[dependabot]

Bumps wrangler from 4.90.0 to 4.160.0.

Release notes

Sourced from wrangler's releases.

wrangler@4.160.0

Minor Changes

• #16760 cb9534f Thanks @​petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

  cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

  Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.

• #16739 6af492e Thanks @​GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

  Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

• #16810 cdc970b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16810 cdc970b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261109.1	^5.20261110.1
  workerd	1.20261109.1	1.20261110.1

• #16709 022ee9d Thanks @​petebacondarwin! - Keep local Container images available for upload retries

  Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.

• #16740 44b39b0 Thanks @​GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

  Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.

• #16758 325dc69 Thanks @​petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

  Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

  Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.

• Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:

  • miniflare@5.20261110.0-beta

wrangler@4.159.0

Minor Changes

• #16737 a589d23 Thanks @​jamesopstad! - Store experimental cf-wrangler dev state in .cloudflare/state

... (truncated)

Commits

• 2674eef Version Packages (#16799)
• 022ee9d [containers-shared] Defer local image cleanup to upload callers (#16709)
• cb9534f [wrangler] Support forwarded dev options in cf-wrangler (#16760)
• 44b39b0 [wrangler, workers-utils, containers-shared, miniflare] Sanitize header diagn...
• 6af492e [wrangler, workers-utils, containers-shared] Add custom Cloudflare API header...
• bf3ec7b Version Packages (#16729)
• dc4e093 [wrangler] Only mention a verification email when the created address is unve...
• 56459a5 Update bundled third-party dependencies with known security fixes (#16648)
• 3ef2afd [wrangler] Delegate Container cleanup to Miniflare (#16413)
• 6f29f97 Stop persisting account selections made by cf (#16683)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)