chore(deps): update dependency wrangler to v4.42.0

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.28.0 -> 4.42.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.42.0

Compare Source

Minor Changes

• #​10735 103fbf0 Thanks @​petebacondarwin! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

Patch Changes

• #​10757 59d5911 Thanks @​dario-piotrowicz! - fix console.debug logs not being logged at the info level (as users expect)

• Updated dependencies [2594130]:

  • @​cloudflare/unenv-preset@​2.7.6

v4.41.0

Compare Source

Minor Changes

• #​10507 21a0bef Thanks @​dario-piotrowicz! - Add strict mode for the wrangler deploy command

  Add a new flag: --strict that makes the wrangler deploy command be more strict and not deploy workers when the deployment could be potentially problematic. This "strict mode" currently only affects non-interactive sessions where conflicts with the remote settings for the worker (for example when the worker has been re-deployed via the dashboard) will cause the deployment to fail instead of automatically overriding the remote settings.

• #​10710 7f2386e Thanks @​penalosa! - Add prompt to resource creation flow allowing for newly created resources to be remote.

Patch Changes

• #​10822 4c06766 Thanks @​edmundhung! - fix: skip banner when using --json flag in wrangler pages deployment commands

• #​10838 d3aee31 Thanks @​edmundhung! - fix: skip banner when using --json flag in wrangler queues subscription commands

• #​10829 59e8ef0 Thanks @​edmundhung! - fix: skip banner when using --json flag in wrangler pipelines commands

• #​10764 79a6b7d Thanks @​emily-shen! - containers: default max_instances to 20 instead of 1.

• #​10844 7a4d0da Thanks @​mikenomitch! - Adds new Container instance types, and rename dev to lite and standard to standard-1. The new instance_types are now:

  Instance Type	vCPU	Memory	Disk
  lite (previously dev)	1/16	256 MiB	2 GB
  basic	1/4	1 GiB	4 GB
  standard-1 (previously standard)	1/2	4 GiB	8 GB
  standard-2	1	6 GiB	12 GB
  standard-3	2	8 GiB	16 GB
  standard-4	4	12 GiB	20 GB

• #​10634 62656bd Thanks @​emily-shen! - fix: error if the container image uri has an account id that doesn't match the current account

• #​10761 886e577 Thanks @​petebacondarwin! - switch zone route warning to an info message

• #​10734 8d7f32e Thanks @​penalosa! - Improve formatting of logged errors in some cases

• #​10832 f9d37db Thanks @​petebacondarwin! - retry subdomain requests to be more resilient to flakes

• #​10770 835d6f7 Thanks @​danielrs! - Enabling or disabling workers_dev is often an indication that
  the user is also trying to enable or disable preview_urls. Warn the
  user when these enter mixed state.

• #​10764 79a6b7d Thanks @​emily-shen! - fix: respect the log level set by wrangler when logging using @​cloudflare/cli

• Updated dependencies [c8d5282, bffd2a9]:

  • miniflare@​4.20251001.0

v4.40.3

Compare Source

Patch Changes

• #​10602 ff82d80 Thanks @​tukiminya! - fix: update Secrets Store command status from alpha to open-beta

• #​10623 7a6381c Thanks @​IRCody! - Handle more cases for correctly resolving the full uri for an image when using containers push.

• #​10779 325d22e Thanks @​hoodmane! - Add fallthrough: true for python_modules data rule

• #​10112 8d07576 Thanks @​devin-ai-integration! - fix: allow Workflow bindings when calling getPlatformProxy()

  Workflow bindings are not supported in practice when using getPlatformProxy().
  But their existence in a Wrangler config file should not prevent other bindings from working.
  Previously, calling getPlatformProxy() would crash if there were any Workflow bindings defined.
  Now, instead, you get a warning telling you that these bindings are not available.

• #​10769 0a554f9 Thanks @​penalosa! - Mark more errors as UserError to disable Sentry reporting

• #​10679 6244a9e Thanks @​KianNH! - Fix rendering for nested objects in containers list and containers info [ID]

• #​10785 d09cab3 Thanks @​pombosilva! - Workflows names and instance IDs are now properly validated with production limits.

• Updated dependencies [6ff41a6, 0c208e1, 2432022, d0801b1, 0a554f9]:

  • miniflare@​4.20250927.0
  • @​cloudflare/unenv-preset@​2.7.5

v4.40.2

Compare Source

Patch Changes

• #​10771 b455281 Thanks @​penalosa! - Fix Worker Loader binding type

v4.40.1

Compare Source

Patch Changes

• #​10668 a57149f Thanks @​danielrs! - Support the deletion of secrets with complex names

v4.40.0

Compare Source

Minor Changes

• #​10743 a7ac751 Thanks @​jonesphillip! - Changes --fileSizeMB to --file-size for wrangler r2 bucket catalog compaction command.
  Small fixes for pipelines commands.

Patch Changes

• #​10706 81fd733 Thanks @​1000hz! - Fixed an issue that caused some Workers to have an incorrect service tag applied when using a redirected configuration file (as used by the Cloudflare Vite plugin). This resulted in these Workers not being correctly grouped with their sibling environments in the Cloudflare dashboard.

• Updated dependencies [06e9a48]:

  • miniflare@​4.20250924.0

v4.39.0

Compare Source

Minor Changes

• #​10647 555a6da Thanks @​efalcao! - VPC service binding support

• #​10612 97a72cc Thanks @​jonesphillip! - Added new pipelines commands (pipelines, streams, sinks, setup), moved old pipelines commands behind --legacy

• #​10652 acd48ed Thanks @​edmundhung! - Rename Hyperdrive local connection string environment variable from WRANGLER_HYPERDRIVE_LOCAL_CONNECTION_STRING_<BINDING_NAME> to CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_<BINDING_NAME>. The old variable name is still supported but will now show a deprecation warning.

• #​10721 55a10a3 Thanks @​penalosa! - Stabilise Worker Loader bindings

Patch Changes

• #​10724 b4a4311 Thanks @​penalosa! - Use Cap'n Web in workers-sdk

• #​10701 dc1d0d6 Thanks @​penalosa! - Fix hotkeys double render

• Updated dependencies [555a6da, 262393a, 3ec1f65, a434352, 328e687, b4a4311]:

  • miniflare@​4.20250923.0

v4.38.0

Compare Source

Minor Changes

• #​10654 a4e2439 Thanks @​laplab! - Switch to WRANGLER_R2_SQL_AUTH_TOKEN env variable for R2 SQL secret. Update the response format for R2 SQL

• #​10676 f76da43 Thanks @​penalosa! - Support ctx.exports in wrangler types

• #​10651 6caf938 Thanks @​edevil! - Added new attribute "allowed_sender_addresses" to send email binding.

Patch Changes

• #​10674 1cc258e Thanks @​penalosa! - Fix remote/local display for KV/D1/R2 & Browser bindings

• #​10678 b30263e Thanks @​penalosa! - Remove dummy auth from SDK setup

• #​10678 b30263e Thanks @​penalosa! - Add WRANGLER_TRACE_ID environment variable to support internal testing

• #​10561 769ffb1 Thanks @​danielrs! - Do not show subdomain status mismatch warnings on first deploy.

• Updated dependencies [b59e3e1, e9b0c66, 6caf938, 88132bc]:

  • miniflare@​4.20250917.0
  • @​cloudflare/unenv-preset@​2.7.4

v4.37.1

Compare Source

Patch Changes

• #​10658 3029b9a Thanks @​1000hz! - Fixed an issue with service tags not being applied properly to Workers when the Wrangler configuration file did not include a top-level name property.

• #​10657 31ec996 Thanks @​penalosa! - Disable remote bindings with the --local flag

• Updated dependencies [783afeb]:

  • miniflare@​4.20250913.0

v4.37.0

Compare Source

Minor Changes

• #​10546 d53a0bc Thanks @​1000hz! - On deploy or version upload, Workers with multiple environments are tagged with metadata that groups them together in the Cloudflare Dashboard.

• #​10596 735785e Thanks @​penalosa! - Add Miniflare & Wrangler support for unbound Durable Objects

• #​10622 15c34e2 Thanks @​nagraham! - Modify R2 Data Catalog compaction commands to enable/disable for Catalog (remove table/namespace args), and require Cloudflare API token on enable.

Patch Changes

• Updated dependencies [735785e]:
  • miniflare@​4.20250906.2

v4.36.0

Compare Source

Minor Changes

• #​10604 135e066 Thanks @​penalosa! - Enable Remote Bindings without the need for the --x-remote-bindings flag

• #​10558 30f558e Thanks @​laplab! - Add commands to send queries and manage R2 SQL product.

• #​10574 d8860ac Thanks @​efalcao! - Add support for VPC services CRUD via wrangler vpc service

• #​10119 336a75d Thanks @​dxh9845! - Add support for dynamically loading 'external' Miniflare plugins for unsafe Worker bindings (developed outside of the workers-sdk repo)

Patch Changes

• #​10212 0837a8d Thanks @​jamesopstad! - Add preserveOriginalMain option to unstable_readConfig. This will pass the original main value through, without converting it to an absolute path.

• #​10541 da24079 Thanks @​qjex! - stable ratelimit binding

  Rate Limiting in Workers is now generally available, ratelimit can be removed from unsafe bindings.

• #​10479 ffa2600 Thanks @​nagraham! - feat: Add wrangler commands for the R2 Data Catalog compaction feature

• #​9955 51553ef Thanks @​penalosa! - Integrate the Cloudflare SDK into Wrangler (internal refactor)

• Updated dependencies [e2b838f, 336a75d]:

  • miniflare@​4.20250906.1

v4.35.0

Compare Source

Minor Changes

• #​10491 5cb806f Thanks @​zebp! - Add traces, OTEL destinations, and configurable persistence to observability settings

  Adds a new traces field to the observability settings in your Worker configuration that configures the behavior of automatic tracing. Both traces and logs support providing a list of OpenTelemetry compliant destinations where your logs/traces will be exported to as well as an implicitly-enabled persist option that controls whether or not logs/traces are persisted to the Cloudflare observability platform and viewable in the Cloudflare dashboard.

Patch Changes

• #​10571 4e49d3e Thanks @​dario-piotrowicz! - add missing type for send_email's experimental_remote field

• #​10534 dceb550 Thanks @​dario-piotrowicz! - update unstable_convertConfigBindingsToStartWorkerBindings to prioritize preview config values

  Ensure that if some bindings include preview values (e.g. preview_database_id for D1 bindings) those get used instead of the standard ones (since these are the ones that start worker should be using)

• #​10552 3b78839 Thanks @​vicb! - Bump unenv to 2.0.0-rc.21

• Updated dependencies [dac302c, 3b78839]:

  • miniflare@​4.20250906.0
  • @​cloudflare/unenv-preset@​2.7.3

v4.34.0

Compare Source

Minor Changes

• #​10478 cc47b51 Thanks @​danielrs! - Beta feature preview_urls is now disabled by default.

  This change makes preview_urls disabled by default when it's not provided, making
  the feature opt-in instead of opt-out.

Patch Changes

• #​10489 6e8dd80 Thanks @​WalshyDev! - Allow Wrangler to upload 100,000 assets inline with the newly increased Workers Paid limit.

• #​10517 7211609 Thanks @​edmundhung! - fix: wrangler vectorize list-vectors --json now output valid json without an extra log line

• #​10527 818ce22 Thanks @​vicb! - Bump unenv to 2.0.0-rc.20

  The latest release include a fix for node:tty default export.
  See the changelog for full details.

• #​10519 5d69df4 Thanks @​dario-piotrowicz! - Slightly improve wrangler init --from-dash error message

• #​10519 5d69df4 Thanks @​dario-piotrowicz! - Internally refactor diffing and wrangler init --from-dash logic

• #​10533 c22acc6 Thanks @​emily-shen! - If unset, containers.max_instances should default to 1 instead of 0.

• #​10503 c0fad5f Thanks @​ichernetsky-cf! - Support setting container affinities

• #​10515 c6a39f5 Thanks @​emily-shen! - fix: script should be accepted as a positional arg in the versions upload command

• Updated dependencies [4cb3370, 818ce22, cb22f5f, a565291]:

  • miniflare@​4.20250902.0
  • @​cloudflare/unenv-preset@​2.7.2

v4.33.2

Compare Source

Patch Changes

• #​10401 3c15bbb Thanks @​dario-piotrowicz! - improve diff lines ordering in remote deploy config diffing logic

• #​10520 dc81221 Thanks @​emily-shen! - fix: wrangler deploy dry run should not require you to be logged in

  Fixes a bug where if you had a container where the image was an image registry link, dry run would require you to be logged in.
  Also fixes a bug where container deployments were not respecting account_id set in Wrangler config.

• #​10393 4492eb0 Thanks @​dario-piotrowicz! - Use resolved local config for remote deploy config diffing logic

• Updated dependencies [31ecfeb, f656d1a, 22c8ae6, bd21fc5, 38bdb78, 4851955]:

  • @​cloudflare/unenv-preset@​2.7.1
  • miniflare@​4.20250829.0

v4.33.1

Compare Source

Patch Changes

• #​10427 85be2b6 Thanks @​dario-piotrowicz! - Simplify ENOENT debug logs for .env files

• Updated dependencies [76d9aa2, 452ad0b, 7c339ae]:

  • @​cloudflare/unenv-preset@​2.7.0
  • miniflare@​4.20250823.1

v4.33.0

Compare Source

Minor Changes

• #​10414 e81c2cf Thanks @​penalosa! - Support automatically updating the user's config file with newly created resources

Patch Changes

• #​10424 c4fd176 Thanks @​penalosa! - Remove the --experimental-json-config/-j flag, which is no longer required.

• #​10432 19e2aab Thanks @​anonrig! - Remove "node:tls" polyfill

• #​10424 c4fd176 Thanks @​penalosa! - Expose global flags from experimental_getWranglerCommands()

• Updated dependencies [19e2aab]:

  • @​cloudflare/unenv-preset@​2.6.3
  • miniflare@​4.20250823.0

v4.32.0

Compare Source

Minor Changes

• #​10354 da40571 Thanks @​edmundhung! - Enable cross-process communication for wrangler dev with multiple config files

  Workers running in separate wrangler dev sessions can now communicate with each other regardless of whether you are running with single or multiple config files.

  Check out the Developing with multiple Workers guide to learn more about the different approaches and when to use each one.

• #​10012 4728c68 Thanks @​penalosa! - Support unsafe dynamic worker loading bindings

Patch Changes

• #​10245 d304055 Thanks @​edmundhung! - Migrate wrangler dev to use Miniflare dev registry implementation

  Updated wrangler dev to use a shared dev registry implementation that now powers both the Cloudflare Vite plugin and Wrangler. This internal refactoring has no user-facing changes but consolidates registry logic for better consistency across tools.

• #​10407 f534c0d Thanks @​emily-shen! - default containers.rollout_active_grace_period to 0

• #​10425 0a96e69 Thanks @​dario-piotrowicz! - Fix debugging logs not including headers for CF API requests and responses

  Fix the fact that wrangler, when run with the WRANGLER_LOG=DEBUG and WRANGLER_LOG_SANITIZE=false environment variables, displays {} instead of the actual headers for requests and responses for CF API fetches

• #​10337 f9f7519 Thanks @​emily-shen! - containers: rollout_step_percentage now also accepts an array of numbers. Previously it accepted a single number, and each rollout step would target the same percentage of instances. Now users can customise percentages for each step.

  rollout_step_percentage also now defaults to [10,100] (previously 25), which should make rollouts progress slightly faster.

  You can also use wrangler deploy --containers-rollout=immediate to override rollout settings in Wrangler configuration and update all instances in one step. Note this doesn't override rollout_active_grace_period if configured.

• Updated dependencies [4728c68]:

  • miniflare@​4.20250816.1

v4.31.0

Compare Source

Minor Changes

• #​10314 9b09751 Thanks @​dario-piotrowicz! - Show possible local vs. dashboard diff information on deploys

  When re-deploying a Worker using wrangler deploy, if the configuration has been modified in the Cloudflare dashboard, the local configuration will overwrite the remote one. This can lead to unexpected results for users. To address this, currently wrangler deploy warns users about potential configuration overrides (without presenting them) and prompts them to confirm whether they want to proceed.

  The changes here improve the above flow in the following way:

  • If the local changes only add new configurations (without modifying or removing existing ones), the deployment proceeds automatically without warnings or prompts, as these changes are non-destructive and safe.
  • If the local changes modify or remove existing configurations, wrangler deploy now displays a git-like diff showing the differences between the dashboard and local configurations. This allows users to review and understand the impact of their changes before confirming the deployment.

• #​10334 cadf19a Thanks @​jonesphillip! - Added queues subscription command to Wrangler including create, update, delete, get, list

Patch Changes

• #​10374 20520fa Thanks @​edmundhung! - Simplify debug package resolution with nodejs_compat

  A patched version of debug was previously introduced that resolved the package to a custom implementation. However, this caused issues due to CJS/ESM interop problems. We now resolve the debug package to use the Node.js implementation instead.

• #​10249 875197a Thanks @​penalosa! - Support JSRPC for remote bindings. This unlocks:

  • JSRPC over Service Bindings
  • JSRPC over Dispatch Namespace Bindings
  • Email
  • Pipelines

• Updated dependencies [565c3a3, ddadb93, 20520fa, 875197a]:

  • miniflare@​4.20250816.0
  • @​cloudflare/unenv-preset@​2.6.2

v4.30.0

Compare Source

Minor Changes

• #​10341 76a6701 Thanks @​garvit-gupta! - feat: Add Wrangler command for Vectorize list-vectors operation

Patch Changes

• #​10217 979984b Thanks @​veggiedefender! - Increase the maxBuffer size for capnp uploads

• #​10356 80e964c Thanks @​WillTaylorDev! - fix: Update regex for valid branch name to remove 61 char length requirement, allowing for longer branch names to be specified for preview aliases.

• #​10289 a5a1426 Thanks @​emily-shen! - Cleanup container images created during local dev if no changes have been made.

  We now untag old images that were created by Wrangler/Vite if we find that the image content and configuration is unchanged, so that we don't keep accumulating image tags.

• #​10315 0c04da9 Thanks @​emily-shen! - Add rollout_active_grace_period option to containers configuration.

  This allows users to configure how long an active container should keep running for during a rollout, before the upgrade is applied.

• #​10321 b524a6f Thanks @​emily-shen! - print prettier errors during container deployment

• #​10253 eb32a3a Thanks @​emily-shen! - fix redeploying container apps when previous deploy failed or container (but not image) was deleted.

  Previously this failed with No changes detected but no previous image found as we assumed there would be a previous deployment when an image exists in the registry.

• #​9990 4288a61 Thanks @​penalosa! - Fix startup profiling when sourcemaps are enabled

• Updated dependencies [d54d8b7, ae0c806]:

  • miniflare@​4.20250813.1

v4.29.1

Compare Source

Patch Changes

• Updated dependencies [5020694]:
  • miniflare@​4.20250813.0

v4.29.0

Compare Source

Minor Changes

• #​10283 80960b9 Thanks @​WillTaylorDev! - Support long branch names in generation of branch aliases in WCI.

• #​10312 bd8223d Thanks @​devin-ai-integration! - Added --domain flag to wrangler deploy command for deploying to custom domains. Use --domain example.com to deploy directly to a custom domain without manually configuring routes.

• #​8318 8cf47f9 Thanks @​gnekich! - Introduce json output flag for wrangler pages deployment list

Patch Changes

• #​10232 e7cae16 Thanks @​emily-shen! - fix: validate wrangler containers delete ID to ensure a valid ID has been provided. Previously if you provided the container name (or any non-ID shaped string) you would get an auth error instead of a 404.

• #​10139 3b6ab8a Thanks @​dom96! - Removes mention of cf-requirements when Python Workers are enabled

• #​10259 c58a05c Thanks @​dario-piotrowicz! - Ensure that maybeStartOrUpdateRemoteProxySession considers the potential account_id from the user's wrangler config

  Currently if the user has an account_id in their wrangler config file, such id won't be taken into consideration for the remote proxy session, the changes here make sure that it is (note that the auth option of maybeStartOrUpdateRemoteProxySession, if provided, takes precedence over this id value).

  The changes here also fix the same issue for wrangler dev and getPlatformProxy (since they use maybeStartOrUpdateRemoteProxySession under the hook).

• #​10288 42aafa3 Thanks @​tgarg-cf! - Do not attempt to update queue producer settings when deploying a Worker with a queue binding

  Previously, each deployed Worker would update a subset of the queue producer's settings for each queue binding, which could result in broken queue producers or at least conflicts where different Workers tried to set different producer settings on a shared queue.

• #​10242 70bd966 Thanks @​devin-ai-integration! - Add experimental API to expose Wrangler command tree structure for documentation generation

• #​10258 d391076 Thanks @​nikitassharma! - Add the option to allow all tiers when creating a container

• #​10248 422ae22 Thanks @​emily-shen! - fix: re-push container images on deploy even if the only change was to the Dockerfile

• #​10179 5d5ecd5 Thanks @​pombosilva! - Prevent defining multiple workflows with the same "name" property in the same wrangler file

• #​10232 e7cae16 Thanks @​emily-shen! - include containers API calls in output of WRANGLER_LOG=debug

• #​10243 d481901 Thanks @​devin-ai-integration! - Remove async_hooks polyfill - now uses native workerd implementation

  The async_hooks module is now provided natively by workerd, making the polyfill unnecessary. This improves performance and ensures better compatibility with Node.js async_hooks APIs.

• #​10060 9aad334 Thanks @​edmundhung! - refactor: switch getPlatformProxy() to use Miniflare's dev registry implementation

  Updated getPlatformProxy() to use Miniflare's dev registry instead of Wrangler's implementation. Previously, you had to start a wrangler or vite dev session before accessing the proxy bindings to connect to those workers. Now the order doesn't matter.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Package Changes Through 5aa1038

There are 2 changes which include create-tauri-app with patch, create-tauri-app-js with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
create-tauri-app	4.6.2	4.6.3
create-tauri-app-js	4.6.2	4.6.3

Add another change file through the GitHub UI by following this link.

---

Read about change files or the docs at github.com/jbolda/covector

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​wrangler@​4.28.0 ⏵ 4.42.0	+3		+7	+5

View full report