chore(deps): update dependency wrangler to v4.94.0 by renovate[bot] · Pull Request #332 · general-programming/megarepo

renovate · 2026-05-15T09:03:21Z

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	`4.90.1` → `4.94.0`

Release Notes

cloudflare/workers-sdk (wrangler)

`v4.94.0`

Compare Source

Minor Changes

#13897 52e9082 Thanks @dario-piotrowicz! - Add automatic Cloudflare skills installation for AI coding agents

Wrangler now detects AI coding agents and offers to install Cloudflare skill files from the cloudflare/skills GitHub repository. Users are prompted once interactively; subsequent runs skip the prompt. Use --install-skills to install without prompting.
#13989 f598eac Thanks @MattieTK! - Print a QR code alongside the tunnel URL when sharing via Cloudflare Tunnel

When a tunnel is started (via wrangler dev --tunnel or the Vite plugin with tunnel: true), a scannable QR code is now printed to the terminal beneath the tunnel URL. This makes it easy to open the tunnel on a mobile device without manually copying the URL.

The QR code uses Unicode block characters for a compact representation and is generated best-effort -- if generation fails for any reason, the tunnel URL is still displayed as before.
#13467 3a1fbed Thanks @deloreyj! - Add schedule property to Workflow bindings for cron-based triggering

Note: This is a configuration-only change. Scheduled triggering of Workflow instances is not yet available — adding schedule to a Workflow binding will not result in scheduled invocations at this time. This change lays the groundwork for an upcoming feature.

Workflow bindings in wrangler.json now accept an optional schedule field that configures one or more cron expressions to automatically trigger new workflow instances on a schedule.
```
// wrangler.json
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "schedule": "0 9 * * 1"
    }
  ]
}
```
Multiple schedules can be provided as an array:
```
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "schedule": ["0 9 * * 1", "0 17 * * 5"]
    }
  ]
}
```
The schedule is sent to the Workflows control plane on wrangler deploy. Configuring schedule on a workflow binding that references an external script_name is an error — the schedule must be configured on the worker that defines the workflow.

Patch Changes

#13993 0733688 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260520.1 1.20260521.1
#14008 fc1f7b9 Thanks @petebacondarwin! - Fix Access Service Token authentication for applications that only allow service tokens

When using remote bindings against a Worker behind a Cloudflare Access application configured to only allow Service Auth tokens (no interactive user authentication), Wrangler previously ignored the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables and the request would fail with a 403.

This happened because Wrangler detects Access by looking for a 302 redirect to cloudflareaccess.com. A service-auth-only Access application has no interactive login path, so it responds with a hard 403 instead of redirecting. Wrangler concluded the domain was not behind Access and skipped attaching the service token headers entirely.

The env-var check now runs before the Access detection step, so the configured service token credentials are always used when present.
#12277 8c569c6 Thanks @penalosa! - Include column names in D1 SQL export INSERT statements

D1 SQL exports now include column names in INSERT statements (e.g., INSERT INTO "table" ("col1","col2") VALUES(...)). This ensures that exported SQL can be successfully imported even when the target table has columns in a different order than the original, which commonly occurs during iterative development when schemas evolve.
Updated dependencies [0733688, 30657e1]:
- miniflare@4.20260521.0

`v4.93.1`

Compare Source

Patch Changes

#13978 fa1f61f Thanks @sassyconsultingllc! - Bump ws from 8.18.0 to 8.20.1 to address GHSA-58qx-3vcg-4xpx

GHSA-58qx-3vcg-4xpx / CVE-2026-45736 reports an uninitialized-memory disclosure in ws@<8.20.1 when a TypedArray is passed as the reason argument to WebSocket.close(). The fix shipped in ws@8.20.1 on 2026-05-12. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.
#13977 2679e05 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260518.1 1.20260519.1
#13984 7e40d98 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260519.1 1.20260520.1
#13963 adc9221 Thanks @gabivlj! - Preserve sibling container image tags during local dev cleanup

Wrangler now keeps other cloudflare-dev image tags from the same dev session when multiple containers share a Dockerfile. Previously, duplicate-image cleanup could remove earlier container tags if Docker BuildKit produced the same image ID for each build.
#13839 735852d Thanks @matingathani! - fix: show actionable hint when /memberships returns a bad-credentials error (code 9106)

Previously, wrangler threw a raw Cloudflare API error ("Missing X-Auth-Key, X-Auth-Email or Authorization headers") with no guidance. Now it emits a UserError explaining that an environment variable such as CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL may be set to an invalid value, and suggests running wrangler logout / wrangler login to re-authenticate.
#13912 d803737 Thanks @petebacondarwin! - Fix /cdn-cgi/* host validation incorrectly accepting subdomains of exact configured routes

Miniflare's /cdn-cgi/* host/origin validator was treating exact configured routes the same as wildcard configured routes, so a request whose Host or Origin hostname was a subdomain of an exact route (e.g. sub.my-custom-site.com for a my-custom-site.com/* route) was incorrectly accepted. Exact configured routes and the configured upstream hostname are now required to match the request hostname exactly. Subdomain matching is only applied to wildcard routes such as *.example.com/*. Localhost hostnames continue to be allowed as before.

This affects wrangler dev and local development through @cloudflare/vite-plugin, both of which use Miniflare under the hood.
#13919 c7eab7f Thanks @petebacondarwin! - Fix the outbound CF-Worker header reflecting the route pattern hostname instead of the parent zone, and falling back to <worker-name>.example.com under vite dev, vitest-pool-workers, and getPlatformProxy

Two related issues affected the CF-Worker header on outbound subrequests in local development:
1. Under @cloudflare/vite-plugin, @cloudflare/vitest-pool-workers, and getPlatformProxy, the header fell back to <worker-name>.example.com even when routes were configured, because unstable_getMiniflareWorkerOptions and the equivalent getPlatformProxy worker-options path did not propagate a zone value to Miniflare. This broke local development against services that reject unknown CF-Worker hosts (for example, Apple WeatherKit returns 403 Forbidden).
2. Across the above paths and wrangler dev --local, when a route used the zone_name field (for example { pattern: "foo.example.com/*", zone_name: "example.com" }), the header was set to the pattern's hostname (foo.example.com) rather than the zone name (example.com). Production sets CF-Worker to the zone name that owns the Worker, so this was inconsistent with deployed behaviour.
Both bugs are fixed: the new unstable_getMiniflareWorkerOptions / getPlatformProxy path now propagates a zone derived from the first configured route, and all four local-dev paths now prefer a route's explicit zone_name over the pattern hostname when computing that zone. When zone_name isn't set, the existing best-effort behaviour is preserved — for wrangler dev this means dev.host is still honoured as a local override and the pattern hostname is used as a final fallback. Resolving the parent zone for zone_id-only, custom_domain, or plain-string routes would require an API lookup, so locally we still approximate it with the pattern hostname.

Note: dev.host is intentionally not consulted by the unstable_getMiniflareWorkerOptions / getPlatformProxy paths — the dev config block is specific to wrangler dev.
#13990 e04e180 Thanks @petebacondarwin! - Improve the log message shown when an asset upload attempt fails and is retried

The retry message now reports which attempt is being made (e.g. Asset upload failed. Retrying... 1 of 5 attempts.), making it easier to gauge how close Wrangler is to exhausting its retry budget. The raw error object is no longer appended to this user-facing message; it is instead logged at debug level (visible via WRANGLER_LOG=debug).
#13954 62abf97 Thanks @petebacondarwin! - Read the on-disk OAuth state lazily so CLOUDFLARE_API_TOKEN from .env takes priority correctly

Wrangler previously read its OAuth state from the user auth config file (for example ~/.config/.wrangler/config/default.toml) eagerly at module-import time. That happens before .env files are loaded, so the in-memory state would always hold the OAuth tokens even when the user only wanted to authenticate via CLOUDFLARE_API_TOKEN. If that stored OAuth token happened to be expired, Wrangler would try to refresh it (and fail), aborting the command with Failed to fetch auth token: 400 Bad Request and Not logged in. — even though a valid API token was in scope.

Wrangler now reads the auth config file on demand, after .env has been loaded. When CLOUDFLARE_API_TOKEN (or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL) is present, the OAuth state on disk is no longer consulted, the OAuth refresh endpoint is no longer called, and the env-based token is used directly. Sibling-process refresh-token rotation is also handled naturally because every check reads the current file contents.

Internally, the exported reinitialiseAuthTokens() function is removed — there is no module-level OAuth cache left to invalidate.

Fixes #13744.
#13951 e349fe0 Thanks @sejoker! - Enforce minimum 60 second interval for R2 Data Catalog sinks

R2 Data Catalog sinks now require a minimum --roll-interval of 60 seconds to prevent compaction issues in the R2 Data Catalog. This validation is applied when creating sinks via wrangler pipelines sinks create with type r2-data-catalog, and during the interactive wrangler pipelines setup flow.

Regular R2 sinks are not affected and can still use intervals as low as 10 seconds.
#13959 da0fa8c Thanks @dmmulroy! - Recognize Artifacts repositories that are still being created

Wrangler's Artifacts repo status type now accepts the creating lifecycle state alongside existing in-progress statuses.
#13964 a5c9365 Thanks @danielrs! - Use dedicated API endpoint for wrangler secret bulk

wrangler secret bulk now uses a more efficient, dedicated API endpoint. This reduces the operation from 2 API calls to 1 and eliminates the risk of accidentally affecting non-secret bindings.
Updated dependencies [fa1f61f, 2679e05, 7e40d98, d803737, 59cd880, e8c2031]:
- miniflare@4.20260520.0

`v4.93.0`

Compare Source

Minor Changes

#13901 aac7ca0 Thanks @bghira! - Add wrangler ai models schema command for fetching model schemas

You can now run wrangler ai models schema <model> to fetch the input and output schema for a Workers AI model from the public model catalog schema endpoint.
#12656 ae047ee Thanks @mikenomitch! - Add --containers-rollout=none

This allows you to skip deploying a container. This is useful if you know that your container is not going to be updated or you don't have Docker locally, but still want to make changes to your Worker.
#13901 aac7ca0 Thanks @bghira! - Add wrangler ai models list command for querying the Workers AI model catalog

wrangler ai models list accepts --search, --task, --author, --source, and --hide-experimental, matching the public model catalog search endpoint.

Patch Changes

#13948 b25dc0d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260515.1 1.20260518.1
#13882 a4f22bc Thanks @matingathani! - Throw a clear error when a D1 migration is cancelled instead of silently returning
#13950 f78d435 Thanks @dario-piotrowicz! - Improve the Docker CLI error message to be more actionable.

Include a link to Docker installation docs, platform-specific instructions for starting the daemon, and guidance for alternative Docker-compatible CLIs.
#11896 c5c9e20 Thanks @staticpayload! - Surface remote proxy session errors

When remote bindings fail to start, include the controller reason and root cause in the error message to make failures like missing cloudflared clearer.
#13932 ebf4b24 Thanks @zebp! - Fix local Workflow startup when compatibility flags include experimental

Miniflare now deduplicates compatibility flags for the internal Workflow engine service. This prevents wrangler dev from failing with Compatibility flag specified multiple times: experimental when the user's Worker already enables that flag.
#13929 895baf5 Thanks @Caio-Nogueira! - Prompt to provision a workers.dev subdomain before deploying Workflows

Wrangler now checks for the account-level workers.dev subdomain when deploying Workflows, even if the Worker is not being published to workers.dev. If the subdomain has not been registered yet, Wrangler prompts to create one before calling the Workflows deploy API so users avoid an opaque server-side deployment failure.
#13930 7bcdf45 Thanks @shiminshen! - Sweep stale .wrangler/tmp/* dirs left behind by abnormal exits

A wrangler dev session creates .wrangler/tmp/bundle-* and .wrangler/tmp/dev-* directories at startup and removes them via a signal-exit hook on graceful shutdown. When the process exited abnormally (SIGKILL, OOM, host crash) those directories were left behind and accumulated across sessions, slowing down dependency-walking tools that follow the bundle-emitted absolute-path imports.

wrangler now sweeps entries in .wrangler/tmp/ older than 24 hours when a new temporary directory is requested, bounding the leak regardless of how prior sessions exited.
Updated dependencies [b25dc0d, ebf4b24, b27eb18]:
- miniflare@4.20260518.0

`v4.92.0`

Compare Source

Minor Changes

#13670 506aa02 Thanks @elithrar! - Add wrangler artifacts commands for managing Artifacts repos and repo tokens.

This adds CLI support for the Artifacts control-plane workflows that were previously only available through the API. You can now list and inspect namespaces, create, list, inspect, and delete repos, and issue repo-scoped tokens when you need to authenticate git access.

The new commands support both human-readable output and --json output so they fit existing Wrangler automation patterns.
#13916 be8a98c Thanks @emily-shen! - Add --keep-vars flag to wrangler versions upload, matching the existing behavior in wrangler deploy. When set, environment variables configured via the dashboard are preserved rather than being deleted before the upload.

Patch Changes

#13926 19ed49a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260511.1 1.20260515.1
#11471 3ff0a50 Thanks @HW13! - Improve wrangler types --env-interface for multi-worker projects.

Custom env interfaces generated by wrangler types no longer expand from Cloudflare.Env, avoiding some unintended type expansion when multiple workers' generated types are used together.
#13910 bf688f7 Thanks @timoconnellaus! - Fix Failed to fetch auth token: 401 Unauthorized from sibling-rotated refresh tokens

refreshToken previously used the refresh token from module-level localState, which is populated once at startup and never re-read. OAuth refresh tokens are single-use, so when a sibling wrangler process (in another repo, another shell, or a parallel script) refreshes first, it rotates the token server-side and writes the new value to the shared config file (~/Library/Preferences/.wrangler/config/default.toml on macOS). The long-lived process — typically wrangler dev — then sends its stale in-memory token on the next refresh and gets 401 Unauthorized from https://dash.cloudflare.com/oauth2/token, falling through to interactive login and timing out unattended.

refreshToken now calls reinitialiseAuthTokens() before exchanging, picking up the latest refresh token written by any sibling process. The previously empty catch {} also now logs the underlying error at debug level so future refresh failures are diagnosable without source-diving.
#13843 2e72c83 Thanks @nzws! - Fix wrangler versions secret put/delete/bulk to preserve the existing version's placement settings

When creating a new version via wrangler versions secret, the previous code only re-emitted a bare { mode: "smart" } placement when the API reported placement_mode === "smart", dropping any other placement entirely. The new version is now created with the placement settings returned by the API, so placement settings survive a secret put/delete/bulk round-trip.
#13908 802eaf4 Thanks @shiminshen! - fix: stop rewriting query strings that happen to contain the request Host

wrangler dev previously rewrote occurrences of the outer host inside request.url's query string. For example, a request to ?echo=https%3A%2F%2Fdevelopment.test%2Fpath with Host: development.test would be seen by the user worker as ?echo=https%3A%2F%2Fproduction.test%2Fpath, silently mutating opaque application data such as redirect_uri values in OAuth flows.

The proxy worker now sets the internal MF-Original-URL header after its blanket host-rewriting pass over request headers, so the URL passed to the user worker preserves the original query string.
#13827 8f5cdb1 Thanks @greyvugrin! - Fix multi-environment warning when CLOUDFLARE_ENV is set

Commands that warn when multiple environments are configured but none is specified (e.g. wrangler deploy, wrangler secret put) were not accounting for the CLOUDFLARE_ENV environment variable when deciding whether to show the warning. This caused a misleading warning to appear even when the target environment was correctly specified via CLOUDFLARE_ENV.
Updated dependencies [19ed49a]:
- miniflare@4.20260515.0

`v4.91.0`

Compare Source

Minor Changes

#13822 c8be316 Thanks @edmundhung! - Add named tunnel support and tunnel shortcuts to wrangler dev

You can now use wrangler dev --tunnel --tunnel-name <name> to start a dev session with an existing named Cloudflare Tunnel, or set --tunnel-name ahead of time and start it later by pressing t to start or close the tunnel. This gives you a stable public hostname for local development instead of the temporary trycloudflare.com URL used by Quick Tunnels.

Patch Changes

#13848 d4794a8 Thanks @MattieTK! - Condense repeated environment configuration warnings

Wrangler now summarises repeated missing vars and define entries in environment configuration warnings. Experimental unsafe warnings are also only emitted once when the field appears at both the top level and in the active environment.
#13894 58b4403 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260508.1 1.20260511.1
#13780 4352f87 Thanks @matingathani! - Normalize legacy instance type aliases (standard → standard-1, dev → lite) to prevent phantom EDIT diffs on every deploy
#13834 a9e6741 Thanks @matingathani! - fix: hotkeys now work with Caps Lock enabled

Wrangler's dev server hotkeys (e.g. b to open browser and x to exit) did not respond when Caps Lock was enabled. These hotkeys now work consistently whether or not Caps Lock is on.
#13750 da664d5 Thanks @matingathani! - fix: automatically delete log files older than 30 days and add WRANGLER_WRITE_LOGS=false to disable disk logging

Wrangler previously accumulated log files in ~/.wrangler/logs/ indefinitely, causing some users to accumulate gigabytes of logs over time.

Log files older than 30 days are now automatically cleaned up on the first log write. Disk logging can be disabled entirely by setting WRANGLER_WRITE_LOGS=false.
#13914 bdc398c Thanks @Maximo-Guk! - preserve native shape of non-string vars in worker previews

wrangler preview previously coerced every non-string entry in previews.vars (arrays, objects, numbers, booleans) into a plain_text binding via JSON.stringify, so at runtime the worker saw a literal string instead of the value declared in wrangler.jsonc. wrangler deploy already serializes non-string vars as json bindings so the Workers runtime parses them back into native JS values; previews now match.

Before:
```
// wrangler.jsonc — previews.vars
{ "ALLOWLIST": ["a@example.com", "b@example.com"] }
// runtime
typeof env.ALLOWLIST === "string" // true (was '["a@example.com","b@example.com"]')
```
After:
```
typeof env.ALLOWLIST === "object"; // Array.isArray(env.ALLOWLIST) === true
```
#13778 1420f10 Thanks @maxwellpeterson! - Propagate unsafe.bindings and service binding cross_account_grant to worker previews

Worker previews now propagate unsafe.bindings declared on the previews config block to the deployment metadata, mirroring the deploy-time behavior. Without this, internal binding shapes that wrangler doesn't yet model (notably service bindings carrying cross_account_grant) were silently dropped on previews while working fine on regular deploys. The same change wires through cross_account_grant on typed services bindings.
Updated dependencies [58b4403, f781a2b]:
- miniflare@4.20260511.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch from 0ed45a6 to 0e3cafa Compare May 15, 2026 14:09

renovate Bot changed the title ~~chore(deps): update dependency wrangler to v4.91.0~~ chore(deps): update dependency wrangler to v4.92.0 May 15, 2026

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch 2 times, most recently from b8a966f to 5bc890f Compare May 19, 2026 11:37

renovate Bot changed the title ~~chore(deps): update dependency wrangler to v4.92.0~~ chore(deps): update dependency wrangler to v4.93.0 May 19, 2026

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch from 5bc890f to 58c615f Compare May 21, 2026 13:38

renovate Bot changed the title ~~chore(deps): update dependency wrangler to v4.93.0~~ chore(deps): update dependency wrangler to v4.93.1 May 21, 2026

chore(deps): update dependency wrangler to v4.94.0

8ccaced

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch from 58c615f to 8ccaced Compare May 22, 2026 15:28

renovate Bot changed the title ~~chore(deps): update dependency wrangler to v4.93.1~~ chore(deps): update dependency wrangler to v4.94.0 May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency wrangler to v4.94.0#332

chore(deps): update dependency wrangler to v4.94.0#332
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/wrangler-4.x-lockfile

renovate Bot commented May 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.94.0

Minor Changes

Patch Changes

v4.93.1

Patch Changes

v4.93.0

Minor Changes

Patch Changes

v4.92.0

Minor Changes

Patch Changes

v4.91.0

Minor Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 15, 2026 •

edited

Loading

`v4.94.0`

`v4.93.1`

`v4.93.0`

`v4.92.0`

`v4.91.0`