Wrangler

2026-03-17

4.75.0

Minor Changes

• #12492 3b81fc6 Thanks @thomasgauvin! - feat: add wrangler tunnel commands for managing Cloudflare Tunnels

  Adds a new set of commands for managing remotely-managed Cloudflare Tunnels directly from Wrangler:

  • wrangler tunnel create <name> - Create a new Cloudflare Tunnel
  • wrangler tunnel list - List all tunnels in your account
  • wrangler tunnel info <tunnel> - Display details about a specific tunnel
  • wrangler tunnel delete <tunnel> - Delete a tunnel (with confirmation)
  • wrangler tunnel run <tunnel> - Run a tunnel using cloudflared
  • wrangler tunnel quick-start <url> - Start a temporary tunnel (Try Cloudflare)

  The run and quick-start commands automatically download and manage the cloudflared binary, caching it in ~/.wrangler/cloudflared/. Users are prompted before downloading and warned if their PATH-installed cloudflared is outdated. You can override the binary location with the CLOUDFLARED_PATH environment variable.

  All commands are marked as experimental.

Patch Changes

• #12927 c9b3184 Thanks @penalosa! - Bump undici from 7.18.2 to 7.24.4

• #12875 13df6c7 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260312.1	1.20260316.1

• #12935 df0d112 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260316.1	1.20260317.1

• #12928 81ee98e Thanks @petebacondarwin! - Migrate chrome-devtools-patches deployment from Cloudflare Pages to Workers + Assets

  The DevTools frontend is now deployed as a Cloudflare Workers + Assets project instead of a Cloudflare Pages project. This uses wrangler deploy for production deployments and wrangler versions upload for PR preview deployments.

  The inspector proxy origin allowlists in both wrangler and miniflare have been updated to accept connections from the new workers.dev domain patterns, while retaining the legacy pages.dev patterns for backward compatibility.

• #12835 c600ce0 Thanks @dario-piotrowicz! - Fix execution freezing on debugger statements when DevTools is not attached

  Previously, wrangler always sent Debugger.enable to the runtime on connection, even when DevTools wasn't open. This caused scripts to freeze on debugger statements. Now Debugger.enable is only sent when DevTools is actually attached, and Debugger.disable is sent when DevTools disconnects to stop the runtime from performing debugging work.

• #12894 f509d13 Thanks @gpanders! - Simplify description of --json option

  Remove extraneous adjectives in the description of the --json option.

• #11888 0a7fef9 Thanks @staticpayload! - Reject cross-drive module paths in Pages Functions routing

  On Windows, module paths using a different drive letter could be parsed in a way that bypassed the project-root check. These paths are now parsed correctly and rejected when they resolve outside the project.

• Updated dependencies [c9b3184, 13df6c7, df0d112, 81ee98e]:

  • miniflare@4.20260317.0

2026-03-16

4.74.0

Minor Changes

• #10896 351e1e1 Thanks @devin-ai-integration! - feat: add --secrets-file parameter to wrangler deploy and wrangler versions upload

  You can now upload secrets alongside your Worker code in a single operation using the --secrets-file parameter on both wrangler deploy and wrangler versions upload. The file format matches what's used by wrangler versions secret bulk, supporting both JSON and .env formats.

  Example usage:

  wrangler deploy --secrets-file .env.production
  wrangler versions upload --secrets-file secrets.json
  

  Secrets not included in the file will be inherited from the previous version, matching the behavior of wrangler versions secret bulk.

• #12873 2b9a186 Thanks @gpanders! - Add wrangler containers instances <application_id> command to list container instances

  Lists all container instances for a given application, matching the Dash instances view. Displays instance ID, state, location, version, and creation time. Supports pagination for applications with many instances. Also adds paginated request support to the containers-shared API client.

Patch Changes

• #12873 2b9a186 Thanks @gpanders! - Add escapeCodeTimeout option to onKeyPress utility for faster Esc key detection

  The onKeyPress utility now accepts an optional escapeCodeTimeout parameter that controls how long readline waits to disambiguate a standalone Esc press from multi-byte escape sequences (e.g. arrow keys). The default remains readline's built-in 500ms, but callers can pass a lower value (e.g. 25ms) for near-instant Esc handling in interactive prompts.

• #12676 65f1092 Thanks @dario-piotrowicz! - Fix autoconfig package installation always failing at workspace roots

  When running autoconfig at the root of a monorepo workspace, package installation commands now include the appropriate workspace root flags (--workspace-root for pnpm, -W for yarn). This prevents errors like "Running this command will add the dependency to the workspace root" that previously occurred when configuring projects at the workspace root.

  Additionally, autoconfig now allows running at the workspace root if the root directory itself is listed as a workspace package (e.g., workspaces: ["packages/*", "."]).

• #12841 7b0d8f5 Thanks @dario-piotrowicz! - Fix unclear error when assets upload session returns a null response

  When deploying assets, if the Cloudflare API returns a null response object, Wrangler now provides a clear error message asking users to retry instead of failing with a confusing error.

• Updated dependencies [ade0aed]:

  • miniflare@4.20260312.1

2026-03-13

4.73.0

Minor Changes

• #12853 ff543e3 Thanks @gpanders! - Deprecate SSH passthrough flags in wrangler containers ssh

  The --cipher, --log-file, --escape-char, --config-file, --pkcs11, --identity-file, --mac-spec, --option, and --tag flags are now deprecated. These flags expose OpenSSH-specific options that are tied to the current implementation. A future release will replace the underlying SSH transport, at which point these flags will be removed. They still function for now.

• #12815 e63539d Thanks @NuroDev! - Support disabling persistence in unstable_startWorker() and unstable_dev()

  You can now disable persistence entirely by setting persist: false in the dev options:

  const worker = await unstable_dev("./src/worker.ts", {
      persist: false,
  });
  

  Or when using unstable_startWorker():

  const worker = await unstable_startWorker({
      entrypoint: "./src/worker.ts",
      dev: {
          persist: false,
      },
  });
  

  This is useful for testing scenarios where you want to ensure a clean state on each run without any persisted data from previous runs.

Patch Changes

• #12861 f7de0fd Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260310.1	1.20260312.1

• #12734 8e89e85 Thanks @flostellbrink! - Add back support for wrangler d1 exports with multiple tables.

  Example:

  # All tables (default)
  wrangler d1 export db --output all-tables.sql
  
  # Single table (unchanged)
  wrangler d1 export db --output single-table.sql --table foo
  
  # Multiple tables (new)
  wrangler d1 export db --output multiple-tables.sql --table foo --table bar
  

• #12807 8d1e130 Thanks @MaxwellCalkin! - fix: vectorize commands now output valid json

  This fixes:

  • wrangler vectorize create
  • wrangler vectorize info
  • wrangler vectorize insert
  • wrangler vectorize upsert
  • wrangler vectorize list
  • wrangler vectorize list-vectors
  • wrangler vectorize list-metadata-index

  Also, wrangler vectorize create --json now also includes the created_at, modified_on and description fields.

• #12856 6ee18e1 Thanks @dario-piotrowicz! - Fix autoconfig for Astro v6 projects to skip wrangler config generation

  Astro 6+ generates its own wrangler configuration on build, so autoconfig now detects the Astro version and skips creating a wrangler.jsonc file for projects using Astro 6 or later. This prevents conflicts between the autoconfig-generated config and Astro's built-in config generation.

• #12700 4bb61b9 Thanks @RiscadoA! - Add client-side validation for VPC service host flags

  The --hostname, --ipv4, and --ipv6 flags on wrangler vpc service create and wrangler vpc service update now validate input before sending requests to the API. Previously, invalid values were accepted by the CLI and only rejected by the API with opaque error messages. Now users get clear, actionable error messages for common mistakes like passing a URL instead of a hostname, using an IP address in the --hostname flag, or providing malformed IP addresses.

• Updated dependencies [f7de0fd, ecc7f79, 1dda1c8]:

  • miniflare@4.20260312.0

2026-03-10

4.72.0

Minor Changes

• #12746 211d75d Thanks @NuroDev! - Add support for inheritable bindings in type generation

  When using wrangler types with multiple environments, bindings from inheritable config properties (like assets) are now correctly inherited from the top-level config in all named environments. Previously, if you defined assets.binding at the top level with named environments, the binding would be marked as optional in the generated Env type because the type generation didn't account for inheritance.

  Example:

  {
      "assets": {
          "binding": "ASSETS",
          "directory": "./public"
      },
      "env": {
          "staging": {},
          "production": {}
      }
  }
  

  Before this change, ASSETS would be typed as ASSETS?: Fetcher (optional). Now, ASSETS is correctly typed as ASSETS: Fetcher (required). This fix currently applies to the assets binding, with an extensible mechanism to support additional inheritable bindings in the future.

• #12826 de65c58 Thanks @gabivlj! - Enable container egress interception in local dev without the experimental compatibility flag

  Container local development now always prepares the egress interceptor sidecar image needed for interceptOutboundHttp(). This makes container-to-Worker interception available by default in Wrangler, Miniflare, and the Cloudflare Vite plugin.

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump node-forge to ^1.3.2 to address security vulnerabilities

  node-forge had ASN.1 unbounded recursion, OID integer truncation, and ASN.1 validator desynchronization vulnerabilities. This is a bundled dependency used for local HTTPS certificate handling.

• #12795 82cc2a8 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260301.1	1.20260306.1

• #12811 3c67c2a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260306.1	1.20260307.1

• #12827 d645594 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260307.1	1.20260310.1

• #12808 6ed249b Thanks @MaxwellCalkin! - Fix wrangler d1 execute --json returning "null" (string) instead of null (JSON null) for SQL NULL values

  When using wrangler d1 execute --json with local execution, SQL NULL values were incorrectly serialized as the string "null" instead of JSON null. This produced invalid JSON output that violated RFC 4627. The fix removes the explicit null-to-string conversion so NULL values are preserved as proper JSON null in the output.

• #12824 9f93b54 Thanks @jamesopstad! - Strip query strings from module names before writing to disk

  When bundling modules with query string suffixes (e.g. .wasm?module), the ? character was included in the output filename. Since ? is not a valid filename character on Windows, this caused an ENOENT error during wrangler dev. This was particularly visible when using Prisma Client with the D1 adapter, which imports .wasm?module files.

  The fix strips query strings from module names before writing them to disk, while preserving correct module resolution.

• #12771 b8c33f5 Thanks @penalosa! - Make remote dev exchange_url optional

  The edge-preview API's exchange_url is now treated as optional. When unavailable or when the exchange fails, the initial token from the API response is used directly. The prewarm step and inspector_websocket have been removed from the remote dev flow in favour of tail_url for live logs.

• Updated dependencies [5451a7f, 82cc2a8, 3c67c2a, d645594, de65c58, cb14820, a7c87d1, e4d9510]:

  • miniflare@4.20260310.0