[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.152.0 → 4.155.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.155.0

Compare Source

Minor Changes

• #​16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]
  }

Patch Changes

• #​16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

  Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

• #​16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

  wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

• #​16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

  Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

• Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:

  • miniflare@5.20261023.2-beta

v4.154.0

Compare Source

Minor Changes

• #​16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #​16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

  Node.js callers also keep custom error names such as ArtifactsError. Errors from remote bindings received inside a Worker keep their properties but are still named Error.

• Updated dependencies [0968b08, f3c13b3]:

  • miniflare@5.20261023.1-beta

v4.153.0

Minor Changes

• #​14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #​15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #​16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261019.1	^5.20261022.1
  workerd	1.20261019.1	1.20261022.1

• #​16437 e651d7c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261022.1	^5.20261023.1
  workerd	1.20261022.1	1.20261023.1

• #​16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #​16485 b7e762d Thanks @​Cherry! - Fix the Windows keyring install when the config path contains a space

  On Windows, wrangler login --use-keyring could not set up keyring storage when the configuration path contained a space, such as a C:\Users\John Smith profile, so credentials fell back to the plaintext file. Keyring setup now works for those paths and credentials are stored encrypted.

• #​16405 c709bff Thanks @​ondraulehla! - Fix kv key list returning only the first 1000 keys in local mode

  Listing a local namespace with more than 1000 keys stopped after the first 1000 without any warning, so the output looked complete when it wasn't. kv key list now returns every key in local mode, with or without --prefix.

• #​16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, bcd618d]:

  • miniflare@5.20261023.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@​4.152.0 ⏵ 4.155.0	-20		+1	+1

View full report

[github-actions]

Remote cache staging

Commit: 42143952bd2139b4b225f64b32d8263b421066f9

The source checks did not pass. No verified Cloudflare staging deployment is ready. See the workflow run.

Manual checks and complete e2e plan.