[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	1.64.0 → 1.66.0
wrangler (source)	4.151.3 → 4.156.0

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.66.0

Compare Source

Minor Changes

• #​16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #​16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #​16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #​16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #​16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #​16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #​16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #​16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #​16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #​16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #​16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

v1.65.0

Compare Source

Minor Changes

• #​16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

  Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes

• #​16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

  Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

• #​16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

  Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

• #​16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

  Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

  The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

• #​16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

  Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

• #​16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

  Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

• #​16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

  Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

cloudflare/workers-sdk (wrangler)

v4.156.0

Compare Source

Minor Changes

• #​16532 25802bc Thanks @​simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

  The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

• #​16369 ec0bea4 Thanks @​MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

  When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

  In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.

• #​16367 b4653b4 Thanks @​MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

  Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

  The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.

• #​16532 25802bc Thanks @​simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

  Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.

• #​16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

  Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

  Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

• Updated dependencies [15fbaed, d8899ac]:

  • miniflare@5.20261023.3-beta

v4.155.0

Compare Source

Minor Changes

• #​16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]
  }

Patch Changes

• #​16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

  Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

• #​16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

  wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

• #​16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

  Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

• Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:

  • miniflare@5.20261023.2-beta

v4.154.0

Compare Source

Minor Changes

• #​16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #​16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

  Node.js callers also keep custom error names such as ArtifactsError. Errors from remote bindings received inside a Worker keep their properties but are still named Error.

• Updated dependencies [0968b08, f3c13b3]:

  • miniflare@5.20261023.1-beta

v4.153.0

Minor Changes

• #​14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #​15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #​16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261019.1	^5.20261022.1
  workerd	1.20261019.1	1.20261022.1

• #​16437 e651d7c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261022.1	^5.20261023.1
  workerd	1.20261022.1	1.20261023.1

• #​16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #​16485 b7e762d Thanks @​Cherry! - Fix the Windows keyring install when the config path contains a space

  On Windows, wrangler login --use-keyring could not set up keyring storage when the configuration path contained a space, such as a C:\Users\John Smith profile, so credentials fell back to the plaintext file. Keyring setup now works for those paths and credentials are stored encrypted.

• #​16405 c709bff Thanks @​ondraulehla! - Fix kv key list returning only the first 1000 keys in local mode

  Listing a local namespace with more than 1000 keys stopped after the first 1000 without any warning, so the output looked complete when it wasn't. kv key list now returns every key in local mode, with or without --prefix.

• #​16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, bcd618d]:

  • miniflare@5.20261023.0-beta

v4.152.0

Minor Changes

• #​14900 08f22d3 Thanks @​mack-erel! - Support remote Hyperdrive bindings in local development

  {
    "hyperdrive": [
      {
        "binding": "HYPERDRIVE",
        "id": "<your-hyperdrive-id>",
        "remote": true
      }
    ]
  }

• #​16357 182d6de Thanks @​Naapperas! - Add a jurisdiction setting to Workflows

  A Workflow defined by the Worker can now set the jurisdiction that its instances run and store their data in, on either a workflows binding or a workflow export:

  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "jurisdiction": "eu"
      }
    ]
  }

  The accepted values are eu, fedramp, and us. wrangler deploy and wrangler triggers deploy send the jurisdiction when they create or update the Workflow. A Workflow's jurisdiction is set when it is created and cannot be changed afterwards, so wrangler deploy and wrangler versions upload stop before uploading when an existing Workflow has a different jurisdiction from the configured one. Leaving jurisdiction out keeps the Workflow's existing jurisdiction. @cloudflare/config adds the setting to exports.workflow(), cf migrate carries it over, and wrangler workflows describe prints it. Local development ignores it.

Patch Changes

• #​16388 80a9f96 Thanks @​DevVettel! - Print wrangler auth token --json output regardless of WRANGLER_LOG

  Previously the JSON was written through the normal log channel, so setting WRANGLER_LOG to warn, error or none made the command exit successfully with empty stdout. Tools that parse this output, such as the OpenNext Cloudflare adapter in CI, then failed to find any credentials. The JSON is now always printed, like other --json commands.

• #​16361 2878645 Thanks @​GrosserNL! - Report the R2 bucket location returned by the API when creating a bucket

  wrangler r2 bucket create --location printed the requested location hint even when R2 ignored it. Recreating a deleted bucket name keeps the original location, so the success message could claim a placement the bucket does not have. The command now uses the location from the create response: it mentions the hint only when that location matches, and otherwise reports the location R2 actually applied.

• Updated dependencies [08f22d3, a4eb57d]:

  • miniflare@5.20261019.2-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sciexp-nixbot]

Browser evidence: passed

This pull request changes the docs site's browser evidence.

build 1989 at 6b77106ff9de: 30 expected, 0 unexpected, 0 flaky, 0 skipped.

No failed attempts.

Receipt: receipt.json

No report identical to this one has been published from main in the last 90 days, so it is shown here.

Evidence kept 30 days.

[sciexp-gitea-mq]

❌ Removed from merge queue: Merge conflict in batch (after #3513). Please rebase and re-schedule automerge.