Version Packages

[workers-devprod]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@cloudflare/vite-plugin@1.38.0

Minor Changes

• #13989 f598eac Thanks @MattieTK! - Print a QR code alongside the tunnel URL when sharing via Cloudflare Tunnel

  When a tunnel is started (via wrangler dev --tunnel or the Vite plugin with tunnel: true), a scannable QR code is now printed to the terminal beneath the tunnel URL. This makes it easy to open the tunnel on a mobile device without manually copying the URL.

  The QR code uses Unicode block characters for a compact representation and is generated best-effort -- if generation fails for any reason, the tunnel URL is still displayed as before.

Patch Changes

• Updated dependencies [52e9082, 0733688, fc1f7b9, 30657e1, 8c569c6, f598eac, 3a1fbed]:
  • wrangler@4.94.0
  • miniflare@4.20260521.0

wrangler@4.94.0

Minor Changes

• #13897 52e9082 Thanks @dario-piotrowicz! - Add automatic Cloudflare skills installation for AI coding agents

  Wrangler now detects AI coding agents and offers to install Cloudflare skill files from the cloudflare/skills GitHub repository. Users are prompted once interactively; subsequent runs skip the prompt. Use --install-skills to install without prompting.

• #13989 f598eac Thanks @MattieTK! - Print a QR code alongside the tunnel URL when sharing via Cloudflare Tunnel

  When a tunnel is started (via wrangler dev --tunnel or the Vite plugin with tunnel: true), a scannable QR code is now printed to the terminal beneath the tunnel URL. This makes it easy to open the tunnel on a mobile device without manually copying the URL.

  The QR code uses Unicode block characters for a compact representation and is generated best-effort -- if generation fails for any reason, the tunnel URL is still displayed as before.

• #13467 3a1fbed Thanks @deloreyj! - Add schedule property to Workflow bindings for cron-based triggering

  Note: This is a configuration-only change. Scheduled triggering of Workflow instances is not yet available — adding schedule to a Workflow binding will not result in scheduled invocations at this time. This change lays the groundwork for an upcoming feature.

  Workflow bindings in wrangler.json now accept an optional schedule field that configures one or more cron expressions to automatically trigger new workflow instances on a schedule.

  // wrangler.json
  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "schedule": "0 9 * * 1"
      }
    ]
  }

  Multiple schedules can be provided as an array:

  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "schedule": ["0 9 * * 1", "0 17 * * 5"]
      }
    ]
  }

  The schedule is sent to the Workflows control plane on wrangler deploy. Configuring schedule on a workflow binding that references an external script_name is an error — the schedule must be configured on the worker that defines the workflow.

Patch Changes

• #13993 0733688 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260520.1	1.20260521.1

• #14008 fc1f7b9 Thanks @petebacondarwin! - Fix Access Service Token authentication for applications that only allow service tokens

  When using remote bindings against a Worker behind a Cloudflare Access application configured to only allow Service Auth tokens (no interactive user authentication), Wrangler previously ignored the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables and the request would fail with a 403.

  This happened because Wrangler detects Access by looking for a 302 redirect to cloudflareaccess.com. A service-auth-only Access application has no interactive login path, so it responds with a hard 403 instead of redirecting. Wrangler concluded the domain was not behind Access and skipped attaching the service token headers entirely.

  The env-var check now runs before the Access detection step, so the configured service token credentials are always used when present.

• #12277 8c569c6 Thanks @penalosa! - Include column names in D1 SQL export INSERT statements

  D1 SQL exports now include column names in INSERT statements (e.g., INSERT INTO "table" ("col1","col2") VALUES(...)). This ensures that exported SQL can be successfully imported even when the target table has columns in a different order than the original, which commonly occurs during iterative development when schemas evolve.

• Updated dependencies [0733688, 30657e1]:

  • miniflare@4.20260521.0

@cloudflare/cli-shared-helpers@0.1.4

Patch Changes

• Updated dependencies [90092c0]:
  • @cloudflare/workers-utils@0.21.1

miniflare@4.20260521.0

Patch Changes

• #13993 0733688 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260520.1	1.20260521.1

• #13999 30657e1 Thanks @edmundhung! - Fix TCP requests failing when outboundService is configured

  Workers using outboundService can now open TCP connections with cloudflare:sockets. Previously, TCP requests could throw an error when a custom outbound service was configured.

@cloudflare/pages-shared@0.13.139

Patch Changes

• Updated dependencies [0733688, 30657e1]:
  • miniflare@4.20260521.0

@cloudflare/vitest-pool-workers@0.16.9

Patch Changes

• #13933 90092c0 Thanks @petebacondarwin! - Derive bundler externals from package.json and shrink the published bundle

  The bundler's external list was previously hand-maintained and out of sync with package.json — undici and semver were both listed as external despite being only devDependencies. The published dist/pool/index.mjs consequently contained a top-level import { fetch } from "undici" that was only resolvable because pnpm happened to hoist undici from other packages' devDependencies during local development.

  The bundler now derives its external list from dependencies + peerDependencies in package.json, making it impossible for a devDependency to silently end up externalized.

  Combined with the new "sideEffects": false declaration in @cloudflare/workers-utils, the unused cloudflared / tunnel exports (and their transitive undici import) are now tree-shaken out of the pool entirely. dist/pool/index.mjs no longer references undici at all, and shrinks from ~489 KB to ~125 KB.

• Updated dependencies [52e9082, 0733688, fc1f7b9, 30657e1, 8c569c6, f598eac, 3a1fbed]:

  • wrangler@4.94.0
  • miniflare@4.20260521.0

@cloudflare/workers-utils@0.21.1

Patch Changes

• #13933 90092c0 Thanks @petebacondarwin! - Mark @cloudflare/workers-utils as side-effect-free and properly declare undici as a runtime dependency

  The package now declares "sideEffects": false in its package.json so that downstream bundlers can tree-shake unused exports. In particular, consumers that only use a subset of the package (for example, getTodaysCompatDate from the main entry) will no longer carry the cloudflared / tunnel exports — or their transitive dependencies — in their final bundle.

  undici has been moved from devDependencies to dependencies. Previously it was incorrectly listed as a devDependency while the bundler config marked it as external, leaving the published dist/index.mjs with an unresolved import { fetch } from "undici" for anyone installing the package directly. undici is deliberately kept external (rather than bundled) so that downstream consumers don't end up with two copies of undici in their bundle — which would break instanceof Request/Response/Headers checks across the boundary and prevent setGlobalDispatcher / proxy configuration from applying to the bundled copy.

  vitest has been added as an optional peerDependency because the ./test-helpers sub-export uses vitest's vi, beforeEach, and afterEach APIs at runtime; consumers that import from ./test-helpers must have vitest installed themselves.

[github-actions]

✅ All changesets look good

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13995

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13995

miniflare

npm i https://pkg.pr.new/miniflare@13995

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13995

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13995

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13995

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13995

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13995

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13995

wrangler

npm i https://pkg.pr.new/wrangler@13995

commit: 32539d9