chore(deps): update dependency wrangler to v4 - #555

v4.136.3

Compare Source

Patch Changes

• #​15662 59267fc Thanks @​oddharsh! - Update smol-toml to 1.8.0

  This updates the bundled TOML parser that reads wrangler.toml to a version that addresses two advisories against 1.5.2: GHSA-7w5x-hrqm-74c2 (a value followed by a comment with no trailing newline, such as a=[1 #, put the parser in an infinite loop) and GHSA-v3rj-xjv7-4jmq (thousands of consecutive comment lines overflowed the stack). On the old version, wrangler deploy against a wrangler.toml ending in a=[1 # never returned; it now fails with Invalid TOML document: cannot find end of structure.

• #​15760 6906bf0 Thanks @​yomna-shousha! - Warn when wrangler preview returns only non-custom-domain URLs even though custom-domain Preview URLs are configured.

• #​15761 354ebdb Thanks @​podonnell-dev! - Fix Preview output artifacts to always include the resolved parent Worker name

  Preview artifacts now use Wrangler's resolved Worker name instead of relying on the Preview API response to include it.

• Updated dependencies []:

  • miniflare@5.20260921.0-alpha

v4.136.2

Compare Source

Patch Changes

• #​15762 ad20547 Thanks @​podonnell-dev! - Fix wrangler types generating runtime headers with trailing whitespace

  Runtime type headers without compatibility flags now end at the compatibility date, keeping generated types reproducible when tools remove trailing whitespace.

• #​15703 02c1d83 Thanks @​KianNH! - Improve Container image listing and deletion

  List all image pages using read-only credentials, validate tags before deletion, and report successful deletion when the garbage-collection request fails.

• #​15700 275184d Thanks @​KianNH! - Fix Container SSH connection setup and shutdown

  Prevent SSH connections from stalling during setup and ensure proxy processes exit when sessions close.

• #​15759 bd59eca Thanks @​petebacondarwin! - Show valid sha256-prefixed tags in Container image listings

  Container image listings now distinguish valid OCI tags such as sha256-release from synthetic digest entries such as sha256:<digest>.

• Updated dependencies []:

  • miniflare@5.20260921.0-alpha

v4.136.1

Compare Source

Patch Changes

• #​15744 0ed4c54 Thanks @​podonnell-dev! - Improve wrangler preview onboarding guidance

  Wrangler now displays placeholder replacement guidance directly beneath the suggested Preview configuration instead of as a separate warning. JSON output continues to include the guidance in its structured onboarding messages.

• #​15678 703922d Thanks @​christhorwarth! - Read workers.dev URLs from the Worker resource during deployment

  Wrangler no longer requires account-level subdomain permission to display Worker and version-preview URLs. It now uses the Worker-scoped URL fields while preserving account-level registration for accounts without a workers.dev subdomain.

• Updated dependencies [14d946d]:

  • @​cloudflare/unenv-preset@2.16.2

v4.136.0

Compare Source

Minor Changes

• #​15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

  The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

• #​15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

  Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export default defineConfig({
  	accountId: "...",
  	complianceRegion: "public",
  	worker: {
  		name: "my-worker",
  		compatibilityDate: "2026-09-18",
  		entrypoint,
  	},
  });

• #​15720 35668d7 Thanks @​alexkli! - Add experimental --zone and --zone-id flags to wrangler deploy and wrangler triggers deploy to attach a zone to routes passed via --route

  Routes passed on the command line were always sent to the Cloudflare API as bare patterns. Zones with an SSL for SaaS entitlement reject such routes with error 10082 ("When using wildcard host ssl for saas entitlement you must specify the zone per route using zone_id or zone_name"), and until now the only way to set a zone was in the config file, which --route overrides.

  The new flags are experimental and must be enabled with --experimental-route-zones (alias --x-route-zones). Pass a single zone to apply it to all routes, or one zone per route in the same order as the --route flags:

  wrangler deploy --x-route-zones --route "app.example.com/*" --route "api.example.com/*" --zone example.com

  wrangler deploy --x-route-zones --route "a.example.com/*" --zone example.com --route "b.example.net/*" --zone example.net

  --zone sets zone_name and --zone-id sets zone_id on each route. The two flags cannot be combined, and passing more than one zone requires exactly one per --route. Routes without zone flags behave exactly as before.

• #​15699 45b3b81 Thanks @​skepticfx! - Remove the experimental Container image environment binding

  Durable Object-managed Containers now use ctx.container.images without Wrangler generating env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Update code using the experimental environment binding to read ctx.container.images and regenerate your Worker types.

  Version deployments identify managed applications from native named images, and --containers-rollout=none preserves native Container metadata. Containers without named images must first be provisioned with wrangler deploy; versions upload verifies that their applications already exist. The old binding is no longer read or reserved, including on previously uploaded versions. keep_vars retains existing variables as usual; redeploy without it to remove an existing experimental binding.

• #​15702 8235e6a Thanks @​podonnell-dev! - Return structured configuration errors from wrangler preview --json

  When a Worker is missing its Preview configuration, JSON mode now returns an error, a suggested_config patch, and any associated onboarding messages without interactive output or terminal formatting. This changes the private-beta Preview command to make automated onboarding reliable.

• #​15577 731a2ee Thanks @​sdnts! - Add support for jurisdictions to Queues subcommands

Patch Changes

• #​15711 91e2f86 Thanks @​ghostwriternr! - Allow local Container images without exposed ports

  Wrangler and the Cloudflare Vite plugin no longer reject images that omit Docker EXPOSE metadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port.

• #​15740 c5913a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260918.1	^5.20260921.1
  workerd	1.20260918.1	1.20260921.1

• #​15471 0751490 Thanks @​edmundhung! - Fix cf builds for static projects that serve assets from the project root

  The experimental Build Output path now omits the reserved .cloudflare directory when the project root is used for static assets. This prevents recursive output copying in Wrangler while preserving the existing behaviour for other asset directories.

• #​15440 43b1f85 Thanks @​HuzaifaAbdulRehman! - Rebase absolute non-JavaScript module specifiers when preserve_file_names is enabled

  With preserve_file_names set, a non-JS module imported by an absolute path kept that path as its module name. The build machine's filesystem layout ended up inside the deployed Worker, and the module was never written to --outdir. A local dry run reported success while the upload failed server-side with error code 10021. Tooling that rewrites externals to absolute paths hits this, which is how it was found in @opennextjs/cloudflare with WASM imports.

  Absolute specifiers are now rebased to ./<basename>, which is what the hashed branch of the same code already does minus the hash prefix. Relative specifiers keep the behaviour they had.

• Updated dependencies [c5913a6, 3c75cad]:

  • miniflare@5.20260921.0-alpha

v4.135.0

Compare Source

Minor Changes

• #​15609 1f070c8 Thanks @​emily-shen! - Build Containers when emitting experimental Build Output

  Wrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under .cloudflare/output/v0/containers with local image references, while existing registry references pass through unchanged.

• #​15329 c4c9b75 Thanks @​akshitsinha! - Evaluate Flagship flags locally during development

  Flagship bindings now use the local Miniflare store by default in Wrangler and the Vite plugin, keeping development offline and isolated from production flags. Set remote: true on a binding to continue using its remote app.

  Use wrangler flagship flags pull <APP_ID> to seed the store from a remote app. Flag management commands also accept --local to read and update the local store directly.

• #​15701 643e5cc Thanks @​WillTaylorDev! - Pass Preview intent to defineWorker and upload its resolved configuration

  Preview builds now evaluate programmatic Worker configuration with ctx.isPreview set to true and record that intent in Build Output. The shared Preview uploader deploys the resolved bindings and settings while preserving configured Preview base values when it creates a Preview.

Patch Changes

• #​15705 a0485d5 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260917.1	^5.20260918.1
  workerd	1.20260917.1	1.20260918.1

• #​15587 629ddef Thanks @​Kuldeeep18! - Fix duration calculation for running workflow instances, steps, and attempts in wrangler workflows instances describe

  wrangler workflows instances describe previously distorted the elapsed duration of in-progress instances, steps, and attempts across non-UTC timezones by stripping " GMT" from toUTCString(), causing new Date(...) to parse the timestamp in the local client timezone. The duration is now correctly computed against the current time.

• Updated dependencies [a0485d5]:

  • miniflare@5.20260918.0-alpha

v4.134.0

Compare Source

Minor Changes

• #​15684 6874aa9 Thanks @​Ankcorn! - Add support for configuring real-time Issues with observability.issues.enabled

  Wrangler now validates and uploads the Issues setting alongside the existing logs and traces observability options. The experimental configuration format supports the equivalent observability.issues.enabled option.

• #​15681 d96b319 Thanks @​podonnell-dev! - Mark wrangler preview commands as open beta

  Wrangler now labels Preview commands as open beta in help output and command warnings, matching the feature's public availability.

• #​15673 2b39fc2 Thanks @​ghostwriternr! - Support explicit named Container image selection in Wrangler local development

  Wrangler builds or pulls named images configured through Wrangler JSON or TOML and exposes their local tags through ctx.container.images. Pass one of those references to ctx.container.start({ image }) to select the image.

  This extends the experimental Durable Object-managed Containers interface. Named images are opt-in and do not become the Container's default image. A Container without a default image must supply an image or full Container snapshot when starting.

Patch Changes

• #​15689 876eea1 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260916.1	^5.20260917.1
  workerd	1.20260916.1	1.20260917.1

• Updated dependencies [2298cf1, 876eea1]:

  • miniflare@5.20260917.0-alpha

v4.133.0

Compare Source

Minor Changes

• #​15600 bac0c6a Thanks @​podonnell-dev! - Add placement configuration for Previews

  You can now configure placement in the previews block. Preview-specific placement overrides the top-level placement configuration for Preview Defaults and deployments.

• #​15600 bac0c6a Thanks @​podonnell-dev! - Improve onboarding guidance for Previews (when previews block is missing from configuration file)

  When a local previews block is absent, Wrangler writes the Preview Base configuration to the local config file. When no Preview Base configuration exists, Wrangler prints a placeholder configuration derived from production bindings and warns against reusing production binding configuration.

Patch Changes

• #​15483 71b6f10 Thanks @​tpmmorris! - Align Local Explorer Workflow instance status requests with production

  Local Explorer and Wrangler local mode now use the production-compatible status request field for pausing, resuming, restarting, and terminating Workflow instances. Direct Local Explorer API consumers must replace the previous action field with status.

  Successful Local Explorer status updates now return the production-compatible instance status and response timestamp instead of the local-only result.success acknowledgement.

• #​15665 ad23e6e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260915.1	^5.20260916.1
  workerd	1.20260915.1	1.20260916.1

• #​15655 be2437a Thanks @​WillTaylorDev! - Send exports with Worker Preview deployments

  wrangler preview dropped the exports block from deployment requests. Durable Objects reached through ctx.exports had no Preview namespace, and cache settings for each entrypoint were lost too.

• Updated dependencies [71b6f10, ad23e6e, 6f3d7b5]:

  • miniflare@5.20260916.0-alpha

v4.132.0

Compare Source

Minor Changes

• #​14587 76c0ce6 Thanks @​MattieTK! - Categorise the positional path argument to wrangler deploy and wrangler versions upload in command telemetry

  Command telemetry now records a coarse category for the entry-point/assets positional (wrangler deploy <path>) under sanitizedArgs.path, so we can understand whether people pass a file, a directory, or a relational reference such as . or ../example. The possible values are file, directory, current-dir, parent-relative, and not-found, or null when no positional is provided. The raw path is never sent — only the category.

• #​15597 a83d7ac Thanks @​skepticfx! - Configure application-wide logs for experimental Durable Object-managed Containers

  Set containers[].observability.enabled or containers[].observability.logs.enabled when using scheduling_policy: "durable_object". Normal deployments create missing applications and update explicitly configured log settings without a Container rollout. Omitted settings preserve the application configuration; root Worker observability is not inherited for this policy.

  Version uploads may initialize missing applications but preserve existing settings. Deploying or rolling back Worker versions also preserves existing application settings, and --containers-rollout=none skips their updates.

• #​15597 a83d7ac Thanks @​skepticfx! - Support per-image build options for experimental Durable Object-managed Containers

  Set build_context and build_vars alongside dockerfile in a Container's named images entries. Context paths resolve relative to the Wrangler configuration file and default to the Dockerfile's directory. Build variables are passed as Docker build arguments. Entries using the same Dockerfile with different contexts or variables are built separately.

  {
    "containers": [
      {
        "class_name": "Sandbox",
        "scheduling_policy": "durable_object",
        "images": {
          "app": {
            "dockerfile": "./docker/Dockerfile",
            "build_context": ".",
            "build_vars": { "APP_ENV": "production" }
          }
        }
      }
    ]
  }

• #​15638 fa79b26 Thanks @​G4brym! - Support AI Search bindings in Worker Previews

  wrangler preview now accepts ai_search and ai_search_namespaces entries in the previews block and includes them in Preview deployment bindings. This lets Workers that use AI Search instance or namespace bindings attach existing resources to Preview deployments, including preview-specific instance or namespace names.

  These bindings are non-inheritable: declare them explicitly under previews. They attach to existing AI Search resources; preview does not provision new isolated instances or namespaces.

• #​15256 16d1310 Thanks @​theoephraim! - [private beta]: Add --secrets-file and --var flags to wrangler preview

  Like wrangler deploy and wrangler versions upload, wrangler preview now accepts a --secrets-file flag pointing to a JSON or .env format file, and --var KEY:VALUE pairs that are injected into the Preview deployment as plain text variables. CLI vars override same-named vars from the previews section of your config file, and secrets from the file take precedence over both:

  wrangler preview --secrets-file .env.preview --var API_URL:https://api.example.com

• #​15453 ca71205 Thanks @​G4brym! - Remove the gated Web Search binding and Wrangler command

  The unreleased search binding and its experimental command have been removed from Wrangler, Miniflare, and configuration APIs.

• #​15597 a83d7ac Thanks @​skepticfx! - Allow experimental Durable Object-managed Containers to link by name through exports

  Containers using scheduling_policy: "durable_object" can now specify name and link from exports.<Class>.container without repeating class_name. Deploy and version upload resolve that link for image preparation, Worker metadata, and Container application creation.

Patch Changes

• #​14775 1be7b97 Thanks @​dario-piotrowicz! - Sync Local Explorer endpoint lists across agent hints

  The Local Explorer endpoint list is now consistent across the three places it appears: the AGENTS.md template in create-cloudflare, the runtime agent hint in wrangler dev, and the Vite plugin agent hint. All three now include the observability/clear endpoint, use the canonical /cdn-cgi/local/explorer path, and have cross-reference comments pointing to each other.

• #​15409 b149147 Thanks @​tpmmorris! - Fix per-query overrides for wrangler ai-search search

  --score-threshold, --max-num-results, --filter, and --reranking are now sent using the AI Search request schema, so the service applies them to searches instead of ignoring them.

• #​15633 7db596c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260911.1	^5.20260915.1
  workerd	1.20260911.1	1.20260915.1

• #​14906 a0856da Thanks @​exKAZUu! - Surface the original error message, name and stack when the dev server reports an internal error

  Previously wrangler dev could exit with an empty ✘ [ERROR] log that gave no indication of what went wrong (e.g. Network connection lost., see #​14641). These errors now include their original message, name and stack, so the failure is actually diagnosable.

• #​15179 cb0955f Thanks @​rioaguspermana! - Treat 502, 503, and 504 as gateway errors during asset upload retries

  Pages and Workers asset uploads now retry more patiently when the Cloudflare API responds with a 502, 503 or 504 gateway error, reducing concurrency and waiting longer between attempts instead of failing the deploy quickly.

• #​15399 982b806 Thanks @​tpmmorris! - Improve over-limit run_worker_first errors when duplicate rules are present

  The error now reports distinct and duplicate-entry counts and lists duplicated rules, making it clear when removing redundant entries can bring the configuration within the limit.

  Too many `run_worker_first` rules were provided; 105 rules provided (99 distinct, 6 duplicate entries) exceeds max of 100. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your `run_worker_first` configuration.
  
  The duplicated rules found are:
  - "/rule/0"
  - "/rule/1"
  - "/rule/2"
  - "/rule/3"
  - "/rule/4"
  ...and 1 more duplicated rule.
  

• #​12369 ffabe74 Thanks @​43081j! - Replace execa with tinyexec for running subprocesses, shrinking the bundled Wrangler output.

• #​15633 7db596c Thanks @​dependabot! - Preserve service-worker middleware error propagation with spec-compliant event dispatch

  Wrangler's synthetic service-worker events now propagate listener exceptions to middleware without changing the behavior of user-created EventTarget instances.

• #​15400 e03822a Thanks @​james-elicx! - Reduce the size of Wrangler's published package

  Exclude test-only, build-only, and obsolete template files from the npm package while retaining all runtime templates.

• #​15631 c4a6279 Thanks @​petebacondarwin! - Restore static asset upload concurrency after gateway errors

  Static asset uploads previously remained at concurrency one for the rest of the deployment after any 524 response, which could make large deployments exceed the upload session lifetime. Successful uploads now restore the session's original concurrency gradually while retaining gateway throttling. Requests that were already in flight when throttling began do not restore capacity, so a burst of stale successes cannot immediately undo backpressure.

• Updated dependencies [7db596c, e35c4a1, d3565a5, ca71205, 1015cfb, 982b806, 641df47]:

  • miniflare@5.20260915.0-alpha

v4.131.2

Compare Source

Patch Changes

• Updated dependencies [8997652]:
  • miniflare@5.20260911.1-alpha

v4.131.1

Compare Source

Patch Changes

• #​15592 945aaa3 Thanks @​WillTaylorDev! - Add a provisioning delay note when custom domain Preview URLs change

  Wrangler now explains that DNS and TLS certificate provisioning may continue after a deploy adds a custom domain or enables its Preview URLs. Stable redeploys don't repeat the note.

  This assumes that a request which matches the stored custom domain state doesn't restart provisioning. The client infers this from the API changeset and current domain record because this repository can't verify the backend behavior.

• #​15592 945aaa3 Thanks @​WillTaylorDev! - Clarify production status labels for custom domain routes

  Wrangler now prefixes explicit custom domain production states with production: so they match Preview labels. The updated labels appear in deployed trigger output and WRANGLER_OUTPUT_FILE_PATH.

• #​15602 47d906f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260910.1	^5.20260911.1
  workerd	1.20260910.1	1.20260911.1

• #​15592 945aaa3 Thanks @​WillTaylorDev! - Avoid replacement prompts for custom domains already on the Worker

  Wrangler now updates Preview settings without asking to replace a custom domain when that domain already belongs to the deployed Worker. It still asks before replacing domains attached to another Worker.

• #​15592 945aaa3 Thanks @​WillTaylorDev! - Explain how to enable Preview URLs when a Preview deployment has none

  wrangler preview now shows URL shapes and configuration snippets for Workers.dev and custom domains. The custom domain snippet preserves every configured route, and the guidance distinguishes missing settings from disabled ones.

  This changes a private beta feature. The warning also makes clear that wrangler deploy publishes code from the current checkout.

• Updated dependencies [47d906f, c2699bf]:

  • miniflare@5.20260911.0-alpha

v4.131.0

Compare Source

Minor Changes

• #​15480 36aed7f Thanks @​skepticfx! - Add Durable Object-managed Containers to top-level container configuration

  Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.

  Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.

  Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.

  With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.

  versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.

  EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.

• #​15493 493e635 Thanks @​GregBrimble! - Remove wrangler preview settings commands

  The private-beta wrangler preview settings and wrangler preview settings update commands are no longer available.

Patch Changes

• #​15411 0b43395 Thanks @​xgame92! - Fail wrangler versions upload early when a Worker has a pending Durable Object migration

  Wrangler now directs users to run wrangler deploy to apply the migration instead of sending a version upload request that the API will reject.

• #​15518 9d75006 Thanks @​taylorlee! - Detect named-only module Worker entrypoints correctly

  Wrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy addEventListener registration identifies Service Worker format.

• #​15581 b605aa6 Thanks @​MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commands

  The legacy forced result counted every agent-driven Pages command using --force, including commands that could never have been delegated. Wrangler now emits eligible_forced only when --force prevents an otherwise eligible delegation, and records other agent commands as ineligible with a bounded reason and whether force was used.

• #​15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #​15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #​15554 bff525d Thanks @​XiaoZ-0218! - Add the missing transferred_classes migration to the config schema

  DurableObjectMigration described new_classes, new_sqlite_classes, renamed_classes and deleted_classes, but not transferred_classes. normalizeAndValidateConfig has always validated that key, and the deploy path forwards it to the API along with the rest of the step, so Transfer migrations worked — but config-schema.json is generated from the type, so an editor resolving $schema reported a valid, documented migration as an unknown key.

  Adding the field to the type puts it in the generated schema. No runtime change.

• #​15584 96688b3 Thanks @​Svector-anu! - Bump shell-quote to 1.9.0+ to pick up two disclosed advisories

  shell-quote@1.8.1 is affected by a ReDoS in parse() (CVE-2026-13311 / GHSA-395f-4hp3-45gv — an unauthenticated attacker who can feed a string into parse() can block the event loop for tens of seconds with plain space-separated input, no shell metacharacters required) and by an object-token escaping bug in quote() (CVE-2026-9277 / GHSA-w7jw-789q-3m8p), both fixed upstream in 1.9.0. Wrangler's parse() wrapper (src/utils/shell-quote.ts) is reachable from pages dev/init command-line parsing, so the ReDoS applies; the quote() call site only ever passes string arguments, so the object-token issue was not reachable here, but there is no reason to stay on a vulnerable range once a patch exists.

• #​15563 ed5797a Thanks @​Bortlesboat! - Encode filenames in Pages HTML redirects

  Fix wrangler pages dev returning a 502 response when redirecting HTML paths containing Unicode characters. Keep reserved characters in filenames encoded in the redirect destination and preserve the request query string.

• #​14889 128235a Thanks @​chinesepowered! - Fix wrangler types --strict-vars=false emitting invalid TypeScript for an empty array var

  A var whose value was an empty array produced ()[], which is a syntax error. Because this lands in the generated worker-configuration.d.ts, it did not just break that one line — the whole file failed to parse, so no binding types resolved at all. An empty array now generates unknown[].

• #​15494 f8aea7e Thanks @​GregBrimble! - Use previews_base_config for Preview configuration

  Preview commands now read the Worker Previews Base configuration from the previews_base_config API field.

• #​15569 24ef86b Thanks @​RealBhupesh! - Fix wrangler workflows instances describe crashing on dynamic retry delays

  The Workflows API serializes function retry delays as "[dynamic]". The describe command previously parsed that as a duration, produced an Invalid Date, and threw RangeError: Invalid time value before printing remaining steps. It now renders unknown (dynamic delay) and also tolerates attempts whose end timestamp is missing.

• Updated dependencies [f45b596, f69f95a, a549e58, dbb3ff4, fea3cd0, 6bd7b6c, 15cd6e1, be1caec, dbc9506]:

  • miniflare@5.20260910.0-alpha

v4.130.0

Compare Source

Minor Changes

• #​14372 dbf6aad Thanks @​ichernetsky-cf! - Add containers[].observability support to wrangler deploy

  Wrangler now accepts container-specific observability settings via containers[].observability, including application-level targeting fields for Containers. Root observability continues to work as a fallback when a container does not define its own observability settings.

  wrangler deploy now preserves legacy configuration.observability for existing container apps that still use rollout-based observability, while using top-level application observability for new or already-migrated apps.

  Existing application diffs are now normalized even when stored resource limits cannot be mapped to a named instance type. API-only metadata and equivalent managed-registry image names no longer appear as edits or affect whether deployment changes require a rollout.

• #​15004 e20df20 Thanks [@​MattieTK](https://redirect.git

❗ Important

✂ PR body was truncated to here.