Workers SDK Updates & Release Notes
209 updates curated from 1 source by the Releasebot Team. Last updated: Sep 12, 2026
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
Workers SDK improves Wrangler custom domain and Preview URL handling with clearer provisioning notes, better production status labels, fewer replacement prompts, and more helpful preview guidance for Workers.dev and custom domains.
Patch Changes
#15592 945aaa3 Thanks @WillTaylorDev! - Add a provisioning delay note when custom domain Preview URLs change
Wrangler now explains that DNS and TLS certificate provisioning may continue after a deploy adds a custom domain or enables its Preview URLs. Stable redeploys don't repeat the note.
This assumes that a request which matches the stored custom domain state doesn't restart provisioning. The client infers this from the API changeset and current domain record because this repository can't verify the backend behavior.
#15592 945aaa3 Thanks @WillTaylorDev! - Clarify production status labels for custom domain routes
Wrangler now prefixes explicit custom domain production states with production: so they match Preview labels. The updated labels appear in deployed trigger output and WRANGLER_OUTPUT_FILE_PATH.
#15602 47d906f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
Dependency
From
To
@cloudflare/workers-types
^5.20260910.1
^5.20260911.1
workerd
1.20260910.1
1.20260911.1
#15592 945aaa3 Thanks @WillTaylorDev! - Avoid replacement prompts for custom domains already on the Worker
Wrangler now updates Preview settings without asking to replace a custom domain when that domain already belongs to the deployed Worker. It still asks before replacing domains attached to another Worker.
#15592 945aaa3 Thanks @WillTaylorDev! - Explain how to enable Preview URLs when a Preview deployment has none
wrangler preview now shows URL shapes and configuration snippets for Workers.dev and custom domains. The custom domain snippet preserves every configured route, and the guidance distinguishes missing settings from disabled ones.
This changes a private beta feature. The warning also makes clear that wrangler deploy publishes code from the current checkout.
Updated dependencies [47d906f, c2699bf]
Original source - Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
Workers SDK fixes Durable Object stub.fetch for Node Request objects and updates miniflare and wrangler dependencies.
Patch Changes
#15602 47d906f Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
Dependency
From
To
@cloudflare/workers-types
^5.20260910.1
^5.20260911.1
workerd
1.20260910.1
1.20260911.1
#15121 c2699bf Thanks @HaoChiBao! - Fix Durable Object stub.fetch rejecting Node's global Request
Passing a Node.js global Request object to a Durable Object stub's fetch() (for example when using getPlatformProxy) previously failed with a URL parsing error. Such requests are now accepted and forwarded as expected.
Original source All of your release notes in one feed
Join Releasebot and get updates from Cloudflare and hundreds of other software products.
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
Workers SDK updates the default compatibility date for new projects to 2026-09-11.
Patch Changes
- #15604 9109a76 Thanks @dom96! - Update the default compatibility date for newly created projects to 2026-09-11
The default compatibility date tracks the pinned workerd release, which was bumped to 1.20260911.1. Releasing C3 ships the updated date to npm create cloudflare users, since it is bundled into the published package.
Original source - Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK ships patch updates with refreshed Wrangler and Miniflare dependencies.
Patch Changes
Updated dependencies [945aaa3, 945aaa3, 47d906f, c2699bf, 945aaa3, 945aaa3]:
Original source - Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK updates dependencies including wrangler 4.131.1 and miniflare 5.20260911.0-alpha.
Patch Changes
Updated dependencies [945aaa3, 945aaa3, 47d906f, c2699bf, 945aaa3, 945aaa3]:
Original source Similar to Workers SDK with recent updates:
- Claude updates137 release notes · Latest Sep 10, 2026
- OpenAI updates210 release notes · Latest Sep 10, 2026
- Cloudflare AI updates152 release notes · Latest Sep 11, 2026
- Analytics updates131 release notes · Latest Sep 8, 2026
- Application Security updates160 release notes · Latest Sep 10, 2026
- Network Security updates33 release notes · Latest Jul 8, 2026
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK updates dependencies and bumps Miniflare to 5.20260911.0-alpha in a patch release.
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK patches dependencies with updates to deploy helpers and Miniflare.
Patch Changes
Updated dependencies [945aaa3, 945aaa3, 47d906f, c2699bf, 945aaa3, 945aaa3]:
- @cloudflare/[email protected]
- [email protected]
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK updates dependencies in a patch release with Miniflare alpha support.
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK adds clearer custom domain and Preview URL handling in Wrangler, with provisioning delay notes, production status label fixes, safer domain update prompts, and better guidance for enabling Preview URLs in private beta.
Patch Changes
#15592 945aaa3 Thanks @WillTaylorDev! - Add a provisioning delay note when custom domain Preview URLs change
Wrangler now explains that DNS and TLS certificate provisioning may continue after a deploy adds a custom domain or enables its Preview URLs. Stable redeploys don't repeat the note.
This assumes that a request which matches the stored custom domain state doesn't restart provisioning. The client infers this from the API changeset and current domain record because this repository can't verify the backend behavior.
#15592 945aaa3 Thanks @WillTaylorDev! - Clarify production status labels for custom domain routes
Wrangler now prefixes explicit custom domain production states with production: so they match Preview labels. The updated labels appear in deployed trigger output and WRANGLER_OUTPUT_FILE_PATH.
#15592 945aaa3 Thanks @WillTaylorDev! - Avoid replacement prompts for custom domains already on the Worker
Wrangler now updates Preview settings without asking to replace a custom domain when that domain already belongs to the deployed Worker. It still asks before replacing domains attached to another Worker.
#15592 945aaa3 Thanks @WillTaylorDev! - Explain how to enable Preview URLs when a Preview deployment has none
wrangler preview now shows URL shapes and configuration snippets for Workers.dev and custom domains. The custom domain snippet preserves every configured route, and the guidance distinguishes missing settings from disabled ones.
This changes a private beta feature. The warning also makes clear that wrangler deploy publishes code from the current checkout.
Updated dependencies [47d906f, c2699bf, 7d39eed]:
- [email protected]
- @cloudflare/[email protected]
- Sep 11, 2026
- Date parsed from source:Sep 11, 2026
- First seen by Releasebot:Sep 12, 2026
@cloudflare/[email protected]
Workers SDK publishes @cloudflare/containers-shared for internal use.
Patch Changes
#15512 7d39eed Thanks @emily-shen! - Publish @cloudflare/containers-shared for internal use
It remains internal-only and does not provide a stable public API surface.
Original source - Sep 10, 2026
- Date parsed from source:Sep 10, 2026
- First seen by Releasebot:Sep 11, 2026
Workers SDK adds Durable Object-managed Containers, improving Wrangler deploy flows with idempotent application setup, image binding handling, and safer versions deploy behavior. It also removes preview settings commands, fixes several Wrangler and Pages edge cases, and updates dependencies and security fixes.
Minor Changes
- #15480 36aed7f Thanks @skepticfx! - Add Durable Object-managed Containers to top-level container configuration
Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.
Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.
Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.
With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.
versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.
EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.
- #15493 493e635 Thanks @GregBrimble! - Remove wrangler preview settings commands
The private-beta wrangler preview settings and wrangler preview settings update commands are no longer available.
Patch Changes
- #15411 0b43395 Thanks @xgame92! - Fail wrangler versions upload early when a Worker has a pending Durable Object migration
Wrangler now directs users to run wrangler deploy to apply the migration instead of sending a version upload request that the API will reject.
- #15518 9d75006 Thanks @taylorlee! - Detect named-only module Worker entrypoints correctly
Wrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy addEventListener registration identifies Service Worker format.
- #15581 b605aa6 Thanks @MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commands
The legacy forced result counted every agent-driven Pages command using --force, including commands that could never have been delegated. Wrangler now emits eligible_forced only when --force prevents an otherwise eligible delegation, and records other agent commands as ineligible with a bounded reason and whether force was used.
- #15432 f45b596 Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindings
Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.
- #15585 f69f95a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
Dependency
From
To
@cloudflare/workers-types
^5.20260908.1
^5.20260910.1
workerd
1.20260908.1
1.20260910.1
- #15554 bff525d Thanks @XiaoZ-0218! - Add the missing transferred_classes migration to the config schema
DurableObjectMigration described new_classes, new_sqlite_classes, renamed_classes and deleted_classes, but not transferred_classes. normalizeAndValidateConfig has always validated that key, and the deploy path forwards it to the API along with the rest of the step, so Transfer migrations worked — but config-schema.json is generated from the type, so an editor resolving $schema reported a valid, documented migration as an unknown key.
Adding the field to the type puts it in the generated schema. No runtime change.
- #15584 96688b3 Thanks @Svector-anu! - Bump shell-quote to 1.9.0+ to pick up two disclosed advisories
[email protected] is affected by a ReDoS in parse() (CVE-2026-13311 / GHSA-395f-4hp3-45gv — an unauthenticated attacker who can feed a string into parse() can block the event loop for tens of seconds with plain space-separated input, no shell metacharacters required) and by an object-token escaping bug in quote() (CVE-2026-9277 / GHSA-w7jw-789q-3m8p), both fixed upstream in 1.9.0. Wrangler's parse() wrapper (src/utils/shell-quote.ts) is reachable from pages dev/init command-line parsing, so the ReDoS applies; the quote() call site only ever passes string arguments, so the object-token issue was not reachable here, but there is no reason to stay on a vulnerable range once a patch exists.
- #15563 ed5797a Thanks @Bortlesboat! - Encode filenames in Pages HTML redirects
Fix wrangler pages dev returning a 502 response when redirecting HTML paths containing Unicode characters. Keep reserved characters in filenames encoded in the redirect destination and preserve the request query string.
- #14889 128235a Thanks @chinesepowered! - Fix wrangler types --strict-vars=false emitting invalid TypeScript for an empty array var
A var whose value was an empty array produced ()[], which is a syntax error. Because this lands in the generated worker-configuration.d.ts, it did not just break that one line — the whole file failed to parse, so no binding types resolved at all. An empty array now generates unknown[].
- #15494 f8aea7e Thanks @GregBrimble! - Use previews_base_config for Preview configuration
Preview commands now read the Worker Previews Base configuration from the previews_base_config API field.
- #15569 24ef86b Thanks @RealBhupesh! - Fix wrangler workflows instances describe crashing on dynamic retry delays
The Workflows API serializes function retry delays as "[dynamic]". The describe command previously parsed that as a duration, produced an Invalid Date, and threw RangeError: Invalid time value before printing remaining steps. It now renders unknown (dynamic delay) and also tolerates attempts whose end timestamp is missing.
- Updated dependencies [f45b596, f69f95a, a549e58, dbb3ff4, fea3cd0, 6bd7b6c, 15cd6e1, be1caec, dbc9506]:
- Sep 10, 2026
- Date parsed from source:Sep 10, 2026
- First seen by Releasebot:Sep 11, 2026
Workers SDK adds Miniflare improvements for TCP handler testing, more reliable startup and disposal, better fetch-only remote binding handling, case-insensitive compression matching, broader Headers support, and smaller embedded assets and router Workers.
Minor Changes
- #15578 15cd6e1 Thanks @ThomasRubini! - Add Miniflare#dispatchConnect() for testing Worker TCP handlers
Tests can now open a Node.js socket to a Worker's configured TCP trigger without reserving and connecting to a fixed port manually. Miniflare waits for startup, resolves OS-assigned ports, supports selecting Workers and triggers, and closes dispatched sockets during disposal.
Patch Changes
- #15432 f45b596 Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindings
Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.
- #15585 f69f95a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
Dependency
From
To
@cloudflare/workers-types
^5.20260908.1
^5.20260910.1
workerd
1.20260908.1
1.20260910.1- #14814 a549e58 Thanks @chinesepowered! - Match Content-Type case-insensitively when simulating Cloudflare's response compression
Locally, responses were only compressed when the Content-Type matched the compressible media type list exactly. Because HTTP media types are case-insensitive and may carry whitespace before their parameters, headers such as Application/JSON or text/html ; charset=utf-8 were treated as non-compressible, diverging from production behaviour. The media type is now trimmed and lowercased before matching.
- #15540 dbb3ff4 Thanks @NAVEENKUMARKR777! - Fix DevalueError: Cannot stringify arbitrary non-POJOs when passing a Headers instance to a proxied binding method
R2Object#writeHttpMetadata(), R2Bucket#put()'s onlyIf option, and other proxied APIs that accept a Headers argument previously only worked if that Headers instance came from the exact same Headers implementation Miniflare uses internally (undici). In practice, user code almost always constructs Headers using the platform global instead (for example inside Next.js, Astro, Remix, or SvelteKit dev servers), which is backed by a different copy of undici and isn't instanceof the one Miniflare imports. This mismatch caused serialisation to fail with a confusing DevalueError, even though the exact same code worked fine when deployed.
Headers, Request, and Response values are now also recognised by their Symbol.toStringTag, which is realm-independent, so any spec-compliant instance is accepted regardless of which copy of the class created it.
- #15485 fea3cd0 Thanks @RealBhupesh! - Reject loopback server bind failures during Miniflare startup instead of leaving ready and dispose() hanging
#startLoopbackServer now attaches an error listener before listen, matching the inspector proxy. When the configured host cannot be bound (e.g. 192.0.2.1), ready rejects and dispose() still settles even if the loopback server never started.
- #15580 6bd7b6c Thanks @petebacondarwin! - Update sharp to 0.35.4
This updates the image-processing dependency used by Miniflare's local Images binding to a version that addresses GHSA-rgj7-g3m4-5g8c, covering vulnerabilities in its bundled libheif library.
- #15515 be1caec Thanks @Wichtowski! - Handle Miniflare listener startup failures consistently
Loopback and inspector servers now remove startup-only error handlers after binding and close the server after bind failures. Inspector bind failures are observed immediately and propagated through readiness, URL access, and disposal.
- #15403 dbc9506 Thanks @james-elicx! - Reduce the size of Miniflare's embedded asset and router Workers
Miniflare does not configure Sentry credentials for its asset services, so their builds now replace the unused production Sentry setup with a no-op instead of bundling Toucan.
Original source - Sep 10, 2026
- Date parsed from source:Sep 10, 2026
- First seen by Releasebot:Sep 11, 2026
@cloudflare/[email protected]
Workers SDK adds Durable Object-managed Containers in top-level Wrangler configuration, improves deploy and versions deploy behavior for Container image bindings, and fixes a missing transferred_classes migration field in the generated config schema.
Minor Changes
#15480 36aed7f Thanks @skepticfx! - Add Durable Object-managed Containers to top-level container configuration
Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.
Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.
Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.
With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.
versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.
EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.
Patch Changes
#15554 bff525d Thanks @XiaoZ-0218! - Add the missing transferred_classes migration to the config schema
DurableObjectMigration described new_classes, new_sqlite_classes, renamed_classes and deleted_classes, but not transferred_classes. normalizeAndValidateConfig has always validated that key, and the deploy path forwards it to the API along with the rest of the step, so Transfer migrations worked — but config-schema.json is generated from the type, so an editor resolving $schema reported a valid, documented migration as an unknown key.
Adding the field to the type puts it in the generated schema. No runtime change.
Original source - Sep 10, 2026
- Date parsed from source:Sep 10, 2026
- First seen by Releasebot:Sep 11, 2026
@cloudflare/[email protected]
Workers SDK ships a patch update with refreshed dependencies, including @cloudflare/workers-utils 0.38.0.
Patch Changes
Updated dependencies [36aed7f, bff525d]:
- @cloudflare/[email protected]
- Sep 10, 2026
- Date parsed from source:Sep 10, 2026
- First seen by Releasebot:Sep 11, 2026
@cloudflare/[email protected]
Workers SDK fixes cloudflare:test declarations to work cleanly with Wrangler-generated runtime types and keeps strict projects compatible with skipLibCheck disabled. It also prevents delayed internal errors from fetch-only remote bindings by creating RPC sessions only when needed.
Patch Changes
#15465 efc8c51 Thanks @xgame92! - Fix cloudflare:test declarations composing with Wrangler-generated runtime types
The public test helpers now avoid private workers-types-only globals and use constraints compatible with generated runtime declarations, so strict projects can keep skipLibCheck disabled.
#15432 f45b596 Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindings
Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.
Updated dependencies [0b43395, 9d75006, b605aa6, f45b596, f69f95a, a549e58, 36aed7f, 493e635, bff525d, dbb3ff4, fea3cd0, 96688b3, 6bd7b6c, 15cd6e1, be1caec, ed5797a, dbc9506, 128235a, f8aea7e, 24ef86e]:
Curated by the Releasebot team
Releasebot is an aggregator of official product update announcements from hundreds of software vendors and thousands of sources.
Our editorial process involves the manual review and audit of release notes procured with the help of automated systems.