chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-wrangler-vulnerability
Open

chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-wrangler-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Jan 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence

Wrangler affected by OS Command Injection in wrangler pages deploy

CVE-2026-0933 / GHSA-36p8-mvp6-cv38

More information

Details

Summary

A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.

Root cause

The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.

Impact

This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:

  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.

Mitigation

  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.

Credits

Disclosed responsibly by kny4hacker.

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

cloudflare/workers-sdk (wrangler)

v4.59.1

Compare Source

Patch Changes

  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy

    Pass user provided values from --commit-hash safely to underlying git command.

v4.59.0

Compare Source

Minor Changes

  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command

    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.

    When types are up-to-date, the command exits with code 0:

    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.

    When types are out-of-date, the command exits with code 1:

    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.

    You can also use it with a custom output path:

    $ wrangler types ./custom-types.d.ts --check

  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments

    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    basis. The default limit remains at 20,000 assets.

  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    If left unset, we will default to tiers: [1, 2].
    Note that constraints is an experimental feature.

Patch Changes

  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events

    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.

    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.

  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port

    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.

    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.

  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    DependencyFromTo
    workerd1.20260107.11.20260108.0

  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    DependencyFromTo
    workerd1.20260108.01.20260109.0

  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    DependencyFromTo
    workerd1.20260109.01.20260111.0

  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku

    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.

    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.

  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config

    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.

  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:

v4.58.0

Compare Source

Minor Changes

  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu

    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:

    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.

Patch Changes

  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    DependencyFromTo
    workerd1.20260103.01.20260107.1

  • Updated dependencies [97e67b9]:

    • miniflare@​4.20260107.0

v4.57.0

Compare Source

Minor Changes

  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.

    You can now retrieve your authentication token for use with other tools and scripts:

    wrangler auth token

    The command returns whichever authentication method is currently configured:

    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable

    Use --json to get structured output including the token type, which also supports API key/email authentication:

    wrangler auth token --json

    This is similar to gh auth token in the GitHub CLI.

  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler

    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:

    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."

    This allows you to specify CA public keys that can be used to verify SSH user certificates.

  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field

  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev

    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.

    To use it you can either:

    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}

  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output

    Two new hidden flags have been added to wrangler setup:

    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup

  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights

    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:

    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified

    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.

  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.

    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.

  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig

  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig

Patch Changes

  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions

    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.

  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used

    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).

  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names

    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    body to use the correct field names:

    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep

    The CLI options (--older-than-days and --retain-last) remain unchanged.

  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars

    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".

  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file

    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:

    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."

  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy

    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)

  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.

    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".

  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging

  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:

v4.56.0

Compare Source

Minor Changes

  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    Update wrangler to correctly send a request to configure a registry for FedRAMP containers.

  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands

    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:

    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration

    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.

    Example usage:

    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes

  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.

  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects

  • Updated dependencies [ae1ad22, 737c0f4]:

    • miniflare@​4.20251217.0

v4.55.0

Compare Source

Minor Changes
Patch Changes

  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.

  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting

  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH

  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().

  • Updated dependencies [5d085fb, b75b710, 1e9be12]:

    • miniflare@​4.20251213.0

v4.54.0

Compare Source

Minor Changes

  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers

    You can now use containers with Durable Objects that are accessed via ctx.exports.

    Now your config file can look something like this:

    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.

    Refer to the docs for more information on using ctx.exports.

  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup

  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin

  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig

  • #​10582991760d Thanks @​flakey5! - Add containers ssh command

Patch Changes

v4.53.0

Compare Source

Minor Changes

  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry

    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).

    Note: the field is experimental and could change while autoconfig is not GA

  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig

  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig

  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields

    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:

    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource

    These fields are mutually exclusive - only one can be specified at a time.

    Example configuration:

    [placement]
host = "example.com:8123"

  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig

  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024

Patch Changes

v4.52.1

Compare Source

Patch Changes

v4.52.0

Compare Source

Minor Changes

  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag

    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.

  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config

  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.

    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.

  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig

  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev

    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.

    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.

    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.

  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession

  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig

  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig

  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare

  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0

  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property

  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.

    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.

Patch Changes

  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules

    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.

  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle

  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages

  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording

    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)

  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects

    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.

    For example given a project located in /Users/usr/projects/sites/my-static-site, before:

    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}

    and after:

    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}

  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).

    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:

    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},

    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.

  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details

  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks

    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.

  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:

    • miniflare@​4.20251128.0
    • [@​cloudflare/unen

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Jan 24, 2026
@renovate
renovateBot requested a review from a teamJanuary 24, 2026 08:51
@renovate
renovateBot requested review from a team and sullivanpj as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot enabled auto-merge (squash) January 24, 2026 08:51
@renovate

renovateBot commented Jan 24, 2026

Copy link
Copy Markdown
ContributorAuthor

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@deepsource-io

deepsource-ioBot commented Jan 24, 2026•
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall GradeSecurity

Reliability

Complexity

Hygiene

Code Review Summary

AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗

@socket-security

socket-securityBot commented Jan 24, 2026•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100

View full report

@socket-security

socket-securityBot commented Jan 24, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated

Confidence: 0.91

Location:Package overview

From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from aa6f6cb to 9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 2 times, most recently from 17ba561 to 53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 53cfc6e to 8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 8c2efac to dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot closed this Mar 27, 2026
auto-merge was automatically disabled March 27, 2026 02:22

Pull request was closed

@renovate
renovateBot deleted the renovate/npm-wrangler-vulnerability branch March 27, 2026 02:22
@storm-softwarestorm-software locked and limited conversation to collaborators Mar 28, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot reopened this Mar 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 3 times, most recently from c4b7712 to 3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot enabled auto-merge (squash) April 1, 2026 17:05
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 3dd3fdd to 2081511CompareApril 8, 2026 21:10
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot closed this Apr 27, 2026
auto-merge was automatically disabled April 27, 2026 17:55

Pull request was closed

@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot reopened this Apr 27, 2026
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 3 times, most recently from a7914d5 to 1861112CompareApril 29, 2026 09:45
@renovate
renovateBot enabled auto-merge (squash) April 29, 2026 09:45
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 2 times, most recently from 36c9146 to 9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 2 times, most recently from 80d590f to 34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 34ce701 to 5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 3 times, most recently from 29d6752 to 59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch 2 times, most recently from 164f7e1 to 221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 221f831 to 6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed the renovate/npm-wrangler-vulnerability branch from 6dd1cad to dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - #207
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Open
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-wrangler-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
PackageChangeAgeConfidence
wrangler (source)4.33.0 → 4.59.1ageconfidence
Wrangler affected by OS Command Injection in wrangler pages deploy
CVE-2026-0933 / GHSA-36p8-mvp6-cv38
More information
Details
Summary
A command injection vulnerability (CWE-78) has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to execute arbitrary commands on the system running Wrangler.
Root cause
The commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution.
Impact
This vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where wrangler pages deploy is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to:
  • Run any shell command.
  • Exfiltrate environment variables.
  • Compromise the CI runner to install backdoors or modify build artifacts.
Mitigation
  • Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher.
  • Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher.
  • Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Credits
Disclosed responsibly by kny4hacker.
Severity
  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
cloudflare/workers-sdk (wrangler)
v4.59.1
Compare Source
Patch Changes
  • #​1188999b1f32 Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy
    Pass user provided values from --commit-hash safely to underlying git command.
v4.59.0
Compare Source
Minor Changes
  • #​11852ad65efa Thanks @​NuroDev! - Add --check flag to wrangler types command
    The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
    When types are up-to-date, the command exits with code 0:
    $ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
    When types are out-of-date, the command exits with code 1:
    $ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
    You can also use it with a custom output path:
    $ wrangler types ./custom-types.d.ts --check
  • #​1152943d5363 Thanks @​matthewdavidrodgers! - Add ability to enable higher asset count limits for Pages deployments
    Wrangler can now read asset count limits from JWT claims during Pages deployments,
    
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
    
basis. The default limit remains at 20,000 assets.
  • #​117550f8d69d Thanks @​nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
    
If left unset, we will default to tiers: [1, 2].
    
Note that constraints is an experimental feature.
Patch Changes
  • #​11820b0e54b2 Thanks @​MattieTK! - Add AI agent detection to analytics events
    Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
    The agent property will contain the agent ID (e.g., "claude-code", "cursor-agent") when detected, or null when running outside an agentic environment.
  • #​11494ed60c4f Thanks @​jalmonter! - Fix scheduled trigger warning showing undefined port
    When running wrangler dev with a worker that has cron triggers, the warning message displayed an invalid URL like curl "http://localhost:undefined/cdn-cgi/handler/scheduled" because the port wasn't yet determined when the warning was logged.
    Moved the warning to after the proxy server is fully ready, where the actual public URL and port are known.
  • #​11831faa5753 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260107.11.20260108.0
  • #​11844e574ef3 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260108.01.20260109.0
  • #​11872b6148ed Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260109.01.20260111.0
  • #​11843ab3859c Thanks @​dario-piotrowicz! - Update the Wrangler autoconfig logic to work with the latest version of Waku
    The latest version of Waku (0.12.5-1.0.0-alpha.1-0) requires a src/waku.server.tsx file instead of a src/server-entry.tsx one, so the Wrangler autoconfig logic (the logic being run as part of wrangler setup and wrangler deploy --x-autoconfig that configures a project to be deployable on Cloudflare) has been updated accordingly.
    Also the way the worker needs to handle static assets has been updated as recommended from the Waku team.
  • #​118480eb973d Thanks @​petebacondarwin! - Fix incorrect warning about multiple environments when using redirected config
    Previously, when using a redirected config (via configPath in another config file) that originated from a config with multiple environments, wrangler would incorrectly warn about missing environment specification. This fix ensures the warning is only shown when the actual config being used has multiple environments defined, not when the original config did.
  • Updated dependencies [ed60c4f, 5c59217, faa5753, e574ef3, b6148ed, beb96af, 5c59217, fc96e5f]:
v4.58.0
Compare Source
Minor Changes
  • #​117287d63fa5 Thanks @​NuroDev! - Add command categories to wrangler help menu
    The help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
    $ wrangler --help
COMMANDS
wrangler docs [search..] 📚 Open Wrangler's command documentation in your browser
ACCOUNT
wrangler auth 🔓 Manage authentication
wrangler login 🔑 Login to Cloudflare
...
COMPUTE & AI
wrangler ai 🤖 Manage AI models
wrangler containers 📦 Manage Containers [open beta]
...

    This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
  • #​1182297e67b9 Thanks @​dependabot! - chore: update dependencies of "miniflare", "wrangler"
    The following dependency versions have been updated:
    DependencyFromTo
    workerd1.20260103.01.20260107.1
  • Updated dependencies [97e67b9]:
    • miniflare@​4.20260107.0
v4.57.0
Compare Source
Minor Changes
  • #​11682b993d95 Thanks @​ascorbic! - Add wrangler auth token command to retrieve your current authentication credentials.
    You can now retrieve your authentication token for use with other tools and scripts:
    wrangler auth token
    The command returns whichever authentication method is currently configured:
    • OAuth token from wrangler login (automatically refreshed if expired)
    • API token from CLOUDFLARE_API_TOKEN environment variable
    Use --json to get structured output including the token type, which also supports API key/email authentication:
    wrangler auth token --json
    This is similar to gh auth token in the GitHub CLI.
  • #​11702f612b46 Thanks @​gpanders! - Add support for trusted_user_ca_keys in Wrangler
    You can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
    [[containers.trusted_user_ca_keys]]
public_key = "ssh-ed25519 AAAAC3..."
    This allows you to specify CA public keys that can be used to verify SSH user certificates.
  • #​114379e360f6 Thanks @​ichernetsky-cf! - Drop deprecated containers observability.logging field
  • #​11616fc95831 Thanks @​NuroDev! - Add type generation support to wrangler dev
    You can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
    To use it you can either:
    1. Add the --types flag when running wrangler dev.
    2. Update your Wrangler configuration file to add the new dev.generate_types boolean property.
    {
"$schema": "node_modules/wrangler/config-schema.json",
"name": "example",
"main": "src/index.ts",
"compatibility_date": "2025-12-12",
"dev": {
"generate_types": true
}
}
  • #​11524b0dbf1a Thanks @​penalosa! - Add hidden CLI flags to wrangler setup for suppressing output
    Two new hidden flags have been added to wrangler setup:
    • --no-completion-message: Suppresses the deployment details message after setup completes
    • --no-install-wrangler: Skips Wrangler installation during project setup
  • #​1177769979a3 Thanks @​MattieTK! - Add analytics properties to secret commands for better usage insights
    Secret commands (wrangler secret put, wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:
    • secretOperation: Whether this is a "single" or "bulk" secret operation
    • secretSource: How the secret was provided ("interactive", "stdin", or "file")
    • secretFormat: For bulk operations, the format used ("json" or "dotenv")
    • hasEnvironment: Whether an environment was specified
    These properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
  • #​11738c54f8da Thanks @​jamesopstad! - Add default Text module rule for .sql files.
    This enables importing .sql files directly in Wrangler and the Cloudflare Vite plugin without extra configuration.
  • #​11692df1f9c9 Thanks @​dario-piotrowicz! - Support Waku in autoconfig
  • #​11549d059f69 Thanks @​dario-piotrowicz! - Support Vike in autoconfig
Patch Changes
  • #​1168302fbd22 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.
  • #​1170477078ef Thanks @​dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versions
    Previously, wrangler setup and wrangler deploy --x-autoconfig would fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.
  • #​117962510723 Thanks @​dario-piotrowicz! - wrangler deploy delegates to opennextjs-cloudflare deploy only when the --x-autoconfig flag is used
    The wrangler deploy command has been updated to delegate to the opennextjs-cloudflare deploy command when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the --x-autoconfig flag is set (since this behavior, although generally valid, is only strictly necessary for the wrangler deploy's autoconfig flow).
  • #​117649f6dd71 Thanks @​terakoya76! - Fix R2 Data Catalog snapshot-expiration API field names
    The wrangler r2 bucket catalog snapshot-expiration enable command was sending incorrect field names
    
to the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
    
body to use the correct field names:
    • olderThanDays -> max_snapshot_age (as duration string, e.g., "30d")
    • retainLast -> min_snapshots_to_keep
    The CLI options (--older-than-days and --retain-last) remain unchanged.
  • #​11651d123ad0 Thanks @​dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values in vars
    TOML parses unquoted date/time values like DATE = 2024-01-01 as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g. DATE = "2024-01-01".
  • #​117115121b23 Thanks @​southpolesteve! - Show an error when D1 migration commands are run without a configuration file
    Previously, running wrangler d1 migrations apply, wrangler d1 migrations list, or wrangler d1 migrations create in a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:
    "No configuration file found. Create a wrangler.jsonc file to define your D1 database."
  • #​1171082e7e90 Thanks @​dario-piotrowicz! - Fix arguments passed to wrangler deploy not being forwarded to opennextjs-cloudflare deploy
    wrangler deploy run in an open-next project delegates to opennextjs-cloudflare deploy, as part of this all the arguments passed to wrangler deploy need be forwarded to opennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for example wrangler deploy --keep-vars will call opennextjs-cloudflare deploy --keep-vars)
  • #​107504688f59 Thanks @​jacoblearned! - Notify user on local dev server reload.
    When running wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".
  • #​11673b827893 Thanks @​MattieTK! - Breaks out version numbers into sortable number types for analytics logging
  • Updated dependencies [65d1850, 1615fce, b2769bf, 554a4df, 8eede3f, 6a05b1c, 62fd118, a7e9f80, eac5cf7]:
v4.56.0
Compare Source
Minor Changes
  • #​11196171cfd9 Thanks @​emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.
    
Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
  • #​11646472cf72 Thanks @​vovacf201! - feat: add R2 Data Catalog snapshot expiration commands
    Adds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
    • wrangler r2 bucket catalog snapshot-expiration enable - Enable automatic snapshot expiration
    • wrangler r2 bucket catalog snapshot-expiration disable - Disable automatic snapshot expiration
    Snapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
    Example usage:
    # Enable snapshot expiration for entire catalog (keep 10 snapshots, expire after 5 days)
wrangler r2 bucket catalog snapshot-expiration enable my-bucket --token $R2_CATALOG_TOKEN --max-age 7200 --min-count 10
# Enable for specific table
wrangler r2 bucket catalog snapshot-expiration enable my-bucket my-namespace my-table --token $R2_CATALOG_TOKEN --max-age 2880 --min-count 5
# Disable snapshot expiration
wrangler r2 bucket catalog snapshot-expiration disable my-bucket
Patch Changes
  • #​11649428ae9e Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules
    When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.
  • #​11647c0e249e Thanks @​dario-piotrowicz! - The auto-configuration logic present in wrangler setup and wrangler deploy --x-autoconfig cannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.
  • #​116943853200 Thanks @​dario-piotrowicz! - fix: improve the open-next detection that wrangler deploy performs to eliminate false positives for non open-next projects
  • Updated dependencies [ae1ad22, 737c0f4]:
    • miniflare@​4.20251217.0
v4.55.0
Compare Source
Minor Changes
Patch Changes
  • #​11615ed42010 Thanks @​elithrar! - Add helpful warning when SSL certificate errors occur due to corporate proxies or VPNs intercepting HTTPS traffic. When errors like "self-signed certificate in certificate chain" are detected, wrangler now displays guidance about installing missing system roots from your corporate proxy vendor.
  • #​116416b28de1 Thanks @​petebacondarwin! - update command status text and formatting
  • #​115784201472 Thanks @​gpanders! - Fixup UX papercuts in containers SSH
  • #​1155095d81e1 Thanks @​hiendv! - Fix "TypeError: Body is unusable: Body has already been read" when failing to exchange oauth code because of double response.text().
  • Updated dependencies [5d085fb, b75b710, 1e9be12]:
    • miniflare@​4.20251213.0
v4.54.0
Compare Source
Minor Changes
  • #​11512c15e99e Thanks @​emily-shen! - Enable using ctx.exports with containers
    You can now use containers with Durable Objects that are accessed via ctx.exports.
    Now your config file can look something like this:
    {
"name": "container-app",
"main": "src/index.ts",
"compatibility_date": "2025-12-01",
"compatibility_flags": ["enable_ctx_exports"], // compat flag needed for now.
"containers": [
{
"image": "./Dockerfile",
"class_name": "MyDOClassname",
"name": "my-container"
},
],
"migrations": [
{
"tag": "v1",
"new_sqlite_classes": ["MyDOClassname"],
},
],
// no need to declare your durable object binding here
}

    Note that when using ctx.exports, where you previously accessed a Durable Object via something like env.DO, you should now access with ctx.exports.MyDOClassname.
    Refer to the docs for more information on using ctx.exports.
  • #​11508b17797c Thanks @​dario-piotrowicz! - Wrangler will no longer try to add additional configuration to projects using @cloudflare/vite-plugin when deploying or running wrangler setup
  • #​11508b17797c Thanks @​dario-piotrowicz! - When a Vite project is detected, install @cloudflare/vite-plugin
  • #​11576bb47e20 Thanks @​dario-piotrowicz! - Support Analog projects in autoconfig
  • #​10582991760d Thanks @​flakey5! - Add containers ssh command
Patch Changes
v4.53.0
Compare Source
Minor Changes
  • #​11500af54c63 Thanks @​dario-piotrowicz! - Add new autoconfig_summary field to the deploy output entry
    This change augments wrangler deploy output being printed to WRANGLER_OUTPUT_FILE_DIRECTORY or WRANGLER_OUTPUT_FILE_PATH to also include a new autoconfig_summary field containing the possible summary details for the autoconfig process (the field is undefined if autoconfig didn't run).
    Note: the field is experimental and could change while autoconfig is not GA
  • #​114779988cc9 Thanks @​ascorbic! - Support Nuxt in autoconfig
  • #​11472ce295bf Thanks @​dario-piotrowicz! - Support Qwik projects in autoconfig
  • #​109379514c9a Thanks @​ReppCodes! - Add support for "targeted" placement mode with region, host, and hostname fields
    This change adds a new mode to placement configuration. You can specify one of the following fields to target specific external resources for Worker placement:
    • region: Specify a region identifier (e.g., "aws:us-east-1") to target a region from another cloud service provider
    • host: Specify a host with (required) port (e.g., "example.com:8123") to target a TCP service
    • hostname: Specify a hostname (e.g., "example.com") to target an HTTP resource
    These fields are mutually exclusive - only one can be specified at a time.
    Example configuration:
    [placement]
host = "example.com:8123"
  • #​11498ac861f8 Thanks @​penalosa! - Add React Router support in autoconfig
  • #​1150679d30d4 Thanks @​vicb! - Set the target JS version to ES2024
Patch Changes
v4.52.1
Compare Source
Patch Changes
v4.52.0
Compare Source
Minor Changes
  • #​11416abe49d8 Thanks @​dario-piotrowicz! - Remove the wrangler deploy's --x-remote-diff-check experimental flag
    The remote diffing feature has been enabled by default for a while and its functionality is stable, as a result the experimental flag (only available for option-out of the feature right now) has been removed.
  • #​11408f29e699 Thanks @​ascorbic! - Export unstable helpers useful for generating wrangler config
  • #​113892342d2f Thanks @​dario-piotrowicz! - Improve the wrangler deploy flow to also check for potential overrides of secrets.
    Now when you run wrangler deploy Wrangler will check the remote secrets for your workers for conflicts with the names of the bindings you're about to deploy. If there are conflicts, Wrangler will warn you and ask you for your permission before proceeding.
  • #​113759a1de61 Thanks @​penalosa! - Support TanStack Start in autoconfig
  • #​113606b38532 Thanks @​emily-shen! - Containers: Allow users to directly authenticate external image registries in local dev
    Previously, we always queried the API for stored registry credentials and used those to pull images. This means that if you are using an external registry (ECR, dockerhub) then you have to configure registry credentials remotely before running local dev.
    Now you can directly authenticate with your external registry provider (using docker login etc.), and Wrangler or Vite will be able to pull the image specified in the containers.image field in your config file.
    The Cloudflare-managed registry (registry.cloudflare.com) currently still does not work with the Vite plugin.
  • #​11009e4ddbc2 Thanks @​dario-piotrowicz! - Allow users to provide an account_id as part of the WorkerConfigObject they pass to maybeStartOrUpdateRemoteProxySession
  • #​114782aec2b4 Thanks @​dario-piotrowicz! - Support SolidStart in autoconfig
  • #​113305a873bb Thanks @​dario-piotrowicz! - Support Angular projects in autoconfig
  • #​11449e7b690b Thanks @​penalosa! - Delegate generation of HTTPS certificates to Miniflare
  • #​114482b4813b Thanks @​edmundhung! - Bumps esbuild version to 0.27.0
  • #​11335c47ad11 Thanks @​dario-piotrowicz! - Support internal-only undocumented cross_account_grant service binding property
  • #​11346a977701 Thanks @​penalosa! - We're soon going to make backend changes that mean that wrangler dev --remote sessions will no longer have an associated inspector connection. In advance of these backend changes, we've enabled a new wrangler tail-based logging strategy for wrangler dev --remote. For now, you can revert to the previous logging strategy with wrangler dev --remote --no-x-tail-logs, but in future it will not be possible to revert.
    The impact of this will be that logs that were previously available via devtools will now be provided directly to the Wrangler console and it will no longer be possible to interact with the remote Worker via the devtools console.
Patch Changes
  • #​11397b154de2 Thanks @​vicb! - Use more workerd native modules
    Node modules punycode, trace_events, cluster, wasi, and domains will be used when enabled
    
via a compatibility flag or by default when the compatibility date is greater or equal to 2025-12-04.
  • #​1145276f0540 Thanks @​penalosa! - Remove uses of eval() from the Wrangler bundle
  • #​11284695fa25 Thanks @​dom96! - Removes duplicate module warnings when vendoring Python packages
  • #​11249504e258 Thanks @​dario-piotrowicz! - fix: Generalize autoconfig wording
    Generalize the autoconfig wording so that when it doesn't specifically mention "deployment" (since it can be run via wrangler setup or the autoconfig programmatic API)
  • #​11455d25f7e2 Thanks @​dario-piotrowicz! - Fix autoconfig using absolute paths for static projects
    Running the experimental autoconfig logic through wrangler setup and wrangler deploy --x-autoconfig on a static project results in absolute paths being used. This is incorrect, especially when such paths are being included in the generated wrangler.jsonc. The changes here fix the autoconfig logic to use paths relative to the project's root instead.
    For example given a project located in /Users/usr/projects/sites/my-static-site, before:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "/Users/usr/projects/sites/my-static-site/public"}}
    and after:
    // wrangler.jsonc at /Users/usr/projects/sites/my-static-site{"$schema": "node_modules/wrangler/config-schema.json","name": "static","compatibility_date": "2025-11-27","observability": {"enabled": true},"assets": {"directory": "public"}}
  • #​114841cfae2d Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25
  • #​113831d685cb Thanks @​dario-piotrowicz! - Fix: ensure that when a remote proxy session creation fails a hard error is surfaced to the user (both in wrangler dev and in the programmatic API).
    When using remote bindings, either with wrangler dev or via startRemoteProxySession/maybeStartOrUpdateRemoteProxySession the remote proxy session necessary to connect to the remote resources can fail to be created, this might happen if for example you try to set a binding with some invalid values such as:
    MY_R2: {type: "r2_bucket",bucket_name: "non-existent",// No bucket called "non-existent" existsremote: true,},
    Before this could go undetected and cause unwanted behaviors such as requests handling hanging indefinitely, now wrangler will instead crash (or throw a hard error ion the programmatic API), clearly indicating that something went wrong during the remote session's creation.
  • #​11366edf896d Thanks @​ascorbic! - Use correctly-formatted names when displaying detected framework details
  • #​114619eaa9e2 Thanks @​dario-piotrowicz! - Update the structure of the configure method of autoconfig frameworks
    Update the signature of the configure function of autoconfig frameworks (AutoconfigDetails#Framework), before they would return a RawConfig object to use to update the project's wrangler config file, now they return an object that includes the RawConfig and that can potentially also hold additional data relevant to the configuration.
  • Updated dependencies [2b4813b, b154de2, 5ee3780, 6e63b57, 71ab562, 5e937c1]:
    • miniflare@​4.20251128.0
    • [@​cloudflare/unen
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Jan 24, 2026
@renovate
renovateBot
requested a review
from a teamJanuary 24, 2026 08:51
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersJanuary 24, 2026 08:51
@renovate
renovateBot
enabled auto-merge (squash)
January 24, 2026 08:51
@renovate
renovateBot
commented
Jan 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Branch automerge failure
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
  • Branch has one or more failed status checks
@deepsource-io
deepsource-ioBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...dc65c2e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 13, 2026 5:23p.m.Review ↗
ShellMar 13, 2026 5:23p.m.Review ↗
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​stryke/​fs@​0.28.6761009997100
Addedtsup@​8.4.0981009483100
Added@​microsoft/​tsdoc@​0.16.0991009084100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+198+6100
View full report
@socket-security
socket-securityBot
commented
Jan 24, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
aa6f6cb to
9b1d8e0CompareFebruary 2, 2026 19:14
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
17ba561 to
53cfc6eCompareFebruary 17, 2026 16:51
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
53cfc6e to
8c2efacCompareMarch 5, 2026 15:36
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
8c2efac to
dc65c2eCompareMarch 13, 2026 17:23
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-wrangler-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
c4b7712 to
3dd3fddCompareApril 1, 2026 17:05
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:05
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
3dd3fdd to
2081511CompareApril 8, 2026 21:10
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security] - autoclosedchore(monorepo): update pnpm.catalog.default wrangler to v4.59.1 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
a7914d5 to
1861112CompareApril 29, 2026 09:45
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:45
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
36c9146 to
9c5a1caCompareMay 18, 2026 12:44
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
80d590f to
34ce701CompareJune 1, 2026 20:21
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
34ce701 to
5c5e646CompareJune 11, 2026 11:19
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
3 times, most recently
from
29d6752 to
59a53b5CompareJuly 24, 2026 22:15
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
2 times, most recently
from
164f7e1 to
221f831CompareJuly 30, 2026 18:16
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
221f831 to
6dd1cadCompareAugust 12, 2026 04:22
@renovate
renovateBotforce-pushed
the
renovate/npm-wrangler-vulnerability
branch
from
6dd1cad to
dbf62c4CompareAugust 14, 2026 21:13
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants