Version Packages

[workers-devprod]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@cloudflare/vite-plugin@1.36.0

Minor Changes

• #13810 2b8c0cc Thanks @jamesopstad! - Stabilize the secrets configuration property

  The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

  {
    "secrets": {
      "required": ["API_KEY", "DB_PASSWORD"]
    }
  }

Patch Changes

• #13814 a2f9c26 Thanks @edmundhung! - Deny additional credential files from the Vite dev server

  The Cloudflare Vite plugin now adds .npmrc, .yarnrc, .yarnrc.yml, and more certificate and key file extensions to server.fs.deny. This prevents common credential files from being fetched directly during local development.

• Updated dependencies [e07825a, 58899d8, 3020214, 0099265, 25f5ef2, bb27219, 194d75e, 12fb5db, 18b9d5b, 9f532f7, 1127114, 3ceadef, 2b8c0cc, 1a5cc86]:

  • wrangler@4.88.0
  • miniflare@4.20260504.0

@cloudflare/vitest-pool-workers@0.16.0

Minor Changes

• #13810 2b8c0cc Thanks @jamesopstad! - Stabilize the secrets configuration property

  The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

  {
    "secrets": {
      "required": ["API_KEY", "DB_PASSWORD"]
    }
  }

Patch Changes

• #12974 1127114 Thanks @ask-bonk! - Rewrite self-referencing service bindings to kCurrentWorker before renaming the runner worker

  When a wrangler config has a service binding to itself (e.g. services: [{ binding: "SELF", service: "my-worker" }] where the worker is named "my-worker"), the binding's literal name pointed to a worker that no longer existed once vitest-pool-workers renamed the runner to vitest-pool-workers-runner-<project>. The self-reference is now rewritten to the miniflare kCurrentWorker symbol, which resolves at request time relative to the referer worker and so survives the rename. Previously this rewrite lived in wrangler's unstable_getMiniflareWorkerOptions, but it's only needed for vitest-pool-workers' rename — other consumers (getPlatformProxy, @cloudflare/vite-plugin) preserve the original worker name and so don't need it.

• Updated dependencies [e07825a, 58899d8, 3020214, 0099265, 25f5ef2, bb27219, 194d75e, 12fb5db, 18b9d5b, 9f532f7, 1127114, 3ceadef, 2b8c0cc, 1a5cc86]:

  • wrangler@4.88.0
  • miniflare@4.20260504.0

@cloudflare/workers-utils@0.19.0

Minor Changes

• #13810 2b8c0cc Thanks @jamesopstad! - Stabilize the secrets configuration property

  The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

  {
    "secrets": {
      "required": ["API_KEY", "DB_PASSWORD"]
    }
  }

wrangler@4.88.0

Minor Changes

• #13760 e07825a Thanks @danielgek! - Add builtin storage option to wrangler ai-search create.

  wrangler ai-search create now supports a third storage type, builtin, in addition to r2 and web-crawler. When --type builtin is selected (or chosen interactively), Wrangler creates the instance using Cloudflare-managed storage by omitting type and source from the API request — the API treats an absent type as builtin storage. Builtin instances do not accept --source, --prefix, --include-items, or --exclude-items.

• #13721 58899d8 Thanks @danielgek! - Add optional custom_metadata step to wrangler ai-search create

  The wrangler ai-search create interactive wizard now lets you declare custom metadata fields that the new AI Search instance should index. Each field is a field_name paired with a data_type (text, number, boolean, or datetime).

  You can provide fields up-front via the new repeatable --custom-metadata flag using field_name:data_type syntax:

  wrangler ai-search create my-instance \
    --type r2 --source my-bucket \
    --custom-metadata title:text \
    --custom-metadata views:number

  For larger schemas, use --custom-metadata-schema to point at a JSON file containing an array of { field_name, data_type } objects:

  wrangler ai-search create my-instance \
    --type r2 --source my-bucket \
    --custom-metadata-schema schema.json

  [
    { "field_name": "title", "data_type": "text" },
    { "field_name": "views", "data_type": "number" }
  ]

• #13701 18b9d5b Thanks @dario-piotrowicz! - Prompt for missing name and compatibility date interactively during wrangler deploy

  When deploying without a project name or compatibility_date in your configuration or CLI arguments, wrangler deploy now interactively prompts for the missing values instead of immediately failing with an error. For compatibility date, the prompt offers to use today's date; if you decline, the existing error is shown. The compatibility date prompt is skipped when --latest is passed. In non-interactive or CI environments, behavior is unchanged.

  Additionally, when no config file exists, wrangler deploy now offers to save the prompted name and compatibility date to a wrangler.jsonc file for future use. This interactive flow is available for all wrangler deploy invocations — not just asset-only deployments.

• #13810 2b8c0cc Thanks @jamesopstad! - Stabilize the secrets configuration property

  The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

  {
    "secrets": {
      "required": ["API_KEY", "DB_PASSWORD"]
    }
  }

Patch Changes

• #13765 3020214 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260430.1	1.20260501.1

• #13800 0099265 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260501.1	1.20260504.1

• #13812 25f5ef2 Thanks @emily-shen! - fix: --alias CLI flag now works in wrangler deploy

  The --alias flag was accepted but silently ignored during wrangler deploy — only config.alias took effect. We now collect aliases from both config and CLI flags.

• #13772 194d75e Thanks @zakcutner! - Fix wrangler types to generate Fetcher for unsafe.bindings entries with type: "service"

  Previously, all entries in unsafe.bindings (other than ratelimit) generated a fallback any type. wrangler types now generates Fetcher for unsafe bindings declared with type: "service", matching the type used for regular service bindings.

• #13818 9f532f7 Thanks @1000hz! - Support Flagship bindings in Worker Previews

  wrangler preview now accepts flagship entries in the previews block and includes them in Preview deployment bindings. This lets Workers that use Flagship bindings deploy Preview versions with preview-specific Flagship app IDs.

• #12974 1127114 Thanks @ask-bonk! - Fix props and fetcher-type service bindings being dropped in unstable_getMiniflareWorkerOptions

  The post-processing in unstable_getMiniflareWorkerOptions was rebuilding serviceBindings from scratch, which silently dropped props on service bindings and dropped fetcher-type bindings entirely. It was also re-deriving durableObjects identically to what buildMiniflareBindingOptions already produces. Both have been removed; buildMiniflareBindingOptions now produces the final bindings unchanged.

• #13739 3ceadef Thanks @edmundhung! - Skip confirmation prompts in wrangler versions deploy when versions are provided as CLI arguments

  Passing version IDs or version specs to wrangler versions deploy now applies those values directly instead of opening interactive prompts to confirm the same versions and percentages. This makes the command easier to automate without requiring --yes.

• #13745 1a5cc86 Thanks @edmundhung! - fix: preserve request ports in Origin and Referer headers when using wrangler dev --host

• Updated dependencies [3020214, 0099265, bb27219, 12fb5db]:

  • miniflare@4.20260504.0

@cloudflare/cli-shared-helpers@0.1.1

Patch Changes

• Updated dependencies [2b8c0cc]:
  • @cloudflare/workers-utils@0.19.0

create-cloudflare@2.68.1

Patch Changes

• #13793 e414059 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  @tanstack/create-start	0.59.26	0.59.28

• #13794 556a58c Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  create-waku	0.12.5-1.0.0-alpha.8-0	0.12.5-1.0.0-alpha.9-0

• #13795 7c9161a Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  create-docusaurus	3.10.0	3.10.1

• #13796 e8496b6 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  @angular/create	21.2.8	21.2.9

miniflare@4.20260504.0

Patch Changes

• #13765 3020214 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260430.1	1.20260501.1

• #13800 0099265 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260501.1	1.20260504.1

• #13737 bb27219 Thanks @ruifigueira! - Fix race condition that broke Browser Run on Windows when Chrome had not yet started accepting connections

  When Miniflare launched Chrome for Browser Run bindings, it returned the WebSocket endpoint as soon as Chrome printed its DevTools listening on ws://... banner. On Windows the underlying listening socket is occasionally not yet accepting connections at that point, causing the first request from workerd to Chrome to fail with ConnectEx (#1225) The remote computer refused the network connection. and the user worker to receive an error response from /v1/acquire.

  Miniflare now probes Chrome's /json/version HTTP endpoint with retry/backoff after the banner is logged, only declaring the browser ready once the socket actually accepts connections. As an additional safety net, the browser binding worker also retries transient ConnectEx/WSARecv failures when establishing connections to Chrome.

• #13767 12fb5db Thanks @edmundhung! - Fix local explorer startup in Yarn Plug'n'Play projects by copying the explorer UI assets to a real temporary directory before registering the workerd disk service.

@cloudflare/pages-shared@0.13.131

Patch Changes

• Updated dependencies [3020214, 0099265, bb27219, 12fb5db]:
  • miniflare@4.20260504.0

@cloudflare/workers-shared@0.19.5

Patch Changes

• #13740 6d2a573 Thanks @courtney-sims! - During deployment, routes requests to new versions of asset-worker based on customer account plan.

• #12276 926bad5 Thanks @penalosa! - Warn when _headers rules contain multiple wildcards or wildcard combined with :splat

  Rules containing multiple wildcards (e.g. https://*.workers.dev/*) or combining a wildcard with a :splat placeholder (e.g. https://*.pages.dev/:splat) are now rejected during parsing. Previously this would fail silently during dev.

[ask-bonk]

LGTM

github run

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13766

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13766

miniflare

npm i https://pkg.pr.new/miniflare@13766

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13766

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13766

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13766

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13766

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13766

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13766

wrangler

npm i https://pkg.pr.new/wrangler@13766

commit: 832197f

[github-actions]

✅ All changesets look good

Review Summary

Total changesets reviewed: 22

Changesets Passing Review:

File	Package	Type	Status
ai-search-builtin-storage.md	wrangler	minor	✅
ai-search-create-custom-metadata.md	wrangler	minor	✅
asset-worker-cohort-deployments.md	@cloudflare/workers-shared	patch	✅
c3-frameworks-update-13793.md	create-cloudflare	patch	✅ (skipped - dependabot)
c3-frameworks-update-13794.md	create-cloudflare	patch	✅ (skipped - dependabot)
c3-frameworks-update-13795.md	create-cloudflare	patch	✅ (skipped - dependabot)
c3-frameworks-update-13796.md	create-cloudflare	patch	✅ (skipped - dependabot)
dependabot-update-13765.md	miniflare, wrangler	patch	✅
dependabot-update-13800.md	miniflare, wrangler	patch	✅
fix-deploy-alias-flag.md	wrangler	patch	✅
fix-miniflare-browser-rendering-windows-race.md	miniflare	patch	✅
fix-wrangler-types-unsafe-service-binding.md	wrangler	patch	✅
four-masks-draw.md	miniflare	patch	✅
interactive-compatibility-date-prompt.md	wrangler	minor	✅
quiet-flags-preview.md	wrangler	patch	✅
reject-multiple-wildcards-headers.md	@cloudflare/workers-shared	patch	✅
remove-dev-registry-filtering.md	wrangler	patch	✅
slow-masks-film.md	wrangler	patch	✅
stabilize-secrets-config.md	@cloudflare/workers-utils, wrangler, @cloudflare/vite-plugin, @cloudflare/vitest-pool-workers	minor	✅
tiny-ducks-look.md	wrangler	patch	✅
vite-plugin-deny-more-credentials.md	@cloudflare/vite-plugin	patch	✅
vitest-pool-workers-self-ref.md	@cloudflare/vitest-pool-workers	patch	✅

Validation Notes:

1. Version Types: All version types are appropriate:

   • Minor versions used for new features (ai-search commands, interactive prompts, secrets stabilization)
   • Patch versions used for bug fixes and dependency updates

2. Changelog Quality: All descriptions are meaningful and explain:

   • What changed
   • Why it matters (user impact)
   • Examples provided where helpful (ai-search-create-custom-metadata.md, stabilize-secrets-config.md)

3. Markdown Headers: No h1/h2/h3 headers found - all comply with formatting rules

4. Dependabot Changesets: Create-cloudflare dependency updates (c3-frameworks-update-*.md) were noted but not validated per guidelines

5. Experimental Features: N/A - no experimental feature opt-in notes required

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.