[dependabot]

Bumps the npm-minor-and-patch group in /deploy/cloudflare with 1 update: wrangler.

Updates wrangler from 4.159.0 to 4.160.0

Release notes

Sourced from wrangler's releases.

wrangler@4.160.0

Minor Changes

• #16760 cb9534f Thanks @​petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

  cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

  Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.

• #16739 6af492e Thanks @​GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

  Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

• #16810 cdc970b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16810 cdc970b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261109.1	^5.20261110.1
  workerd	1.20261109.1	1.20261110.1

• #16709 022ee9d Thanks @​petebacondarwin! - Keep local Container images available for upload retries

  Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.

• #16740 44b39b0 Thanks @​GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

  Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.

• #16758 325dc69 Thanks @​petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

  Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

  Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.

• Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:

  • miniflare@5.20261110.0-beta

Commits

• 2674eef Version Packages (#16799)
• 022ee9d [containers-shared] Defer local image cleanup to upload callers (#16709)
• cb9534f [wrangler] Support forwarded dev options in cf-wrangler (#16760)
• 44b39b0 [wrangler, workers-utils, containers-shared, miniflare] Sanitize header diagn...
• 6af492e [wrangler, workers-utils, containers-shared] Add custom Cloudflare API header...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions