Workers SDK Updates & Release Notes

Minor Changes

#14633 3203b5d Thanks @nickpatt! - Add local-dev observability

wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

You can explore this data two ways:

A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.

A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

#14373 246ce92 Thanks @Jacroney! - Improve the D1 database-limit error message

When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

#14796 c38a2c3 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency
From
To
@cloudflare/workers-types
^5.20260721.1
^5.20260722.1
workerd
1.20260721.1
1.20260722.1

#14788 8416b33 Thanks @chinesepowered! - Fix grammar in the container image-too-large error

The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

#14809 4683ff8 Thanks @jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

#14593 02232f3 Thanks @spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

#14797 f8a8c2c Thanks @roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

[email protected]

Original source

Minor Changes

#14633 3203b5d Thanks @nickpatt! - Add local-dev observability

wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

You can explore this data two ways:

• A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
• A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

#14796 c38a2c3 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency
From
To
@cloudflare/workers-types
^5.20260721.1
^5.20260722.1
workerd
1.20260721.1
1.20260722.1

#14772 c079ba3 Thanks @chinesepowered! - Fix incorrect byte limit reported in the local Queues batch-size error

When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

#14493 95b026e Thanks @petebacondarwin! - Update sharp to 0.35.2

sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

#14792 c4bacec Thanks @matthewp! - Recover local development after the Workers runtime crashes

Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

Original source

Patch Changes

• #14505 65b0ccf Thanks @petebacondarwin! - Stop pre-approving sharp's build script in generated projects

  miniflare 0.35+ ships sharp 0.35, which no longer has an install lifecycle script, so generated pnpm-workspace.yaml files no longer pre-approve sharp under allowBuilds. esbuild and workerd are still pre-approved because they retain their install/postinstall scripts.

• #14761 c64cad3 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  nuxi
  3.36.1
  3.37.0

• #14789 67f55b7 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  create-vike
  0.0.662
  0.0.664

• #14613 620227d Thanks @lucasmzz! - Fix Cloudflare bindings being unavailable during nuxt dev in pnpm projects created from the Nuxt template

  The Nuxt (Workers) template explicitly installs h3 when using pnpm, so that the H3EventContext type augmentation in env.d.ts can resolve the h3 module under pnpm's isolated node_modules layout. Since h3's latest npm dist-tag moved to the 2.x release candidates, this installed [email protected] alongside the [email protected] that Nuxt/Nitro run on. Nitro's auto-import layer then resolved getRequestURL from h3 v2, which throws when called with an h3 v1 event inside the nitro-cloudflare-dev request hook. Nitro swallows request-hook errors, so the hook silently failed before assigning event.context.cloudflare, and any server route accessing bindings crashed with "Cannot read properties of undefined (reading 'env')".

  The template now installs h3@^1, matching the h3 major that nitropack depends on.

• #14769 d059704 Thanks @edmundhung! - Stop adding a custom React Router server entry file to new projects

  React Router 8.2 now provides a Web Streams-compatible default server entry for non-Node runtimes. Newly generated Cloudflare projects use that default and only need app/entry.server.tsx for custom server rendering.

Original source

Minor Changes

• #14633 3203b5d Thanks @nickpatt! - Add local-dev observability

wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

You can explore this data two ways:

• A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
• A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14792 c4bacec Thanks @matthewp! - Recover local development after the Workers runtime crashes

Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

• [email protected]
• [email protected]

Original source

Patch Changes

#14373 246ce92 Thanks @Jacroney! - Improve the D1 database-limit error message

When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

• [email protected]

Original source

Minor Changes

• #14471 f03b108 Thanks @DiogoSantoss! - Apply Email Routing addresses during Worker trigger deployment

Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy, wrangler triggers deploy, and clients of @cloudflare/deploy-helpers. After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone (+ added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules.

• #14679 deae171 Thanks @dario-piotrowicz! - Add exclude_packages option to dependencies_instrumentation configuration

The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads.

// wrangler.json
{
"dependencies_instrumentation": {
"exclude_packages": ["@internal/*", "secret-tool"]
}
}

• #14721 4e92e32 Thanks @dmmulroy! - Support Artifacts sources when creating Queue event subscriptions

wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API.

• #13352 d1d6945 Thanks @penalosa! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings

Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled.

• #14688 a0c8bb1 Thanks @NuroDev! - Print Local Explorer API details for headless agent-driven wrangler dev sessions

When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI.

• #14724 a50f73a Thanks @jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

// cloudflare.config.ts
import { defineSettings, defineWorker } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
export const settings = defineSettings({
accountId: "<your-account-id>",
});
export default defineWorker({
name: "my-worker",
entrypoint,
compatibilityDate: "2026-05-18",
});

This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

• #14595 2b390d7 Thanks @colinhacks! - Recognise nub as a package manager

wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

• #14742 34430b3 Thanks @pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

• #14715 42af66d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To @cloudflare/workers-types ^5.20260714.1 ^5.20260721.1 workerd 1.20260714.1 1.20260721.1

• #14744 a0a091b Thanks @penalosa! - Drop the "Experimental:" prefix from the resource provisioning header now that automatic provisioning is generally available. The deploy output now reads The following bindings need to be provisioned:.

• #14720 0df3d43 Thanks @penalosa! - Fix remote binding previews for accounts without a workers.dev subdomain

Wrangler now automatically registers a workers.dev subdomain when one is required to start a remote binding preview.

• #14773 d83a476 Thanks @chinesepowered! - Fix stray characters in the Workers Sites asset-key-too-long error

The error thrown when an asset path key exceeds the 512-character limit ended with a stray ", copy-paste artifact, so the message printed to users terminated with ...#kv-limits", and the trailing documentation URL was malformed. The message now ends cleanly at the URL.

• #14766 4815711 Thanks @gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

• #14448 c82d96b Thanks @GregBrimble! - Use the new PATCH APIs for versioned secret commands

Wrangler now updates versioned Worker secrets by patching the latest Worker version instead of downloading the latest version contents and uploading a full replacement version. This avoids reconstructing Worker configuration in Wrangler, which should reduce bugs when Workers use less common features. For example, this avoids regressions like the previous placement preservation bug fixed in #13843.

• #14617 f75ae5d Thanks @martijnwalraven! - Derive nodejsCompatMode from the effective compatibility inputs in unstable_startWorker()

The CLI computes the node-compat mode from the effective compatibility date and flags (args.* ?? parsedConfig.*), but the programmatic path used input.build.nodejsCompatMode raw — leaving it unset meant a worker's nodejs_compat flag (from its config file or from input-level compatibilityFlags) was silently ignored, so bundling failed to resolve node builtins that wrangler dev handles. startWorker now derives the mode the same way when the caller does not provide one: input-level compatibilityDate/compatibilityFlags first, then the resolved config, with no-bundle taken from the resolved build.bundle semantics. Passing an explicit null still disables it.

Updated dependencies [42af66d, 4815711, 34430b3]:

• [email protected]

Original source

Minor Changes

#14742 34430b3 Thanks @pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

#14715 42af66d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency

From

To

@cloudflare/workers-types

^5.20260714.1

^5.20260721.1

workerd

1.20260714.1

1.20260721.1

#14766 4815711 Thanks @gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

Original source

Patch Changes

• #14659 5cee1d4 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  create-docusaurus
  3.10.1
  3.10.2

• #14759 947ad34 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  @angular/create
  22.0.6
  22.0.7

• #14760 9ed6dc2 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  sv
  0.16.2
  0.16.3

• #14534 a330170 Thanks @petebacondarwin! - Preserve existing Nuxt modules when adding Cloudflare configuration

  Scaffolding a Nuxt application whose nuxt.config.ts already declares a modules array (for example the ui starter, which registers @nuxt/ui and @nuxt/eslint) previously overwrote that array when adding nitro-cloudflare-dev, dropping the existing modules and breaking the build. Existing entries are now retained and the Cloudflare module is appended instead.

• #14790 03ce063 Thanks @emily-shen! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency
  From
  To
  create-next-app
  16.2.10
  16.2.11

Original source

Minor Changes

• #14595 2b390d7 Thanks @colinhacks! - Recognise nub as a package manager

wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

Patch Changes

• #14746 a6c214f Thanks @samarth70! - Return a clear error when observability is set to null

validateObservability guarded only against undefined, so a null value (valid in JSON/JSONC config) passed the typeof value === "object" check and then threw TypeError: Cannot read properties of null (reading 'enabled') while validating the config. It now rejects null with the same "observability" should be an object but got null. diagnostic that the sibling cache validator already produces.

Original source