument.

This command is experimental and its interface may change.
#15134 c66d2d5 Thanks @gpanders! - Enable FUSE-capable local container development

Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.
#15326 9fcb1c9 Thanks @jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.
#14966 a4c3458 Thanks @yomna-shousha! - Add pull request metadata to wrangler preview deployments

wrangler preview now detects the pull request associated with the current CI run (GitHub Actions, GitLab CI, CircleCI, and a generic PULL_REQUEST_URL/PR_URL/CHANGE_URL fallback) and attaches it, along with the repository URL, to the preview deployment as annotations (workers/pull_request_number, workers/pull_request_url, workers/repository_url).

This is best effort: if no pull request can be detected, nothing changes. When a pull request is detected, its URL is now also shown in the wrangler preview command output.
#15307 433fa98 Thanks @for-the-kidz! - Add pull request title to wrangler preview deployment annotations

wrangler preview now also detects the title of the pull/merge request associated with the current CI run (GitHub Actions and GitLab CI, plus a generic PULL_REQUEST_TITLE fallback) and attaches it to the preview deployment as the workers/pull_request_title annotation, alongside the existing pull request number/URL, repository URL, and commit SHA annotations.

This is best effort: if no pull request title can be detected, nothing changes.

Patch Changes

#15294 4a67a28 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260820.1 ^5.20260821.1

workerd 1.20260820.1 1.20260821.1
#15328 2d78137 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260821.1 ^5.20260823.1

workerd 1.20260821.1 1.20260824.1
#15346 04e8564 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260823.1 ^5.20260825.1

workerd 1.20260824.1 1.20260825.1
#15246 daefb3c Thanks @edmundhung! - Prepare autoconfig for multiple configuration targets

Add target-specific configuration output and command detection while preserving Wrangler's existing setup and deployment behavior.
#15320 c809851 Thanks @Om-singhaI! - Fix wrangler login --use-keyring incorrectly reporting that secret-tool is missing on Linux

Libsecret's secret-tool does not support --version; it prints usage and exits 2, which Wrangler previously interpreted as unavailable. Wrangler now reports it missing only when launching the executable fails.
#15336 22182da Thanks @podonnell-dev! - [private beta]: Explain unavailable Preview URLs after wrangler preview deployments

When a Preview deployment has no active URLs, Wrangler now explains how to enable Preview Deployments on workers.dev or a custom domain.
#15296 d589d30 Thanks @MattieTK! - Stop automatically offering to install Cloudflare skills for new users

Wrangler will no longer prompt new users to install Cloudflare skills after commands complete. It will continue to offer updates to skills that Wrangler previously installed.
Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, 693ca29, 693ca29, 693ca29, 37ed753, f76b68e, c66d2d5, 693ca29, 74de3ab, 0cb8690, dd5148d, 82d11fc]:
- miniflare@5.20260825.0-alpha

`v4.125.0`

Compare Source

Minor Changes

#14995 59872c4 Thanks @ThomasRubini! - Add connect trigger for raw sockets

You can now configure a Worker to receive raw socket connections during wrangler dev, delivered directly to the Worker's connect(socket, env, ctx) handler:
```
{
  "connect": [{ "protocol": "tcp", "port": 5432 }]
}
```
Each entry opens a listening socket on 127.0.0.1 (or the given address) that forwards incoming connections straight to the Worker, bypassing the local dev HTTP entry point. This requires the experimental compatibility flag. Only "tcp" is supported at the moment.

@cloudflare/config also supports declaring this trigger via triggers.connect(...), which lowers to the connect field above:
```
import { defineWorker, triggers } from "@cloudflare/config";

export default defineWorker({
  triggers: [
    triggers.connect({ protocol: "tcp", port: 5432, address: "127.0.0.1" }),
  ],
});
```
#15172 c68f9cb Thanks @WillTaylorDev! - Add container support to worker previews

Worker previews now support containers through a new previews.containers configuration block. Container configuration doesn't inherit, so declare containers explicitly in the previews block to enable them for previews. This mirrors how previews.durable_objects works today. Wrangler names each preview container application {worker_name}_{preview_slug}_{class_name}, normalising and shortening the result to what the API accepts. Either change appends a short digest of the composed name, so two names that would otherwise land on one stay distinct. An entry cannot set its own name, because application names are unique to an account and a fixed name would collide between two previews of the same Worker. A Durable Object class is backed by at most one container application, so the validator rejects two entries that share a class_name. Wrangler skips container applications bound to Durable Object classes that another Worker implements through script_name, because the implementing Worker owns its own container application. A binding is not required: a Durable Object declared through migrations or exports and reached only over ctx.exports can still back a container. Every entry must set class_name. A previews.containers entry whose class_name matches no Durable Object class at all is rejected before the preview deployment is created, so a typo fails loudly instead of producing a preview with no container.

Wrangler creates the container applications on wrangler preview. Deleting a preview tears them down server side, so wrangler preview delete doesn't remove them.

Container build and deploy progress prints to stdout. wrangler preview --json suppresses wrangler's own output so it doesn't interleave with the payload, and warnings and errors still go to stderr. Docker's build output and the progress spinner write to stdout directly and bypass that suppression, so parse --json from a non interactive shell, where the spinner is skipped, and prefer a prebuilt image over a Dockerfile.
#15174 649f667 Thanks @WillTaylorDev! - [private beta]: Create the parent Worker automatically when wrangler preview targets one that doesn't exist yet

Previews hang off a parent Worker, so running wrangler preview before the Worker had ever been deployed failed with a raw API error naming the Preview endpoint. Wrangler now offers to create an empty parent Worker and then carries on creating the Preview. The parent uses the same workers.dev and Preview URL settings that wrangler deploy would resolve, without applying routes or cron triggers. In non-interactive environments, Wrangler creates the Worker without asking.
#14735 30c2d47 Thanks @vaishnav-mk! - Add individual and batch Workflow instance deletion to the runtime and SDK.
- WorkflowInstance.delete() deletes one instance. Self-deletion stops the current execution.
- env.MY_WORKFLOW.deleteBatch(instanceIds) deletes up to 100 instances and returns { deleted, errors } per input position.
- wrangler workflows instances delete <name> [id..] deletes instances remotely or with --local; IDs can also come from a JSON array passed with --filename, with a combined limit of 100.

Patch Changes

#15260 5ae9d5b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260815.1 ^5.20260816.1

workerd 1.20260815.1 1.20260816.1
#15264 4b52975 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260816.1 ^5.20260819.1

workerd 1.20260816.1 1.20260819.1
#15277 ce9b151 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260819.1 ^5.20260820.1

workerd 1.20260819.1 1.20260820.1
#15192 ef73a28 Thanks @ondraulehla! - Fixes kv bulk put corrupting binary values written to local KV

Values marked base64: true were stored incorrectly whenever they contained bytes that do not form valid UTF-8, which covers images, compressed data and most other binary payloads. A Worker reading such a key back under wrangler dev got a different, longer value than the one that was written: a 12 byte PNG header came back as 20 bytes.

kv bulk put writes to local KV by default, so the plain command was the affected one. Remote writes were never affected, and neither were entries without base64 or values written with kv key put.
#15284 39dcea6 Thanks @emily-shen! - Move deploy output writing into shared deploy helpers
#15130 99a1f49 Thanks @emily-shen! - Remove unsupported remote configuration from Workflow bindings

Workflow bindings no longer accept remote in configuration, as remote Workflow bindings have never actually been supported.
#15278 f2437e6 Thanks @Sosokker! - Fix the --temporary error on commands that authenticate more than one time

wrangler d1 migrations apply --remote --temporary failed with this error: You're already authenticated with Cloudflare, so --temporary can't be used. The failure occurred with no login and with no CLOUDFLARE_API_TOKEN. This command authenticates one time for each statement that it runs. The first authentication makes a temporary preview account. The second authentication read the token of this new account as an earlier login.

Wrangler now uses again the temporary account from the same command run. Commands that authenticate more than one time now work as wrangler deploy --temporary works. If real credentials are available, --temporary is still an error.
Updated dependencies [59872c4, 99a1f49, 5ae9d5b, 4b52975, ce9b151, 99a1f49, 99a1f49, 30c2d47]:
- miniflare@5.20260820.0-alpha

`v4.124.0`

Compare Source

Minor Changes

#15026 6529f0c Thanks @petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:
```
{
  "name": "my-worker",
  "main": "worker.js",
  "compatibility_date": "2026-07-01",
  "containers": [
    { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
  ],
  "exports": {
    "MyContainerDO": {
      "type": "durable-object",
      "storage": "sqlite",
      "container": "my-container"
    }
  }
}
```
The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:
- a container reference names a container that does not exist
- two Durable Object exports claim the same container
- a container and a Durable Object export disagree about which one they are linked to
- a container ends up linked to no Durable Object at all
- two containers share a name
- a container's class_name names a Durable Object whose storage is legacy-kv
- two containers are attached to the same Durable Object
That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

#15211 bc5726b Thanks @nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.
#14999 ba54f0d Thanks @mittalpk! - Fix .env loading on Windows leaking stale, differently-cased duplicate keys

On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env. When a key was set again under a different casing (e.g. a value in .env.local overriding one from .env with different casing), the previous casing was never removed from the underlying object. env.PATH/env.Path still returned the correct, latest value, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — would see both the stale and current key.

Duplicate entries no longer appear, so environment variables passed to subprocesses and any code that lists the environment now see only the latest value for each variable.
#15044 b7422b0 Thanks @stareezy-1! - Normalize structural CRLF line endings before sending D1 commands to the remote query API

wrangler d1 migrations apply --remote and wrangler d1 execute --remote --command failed with incomplete input: SQLITE_ERROR when the SQL contained CRLF line endings inside a compound statement such as a CREATE TRIGGER ... BEGIN ... END; body. Structural line endings are now normalized to LF before the command is sent to the D1 query API, while CRLF inside quoted values and identifiers remains unchanged.
#15046 186339c Thanks @erwinzhang7! - Fixes D1 SQL statements not handling lowercase ends correctly

wrangler d1 execute and wrangler d1 migrations apply split a SQL file into statements before running them. A BEGIN or CASE block closed with a lowercase end was not recognised as closed, so every statement after it was folded into that block instead of being run on its own. SQLite accepts either case, so a file like this applied only the trigger and silently skipped the table:
```
CREATE TRIGGER IF NOT EXISTS update_trigger AFTER UPDATE ON items
begin
	DELETE FROM updates WHERE item_id=old.id;
end;
CREATE TABLE after_the_trigger (id TEXT PRIMARY KEY);
```
Files written with an uppercase END were unaffected. Both cases now behave the same.
#15231 4f922dc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260811.1 ^5.20260814.1

workerd 1.20260811.1 1.20260814.1
#15248 4d74b8d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260814.1 ^5.20260815.1

workerd 1.20260814.1 1.20260815.1
#15185 1f79ace Thanks @jamesopstad! - Resolve --latest to the newest compatibility date supported by the installed runtime

wrangler deploy --latest and wrangler versions upload --latest resolved the compatibility date to the current date, and wrangler pages download config did the same for projects configured to always use the latest compatibility date. Both write that date into a configuration file for subsequent commands to use, so a date that the installed workerd did not yet support left the project unable to run wrangler dev.

These now resolve to the latest compatibility date supported by this version of Wrangler, which is the release date of the workerd it ships with.
#15151 49f73de Thanks @maximilliangrand! - Fix spurious Trailing comma jsonc(519) warnings for wrangler.jsonc in VS Code 1.131+

Trailing commas in wrangler.jsonc files that reference Wrangler's JSON schema are no longer reported as errors by recent versions of VS Code. Wrangler always accepted these files; only the editor warning was wrong.
#14983 7cee278 Thanks @kdelay! - Respect CLOUDFLARE_ACCOUNT_ID in wrangler pages project list, create and delete

These three commands could target a previously used account even when CLOUDFLARE_ACCOUNT_ID was set, failing with Authentication error [code: 10000] in setups with more than one account. They now use the account named by CLOUDFLARE_ACCOUNT_ID, matching the rest of wrangler pages. When the variable is unset, the previously used account is still selected, as before.
#15153 265256a Thanks @podonnell-dev! - Fix wrangler preview base-config commands showing an inherited script positional
#15185 1f79ace Thanks @jamesopstad! - Use a fixed default compatibility date rather than the current date

When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.
#15239 f431166 Thanks @jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime types

Runtime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit nodejs_compat flag. Node.js globals continue to come from @types/node instead of being generated as any declarations that override those types.
#15196 8fb2b87 Thanks @skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance region

Container builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either compliance_region or CLOUDFLARE_COMPLIANCE_REGION.
#15082 75cf407 Thanks @penalosa! - Enable the new configuration format in the cf-wrangler dev delegate

Projects started through cf dev now load cloudflare.config.ts and optional wrangler.config.ts, matching the configuration used by the delegate's build path.
Updated dependencies [1277a72, 4f922dc, 4d74b8d, 2e0c962, 8777180]:
- miniflare@5.20260815.0-alpha

`v4.123.0`

Compare Source

Minor Changes

#15113 b8fd112 Thanks @BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.
```
// wrangler.json
{
  "access": {
    "dev": {
      "aud": "my-app-aud-tag",
      "identity": {
        "email": "user@example.com",
        "name": "Test User"
      }
    }
  }
}
```
#15152 f0f2054 Thanks @GregBrimble! - [private beta]: Updates the --ignore-defaults flag to --ignore-base-config on wrangler preview commands.

--ignore-base-config now only takes effect on Preview creation, rather than on each deployment, since Preview base configuration is now copy-on-create rather than inherit-on-deploy.
#14872 339509d Thanks @dario-piotrowicz! - Add automatic update prompts for out-of-date Cloudflare agent skills

When Cloudflare skills were previously installed by Wrangler and the upstream cloudflare/skills repository has newer content, Wrangler now offers to update them after eligible commands complete.

To reduce prompt fatigue, the update check only runs once a month (30 days since the last install or update). Declining suppresses the prompt until the next upstream change.

When declining an update, Wrangler offers the option to permanently disable future update prompts. This preference is stored globally in ~/.wrangler/agents-skills-install.jsonc. The WRANGLER_NO_SKILLS_UPDATE_PROMPTS=true environment variable can also be used to suppress prompts. The --install-skills flag remains available regardless of these settings.

Patch Changes

Updated dependencies [b8fd112]:
- miniflare@5.20260811.1-alpha

`v4.122.0`

Compare Source

Minor Changes

#15123 d0c976c Thanks @dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

@cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

Patch Changes

[#15123](https://red

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-02-26T03:44:07Z

🚀 Preview is available at https://039f4b07.enterprise-contract.pages.dev

github-actions · 2026-02-26T17:35:05Z

🚀 Preview is available at https://08300ee1.enterprise-contract.pages.dev

github-actions · 2026-03-04T00:40:10Z

🚀 Preview is available at https://6626ba07.enterprise-contract.pages.dev

github-actions · 2026-03-05T23:55:35Z

🚀 Preview is available at https://547ec4d3.enterprise-contract.pages.dev

github-actions · 2026-03-09T12:49:51Z

🚀 Preview is available at https://777ca95c.enterprise-contract.pages.dev

github-actions · 2026-03-10T23:04:30Z

🚀 Preview is available at https://41dff465.enterprise-contract.pages.dev

github-actions · 2026-03-13T09:55:22Z

🚀 Preview is available at https://604b8a26.enterprise-contract.pages.dev

github-actions · 2026-03-24T13:28:28Z

🚀 Preview is available at https://cfdb8b39.enterprise-contract.pages.dev

github-actions · 2026-03-27T18:35:59Z

🚀 Preview is available at https://360d8039.enterprise-contract.pages.dev

github-actions · 2026-03-31T14:03:19Z

🚀 Preview is available at https://bf28eac1.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-13T19:48:48Z

🤖 Review · ❌ Terminated · Started 7:48 PM UTC · Ended 8:00 PM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-13T19:49:14Z

🚀 Preview is available at https://8db5711d.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-13T20:00:52Z

🤖 Finished Review · ✅ Success · Started 7:48 PM UTC · Completed 8:00 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-18T17:03:13Z

🤖 Review · ❌ Terminated · Started 5:03 PM UTC · Ended 5:16 PM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-18T17:03:49Z

🚀 Preview is available at https://88e89bba.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-18T17:16:49Z

🤖 Finished Review · ✅ Success · Started 5:03 PM UTC · Completed 5:16 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-20T20:13:59Z

🤖 Review · ❌ Terminated · Started 8:13 PM UTC · Ended 8:27 PM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-20T20:14:16Z

🚀 Preview is available at https://599f79f1.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-20T20:27:02Z

🤖 Finished Review · ✅ Success · Started 8:13 PM UTC · Completed 8:27 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-25T23:58:59Z

🤖 Review · ❌ Terminated · Started 11:58 PM UTC · Ended 12:09 AM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-25T23:59:11Z

🚀 Preview is available at https://9731b859.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-26T00:09:36Z

🤖 Finished Review · ✅ Success · Started 11:58 PM UTC · Completed 12:09 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.22

fullsend-ai-review · 2026-08-27T12:35:22Z

🤖 Review · ❌ Terminated · Started 12:35 PM UTC · Ended 12:47 PM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-27T12:35:40Z

🚀 Preview is available at https://595fbfaf.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-27T12:47:15Z

🤖 Finished Review · ✅ Success · Started 12:35 PM UTC · Completed 12:47 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.17

fullsend-ai-review · 2026-08-28T20:14:38Z

🤖 Review · ❌ Terminated · Started 8:14 PM UTC · Ended 8:26 PM UTC

Commit: 87c4a29 · View workflow run →

github-actions · 2026-08-28T20:14:55Z

🚀 Preview is available at https://1d065f8e.enterprise-contract.pages.dev

fullsend-ai-review · 2026-08-28T20:25:57Z

🤖 Finished Review · ✅ Success · Started 8:14 PM UTC · Completed 8:25 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.94

fullsend-ai-review · 2026-08-29T09:40:27Z

🤖 Finished Review · ✅ Success · Started 9:40 AM UTC · Completed 9:51 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.22

fullsend-ai-review · 2026-09-01T20:07:54Z

🤖 Finished Review · ✅ Success · Started 8:07 PM UTC · Completed 8:23 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.83

fullsend-ai-review · 2026-09-01T20:23:37Z

Risk Assessment: moderate (2/5)

Details

Automated Renovate bot dependency lockfile update with high line count but only 2 files changed, no protected or security-sensitive paths, no CI changes, no recent churn or regression history — low-to-moderate risk typical of routine dependency bumps.

renovate Bot added main renovate labels Feb 26, 2026

github-actions Bot added the size: XL label Feb 26, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 4de6708 to 8f5d08f Compare February 26, 2026 17:33

renovate Bot changed the title ~~Update dependency wrangler to v4.68.1 (main)~~ Update dependency wrangler to v4.69.0 (main) Feb 26, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 8f5d08f to 063bccc Compare March 4, 2026 00:38

renovate Bot changed the title ~~Update dependency wrangler to v4.69.0 (main)~~ Update dependency wrangler to v4.70.0 (main) Mar 4, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 063bccc to d1bb21f Compare March 5, 2026 23:53

renovate Bot changed the title ~~Update dependency wrangler to v4.70.0 (main)~~ Update dependency wrangler to v4.71.0 (main) Mar 5, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from d1bb21f to 085816e Compare March 9, 2026 12:48

renovate Bot changed the title ~~Update dependency wrangler to v4.71.0 (main)~~ Update npm dependencies (main) (minor) Mar 9, 2026

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 085816e to 04a82b2 Compare March 10, 2026 23:02

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 04a82b2 to d42d94a Compare March 13, 2026 09:53

renovate Bot force-pushed the renovate/main-npm-dependencies branch 3 times, most recently from d3d3ce0 to 8b18491 Compare March 20, 2026 09:56

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 8b18491 to 7fc3e4c Compare March 24, 2026 13:26

renovate Bot force-pushed the renovate/main-npm-dependencies branch from 7fc3e4c to ab5547c Compare March 27, 2026 18:34

renovate Bot force-pushed the renovate/main-npm-dependencies branch from ab5547c to aa15d89 Compare March 31, 2026 14:01

renovate Bot force-pushed the renovate/main-npm-dependencies branch from aa15d89 to f3e5e17 Compare April 1, 2026 12:31

This comment was marked as outdated.

Sign in to view

Update npm dependencies

3e9cf9f

fullsend-ai-review Bot approved these changes Sep 1, 2026

View reviewed changes

Dependency	From	To
@cloudflare/workers-types	^5.20260828.1	^5.20260831.1
workerd	1.20260828.1	1.20260831.1

Dependency	From	To
@cloudflare/workers-types	^5.20260826.1	^5.20260827.1
workerd	1.20260826.1	1.20260827.1

Dependency	From	To
@cloudflare/workers-types	^5.20260825.1	^5.20260826.1
workerd	1.20260825.1	1.20260826.1

Dependency	From	To
@cloudflare/workers-types	^5.20260820.1	^5.20260821.1
workerd	1.20260820.1	1.20260821.1

Dependency	From	To
@cloudflare/workers-types	^5.20260821.1	^5.20260823.1
workerd	1.20260821.1	1.20260824.1

Dependency	From	To
@cloudflare/workers-types	^5.20260815.1	^5.20260816.1
workerd	1.20260815.1	1.20260816.1

Dependency	From	To
@cloudflare/workers-types	^5.20260816.1	^5.20260819.1
workerd	1.20260816.1	1.20260819.1

Dependency	From	To
@cloudflare/workers-types	^5.20260811.1	^5.20260814.1
workerd	1.20260811.1	1.20260814.1

Uh oh!

Conversation

renovate Bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

github-actions Bot commented Feb 26, 2026

Uh oh!

github-actions Bot commented Feb 26, 2026

Uh oh!

github-actions Bot commented Mar 4, 2026

Uh oh!

github-actions Bot commented Mar 5, 2026

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

github-actions Bot commented Mar 10, 2026

Uh oh!

github-actions Bot commented Mar 13, 2026

Uh oh!

github-actions Bot commented Mar 24, 2026

Uh oh!

github-actions Bot commented Mar 27, 2026

Uh oh!

github-actions Bot commented Mar 31, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 13, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 18, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 26, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

renovate Bot commented Feb 26, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 13, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 18, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 20, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 25, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 27, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 28, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 29, 2026 •

edited

Loading

fullsend-ai-review Bot commented Sep 1, 2026 •

edited

Loading