chore(deps): update dependency miniflare to v4 by renovate[bot] · Pull Request #63 · intlify/utils

renovate · 2025-11-09T15:34:49Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
miniflare (source)	`^3.20250718.3` → `^4.0.0`

Release Notes

cloudflare/workers-sdk (miniflare)

`v4.20260721.0`

Compare Source

Minor Changes

#14742 34430b3 Thanks @pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

#14715 42af66d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260714.1 ^5.20260721.1

workerd 1.20260714.1 1.20260721.1
#14766 4815711 Thanks @gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

`v4.20260714.0`

Compare Source

Minor Changes

#14562 9f04a7e Thanks @martijnwalraven! - Add a handleUncaughtError shared option that receives uncaught Worker exceptions

The runtime catches handler exceptions to build the 500 response, so they never reach the inspector — the one place an uncaught exception exists as a structured value in Node is the pretty-error path, where the error report from the Worker is revived into a source-mapped Error. Embedders can now pass handleUncaughtError: (error: Error) => void to observe that revived error programmatically; logging behavior is unchanged.

The hook fires only where the pretty-error path does: requests reaching the Worker through the entry socket (a browser or another HTTP client against the dev server). dispatchFetch() is unaffected — it always sets MF-Disable-Pretty-Error, and the entry worker then propagates the exception by rejecting the returned promise instead, so dispatchFetch() callers already receive the error directly and the hook is not invoked.

#14706 cb6c3f9 Thanks @edmundhung! - Add Durable Object storage access to createTestHarness()

You can now execute SQL against a SQLite-backed Durable Object to seed or assert the storage state.

const server = createTestHarness({
  workers: [{ configPath: "./wrangler.json" }],
});
await server.listen();

const worker = server.getWorker();
const storage = await worker.getDurableObjectStorage("COUNTER", {
  name: "user-123",
});

await worker.fetch("/counter/user-123");

const rows = await storage.exec(
  "SELECT value FROM counters WHERE id = ?",
  "user-123"
);
expect(rows).toEqual([{ value: 1 }]);

Patch Changes

#14417 34e696d Thanks @matthewdavidrodgers! - Improve asset serving performance by removing an unnecessary internal dispatch hop

Asset requests and RPC calls now avoid an extra internal forwarding layer, reducing latency. The forwarding infrastructure is preserved for future use by cohort-based deployments.
#14682 d39ae01 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260710.1 ^5.20260714.1

workerd 1.20260710.1 1.20260714.1
#14562 9f04a7e Thanks @martijnwalraven! - Keep reporting uncaught Worker errors when a stack frame's file URL has no local path

fileURLToPath throws on file:// URLs that cannot be represented as a local path (a non-local host; on Windows, any drive-less path — which is every file:///... URL reported by a POSIX-built bundle). Both the source-mapping machinery and youch's error-page frame parsing convert stack-frame specifiers this way, so one such frame previously failed the whole pretty-error request: the error page was replaced by a raw Node stack, the error was not logged, and handleUncaughtError did not fire. Source mapping now degrades to the unmapped stack and the pretty page falls back to a plain stack response instead.
#14418 cb30df3 Thanks @matthewdavidrodgers! - Improve routing performance for Workers with assets

Reduce request handling latency by streamlining the router Worker's request path. The loopback infrastructure remains available for future use.
#14727 3f3afbb Thanks @ascorbic! - Prevent local Browser Rendering teardown from hanging when Chrome does not exit

Miniflare now bounds graceful Chrome shutdown and forcefully terminates the browser process tree when needed, preventing disposal from waiting indefinitely.
#14723 e6fbc4e Thanks @ascorbic! - Prevent concurrent Miniflare instances from deleting each other's temporary email sessions

Email session cleanup now removes only the current instance's session directory and leaves the shared parent intact, avoiding startup failures when multiple local runtimes use the same project.

`v4.20260710.0`

Compare Source

Minor Changes

#14602 7692a61 Thanks @edmundhung! - Add unsafeEvictDurableObject() for targeted Durable Object eviction

This lets users verify how a Durable Object recovers after its instance is torn down.
#14602 7692a61 Thanks @edmundhung! - Allow listDurableObjectIds() to accept Durable Object class names as well as binding names.

Patch Changes

#14627 ed33326 Thanks @tpmmorris! - Add convenient logging for worker emails in the project directory. In addition to the system's temp directory, logs for emails sent by workers are also written to a local temp directory defined by the calling process, e.g for an simple text email sent via Wrangler this is .wrangler/tmp/email/<session>/email-text/<message-uuid>.txt (and related files) in the project root. Callers of Miniflare can control this location via the new defaultProjectTmpPath option, which Wrangler and Vite plugin now set automatically.
#14642 018574b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260708.1 ^5.20260710.1

workerd 1.20260708.1 1.20260710.1

`v4.20260708.1`

Compare Source

Minor Changes

#14535 1b965c5 Thanks @Naapperas! - Support dynamic retry delays for Workflow steps in local dev

A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.
```
await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);
```
The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

`v4.20260708.0`

Compare Source

Minor Changes

#14489 e3f0cd6 Thanks @edmundhung! - Add listDurableObjectIds() to Miniflare

Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.
#14465 2fedb1f Thanks @vaishnav-mk! - Add rollback support when terminating Workflow instances

WorkflowInstance.terminate({ rollback: true }) now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via wrangler workflows instances terminate --rollback, including local mode.

The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.

Patch Changes

#14596 8511ddf Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260706.1 1.20260708.1

@cloudflare/workers-types ^5.20260706.1 ^5.20260708.1

`v4.20260706.0`

Compare Source

Patch Changes

#14567 0852346 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler", "create-cloudflare"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260702.1 1.20260706.1

@cloudflare/workers-types 4.20260702.1 5.20260706.1

`v4.20260702.0`

Compare Source

Minor Changes

#14469 e7e5780 Thanks @connyay! - Support Queues across separate local dev processes

Queue producers can now send messages to consumers running in a separate local dev process. Messages produced before the consumer process has registered, or while it is down or reloading, are dropped rather than buffered, with a debug-level log emitted.

Patch Changes

#14514 d88555e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260701.1 1.20260702.1
#14492 1ac96a1 Thanks @penalosa! - Replace the CommonJS xdg-app-paths dependency with a vendored pure-ESM implementation

xdg-app-paths (and its xdg-portable/os-paths dependencies) are CommonJS only, which caused "Dynamic require of 'path' is not supported" errors when the surrounding code was bundled to ESM. The global config/cache directory resolution is now provided by a small, dependency-free pure-ESM module in @cloudflare/workers-utils that reproduces the previous path resolution exactly (verified against the real package in unit tests), so existing config and credential locations are unchanged. This also drops the transitive fsevents optional dependency that xdg-app-paths pulled in.

Miniflare and create-cloudflare now consume the shared helpers from @cloudflare/workers-utils instead of maintaining their own copies, importing node-only leaf entry points (@cloudflare/workers-utils/fs-helpers, @cloudflare/workers-utils/global-wrangler-config-path) where ESM bundling is required.
#14572 f416dd9 Thanks @petebacondarwin! - Key local rate limit counters by namespace_id instead of binding name

wrangler dev and Miniflare previously tracked each rate limit binding's counter by its binding name, so two bindings that referenced the same namespace_id were treated as separate limiters. Counters are now keyed by namespace_id, matching production: bindings that share a namespace_id share a limit, while distinct namespaces stay isolated. This also re-enables rate limit bindings in multiworker wrangler dev sessions, where they were previously stripped from secondary Workers to avoid a startup crash.
#14409 16fbf81 Thanks @matingathani! - reset() from cloudflare:test now resets ratelimit binding state between tests. Previously, RATE_LIMITERS bindings retained their in-memory bucket counts across test boundaries, causing later tests in the same file to see stale rate-limit exhaustion state.

`v4.20260701.0`

Compare Source

Patch Changes

#14502 6b0ce98 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260630.1 1.20260701.1

`v4.20260630.0`

Compare Source

Patch Changes

#14490 75d8cb0 Thanks @petebacondarwin! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260625.1 1.20260629.1
#14478 f10d4ad Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260629.1 1.20260630.1
#14490 75d8cb0 Thanks @petebacondarwin! - Fix edge cases on the local R2 public bucket endpoint (/cdn-cgi/local/r2/public) to match r2.dev: write methods are rejected with 401, malformed/multiple/inverted ranges with 400 and unsatisfiable ranges (including bytes=-0) with 416, Range is honored on HEAD requests with a bodyless 206, Content-Range is correct for suffix ranges, object keys are percent-decoded exactly once (keys containing a literal % no longer fail), and objects stored without a content type are served as application/octet-stream instead of omitting the Content-Type header. Unread object bodies are also cancelled (on HEAD and unsatisfiable-range responses) instead of leaking a read stream until garbage collection.

#14490 75d8cb0 Thanks @petebacondarwin! - Add Workflow introspection to createTestHarness()

Worker handles can now introspect Workflow bindings by name, allowing tests to disable sleeps, mock step results, and wait for Workflow outcomes. Tests can introspect a known Workflow instance by ID or track instances created after introspection starts.

const harness = createTestHarness({
	workers: [{ configPath: "./wrangler.json" }],
});

const worker = harness.getWorker();
await using workflow = await worker.introspectWorkflow("MY_WORKFLOW");

await workflow.modifyAll((modifier) =>
	modifier.disableSleeps([{ name: "wait-for-approval" }])
);

const response = await worker.fetch("/start-workflow");
const [instance] = await workflow.get();
await instance.waitForStatus("complete");

`v4.20260625.0`

Compare Source

Patch Changes

#14406 3b743c1 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260623.1 1.20260625.1

`v4.20260623.0`

Compare Source

Patch Changes

#14364 a085dec Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260617.1 1.20260619.1
#14383 9a0de8f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260619.1 1.20260621.1
#14397 fab565f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260621.1 1.20260623.1

`v4.20260617.1`

Compare Source

Patch Changes

#14118 b38823f Thanks @aicayzer! - Fix Uint8Array step outputs in local Workflows being persisted with the full backing ArrayBuffer

A Uint8Array returned from a Workflows step under wrangler dev was serialised together with its full underlying ArrayBuffer, causing a raw SQLITE_TOOBIG error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from crypto.getRandomValues or arr.slice(...) on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes #14101.

`v4.20260617.0`

Compare Source

Patch Changes

#14347 673b09e Thanks @jamesopstad! - Update undici from 7.24.8 to 7.28.0
#14346 e930bd4 Thanks @haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.
#14314 5c3bb11 Thanks @harryzcy! - Bump esbuild to 0.28.1

This update includes several bug fixes from esbuild versions 0.27.3 through 0.28.1. See the esbuild changelog for details.
#14331 296ad65 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260616.1 1.20260617.1

`v4.20260616.0`

Compare Source

Minor Changes

#14221 0e055d3 Thanks @mglewis! - Support cf.image (transform via Workers) image transformations in local dev

fetch(url, { cf: { image: { ... } } }) now transforms images locally via Sharp, instead of returning the original bytes unchanged. This mirrors the production "transform via Workers" feature, so Workers already using cf.image behave much more closely to production in wrangler dev.

As with the Images binding, cf.image transforms require Sharp to be installed — transforms are silently skipped if Sharp is unavailable.

Patch Changes

#14271 27db82c Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260611.1 1.20260612.1
#14298 2a6a26b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260612.1 1.20260615.1
#14317 9a424ed Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260615.1 1.20260616.1
#14287 41f391f Thanks @edmundhung! - Improve errors for missing resource bindings

When methods like getKVNamespace() or getR2Bucket() are called with a binding name that is not configured for that resource type, Miniflare now reports the expected binding type in the error message.

`v4.20260611.0`

Compare Source

Minor Changes

#14119 2047a32 Thanks @tahmid-23! - Add support for serving R2 bucket objects publicly via the dev server

Each local R2 bucket is now exposed under /cdn-cgi/local/r2/public/<bucket-id>/<key> on the existing user-facing dev server. The <bucket-id> is the bucket's id when set, otherwise its binding name. Buckets with a remoteProxyConnectionString are not exposed. The endpoint supports GET and HEAD, range requests, conditional headers, and forwards stored HTTP metadata.

Patch Changes

#14246 f3990b2 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260609.1 1.20260610.1
#14256 4597f08 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260610.1 1.20260611.1

`v4.20260609.0`

Compare Source

Patch Changes

#14192 d076bcc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260603.1 1.20260605.1
#14217 24497d0 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260605.1 1.20260608.1
#14231 4bb572f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260608.1 1.20260609.1
#14177 48c4ff0 Thanks @ktKongTong! - Enable local scheduled handler dispatch for Workers + Assets (#9882)

It is now possible to trigger a scheduled handler on a Worker that has assets.

`v4.20260603.0`

Compare Source

Minor Changes

#14164 b502d54 Thanks @G4brym! - Rename the web_search binding kind to websearch

Pre-launch rename of the public binding type from web_search to websearch so the on-the-wire shape matches the product name (Web Search). The wrangler config key, the binding-type string sent to the Cloudflare API, and the miniflare option key all move from web_search / webSearch to websearch.

Update your wrangler config:
```
- "web_search": { "binding": "WEBSEARCH" }
+ "websearch": { "binding": "WEBSEARCH" }
```
The runtime WebSearch type exposed on env.WEBSEARCH is unchanged.
#13863 3b8b80a Thanks @aslakhellesoy! - Support cross-worker workflow bindings via the dev registry

When a workflow binding has a scriptName that refers to a worker registered in another Miniflare instance (via unsafeDevRegistryPath), miniflare now reroutes the engine's USER_WORKFLOW binding through the dev-registry-proxy worker — the same mechanism Durable Objects already use for cross-worker scriptName bindings.

Previously the workflow engine was bound directly to a local service core:user:<scriptName>, so workerd refused to start when that script lived in a different process.

This unblocks getPlatformProxy() (and any other split-Miniflare setup) for users whose workflow class is defined in a separate worker — for example SvelteKit/Remix on Cloudflare, where adapter-cloudflare's dev integration runs the user's worker in a sidecar.

See #7459.

Patch Changes

#14175 a3eea27 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260601.1 1.20260603.1
#14081 1fdd8de Thanks @dario-piotrowicz! - Detect early workerd exit instead of hanging indefinitely

When workerd exits during startup before writing all expected listen events to the control file descriptor (e.g. due to an IPv6 bind failure, permission error, or missing library), Miniflare's waitForPorts() would block forever. This caused wrangler dev to stall at "Starting local server..." with no error and no timeout.

The fix races waitForPorts() against the child process exit event so that any unexpected workerd termination is detected immediately. When workerd exits early, Miniflare now throws ERR_RUNTIME_FAILURE with the runtime's stderr output included in the error message, making the root cause diagnosable without external tools.

`v4.20260601.0`

Compare Source

Patch Changes

#14147 e06cbb7 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260529.1 1.20260601.1
#14086 4ef790b Thanks @dario-piotrowicz! - Use 127.0.0.1 instead of localhost for the runtime inspector address

On systems where getaddrinfo("localhost") returns ::1 but IPv6 is disabled at the kernel level, workerd fails to bind the inspector socket and silently continues without emitting the listen-inspector event to the control FD. This caused wrangler dev to hang indefinitely at "Starting local server..." with no error output.

Using 127.0.0.1 explicitly is consistent with DEFAULT_HOST, --debug-port, and resolveLocalhost() already in the codebase.
#14105 337e912 Thanks @dario-piotrowicz! - Remove trailing periods from URLs in terminal output

URLs printed to the terminal with a sentence-ending period (e.g. https://example.com/path.) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.
#14112 3a746ac Thanks @penalosa! - Pin non-bundled runtime dependencies to exact versions

Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new pnpm check:pinned-deps lint enforces this for all published packages (and for the shared pnpm catalog) going forward.

`v4.20260529.0`

Compare Source

Minor Changes

#14087 e3c862a Thanks @edmundhung! - Add support for the new web_search binding kind.

Cloudflare Web Search is a managed, zero-setup web discovery primitive for agents and Workers. Declare the binding as a single object in wrangler.jsonc:
```
{
  "web_search": { "binding": "WEBSEARCH" }
}
```
There is exactly one shared web corpus, so there is no namespace, instance, or other field to specify -- only the variable name. The binding exposes a single search() method that returns URLs and catalog metadata for a query. Web Search is discovery-only -- to read a result's content the caller invokes the global fetch() API against the result's url.

The binding is always remote in local development: Miniflare proxies to the production Web Search service via the remote-bindings transport. Adds the websearch.run OAuth scope to wrangler login.

Also adds a wrangler websearch search command for running ad-hoc queries from the CLI:
```
npx wrangler websearch search "cloudflare workers"
npx wrangler websearch search "cloudflare workers" --limit 5
npx wrangler websearch search "cloudflare workers" --json
```
--limit is optional (defaults to 10, capped at 20). --json prints the raw response; without it the results render as a pretty table.
#13610 cbb39bd Thanks @petebacondarwin! - Add support for agent_memory bindings

Agent Memory bindings allow Workers to connect to Cloudflare's Agent Memory service for storing and retrieving agent conversation state. This binding is remote-only, meaning it always connects to the Cloudflare API during wrangler dev rather than using a local simulation.

To configure an agent_memory binding, add the following to your wrangler.json:
```
{
  "agent_memory": [
    {
      "binding": "MY_MEMORY",
      "namespace": "my-namespace"
    }
  ]
}
```
Wrangler will automatically provision the namespace during deployment if it does not already exist. Type generation via wrangler types is also supported.

This change also adds the agent-memory:write OAuth scope to Wrangler's default login scopes, so wrangler login can request the permissions needed to provision and manage Agent Memory namespaces.
#14087 e3c862a Thanks @edmundhung! - Rename pipeline field to stream in pipeline bindings configuration

The pipeline field inside pipelines bindings has been renamed to stream to align with the updated API wire format. The old pipeline field is still accepted but deprecated and will emit a warning.

Before:
```
// wrangler.json
{
  "pipelines": [
    {
      "binding": "MY_PIPELINE",
      "pipeline": "my-stream-name"
    }
  ]
}
```
After:
```
// wrangler.json
{
  "pipelines": [
    {
      "binding": "MY_PIPELINE",
      "stream": "my-stream-name"
    }
  ]
}
```
#14079 972d13d Thanks @edmundhung! - Add JSON output to /cdn-cgi/handler/scheduled

The /cdn-cgi/handler/scheduled endpoint now accepts ?format=json to return the scheduled handler result as JSON, including whether the handler called controller.noRetry(). Requests without format=json still return the existing text outcome for backward compatibility.

Patch Changes

#14106 7bb5c7a Thanks @dario-piotrowicz! - Add timeout to browser-rendering browser launch to prevent infinite hangs

The browser-rendering plugin's launchBrowser() function now passes a 5-minute timeout to waitForLineOutput() when waiting for Chrome to print its DevTools WebSocket URL. Previously, if Chrome failed to start or crashed before printing the URL, the promise would hang forever. This could cause CI pipelines and local dev sessions to get stuck indefinitely.
#14087 e3c862a Thanks @edmundhung! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260526.1 1.20260527.1
#14076 97d7d81 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260527.1 1.20260528.1
#14100 c647ccc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260528.1 1.20260529.1
#14087 e3c862a Thanks @edmundhung! - Fix wrangler dev crash under Yarn PnP when the worker emits a structured log or the inspector forwards a stack trace.

getFreshSourceMapSupport was unconditionally indexing require.cache, but when miniflare is imported from ESM under Yarn PnP, Node's ESM->CJS bridge (loadCJSModule in node:internal/modules/esm/translators) hands the wrapped CJS module a re-invented require that only carries .resolve and .main, with no .cache. Fall back to createRequire(__filename) in that case so the fresh-load cache-swap keeps working.

`v4.20260526.0`

Compare Source

Patch Changes

#14003 c1fd2fd Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260521.1 1.20260526.1
#14011 420e457 Thanks @petebacondarwin! - Warn when a remote-bindings request is blocked by Cloudflare Access

When wrangler dev is used with remote bindings and a request from the local remote-bindings proxy client to the remote workers.dev proxy server is blocked by Cloudflare Access (HTTP 403 with the Cloudflare Access block page), Wrangler now:
- Logs a single, visually striking warning per dev session explaining how to set CLOUDFLARE_ACCESS_CLIENT_ID / CLOUDFLARE_ACCESS_CLIENT_SECRET (Service Token credentials) or run cloudflared access login to authenticate.
- Replaces the original Access HTML block page with a readable plain-text body containing the same guidance, so the message also reaches the user via binding error messages (e.g. InferenceUpstreamError from env.AI.run()) and any browser response piped back via a service binding .fetch().
Previously the 403 was returned to user code with the full Access HTML, which both drowned out other logs and made it hard to tell that the failure was due to Cloudflare Access on workers.dev rather than a problem in the binding itself or the deployed proxy server. The detection runs inside the proxy client worker (which only ever talks to the remote-bindings proxy URL), so it does not trigger false positives on user-worker 403s.

`v4.20260521.0`

Compare Source

Patch Changes

#13993 0733688 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260520.1 1.20260521.1
#13999 [30657e1](https://red

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-11-09T15:34:58Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2025-11-09T15:35:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@intlify/utils@63

commit: 9567199

renovate Bot added the deps label Nov 9, 2025

renovate Bot force-pushed the renovate/miniflare-4.x branch 4 times, most recently from 19d429f to c06c210 Compare November 13, 2025 18:02

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from 8a83174 to 61fd395 Compare November 25, 2025 11:43

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from 4706ae6 to 34a4e14 Compare December 3, 2025 19:58

renovate Bot force-pushed the renovate/miniflare-4.x branch from 34a4e14 to 036e539 Compare December 9, 2025 19:53

renovate Bot force-pushed the renovate/miniflare-4.x branch 2 times, most recently from c6bfec6 to 3e7b082 Compare December 23, 2025 13:51

renovate Bot force-pushed the renovate/miniflare-4.x branch from 3e7b082 to 86658c2 Compare December 31, 2025 17:06

renovate Bot force-pushed the renovate/miniflare-4.x branch 2 times, most recently from fa03fb7 to 8bd532b Compare January 14, 2026 14:46

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from ef59e9b to 68fcc97 Compare January 23, 2026 17:29

renovate Bot force-pushed the renovate/miniflare-4.x branch 2 times, most recently from 71bacf4 to e5437b8 Compare February 2, 2026 18:16

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from b832efd to 9a6a6a7 Compare February 12, 2026 10:03

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from d2ec3b2 to eb8199a Compare February 24, 2026 15:54

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from b0d9113 to 573b4b5 Compare April 3, 2026 17:39

renovate Bot force-pushed the renovate/miniflare-4.x branch 2 times, most recently from cb37494 to 9e73bf1 Compare April 9, 2026 15:07

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from 5e815e8 to 5f0c14c Compare April 22, 2026 16:18

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from 2867454 to f0d9bb0 Compare May 1, 2026 14:01

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from 4bbc5ad to b0f4ea2 Compare May 12, 2026 09:42

renovate Bot force-pushed the renovate/miniflare-4.x branch 6 times, most recently from 0839d17 to 992e4d5 Compare May 19, 2026 15:02

renovate Bot force-pushed the renovate/miniflare-4.x branch 3 times, most recently from ac56df7 to 7e978f4 Compare May 26, 2026 11:11

renovate Bot force-pushed the renovate/miniflare-4.x branch 4 times, most recently from 81d3c98 to f75617c Compare June 2, 2026 19:13

renovate Bot force-pushed the renovate/miniflare-4.x branch 2 times, most recently from dd47f92 to 7cbe72c Compare June 11, 2026 12:01

chore(deps): update dependency miniflare to v4

9567199

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update dependency miniflare to v4 - #63

chore(deps): update dependency miniflare to v4#63
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/miniflare-4.x

renovate Bot commented Nov 9, 2025 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 9, 2025 •

edited

Loading

Review skipped

Uh oh!

pkg-pr-new Bot commented Nov 9, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20260714.1	^5.20260721.1
workerd	1.20260714.1	1.20260721.1

Dependency	From	To
@cloudflare/workers-types	^5.20260710.1	^5.20260714.1
workerd	1.20260710.1	1.20260714.1

Dependency	From	To
@cloudflare/workers-types	^5.20260708.1	^5.20260710.1
workerd	1.20260708.1	1.20260710.1

Dependency	From	To
workerd	1.20260706.1	1.20260708.1
@cloudflare/workers-types	^5.20260706.1	^5.20260708.1

Dependency	From	To
workerd	1.20260702.1	1.20260706.1
@cloudflare/workers-types	4.20260702.1	5.20260706.1

Uh oh!

Uh oh!

Conversation

renovate Bot commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

coderabbitai Bot commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

pkg-pr-new Bot commented Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 9, 2025 •

edited

Loading

coderabbitai Bot commented Nov 9, 2025 •

edited

Loading

pkg-pr-new Bot commented Nov 9, 2025 •

edited

Loading