Skip to content

Update dependency wrangler to v4.130.0 - #767

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/wrangler-4.x
Open

Update dependency wrangler to v4.130.0#767
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/wrangler-4.x

Conversation

@renovate

@renovate renovate Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
wrangler (source) 4.107.14.130.0 age adoption passing confidence

Release Notes

cloudflare/workers-sdk (wrangler)

v4.130.0

Compare Source

Minor Changes
  • #​14372 dbf6aad Thanks @​ichernetsky-cf! - Add containers[].observability support to wrangler deploy

    Wrangler now accepts container-specific observability settings via containers[].observability, including application-level targeting fields for Containers. Root observability continues to work as a fallback when a container does not define its own observability settings.

    wrangler deploy now preserves legacy configuration.observability for existing container apps that still use rollout-based observability, while using top-level application observability for new or already-migrated apps.

    Existing application diffs are now normalized even when stored resource limits cannot be mapped to a named instance type. API-only metadata and equivalent managed-registry image names no longer appear as edits or affect whether deployment changes require a rollout.

  • #​15004 e20df20 Thanks @​MattieTK! - Delegate agent Pages project creation with a production branch to Workers

    When run by an AI agent, wrangler pages project create --production-branch <name> is now eligible for delegation to a Workers static-assets deploy. The production branch names the target that a Workers deploy would publish to, so it does not need to disqualify a brand-new project from delegation.

    wrangler pages deploy --branch <name> remains on Pages because an interactive new-project flow separately prompts for its production branch. The deployment branch may therefore represent a preview and cannot safely be converted into a production Workers deployment.

  • #​15004 e20df20 Thanks @​MattieTK! - Widen agent Pages-to-Workers delegation to new projects on accounts that already use Pages

    When run by an AI agent, wrangler pages deploy and wrangler pages project create now delegate a brand-new static Pages project to a Workers static-assets deploy even when the account already has other Pages projects. The gate is now per-project rather than per-account: a command targeting a project that already exists stays on Pages, but a new project is delegated regardless of the account's other Pages projects.

    A project name restored from the Pages configuration cache is only used when the cache belongs to the currently authenticated account. An account-matching cached name remains on Pages even when the project is missing remotely, preserving the user's recorded Pages intent. After switching accounts, an otherwise unnamed deploy stays on Pages rather than treating a stale cached project name as a new project on the selected account.

Patch Changes
  • #​15560 edb3631 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260907.1 ^5.20260908.1
    workerd 1.20260907.1 1.20260908.1
  • #​15557 63c7ff1 Thanks @​tomekancu! - Fix wrangler d1 execute --local being extremely slow with large SQL files or commands

    The local SQL splitter consumed quoted strings and comments character-by-character, re-checking the full accumulated string each time. This made splitting a large quoted value or comment quadratic, so seed files could take tens of seconds to run. The splitter now only inspects a bounded trailing window on each step, making splitting effectively linear. The remote path is unaffected as it imports the file server-side.

  • #​15542 a4e41df Thanks @​NAVEENKUMARKR777! - Fix wrangler dev running the custom build command twice on startup and on every config change

    Wrangler already runs the custom build.command once before starting wrangler dev, to resolve the Worker's entry point. When dev.watch wasn't explicitly disabled, BundlerController then unconditionally ran the same build command again the moment it started watching for changes, and repeated this on every subsequent config reload too.

    For fast build commands this just meant duplicate log output (e.g. a vite build visibly running twice at startup). For slower or stateful build commands, running two builds concurrently against the same output files could corrupt the result or fail outright (for example, non-deterministic wasm-opt failures have been reported for Rust builds).

    The initial watcher setup now only bundles the output the build command already produced, instead of re-running the command. Real file changes detected by the watcher still re-run the build command as before.

  • Updated dependencies [edb3631, bcebf08]:

v4.129.1

Compare Source

Patch Changes
  • #​15502 8bbcb9f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260903.1 ^5.20260904.1
    workerd 1.20260903.1 1.20260904.1
  • #​15543 2b42d6f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260904.1 ^5.20260907.1
    workerd 1.20260904.1 1.20260907.1
  • #​15323 ea5634e Thanks @​Sakshamm-Goyal! - Prevent Wrangler from exiting when a process capturing its output closes the pipe.

    Wrangler now ignores broken-pipe errors from stdout and stderr while preserving the existing failure behavior for other output errors.

  • #​14001 c0c6504 Thanks @​for-the-kidz! - Update bundle size warning thresholds to use uncompressed size instead of gzip size

    The compressed script size limits (3 MiB free / 10 MiB paid) have been removed server-side in favor of a single 64 MiB uncompressed limit. The bundle size reporter now compares the uncompressed bundle size against this 64 MiB limit for its color-coded warnings, instead of comparing gzip size against the old 3 MiB compressed limit.

  • #​15499 ffc7efd Thanks @​WillTaylorDev! - Honor Workers Builds name overrides in wrangler preview

    Preview commands now target the Worker name supplied by Workers Builds instead of the name in local Wrangler configuration. This prevents preview builds from failing when the two names differ.

  • #​15252 682cd44 Thanks @​GregoryCollett! - wrangler dev no longer exits when a request to your Worker fails transiently

    Previously, a transient network failure on a single request — most commonly a request arriving just as an idle internal connection was closed, after roughly five seconds without traffic — could take down the whole dev server with an empty ✘ [ERROR], leaving the port unbound until restarted. In CI test suites, one such failure caused every remaining test to fail with connection errors.

    wrangler dev now automatically retries the affected request if it is safe to repeat (GET and HEAD requests). If a request still fails, it fails individually — the error is logged with the request method and URL — and the dev server keeps serving.

  • Updated dependencies [8bbcb9f, 2b42d6f]:

v4.129.0

Compare Source

Minor Changes
  • #​15460 93d72a5 Thanks @​QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

    Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

  • #​15358 d2d8eea Thanks @​pombosilva! - Add a --json flag to the wrangler workflows commands

    Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

    wrangler workflows instances list my-workflow --json

    The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes
  • #​15469 d40a634 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260831.1 ^5.20260902.1
    workerd 1.20260831.1 1.20260902.1
  • #​15481 7c1b2a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260902.1 ^5.20260903.1
    workerd 1.20260902.1 1.20260903.1
  • #​15472 f6fb347 Thanks @​emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

    wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

  • #​15472 f6fb347 Thanks @​emily-shen! - Tolerate missing resource permissions during resource provisioning

    When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

  • #​15476 dc24057 Thanks @​christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

    Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

  • Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

v4.128.0

Compare Source

Minor Changes
  • #​15454 dbbb795 Thanks @​jamesopstad! - Move binding utilities into @cloudflare/workers-utils

    Binding conversion, printing, and local-development validation are now exported from @cloudflare/workers-utils so they can be shared by Wrangler, the Cloudflare Vite plugin, and other consumers.

    The corresponding exports have been removed from @cloudflare/deploy-helpers. Consumers should import them directly from @cloudflare/workers-utils instead.

    Wrangler's unstable_printBindings API now accepts the bindings and an options object instead of five positional parameters.

  • #​15353 87a7acf Thanks @​pombosilva! - Add --date-start and --date-end filters to wrangler workflows instances list

    You can now narrow an instance listing to a creation-time window:

    wrangler workflows instances list my-workflow --date-start 2026-01-01 --date-end 2026-01-31

    Either flag can be used independently. Both accept an ISO 8601 date or timestamp and are normalised to UTC before being sent, so a date-only value such as 2026-01-01 works as well as a full 2026-01-01T13:00:00Z. The bounds are inclusive and compose with the existing --status filter.

  • #​15379 ea28cc3 Thanks @​ibbykhazanchi! - Add query string redaction to Workers observability configuration

    Set observability.redact_query_string in wrangler.json or observability.redactQueryString in the experimental cloudflare.config.ts format to remove query strings from request URLs in logs and traces.

  • #​14915 707cb6f Thanks @​longlho! - Include exact raw and gzip-compressed Worker bundle sizes in structured deploy and version-upload output.

Patch Changes
  • #​15436 200780f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260828.1 ^5.20260831.1
    workerd 1.20260828.1 1.20260831.1
  • #​15406 b3f2628 Thanks @​james-elicx! - Reduce the installed bundle sizes of Wrangler and Miniflare

    Wrangler now resolves bundled workspace dependencies from source during monorepo builds so unused exports can be removed. Miniflare, its shared CLI and container dependencies now use granular @cloudflare/workers-utils entry points instead of loading the package barrel, reducing the raw Wrangler and Miniflare artifacts by 6.16 MiB (31.4%) and 1.06 MiB (22.9%) respectively without changing runtime behavior or installed dependencies.

  • #​15398 1809c5e Thanks @​james-elicx! - Reduce Wrangler's published package size

    Stop including the unused build metafile in the npm package, reducing its unpacked size by approximately 3.1 MiB.

  • #​15382 b3fb2bf Thanks @​Om-singhaI! - Skip the skills install status lookup when telemetry is disabled

    Telemetry events include a currentAgentSkillsInstalled property, and computing it can query the GitHub API. The lookup used to start before the telemetry permission was checked, so users who opted out via WRANGLER_SEND_METRICS, DO_NOT_TRACK, or send_metrics in their Wrangler config still triggered network requests on behalf of telemetry. The dispatcher now checks the permission first and only performs the lookup when telemetry is enabled.

  • Updated dependencies [200780f, b3f2628, 87a7acf]:

v4.127.1

Compare Source

Patch Changes

v4.127.0

Compare Source

Minor Changes
  • #​15356 fe265f8 Thanks @​rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

    The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.

    {
      "workflows": [
        {
          "binding": "MY_WORKFLOW",
          "name": "my-workflow",
          "class_name": "MyWorkflow",
          "concurrency": { "limit": 10 }
        }
      ]
    }
Patch Changes
  • #​15367 412c79e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260825.1 ^5.20260826.1
    workerd 1.20260825.1 1.20260826.1
  • #​15375 92874f6 Thanks @​WillTaylorDev! - Upload wrangler preview modules as multipart form data

    wrangler preview used to base64 the bundle, its modules, and any sourcemaps into a single JSON request body. Base64 inflates content by a third, so a Worker with a large sourcemap could exceed the API request size limit and fail to deploy.

    The preview deployment request is now multipart/form-data. The deployment settings travel in a metadata part and each module follows as its own part carrying raw bytes, matching how wrangler deploy already uploads a Worker.

  • Updated dependencies [412c79e]:

v4.126.0

Compare Source

Minor Changes
  • #​15332 d1cc3af Thanks @​pombosilva! - Add default_retention to Workflow bindings for configuring how long instances are retained

    Workflow instances are retained for an account-wide default period after they finish. You can now set a per-Workflow default in your Wrangler configuration, applied to instances that do not specify their own retention:

    {
      "workflows": [
        {
          "binding": "MY_WORKFLOW",
          "name": "my-workflow",
          "class_name": "MyWorkflow",
          "default_retention": {
            "success_retention": "3 days",
            "error_retention": "7 days"
          }
        }
      ]
    }

    Each side is optional and accepts either a duration string such as "3 days" or a whole number of milliseconds. Durations are interpreted by the Workflows API, which also caps them at your account's retention limit.

  • #​15064 693ca29 Thanks @​tpmmorris! - Include a chronological list of handler events in email test harness results, so programmatic local email tests can assert the order in which messages are received, forwarded, replied to, or rejected.

    const result = await server.getWorker().email({
      from: "sender@example.com",
      to: "inbox@example.com",
      raw: [
        "From: Sender <sender@example.com>",
        "To: Inbox <inbox@example.com>",
        "Message-ID: <test@example.com>",
        "Subject: Test email",
        "",
        "Hello from the test harness",
      ].join("\r\n"),
    });
    
    expect(result.events).toEqual([
      { type: "received", timestamp: expect.any(String) },
      {
        type: "forward",
        timestamp: expect.any(String),
        messageId: expect.any(String),
      },
      {
        type: "reply",
        timestamp: expect.any(String),
        messageId: expect.any(String),
      },
    ]);
  • #​15065 ad89456 Thanks @​mtlemilio! - Add experimental wrangler hyperdrive planetscale signature for provisioning Cloudflare-billed PlanetScale databases

    wrangler hyperdrive planetscale signature prints a signed authorization as JSON, proving to PlanetScale that Cloudflare will be billed for the database you are about to create:

    npx wrangler hyperdrive planetscale signature | \
      pscale database create <name> \
        --org <org> \
        --engine postgresql \
        --cloudflare-billing @- \
        --format json

    pscale database create defaults to Vitess, so pass --engine postgresql for a Postgres database, and --format json is recommended when the output is consumed by an agent.

    This requires pscale v0.313.0 or newer. Wrangler authorizes the Cloudflare billing side only, so your PlanetScale credentials stay between you and pscale.

    The signature is a cryptographically signed token that authorizes creating a database billed to your Cloudflare account. Treat it as a credential and do not share it. Piping it, as above, is recommended over passing it as a command line argument.

    This command is experimental and its interface may change.

  • #​15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

    Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

  • #​15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

    The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

  • #​14966 a4c3458 Thanks @​yomna-shousha! - Add pull request metadata to wrangler preview deployments

    wrangler preview now detects the pull request associated with the current CI run (GitHub Actions, GitLab CI, CircleCI, and a generic PULL_REQUEST_URL/PR_URL/CHANGE_URL fallback) and attaches it, along with the repository URL, to the preview deployment as annotations (workers/pull_request_number, workers/pull_request_url, workers/repository_url).

    This is best effort: if no pull request can be detected, nothing changes. When a pull request is detected, its URL is now also shown in the wrangler preview command output.

  • #​15307 433fa98 Thanks @​for-the-kidz! - Add pull request title to wrangler preview deployment annotations

    wrangler preview now also detects the title of the pull/merge request associated with the current CI run (GitHub Actions and GitLab CI, plus a generic PULL_REQUEST_TITLE fallback) and attaches it to the preview deployment as the workers/pull_request_title annotation, alongside the existing pull request number/URL, repository URL, and commit SHA annotations.

    This is best effort: if no pull request title can be detected, nothing changes.

Patch Changes

v4.125.0

Compare Source

Minor Changes
  • #​14995 59872c4 Thanks @​ThomasRubini! - Add connect trigger for raw sockets

    You can now configure a Worker to receive raw socket connections during wrangler dev, delivered directly to the Worker's connect(socket, env, ctx) handler:

    {
      "connect": [{ "protocol": "tcp", "port": 5432 }]
    }

    Each entry opens a listening socket on 127.0.0.1 (or the given address) that forwards incoming connections straight to the Worker, bypassing the local dev HTTP entry point. This requires the experimental compatibility flag. Only "tcp" is supported at the moment.

    @cloudflare/config also supports declaring this trigger via triggers.connect(...), which lowers to the connect field above:

    import { defineWorker, triggers } from "@cloudflare/config";
    
    export default defineWorker({
      triggers: [
        triggers.connect({ protocol: "tcp", port: 5432, address: "127.0.0.1" }),
      ],
    });
  • #​15172 c68f9cb Thanks @​WillTaylorDev! - Add container support to worker previews

    Worker previews now support containers through a new previews.containers configuration block. Container configuration doesn't inherit, so declare containers explicitly in the previews block to enable them for previews. This mirrors how previews.durable_objects works today. Wrangler names each preview container application {worker_name}_{preview_slug}_{class_name}, normalising and shortening the result to what the API accepts. Either change appends a short digest of the composed name, so two names that would otherwise land on one stay distinct. An entry cannot set its own name, because application names are unique to an account and a fixed name would collide between two previews of the same Worker. A Durable Object class is backed by at most one container application, so the validator rejects two entries that share a class_name. Wrangler skips container applications bound to Durable Object classes that another Worker implements through script_name, because the implementing Worker owns its own container application. A binding is not required: a Durable Object declared through migrations or exports and reached only over ctx.exports can still back a container. Every entry must set class_name. A previews.containers entry whose class_name matches no Durable Object class at all is rejected before the preview deployment is created, so a typo fails loudly instead of producing a preview with no container.

    Wrangler creates the container applications on wrangler preview. Deleting a preview tears them down server side, so wrangler preview delete doesn't remove them.

    Container build and deploy progress prints to stdout. wrangler preview --json suppresses wrangler's own output so it doesn't interleave with the payload, and warnings and errors still go to stderr. Docker's build output and the progress spinner write to stdout directly and bypass that suppression, so parse --json from a non interactive shell, where the spinner is skipped, and prefer a prebuilt image over a Dockerfile.

  • #​15174 649f667 Thanks @​WillTaylorDev! - [private beta]: Create the parent Worker automatically when wrangler preview targets one that doesn't exist yet

    Previews hang off a parent Worker, so running wrangler preview before the Worker had ever been deployed failed with a raw API error naming the Preview endpoint. Wrangler now offers to create an empty parent Worker and then carries on creating the Preview. The parent uses the same workers.dev and Preview URL settings that wrangler deploy would resolve, without applying routes or cron triggers. In non-interactive environments, Wrangler creates the Worker without asking.

  • #​14735 30c2d47 Thanks @​vaishnav-mk! - Add individual and batch Workflow instance deletion to the runtime and SDK.

    • WorkflowInstance.delete() deletes one instance. Self-deletion stops the current execution.
    • env.MY_WORKFLOW.deleteBatch(instanceIds) deletes up to 100 instances and returns { deleted, errors } per input position.
    • wrangler workflows instances delete <name> [id..] deletes instances remotely or with --local; IDs can also come from a JSON array passed with --filename, with a combined limit of 100.
Patch Changes
  • #​15260 5ae9d5b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260815.1 ^5.20260816.1
    workerd 1.20260815.1 1.20260816.1
  • #​15264 4b52975 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260816.1 ^5.20260819.1
    workerd 1.20260816.1 1.20260819.1
  • #​15277 ce9b151 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260819.1 ^5.20260820.1
    workerd 1.20260819.1 1.20260820.1
  • #​15192 ef73a28 Thanks @​ondraulehla! - Fixes kv bulk put corrupting binary values written to local KV

    Values marked base64: true were stored incorrectly whenever they contained bytes that do not form valid UTF-8, which covers images, compressed data and most other binary payloads. A Worker reading such a key back under wrangler dev got a different, longer value than the one that was written: a 12 byte PNG header came back as 20 bytes.

    kv bulk put writes to local KV by default, so the plain command was the affected one. Remote writes were never affected, and neither were entries without base64 or values written with kv key put.

  • #​15284 39dcea6 Thanks @​emily-shen! - Move deploy output writing into shared deploy helpers

  • #​15130 99a1f49 Thanks @​emily-shen! - Remove unsupported remote configuration from Workflow bindings

    Workflow bindings no longer accept remote in configuration, as remote Workflow bindings have never actually been supported.

  • #​15278 f2437e6 Thanks @​Sosokker! - Fix the --temporary error on commands that authenticate more than one time

    wrangler d1 migrations apply --remote --temporary failed with this error: You're already authenticated with Cloudflare, so --temporary can't be used. The failure occurred with no login and with no CLOUDFLARE_API_TOKEN. This command authenticates one time for each statement that it runs. The first authentication makes a temporary preview account. The second authentication read the token of this new account as an earlier login.

    Wrangler now uses again the temporary account from the same command run. Commands that authenticate more than one time now work as wrangler deploy --temporary works. If real credentials are available, --temporary is still an error.

  • Updated dependencies [59872c4, 99a1f49, 5ae9d5b, 4b52975, ce9b151, 99a1f49, 99a1f49, 30c2d47]:

v4.124.0

Compare Source

Minor Changes
  • #​15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

    A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

    {
      "name": "my-worker",
      "main": "worker.js",
      "compatibility_date": "2026-07-01",
      "containers": [
        { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
      ],
      "exports": {
        "MyContainerDO": {
          "type": "durable-object",
          "storage": "sqlite",
          "container": "my-container"
        }
      }
    }

    The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

    container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

    • a container reference names a container that does not exist
    • two Durable Object exports claim the same container
    • a container and a Durable Object export disagree about which one they are linked to
    • a container ends up linked to no Durable Object at all
    • two containers share a name
    • a container's class_name names a Durable Object whose storage is legacy-kv
    • two containers are attached to the same Durable Object

    That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Chan

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: wrangler@4.130.0
npm ERR! Found: @cloudflare/workers-types@4.20260702.1
npm ERR! node_modules/@cloudflare/workers-types
npm ERR!   @cloudflare/workers-types@"4.20260702.1" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peerOptional @cloudflare/workers-types@"^5.20260908.1" from wrangler@4.130.0
npm ERR! node_modules/wrangler
npm ERR!   dev wrangler@"4.130.0" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: @cloudflare/workers-types@5.20260908.1
npm ERR! node_modules/@cloudflare/workers-types
npm ERR!   peerOptional @cloudflare/workers-types@"^5.20260908.1" from wrangler@4.130.0
npm ERR!   node_modules/wrangler
npm ERR!     dev wrangler@"4.130.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-09-08T18_22_46_244Z-debug-0.log

@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from b95c39b to 8181f70 Compare July 21, 2026 19:36
@renovate renovate Bot changed the title Update dependency wrangler to v4.112.0 Update dependency wrangler to v4.113.0 Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 8181f70 to c4b1b9f Compare July 23, 2026 19:32
@renovate renovate Bot changed the title Update dependency wrangler to v4.113.0 Update dependency wrangler to v4.114.0 Jul 23, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from c4b1b9f to 24d7b7e Compare July 25, 2026 02:40
@socket-security

socket-security Bot commented Jul 25, 2026

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Trivial package: npm @img/sharp-darwin-arm64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-darwin-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-darwin-x64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-darwin-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-arm@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-ppc64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-ppc64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-riscv64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-riscv64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-s390x has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-s390x@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-x64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linux-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-arm64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linuxmusl-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-x64 has 1 lines of code

Location: Package overview

From: pnpm-lock.yamlnpm/wrangler@4.130.0npm/@img/sharp-linuxmusl-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 3 times, most recently from 5014452 to b88b727 Compare July 28, 2026 20:58
@renovate renovate Bot changed the title Update dependency wrangler to v4.114.0 Update dependency wrangler to v4.115.0 Jul 28, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from b88b727 to 31b68bf Compare July 30, 2026 16:46
@renovate renovate Bot changed the title Update dependency wrangler to v4.115.0 Update dependency wrangler to v4.116.0 Jul 30, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 31b68bf to dfa3aca Compare July 31, 2026 11:07
@renovate renovate Bot changed the title Update dependency wrangler to v4.116.0 Update dependency wrangler to v4.117.0 Jul 31, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from dfa3aca to e739700 Compare July 31, 2026 17:55
@renovate renovate Bot changed the title Update dependency wrangler to v4.117.0 Update dependency wrangler to v4.118.0 Jul 31, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from 142d775 to c859640 Compare August 5, 2026 16:29
@renovate renovate Bot changed the title Update dependency wrangler to v4.118.0 Update dependency wrangler to v4.119.0 Aug 5, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from c0e4ce7 to 6b17de9 Compare August 7, 2026 11:40
@renovate renovate Bot changed the title Update dependency wrangler to v4.119.0 Update dependency wrangler to v4.120.0 Aug 7, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from eca1904 to 8de68dd Compare August 10, 2026 18:49
@renovate renovate Bot changed the title Update dependency wrangler to v4.120.0 Update dependency wrangler to v4.120.1 Aug 10, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 8de68dd to 4e2c27b Compare August 11, 2026 23:35
@renovate renovate Bot changed the title Update dependency wrangler to v4.120.1 Update dependency wrangler to v4.121.0 Aug 11, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 4e2c27b to 23c19f0 Compare August 12, 2026 05:14
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from f90f2d3 to c73b8fe Compare August 12, 2026 19:33
@renovate renovate Bot changed the title Update dependency wrangler to v4.121.0 Update dependency wrangler to v4.122.0 Aug 12, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from c73b8fe to 0e318af Compare August 13, 2026 17:13
@renovate renovate Bot changed the title Update dependency wrangler to v4.122.0 Update dependency wrangler to v4.123.0 Aug 13, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from 08867a9 to 36e195c Compare August 18, 2026 18:13
@renovate renovate Bot changed the title Update dependency wrangler to v4.123.0 Update dependency wrangler to v4.124.0 Aug 18, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 36e195c to 54596be Compare August 20, 2026 21:50
@renovate renovate Bot changed the title Update dependency wrangler to v4.124.0 Update dependency wrangler to v4.125.0 Aug 20, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from 479c516 to 2a97580 Compare August 25, 2026 23:16
@renovate renovate Bot changed the title Update dependency wrangler to v4.125.0 Update dependency wrangler to v4.126.0 Aug 25, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 2a97580 to 19009bf Compare August 27, 2026 08:38
@renovate renovate Bot changed the title Update dependency wrangler to v4.126.0 Update dependency wrangler to v4.127.0 Aug 27, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 19009bf to f47f60c Compare August 28, 2026 03:13
@socket-security

socket-security Bot commented Aug 28, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedwrangler@​4.107.1 ⏵ 4.130.0981009296 +1100

View full report

@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from f47f60c to 2c40d6c Compare August 28, 2026 20:37
@renovate renovate Bot changed the title Update dependency wrangler to v4.127.0 Update dependency wrangler to v4.127.1 Aug 28, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 2c40d6c to 3cae444 Compare September 1, 2026 18:59
@renovate renovate Bot changed the title Update dependency wrangler to v4.127.1 Update dependency wrangler to v4.128.0 Sep 1, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch 2 times, most recently from c64a494 to 5f1ff67 Compare September 4, 2026 00:46
@renovate renovate Bot changed the title Update dependency wrangler to v4.128.0 Update dependency wrangler to v4.129.0 Sep 4, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from 5f1ff67 to f36caf6 Compare September 7, 2026 17:11
@renovate renovate Bot changed the title Update dependency wrangler to v4.129.0 Update dependency wrangler to v4.129.1 Sep 7, 2026
@renovate
renovate Bot force-pushed the renovate/wrangler-4.x branch from f36caf6 to bf18e4e Compare September 8, 2026 18:23
@renovate renovate Bot changed the title Update dependency wrangler to v4.129.1 Update dependency wrangler to v4.130.0 Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants