[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.158.0 → 4.159.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.159.0

Compare Source

Minor Changes

• #​16737 a589d23 Thanks @​jamesopstad! - Store experimental cf-wrangler dev state in .cloudflare/state

  Persist local resource data in .cloudflare/state relative to the configuration file. Direct Wrangler usage continues to default to .wrangler/state.

• #​16663 fe69809 Thanks @​FlorentCollin! - Add --compatibility flag to wrangler d1 export

  You can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:

  wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_only

  It accepts d1 (the default) and sqlite3_cli_only. With sqlite3_cli_only, the dump matches the output of the sqlite3 .dump command, including virtual tables. D1 cannot import this dump. sqlite3_cli_only is only supported for remote exports.

• #​16599 dee7a1d Thanks @​petebacondarwin! - Support CLOUDFLARE_AUTH_PROFILE for shared authentication profile selection

  Cloudflare tooling can pass a selected profile to child processes through CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. The cf-wrangler development delegate also initializes cf authentication so it reads the selected cf credentials.

  Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and cf-wrangler keeps its authentication scoped to the delegate invocation.

• #​15615 c64fdfb Thanks @​svetch! - Support jurisdiction when automatically provisioning D1 databases

  Set jurisdiction on a D1 binding without a database_id to create the database in that jurisdiction during deployment. For example, {"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]} creates an EU-jurisdiction database.

• #​16066 4112820 Thanks @​petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker types

  Use wrangler types --include-main-module=false when the Worker entrypoint is generated build output that should not be type-checked as application source. The corresponding includeMainModule option is available in the experimental type-generation API. The option is preserved by --check and automatic regeneration. Omitting the import opts out of module-derived ctx.exports typing while preserving runtime types, environment bindings, and Durable Object namespace declarations.

  New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.

Patch Changes

• #​16648 56459a5 Thanks @​dario-piotrowicz! - Update bundled third-party dependencies with known security fixes

  Local development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.

  Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.

• #​16746 abf924e Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-06

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16792 de10016 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-09

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16746 abf924e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261104.1	^5.20261106.1
  workerd	1.20261104.1	1.20261106.1

• #​16792 de10016 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261106.1	^5.20261109.1
  workerd	1.20261106.1	1.20261109.1

• #​16726 2fb01e7 Thanks @​pratham-jain33! - Warn when cron triggers are configured alongside --dispatch-namespace

  When deploying a user Worker to a dispatch namespace (Workers for Platforms), cron triggers are not supported, but Wrangler previously dropped them silently: schedules configured via triggers.crons in the Wrangler config file or the --triggers CLI flag never ran and no warning was shown. Wrangler now warns that cron triggers will be ignored when deploying with --dispatch-namespace.

• #​16748 dc4e093 Thanks @​shbernal! - Stop wrangler email routing addresses create from claiming a verification email was sent for addresses that are already verified

  Cloudflare doesn't send a verification email when the destination address is already verified on the account, such as the account owner's own email. The command now shows the verification timestamp in that case. It only mentions a verification email when the address is still pending.

• #​15621 cff83d0 Thanks @​petebacondarwin! - Report a failed Wrangler command when the CLI child is terminated by a signal

  Wrangler's executable previously translated signal termination into exit code 0, which could cause callers to report a successful deployment after the operating system stopped Wrangler. Signal exits now use the conventional nonzero shell status.

• #​16413 3ef2afd Thanks @​ghostwriternr! - Remove Container networking sidecars and snapshot clone volumes in local development

  Wrangler and the Vite plugin removed only the application containers of Container-enabled Durable Objects, found by image tag, and left behind the networking sidecars and snapshot clone volumes that workerd also creates. They now leave cleanup to Miniflare, which removes all of these when the Container configuration changes, such as after a rebuild, when local development stops, and when the process exits.

• #​16066 4112820 Thanks @​petebacondarwin! - Preserve environment inputs when automatically regenerating Worker types

  Automatic type regeneration now reuses the recorded --env and --env-file options. This keeps environment-specific bindings and secret declarations consistent with the generated header and subsequent wrangler types --check runs.

• #​15621 cff83d0 Thanks @​petebacondarwin! - Avoid materializing unused multipart request bodies

  Wrangler no longer creates a full text copy of multipart API request bodies when debug logs are disabled or sanitized. This substantially reduces peak memory use when uploading large batches of static assets while preserving request-body output when unsanitized debug logging is explicitly enabled.

• #​16664 9b6582c Thanks @​dario-piotrowicz! - Stop getPlatformProxy() asset misses from recursively calling its own listener

  Requests for assets that do not exist now return a 404 response without hanging or exhausting local development resources.

• Updated dependencies [fea323a, 56459a5, abf924e, de10016, abf924e, de10016, 66bc0d6]:

  • miniflare@5.20261109.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@​4.158.0 ⏵ 4.159.0			+1

View full report

[github-actions]

Remote cache staging

Commit: be9ab4949a63186836d7467cf76fd098cac72273

Cloudflare deployment is disabled. Configure the repository secrets and variables described in the e2e plan, then set REMOTE_CACHE_DEPLOY_ENABLED=true and rerun this workflow. No live deployment passed verification.

Manual checks and complete e2e plan.