Repository navigation
Version Packages - #16598
Version Packages#16598workers-devprod wants to merge 1 commit into
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![clanky-the-clanker[bot]](https://avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
Superseded by the review of
ced1b680.
This review, of 2a0e93c1
✅ Approved — Standard Changesets release pull request: the version bumps and changelog entries match the consumed changesets, and nothing was found.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request consumes the two pending changesets (clean-containers-validate.md and friendly-workers-customize.md). Each affected package gets a version bump and a changelog entry that matches what those changesets describe and what the release notes list:
@cloudflare/vite-plugingoes to2.0.0-beta.v.9(minor change,configcallback API).@cloudflare/configgoes to0.29.1(Container validation patch).autoconfig,build-output-utils,containers-shared,deploy-helpersandremote-bindingsget dependency-only patch bumps.
The previous release tag was not compared because tag history is not available here.
Reviewed commit: 2a0e93c1
@cloudflare/autoconfig
@cloudflare/build-output-utils
@cloudflare/codemods
@cloudflare/config
@cloudflare/containers-shared
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-functions
@cloudflare/pages-shared
@cloudflare/runtime-types
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-plugin
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
2a0e93c to
ced1b68
Compare
There was a problem hiding this comment.
Superseded by the review of
6dd8f775.
This review, of ced1b680
✅ Approved — The version bumps and changelog entries match the three consumed changesets, including the WebAssembly stack-frame fix added since the last review. No issues were found.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request consumes three changesets:
- Vite plugin
configcallback (friendly-workers-customize.md):@cloudflare/vite-plugingoes to2.0.0-beta.v.9. - Container validation (
clean-containers-validate.md):@cloudflare/configgoes to0.29.1. - WebAssembly stack frames (
wasm-stack-frames.md, new since the last review):wranglergoes to4.156.1and@cloudflare/deploy-helpersgoes to0.24.4.
The dependent packages get dependency-only patch bumps: autoconfig 0.8.4, build-output-utils 0.9.7, containers-shared 0.23.6, vitest-plugin 1.4.12 and remote-bindings 0.0.57. The version in each package.json matches its new changelog heading.
The versions were not compared against the previous release tag, because tag history is not available here.
Reviewed commit: ced1b680
ced1b68 to
6dd8f77
Compare
There was a problem hiding this comment.
Superseded by the review of
42ec06e7.
This review, of 6dd8f775
✅ Approved — I found no issues. The version bumps and changelog entries match the four changesets this pull request consumes, including the CRLF fix for wrangler types --check that was added since the last review.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request consumes four changesets:
- Vite plugin
configcallback (friendly-workers-customize.md) bumps@cloudflare/vite-pluginto2.0.0-beta.v.9. - Container validation (
clean-containers-validate.md) bumps@cloudflare/configto0.29.1. - WebAssembly stack frames (
wasm-stack-frames.md) bumpswranglerto4.156.1and@cloudflare/deploy-helpersto0.24.4. - CRLF types check (
crlf-types-check.md, new since the last review) bumps@cloudflare/runtime-typesto0.1.20. The same entry appears in thewranglerchangelog, and thevite-pluginandvitest-pluginchangelogs now listruntime-typesandwrangleramong their updated dependencies.
The other packages get patch bumps for dependency updates only: autoconfig 0.8.4, build-output-utils 0.9.7, containers-shared 0.23.6, vitest-plugin 1.4.12 and remote-bindings 0.0.57. Each package.json version matches its new changelog heading.
I could not compare the new versions against the previous release tags because tag history is not available here.
Reviewed commit: 6dd8f775
6dd8f77 to
42ec06e
Compare
There was a problem hiding this comment.
Superseded by the review of
56d4dbde.
This review, of 42ec06e7
✅ Approved — No issues found. The version bumps and changelog entries match the five changesets this pull request consumes, including the new workers-auth OAuth scope change.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes five changesets. The one added since the last review, cf-user-token-scope.md, bumps @cloudflare/workers-auth from 0.15.3 to 0.15.4. Its changelog entry describes the added user-api-tokens.write OAuth scope. @cloudflare/remote-bindings 0.0.57 lists workers-auth@0.15.4 among its updated dependencies.
The other bumps have not changed since the last review: vite-plugin 2.0.0-beta.v.9, config 0.29.1, runtime-types 0.1.20, deploy-helpers 0.24.4, wrangler 4.156.1, plus patch bumps for dependency updates only in autoconfig, build-output-utils, containers-shared and vitest-plugin. Each package.json version matches its new changelog heading.
Reviewed commit: 42ec06e7
42ec06e to
56d4dbd
Compare
There was a problem hiding this comment.
Superseded by the review of
1696bef5.
This review, of 56d4dbde
✅ Approved — No issues found. The version bumps and changelog entries match the six changesets this pull request consumes, including the newly added assets-upload retry change.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes six changesets. The one added since the last review, tidy-assets-retry.md (#16562), adds the assets-upload retry entry to the 0.24.4 changelogs of @cloudflare/deploy-helpers and to wrangler 4.156.1. @cloudflare/remote-bindings 0.0.57 and @cloudflare/vitest-plugin 1.4.12 now list commit aece4df among their updated dependencies. The version in each package.json matches its new changelog heading, and the other bumps have not changed since the last review.
Reviewed commit: 56d4dbde
56d4dbd to
1696bef
Compare
There was a problem hiding this comment.
Superseded by the review of
d3fa45d1.
This review, of 1696bef5
✅ Approved — No issues found. The version bumps and changelog entries match the seven changesets this pull request consumes, including the newly added OAuth callback validation change (#16525).
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes seven changesets. The one added since the last review is validate-oauth-error-callbacks.md (#16525, ed7fb41). Its entry now appears in the @cloudflare/workers-auth 0.15.4 and wrangler 4.156.1 changelogs. @cloudflare/remote-bindings 0.0.57 and @cloudflare/vitest-plugin 1.4.12 now list ed7fb41 among their updated dependencies. The version in each package.json matches its new changelog heading.
Reviewed commit: 1696bef5
1696bef to
d3fa45d
Compare
There was a problem hiding this comment.
Superseded by the review of
cfe66e84.
This review, of d3fa45d1
✅ Approved — No issues found. The version bumps and changelog entries match the eight consumed changesets, including the newly added create-cloudflare 2.74.6 entry for #16524.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes eight changesets. The new one since the last review is preserve-duplicate-account-names.md (#16524, 3819800). It is released as create-cloudflare 2.74.6: the changelog has a matching 2.74.6 Patch Changes entry, and package.json goes from 2.74.5 to 2.74.6. The other package bumps and changelog entries have not changed since the last review and still match their changesets.
Reviewed commit: d3fa45d1
d3fa45d to
cfe66e8
Compare
There was a problem hiding this comment.
Superseded by the review of
db280841.
This review, of cfe66e84
✅ Approved — No issues found. The version bumps and changelog entries match the nine consumed changesets, including the new autoconfig 0.8.4 entry for #16537.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes nine changesets. The one added since the last review is react-router-cf-minimum-version.md (#16537, a2d1338). It is released as @cloudflare/autoconfig 0.8.4: the changelog has a matching 0.8.4 Patch Changes entry that also lists the @cloudflare/config@0.29.1 dependency update, and package.json goes from 0.8.3 to 0.8.4. None of the other package bumps or changelog entries changed since the last review, and they still match their changesets.
Reviewed commit: cfe66e84
cfe66e8 to
db28084
Compare
There was a problem hiding this comment.
Superseded by the review of
321eb6a3.
This review, of db280841
✅ Approved — No issues found. All eleven changesets are consumed, and the version bumps and changelog entries match them, including the new autoconfig 0.9.0 minor release and the wrangler 4.156.1 entry for #16366.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes eleven changesets. Two were added since the last review:
autoconfig-output-dir-option.md(#16366) is a minor change, so@cloudflare/autoconfigmoves from 0.8.3 to 0.9.0 instead of the earlier 0.8.4. Its changelog lists theoutputDirchange under Minor Changes. The #16537 React Router entry and the@cloudflare/config@0.29.1dependency update are listed under Patch Changes.pages-deploy-requested-directory.md(#16366) is a patch forwrangler4.156.1, and the wrangler changelog has a matching entry.
The vitest-plugin changelog now also lists d174de8 among the wrangler updates. The other package bumps and changelog entries have not changed and still match their changesets.
The tag history and commit range were not checked, because that history is not available here.
Reviewed commit: db280841
2c76fd6 to
321eb6a
Compare
There was a problem hiding this comment.
Superseded by the review of
3dd9f75b.
This review, of 321eb6a3
✅ Approved — No issues found. All thirteen changesets are consumed, and the version bumps and changelog entries match them, including the new pages-functions 0.1.3 release and the wrangler entries for #16535 and #16603.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes thirteen changesets. Two of them are new since the last review:
tidy-slashes-protect-middleware.md(#16603) bumps@cloudflare/pages-functionsfrom 0.1.2 to 0.1.3. The matching changelog entry is there, and wrangler 4.156.1 lists the same change.pages-assets-directory-boundary.md(#16535) appears in the wrangler 4.156.1 changelog. The vitest-plugin changelog now lists5740867and2667a9famong its wrangler dependency updates.
The other package bumps and changelog entries have not changed since the last review and still match their changesets.
The tag history and commit range were not checked, because that history is not available here.
Reviewed commit: 321eb6a3
321eb6a to
3dd9f75
Compare
There was a problem hiding this comment.
Superseded by the review of
b65774bb.
This review, of 3dd9f75b
✅ Approved — No issues found. The new miniflare changeset (#16514) is consumed, and miniflare 5.20261023.4-beta, pages-shared 0.13.206 and the dependent changelog entries match it. The rest of the release is unchanged since the last review and still consistent.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes fourteen changesets. One is new since the last review: miniflare-resolve-local-bindings.md (#16514).
- It bumps
miniflarefrom 5.20261023.3-beta to 5.20261023.4-beta. Because the package is in prerelease mode, the minor change only increments the prerelease counter, which is what you'd expect. @cloudflare/pages-sharedgoes to 0.13.206 as a dependency-only patch.- The changelogs for deploy-helpers, remote-bindings, runtime-types, vite-plugin, vitest-plugin and wrangler now list
009ca6e/ miniflare@5.20261023.4-beta among their updated dependencies.
The other version bumps and changelog entries have not changed since the last review and still match their changesets.
The tag history and commit range were not checked, because that history is not available here.
Reviewed commit: 3dd9f75b
3dd9f75 to
b65774b
Compare
There was a problem hiding this comment.
✅ Approved — No issues found. The newly consumed Vite+ changeset (#16588) matches the new autoconfig 0.9.0 changelog entry, and the rest of the release has not changed since the last review and still matches its changesets.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low
This pull request now consumes fifteen changesets. One is new since the last review: viteplus-project-commands.md (#16588, 3f14c76). Its patch entry now appears in the @cloudflare/autoconfig 0.9.0 changelog, and the text matches the changeset.
The other version bumps and changelog entries have not changed since the last review and still match their changesets.
I could not check the tag history or the commit range, because that history is not available here.
Reviewed commit: b65774bb
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@cloudflare/autoconfig@0.9.0
Minor Changes
#16366
d174de8Thanks @MattieTK! - Add anoutputDiroption togetDetailsForAutoConfigCallers that already know which directory holds their built static assets can pass it as
outputDirinstead of having autoconfig detect one. Relative paths are resolved against the project path. This selects static-asset configuration for unconfigured projects even when framework dependencies are present, without running framework migrations or builds that could replace the requested assets. Existing Workers and Pages configurations, including deployments configured through the Cloudflare Vite plugin alone, retain their usual detection behavior.Checking whether a Vite project already uses the Cloudflare plugin no longer writes the Vite config back to disk, preserving its line endings and trailing newline.
Patch Changes
#16537
a2d1338Thanks @edmundhung! - Support React Router oncffrom version 8.5.1React Router 8.5.1 builds into the output directories that the Cloudflare Vite plugin v2 uses, which
cfneeds. Autoconfig now requires React Router 8.5.1 or later when configuring a project forcf, and stops with a clear message on earlier versions instead of lettingcf buildfail later. Projects configured for Wrangler keep the existing minimum of React Router 7.0.0.#16588
3f14c76Thanks @irvinebroque! - Run the project-local Vite+ executable for Vite+ projectsUse
vp devandvp buildwhen Vite+ is declared. Its Vite alias does not expose aviteexecutable, so invokingvitecan fail with pnpm or cause npm to fetch a separate Vite. Preserve framework-owned commands and custom scripts.Updated dependencies [
91f0e03]:miniflare@5.20261023.4-beta
Minor Changes
#16514
009ca6eThanks @edmundhung! - AddresolveLocalBindings()It fills in a Worker's secrets and Hyperdrive connection strings for local development, and warns about secrets that have no local value.
@cloudflare/vite-plugin@2.0.0-beta.v.9
Minor Changes
#16573
91f0e03Thanks @petebacondarwin! - Customize the full parsed Cloudflare configuration through the beta Vite plugin'sconfigcallbackThe
configoption now accepts(loadedConfig: ParsedInputConfigWithWorker) => ParsedInputConfigWithWorker, allowing frameworks to customize account settings and Containers alongside the entry Worker. Both the loaded and returned configurations include a Worker, andParsedInputConfigWithWorkeris exported for framework authors. The returned configuration is revalidated, including resource relationships, before being used for development and recorded in the build output for preview and deployment.This is a breaking change to the beta API: object overrides and callbacks that mutate or return partial Worker configurations must return a complete configuration instead. Copy the loaded configuration and any nested fields to preserve, for example
config: (loadedConfig) => ({ ...loadedConfig, worker: { ...loadedConfig.worker, name: "my-worker", compatibilityDate: "2026-10-01" } }). Fields and arrays are replaced rather than deep-merged.Patch Changes
91f0e03,effe4ed,009ca6e]:@cloudflare/build-output-utils@0.9.7
Patch Changes
91f0e03]:@cloudflare/config@0.29.1
Patch Changes
#16573
91f0e03Thanks @petebacondarwin! - Reject duplicate Container names and invalid Container linksDuplicate Container names, references to missing Containers, and multiple Durable Objects linked to the same Container now produce configuration errors before development starts or build output is generated. This also catches invalid Container links introduced by the Vite plugin's
configcustomizer.@cloudflare/containers-shared@0.23.6
Patch Changes
91f0e03]:create-cloudflare@2.74.6
Patch Changes
#16524
3819800Thanks @petebacondarwin! - Preserve accounts with duplicate display names during account selectionCreate Cloudflare now keeps accounts by their IDs and includes each ID in the selection prompt, so accounts with the same name remain distinct choices. This applies to both Wrangler and cf projects.
@cloudflare/deploy-helpers@0.24.4
Patch Changes
#16562
aece4dfThanks @audricbizouarn-dashdoc! - Retry transient failures when starting a Workers assets upload sessionAsset manifest registration now uses the same bounded API retry policy as Worker uploads, including support for
Retry-After. Temporary server errors no longer immediately abort an otherwise valid deployment. Persistent failures still surface the original error after the retry limit; this does not repair server-side issues affecting a specific Worker.#16597
f9dbb22Thanks @guybedford! - Fix WebAssembly stack frames printing asat [object Object]in source-mapped errorsWebAssembly frames in source-mapped error stack traces now show their original function and location instead of
[object Object].Updated dependencies [
91f0e03,009ca6e]:@cloudflare/pages-functions@0.1.3
Patch Changes
#16603
2667a9fThanks @petebacondarwin! - Fix repeated slashes in URL paths bypassing Pages Functions middlewarePages Functions now collapse repeated slashes when looking up middleware, so requests such as
//secure/onerun the same middleware as/secure/one. The original request URL and function-route matching are preserved. Middleware receives afunctionPathprefix from the original URL so imported assets can still resolve their relative paths.@cloudflare/pages-shared@0.13.206
Patch Changes
009ca6e]:@cloudflare/runtime-types@0.1.20
Patch Changes
#16594
effe4edThanks @jaeminbird! - Fixwrangler types --checkreporting CRLF types files as out of dateWhen
worker-configuration.d.tswas checked out with CRLF line endings (for example with Git'score.autocrlf=true, the default on Windows), the runtime header kept a trailing\rand never matched the expected header.wrangler types --checkthen always failed,wrangler devalways warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.Updated dependencies [
009ca6e]:@cloudflare/vitest-plugin@1.4.12
Patch Changes
effe4ed,009ca6e,5740867,d174de8,aece4df,2667a9f,ed7fb41,f9dbb22]:@cloudflare/workers-auth@0.15.4
Patch Changes
#16557
30d9f72Thanks @Kmschr! - Request the user API token management scope when logging in with cfInclude
user-api-tokens.writein cf's default OAuth scopes so users can list and manage their user API tokens, including when they have reached the token creation limit. Existing OAuth sessions need a new login to request the scope.#16525
ed7fb41Thanks @petebacondarwin! - Validate OAuth error callbacks against the pending loginAll authorization callbacks, including ones without a code or error, now require the matching login state. Unrelated callbacks leave the login running so the authorization page can complete it, and control characters in provider error messages are displayed as escaped text.
wrangler@4.156.1
Patch Changes
#16594
effe4edThanks @jaeminbird! - Fixwrangler types --checkreporting CRLF types files as out of dateWhen
worker-configuration.d.tswas checked out with CRLF line endings (for example with Git'score.autocrlf=true, the default on Windows), the runtime header kept a trailing\rand never matched the expected header.wrangler types --checkthen always failed,wrangler devalways warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.#16535
5740867Thanks @petebacondarwin! - Keep Pages development asset lookups within the configured directoryValidate resolved asset paths relative to the Pages output directory, preventing neighboring files and directories with a shared name prefix from being served. This also applies to the Vitest Pages ASSETS helper. Assets inside the directory and existing not-found fallbacks retain their behavior.
#16366
d174de8Thanks @MattieTK! - Deploy the requested directory whenwrangler pages deploy <directory>is run as a Workers static-assets deployWhen
wrangler pages deploy <directory>was carried out as a Workers static-assets deploy, the<directory>argument was only used to check for unsupported Pages features and was then dropped. Autoconfig detected an assets directory of its own instead, and when the project root contained anindex.htmlit chose the whole project root, even when a narrower directory such aspublichad been requested. Source files and configuration outside the requested directory that were not excluded by.assetsignorecould then be uploaded as public static assets.The requested directory is now validated before files are written and passed through to the deploy. Unconfigured projects are set up for static assets even when framework dependencies are present; existing Workers configs receive an
--assetsor legacy--siteoverride. Projects configured through the Cloudflare Vite plugin alone keep their configuration and scripts, using the requested directory and an explicit or default compatibility date just for this deploy. Successful deployments without a config file are recorded in the project's.wrangler/deploymentsdirectory for that account and Worker, surviving dependency reinstalls. Repeat deploys verify the recorded version still belongs to the target Worker before allowing an update, preserving protection against name collisions and replacements.#16562
aece4dfThanks @audricbizouarn-dashdoc! - Retry transient failures when starting a Workers assets upload sessionAsset manifest registration now uses the same bounded API retry policy as Worker uploads, including support for
Retry-After. Temporary server errors no longer immediately abort an otherwise valid deployment. Persistent failures still surface the original error after the retry limit; this does not repair server-side issues affecting a specific Worker.#16603
2667a9fThanks @petebacondarwin! - Fix repeated slashes in URL paths bypassing Pages Functions middlewarePages Functions now collapse repeated slashes when looking up middleware, so requests such as
//secure/onerun the same middleware as/secure/one. The original request URL and function-route matching are preserved. Middleware receives afunctionPathprefix from the original URL so imported assets can still resolve their relative paths.#16525
ed7fb41Thanks @petebacondarwin! - Validate OAuth error callbacks against the pending loginAll authorization callbacks, including ones without a code or error, now require the matching login state. Unrelated callbacks leave the login running so the authorization page can complete it, and control characters in provider error messages are displayed as escaped text.
#16597
f9dbb22Thanks @guybedford! - Fix WebAssembly stack frames printing asat [object Object]in source-mapped errorsWebAssembly frames in source-mapped error stack traces now show their original function and location instead of
[object Object].Updated dependencies [
009ca6e]:@cloudflare/remote-bindings@0.0.57
Patch Changes
30d9f72,009ca6e,aece4df,ed7fb41,f9dbb22]: