chore(deps): update wrangler and @cloudflare/vite-plugin

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin	1.45.1 → 1.46.0
wrangler	4.112.0 → 4.113.0

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.46.0

Compare Source

Minor Changes

• #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export const settings = defineSettings({
  	accountId: "<your-account-id>",
  });
  
  export default defineWorker({
  	name: "my-worker",
  	entrypoint,
  	compatibilityDate: "2026-05-18",
  });

  This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

Patch Changes

• Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:
  • miniflare@​4.20260721.0
  • wrangler@​4.113.0

cloudflare/workers-sdk (wrangler)

v4.113.0

Compare Source

Minor Changes

• #​14471 f03b108 Thanks @​DiogoSantoss! - Apply Email Routing addresses during Worker trigger deployment

  Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy, wrangler triggers deploy, and clients of @cloudflare/deploy-helpers. After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone (+ added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules.

• #​14679 deae171 Thanks @​dario-piotrowicz! - Add exclude_packages option to dependencies_instrumentation configuration

  The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads.

  // wrangler.json
  {
    "dependencies_instrumentation": {
      "exclude_packages": ["@​internal/*", "secret-tool"]
    }
  }

• #​14721 4e92e32 Thanks @​dmmulroy! - Support Artifacts sources when creating Queue event subscriptions

  wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API.

• #​13352 d1d6945 Thanks @​penalosa! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings

  Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled.

• #​14688 a0c8bb1 Thanks @​NuroDev! - Print Local Explorer API details for headless agent-driven wrangler dev sessions

  When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI.

• #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export const settings = defineSettings({
  	accountId: "<your-account-id>",
  });
  
  export default defineWorker({
  	name: "my-worker",
  	entrypoint,
  	compatibilityDate: "2026-05-18",
  });

  This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

• #​14595 2b390d7 Thanks @​colinhacks! - Recognise nub as a package manager

  wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

• #​14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

  Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

• #​14715 42af66d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260714.1	^5.20260721.1
  workerd	1.20260714.1	1.20260721.1

• #​14744 a0a091b Thanks @​penalosa! - Drop the "Experimental:" prefix from the resource provisioning header now that automatic provisioning is generally available. The deploy output now reads The following bindings need to be provisioned:.

• #​14720 0df3d43 Thanks @​penalosa! - Fix remote binding previews for accounts without a workers.dev subdomain

  Wrangler now automatically registers a workers.dev subdomain when one is required to start a remote binding preview.

• #​14773 d83a476 Thanks @​chinesepowered! - Fix stray characters in the Workers Sites asset-key-too-long error

  The error thrown when an asset path key exceeds the 512-character limit ended with a stray ", copy-paste artifact, so the message printed to users terminated with ...#kv-limits", and the trailing documentation URL was malformed. The message now ends cleanly at the URL.

• #​14766 4815711 Thanks @​gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

  A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

  The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

• #​14448 c82d96b Thanks @​GregBrimble! - Use the new PATCH APIs for versioned secret commands

  Wrangler now updates versioned Worker secrets by patching the latest Worker version instead of downloading the latest version contents and uploading a full replacement version. This avoids reconstructing Worker configuration in Wrangler, which should reduce bugs when Workers use less common features. For example, this avoids regressions like the previous placement preservation bug fixed in #​13843.

• #​14617 f75ae5d Thanks @​martijnwalraven! - Derive nodejsCompatMode from the effective compatibility inputs in unstable_startWorker()

  The CLI computes the node-compat mode from the effective compatibility date and flags (args.* ?? parsedConfig.*), but the programmatic path used input.build.nodejsCompatMode raw — leaving it unset meant a worker's nodejs_compat flag (from its config file or from input-level compatibilityFlags) was silently ignored, so bundling failed to resolve node builtins that wrangler dev handles. startWorker now derives the mode the same way when the caller does not provide one: input-level compatibilityDate/compatibilityFlags first, then the resolved config, with no-bundle taken from the resolved build.bundle semantics. Passing an explicit null still disables it.

• Updated dependencies [42af66d, 4815711, 34430b3]:

  • miniflare@​4.20260721.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	u	36a82c5	Commit Preview URL Branch Preview URL	Jul 23 2026, 05:31 AM