Update dependency wrangler to v4.112.0 by renovate[bot] · Pull Request #65 · voidzero-dev/pkg-pr-registry-bridge

renovate · 2026-07-10T18:14:50Z

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	`4.107.0` → `4.112.0`

Release Notes

cloudflare/workers-sdk (wrangler)

`v4.112.0`

Compare Source

Minor Changes

#14470 3de70df Thanks @DiogoSantoss! - Add a top-level addresses field to Wrangler configuration for Email Routing

You can now declare the inbound email addresses handled by your Worker directly in wrangler.json:
```
{
  "name": "my-worker",
  "main": "src/index.ts",
  "compatibility_date": "2026-05-21",
  "addresses": ["support@example.com", "*@&#8203;example.com"]
}
```

#14706 cb6c3f9 Thanks @edmundhung! - Add Durable Object storage access to createTestHarness()

You can now execute SQL against a SQLite-backed Durable Object to seed or assert the storage state.

const server = createTestHarness({
  workers: [{ configPath: "./wrangler.json" }],
});
await server.listen();

const worker = server.getWorker();
const storage = await worker.getDurableObjectStorage("COUNTER", {
  name: "user-123",
});

await worker.fetch("/counter/user-123");

const rows = await storage.exec(
  "SELECT value FROM counters WHERE id = ?",
  "user-123"
);
expect(rows).toEqual([{ value: 1 }]);

#14562 9f04a7e Thanks @martijnwalraven! - Emit a typed runtimeError event on the unstable_startWorker DevEnv for uncaught Worker exceptions

Uncaught Worker exceptions were only source-mapped and printed, so programmatic consumers had to scrape terminal output to observe them. The DevEnv now re-emits a RuntimeErrorEvent (like reloadComplete) carrying the exception text and source-mapped stack — fed from Miniflare's pretty-error seam via the new handleUncaughtError option for exceptions the runtime catches, and from the inspector for those it does not.

Patch Changes

#14682 d39ae01 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260710.1 ^5.20260714.1

workerd 1.20260710.1 1.20260714.1
#14725 c79504f Thanks @edmundhung! - Support containers in createTestHarness()

Workers configured with containers can now be tested using createTestHarness(). The harness builds configured images and makes container-backed Durable Objects available during integration tests.
#14696 c7dbe1a Thanks @martijnwalraven! - Type unstable_startWorker, DevEnv.startWorker, and ConfigController.set/patch against WranglerStartDevWorkerInput, so the wrangler-specific dev.structuredLogsHandler field the runtime already honors is expressible through the public API. Previously the public signatures took the base StartDevWorkerInput, and callers passing the handler needed a cast while internal callers (the test harness) routed the wider type around the signature.
#14494 4e1a7a7 Thanks @petebacondarwin! - Register a workers.dev subdomain before uploading a new Worker

Deploying a Worker for the first time on an account that has no workers.dev subdomain failed with an opaque API error raised by the upload request itself (code 10063, "You need a workers.dev subdomain in order to proceed"). Wrangler now checks for a workers.dev subdomain before uploading a brand-new Worker that publishes to workers.dev and prompts you to register one, so you get a clear, actionable message instead of a cryptic API failure. The check is skipped for deploys that don't target workers.dev (routes-only deploys, or workers_dev: false) and for existing Workers, since their account already has a subdomain.
Updated dependencies [34e696d, d39ae01, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, 3f3afbb, e6fbc4e]:
- miniflare@4.20260714.0

`v4.111.0`

Compare Source

Minor Changes

#14602 7692a61 Thanks @edmundhung! - Add Durable Object eviction support to createTestHarness

You can now gracefully evict a running Durable Object by class name or binding name to verify how it recovers after its instance is torn down:
```
const worker = server.getWorker();
await worker.evictDurableObject("Counter", { name: "user-123" });
```
#14620 899c297 Thanks @penalosa! - Remove support for service environments and the legacy_env configuration field

Service environments have been removed. Wrangler now always deploys each environment as its own Worker named <name>-<environment>, which matches the behaviour of the previous default (legacy_env = true). The --legacy-env CLI flag has been removed, and the legacy_env configuration field is no longer supported — including it in your configuration file will now raise an error.

Because legacy_env = true was already the default, removing the field will not change how your Worker is deployed. If you were relying on service environments (legacy_env = false), each environment will now be deployed as a standalone Worker instead of as an environment of a single Worker. See https://developers.cloudflare.com/workers/wrangler/environments/ for more information.
#14652 317ce1f Thanks @jamesopstad! - Append Workers runtime types to the generated types under --x-new-config, with a new dev.types.includeRuntime option

When running wrangler dev --x-new-config, the runtime types generated from your compatibility date and flags are now appended to worker-configuration.d.ts, alongside the types inferred from cloudflare.config.ts. This is controlled by a new dev.types.includeRuntime option in wrangler.config.ts, which defaults to true.

This applies to the experimental new config path only and does not change type generation for existing wrangler.jsonc/wrangler.toml projects.

Patch Changes

#14627 ed33326 Thanks @tpmmorris! - Add convenient logging for worker emails in the project directory. In addition to the system's temp directory, logs for emails sent by workers are also written to a local temp directory defined by the calling process, e.g for an simple text email sent via Wrangler this is .wrangler/tmp/email/<session>/email-text/<message-uuid>.txt (and related files) in the project root. Callers of Miniflare can control this location via the new defaultProjectTmpPath option, which Wrangler and Vite plugin now set automatically.
#14642 018574b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260708.1 ^5.20260710.1

workerd 1.20260708.1 1.20260710.1
#14588 eb99ab1 Thanks @emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

Note that the profile directory is resolved based on the Vite project root.
#14658 cdf3148 Thanks @ATKasem! - Fix wrangler dev corrupting external hostnames in proxied response headers

When a Worker was run with routes configured, wrangler dev's proxy rewrote the host inside URL-valued headers (such as Location) using a boundary-less substring replace. Any host that merely contained the route host as a substring was corrupted — e.g. with an example.com route, a Location: https://books.example.com/read/ch01 header became https://books.127.0.0.1:8788/read/ch01, and https://myexample.com/path became https://my127.0.0.1:8788/path.

The proxy now only rewrites absolute URLs whose host is exactly the proxied host, swapping the scheme and host together (which also fixes a related case where an https: scheme survived on a plain-HTTP dev address). Unrelated hosts and subdomains pass through untouched.
#14601 3015320 Thanks @MattieTK! - Improve the agent-facing --force guidance for Pages-to-Workers delegation

When an AI agent opts out of the Pages-to-Workers delegation by passing --force to wrangler pages deploy or wrangler pages project create, Wrangler now prints a notice at the end of a successful command explaining that --force only needs to be passed once: the project then exists, so subsequent commands are no longer delegated and do not need the flag.
#14569 9da77ac Thanks @dario-piotrowicz! - Suggest similar commands when a typo is detected

When an unknown command or subcommand is entered, wrangler now suggests the closest matching command if one exists within a reasonable edit distance. For example, running wrangler whoamio will display Did you mean "wrangler whoami"?, and running wrangler kv namespase will display Did you mean "wrangler kv namespace"?.
Updated dependencies [7692a61, ed33326, 018574b, 7692a61]:
- miniflare@4.20260710.0

`v4.110.0`

Compare Source

Minor Changes

#14591 0283a1f Thanks @dario-piotrowicz! - Send npm package dependency metadata with worker uploads

Wrangler now collects npm package dependency information from the project's package.json at deploy and version upload time, and includes it in the upload metadata sent to the Cloudflare API. This enables dependency analytics and future features like vulnerability alerting.

The collected data includes the package name, the version constraint from package.json, and the exact installed version from node_modules. Both dependencies and devDependencies are included, while workspace packages, local packages, and unresolvable packages are excluded. The list is capped at 200 entries per upload.

To opt out, set dependencies_instrumentation.enabled to false in your Wrangler configuration file:
```
{
  "dependencies_instrumentation": {
    "enabled": false
  }
}
```
#14535 1b965c5 Thanks @Naapperas! - Support dynamic retry delays for Workflow steps in local dev

A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.
```
await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);
```
The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

Patch Changes

#14589 7b28392 Thanks @jamesopstad! - Fix runtime type caching when wrangler dev auto-regenerates types

When dev.generate_types (or wrangler dev --types) regenerated an out-of-date worker-configuration.d.ts, the written file omitted the // Begin runtime types marker (and the /* eslint-disable */ header) that wrangler types writes. As a result, later runs could not detect the cached runtime types and always regenerated them. The auto-regenerated file now matches wrangler types output, restoring the cache.
Updated dependencies [1b965c5]:
- miniflare@4.20260708.1

`v4.109.0`

Compare Source

Minor Changes

#14489 e3f0cd6 Thanks @edmundhung! - Add listDurableObjectIds() to createTestHarness Worker handles

Tests using createTestHarness can now list persisted Durable Object instance IDs for a Durable Object binding. This helps integration tests discover objects created by app behavior without adding test-only endpoints.
#14465 2fedb1f Thanks @vaishnav-mk! - Add rollback support when terminating Workflow instances

WorkflowInstance.terminate({ rollback: true }) now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via wrangler workflows instances terminate --rollback, including local mode.

The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.
#14511 17d2fc1 Thanks @juleslemee! - Add wrangler turnstile widget commands for managing Turnstile widgets

You can now create, list, inspect, update, and delete Turnstile widgets from the CLI:
```
wrangler turnstile widget create <name> --domain example.com --mode managed
wrangler turnstile widget list
wrangler turnstile widget get <sitekey>
wrangler turnstile widget update <sitekey> --name "Renamed"
wrangler turnstile widget delete <sitekey>
```
All five subcommands accept --json for machine-readable output (get prints a formatted view by default; the rest print a short human summary). --domain accepts comma-separated values, e.g. --domain a.com,b.com. delete --json requires --skip-confirmation/-y to keep output pipeable.

create prints the sitekey, the secret, and the canonical challenges.cloudflare.com/turnstile/v0/siteverify endpoint for backend verification. The hint is backend-agnostic; it doesn't assume Workers. The secret is redacted from list and update output but remains available via get for retrieval later. delete prompts for confirmation; pass --skip-confirmation/-y to bypass.

The OAuth flow now requests the challenge-widgets.write scope (the existing Bach-derived scope for Turnstile widget CRUD). Existing OAuth sessions need to run wrangler login again to pick it up. API token users need a token with the Account.Turnstile:Edit permission.

Patch Changes

#14596 8511ddf Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260706.1 1.20260708.1

@cloudflare/workers-types ^5.20260706.1 ^5.20260708.1
#14604 9f74a5f Thanks @vaishnav-mk! - Improve the deploy error for cron-triggered Workflows on free plans

Wrangler now explains that Workflow schedules require a paid Workers plan instead of showing only the generic Workflows API request failure.
#14616 c782e2a Thanks @penalosa! - Fix wrangler deploy aborting in CI for autoconfigured projects

A recent change guarded non-interactive deploys against overwriting a same-named Worker whenever there was no config file naming it. This was too broad: a plain wrangler deploy run in CI without a config file (for example an autoconfigured project whose generated config PR has not been merged) would fail with "A Worker named ... already exists in your account", even though re-deploying to that Worker is the intended behaviour.

The guard is now limited to the Pages-to-Workers delegation, where the target name is a Pages project name that must not clobber an unrelated Worker. Plain deploys once again deploy normally.
Updated dependencies [e3f0cd6, 8511ddf, 2fedb1f]:
- miniflare@4.20260708.0

`v4.108.0`

Compare Source

Minor Changes

#14312 54f74b8 Thanks @MattieTK! - Delegate agent-driven static Pages deploys to Workers

When wrangler pages deploy or wrangler pages project create is run by an AI coding agent against a brand-new, purely static project, Wrangler now delegates it to Workers static assets (using autoconfig) instead of Cloudflare Pages. Accounts that already have Cloudflare Pages projects, non-agent (human) sessions, and projects using Pages features that can't be carried across to Workers (Pages Functions, a _worker.js, or a _routes.json file) are unaffected and continue to use Pages. Passing --force to either command opts out of the delegation and deploys to Pages directly. Once the Workers deploy starts it is not silently swapped back to Pages: if it fails, the error is surfaced and the --force opt-out is suggested.

Patch Changes

#14567 0852346 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler", "create-cloudflare"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260702.1 1.20260706.1

@cloudflare/workers-types 4.20260702.1 5.20260706.1
#14312 54f74b8 Thanks @MattieTK! - Avoid silently overwriting an existing Worker during non-interactive deploys that cannot prove they own the name

A non-interactive deploy (an agent, CI, or the agent-delegated wrangler pages deploy) has no way to prompt before overwriting a Worker, so it now stops if the target name is already taken and this run cannot show it owns that Worker. This applies when there is no Wrangler configuration file naming the Worker and either the name was generated automatically or the deploy is the Pages-to-Workers delegation (where the name carried across is a Pages project name, not proof of Worker ownership). The check reuses the service metadata the deploy already fetches, so it adds no extra API calls.

Deploys are unaffected when a configuration file names the Worker (so repeat deployments continue to update it), and interactive deploys keep their existing confirmation flow. To update an existing Worker in one of the guarded cases, add a Wrangler configuration file naming it, or deploy under a different name.
Updated dependencies [0852346]:
- miniflare@4.20260706.0

`v4.107.1`

Compare Source

Patch Changes

#14514 d88555e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260701.1 1.20260702.1
#14564 5fd8bee Thanks @jibin7jose! - Fix an issue where wrangler dev would not override config vars with values from .dev.vars during local development when the secrets field was defined in the configuration file.
#14332 5d9990e Thanks @Divkix! - Fix misleading error guidance when deploying a new Worker with secrets.required

When a Worker declares secrets.required and has never been deployed before, the previous error message suggested running wrangler secret put <NAME>, which doesn't work because the Worker doesn't exist yet.

The one path that does work — wrangler deploy --secrets-file <path> — was not mentioned anywhere in the error output.

The pre-deploy error now explains that wrangler secret put cannot be used for a new Worker, and directs users to the --secrets-file flag instead. The post-deploy error for existing Workers now also mentions --secrets-file alongside wrangler secret put.
#14507 bf49a41 Thanks @joey727! - Fix a potential crash when displaying certain CLI output

Previously, some CLI output with no content lines could cause a crash. This is now handled correctly.
#14492 1ac96a1 Thanks @penalosa! - Replace the CommonJS xdg-app-paths dependency with a vendored pure-ESM implementation

xdg-app-paths (and its xdg-portable/os-paths dependencies) are CommonJS only, which caused "Dynamic require of 'path' is not supported" errors when the surrounding code was bundled to ESM. The global config/cache directory resolution is now provided by a small, dependency-free pure-ESM module in @cloudflare/workers-utils that reproduces the previous path resolution exactly (verified against the real package in unit tests), so existing config and credential locations are unchanged. This also drops the transitive fsevents optional dependency that xdg-app-paths pulled in.

Miniflare and create-cloudflare now consume the shared helpers from @cloudflare/workers-utils instead of maintaining their own copies, importing node-only leaf entry points (@cloudflare/workers-utils/fs-helpers, @cloudflare/workers-utils/global-wrangler-config-path) where ESM bundling is required.
#14572 f416dd9 Thanks @petebacondarwin! - Key local rate limit counters by namespace_id instead of binding name

wrangler dev and Miniflare previously tracked each rate limit binding's counter by its binding name, so two bindings that referenced the same namespace_id were treated as separate limiters. Counters are now keyed by namespace_id, matching production: bindings that share a namespace_id share a limit, while distinct namespaces stay isolated. This also re-enables rate limit bindings in multiworker wrangler dev sessions, where they were previously stripped from secondary Workers to avoid a startup crash.
#14570 1ca8d8f Thanks @penalosa! - Upgrade signal-exit from v3 to v4

The bundled signal-exit dependency was CJS-only. Upgrading to v4 (which ships a dual ESM/CJS build) unblocks ESM output. Exit-cleanup behaviour is unchanged, though v4 no longer registers handlers for a few signals that are no longer supported by the OS (SIGUNUSED on Linux; SIGABRT/SIGALRM on Windows).
#14561 b973ed3 Thanks @martijnwalraven! - Emit an error event for watch-mode rebuild failures in unstable_startWorker

Initial build failures already dispatch an error event (surfaced as buildFailed on the DevEnv bus), but watch-mode rebuild failures were only logged from inside the esbuild plugin, so programmatic consumers had no way to observe them while dev kept serving the previous bundle. Rebuild failures now route through the same error path as initial-build failures: terminal output is unchanged and buildFailed fires symmetrically.
Updated dependencies [e7e5780, d88555e, 1ac96a1, f416dd9, 16fbf81]:
- miniflare@4.20260702.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch 2 times, most recently from 1a17658 to 4ea8a9c Compare July 12, 2026 18:54

renovate Bot changed the title ~~Update dependency wrangler to v4.107.1~~ Update dependency wrangler to v4.110.0 Jul 12, 2026

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch from 4ea8a9c to 396c832 Compare July 18, 2026 09:37

renovate Bot changed the title ~~Update dependency wrangler to v4.110.0~~ Update dependency wrangler to v4.111.0 Jul 18, 2026

Update dependency wrangler to v4.112.0

a480389

renovate Bot force-pushed the renovate/wrangler-4.x-lockfile branch from 396c832 to a480389 Compare July 20, 2026 21:54

renovate Bot changed the title ~~Update dependency wrangler to v4.111.0~~ Update dependency wrangler to v4.112.0 Jul 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency wrangler to v4.112.0#65

Update dependency wrangler to v4.112.0#65
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/wrangler-4.x-lockfile

renovate Bot commented Jul 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20260710.1	^5.20260714.1
workerd	1.20260710.1	1.20260714.1

Dependency	From	To
@cloudflare/workers-types	^5.20260708.1	^5.20260710.1
workerd	1.20260708.1	1.20260710.1

Dependency	From	To
workerd	1.20260706.1	1.20260708.1
@cloudflare/workers-types	^5.20260706.1	^5.20260708.1

Dependency	From	To
workerd	1.20260702.1	1.20260706.1
@cloudflare/workers-types	4.20260702.1	5.20260706.1

Uh oh!

Conversation

renovate Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.112.0

Minor Changes

Patch Changes

v4.111.0

Minor Changes

Patch Changes

v4.110.0

Minor Changes

Patch Changes

v4.109.0

Minor Changes

Patch Changes

v4.108.0

Minor Changes

Patch Changes

v4.107.1

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 10, 2026 •

edited

Loading

`v4.112.0`

`v4.111.0`

`v4.110.0`

`v4.109.0`

`v4.108.0`

`v4.107.1`