This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@cloudflare/[email protected]

Minor Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #15033 b6a8629 Thanks @dario-piotrowicz! - Surface Local Explorer API to headless agents

  When a Vite dev or preview server with the Cloudflare plugin is started in a headless AI agent environment, the plugin now prints the Local Explorer API URL and useful resource routes to stdout so agents can discover and call them programmatically.

Patch Changes

• Updated dependencies [b6a8629, b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629, b6a8629, b6a8629]:
  • [email protected]
  • [email protected]

@cloudflare/[email protected]

Minor Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login

  Run wrangler login --device to authenticate without a local callback server. Useful in containers, remote SSH sessions, Codespaces, and any other environment where localhost:8976 is unreachable from your browser.

  The new flow:

  • prints the verification URL and user code to the terminal,
  • attempts to open the verification URL in your default browser automatically (suppressed via --browser=false),
  • and polls the token endpoint until you approve the request (with a 5-minute hard cap).

  The verification URL is supplied by the authorization server, so it is rejected unless it is an https URL on the same auth domain the device code was requested from — it is never printed or opened otherwise.

  --callback-host and --callback-port cannot be combined with --device, since this flow does not start a local callback server.

Patch Changes

• Updated dependencies [b6a8629]:
  • @cloudflare/[email protected]

[email protected]

Minor Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Add --parse-type flag to wrangler ai-search create

  wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.

  Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.

  wrangler ai-search create my-instance \
    --type web-crawler \
    --source https://example.com \
    --parse-type discover

  The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.

• #15033 b6a8629 Thanks @dario-piotrowicz! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #15033 b6a8629 Thanks @dario-piotrowicz! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login

  Run wrangler login --device to authenticate without a local callback server. Useful in containers, remote SSH sessions, Codespaces, and any other environment where localhost:8976 is unreachable from your browser.

  The new flow:

  • prints the verification URL and user code to the terminal,
  • attempts to open the verification URL in your default browser automatically (suppressed via --browser=false),
  • and polls the token endpoint until you approve the request (with a 5-minute hard cap).

  The verification URL is supplied by the authorization server, so it is rejected unless it is an https URL on the same auth domain the device code was requested from — it is never printed or opened otherwise.

  --callback-host and --callback-port cannot be combined with --device, since this flow does not start a local callback server.

Patch Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20260730.1	^5.20260731.1
  workerd	1.20260730.1	1.20260731.1

• #15012 0d33cb8 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20260731.1	^5.20260801.1
  workerd	1.20260731.1	1.20260801.1

• Updated dependencies [b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629]:

  • [email protected]

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629]:
  • @cloudflare/[email protected]
  • @cloudflare/[email protected]

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629]:
  • @cloudflare/[email protected]

[email protected]

Patch Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  sv	0.16.6	0.17.0

• #15033 b6a8629 Thanks @dario-piotrowicz! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  @angular/create	22.0.9	22.1.2

• #15033 b6a8629 Thanks @dario-piotrowicz! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  create-vite	9.1.1	9.1.2

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629, b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629]:
  • @cloudflare/[email protected]
  • [email protected]
  • @cloudflare/[email protected]

[email protected]

Patch Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20260730.1	^5.20260731.1
  workerd	1.20260730.1	1.20260731.1

• #15012 0d33cb8 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20260731.1	^5.20260801.1
  workerd	1.20260731.1	1.20260801.1

• #15033 b6a8629 Thanks @dario-piotrowicz! - Fix local rate limiting being disabled entirely when bindings share a namespace_id but use different periods

  The emulated Ratelimit binding tracked one counter per key per namespace, ignoring the period. Two bindings pointing at the same namespace_id with different simple.period values therefore overwrote each other's counter on every call — each one seeing a window it did not recognise, and so resetting the count to zero — with the result that neither binding ever limited anything:

  {
    "ratelimits": [
      {
        "name": "BURST",
        "namespace_id": "1001",
        "simple": { "limit": 20, "period": 10 }
      },
      {
        "name": "SUSTAINED",
        "namespace_id": "1001",
        "simple": { "limit": 50, "period": 60 }
      }
    ]
  }

  Counters are now tracked per period, matching production, where a counter is identified by a bucket index and bucket start timestamp that are both derived from the period. Bindings that share a namespace_id and a period still share a counter for a given key.

• #15033 b6a8629 Thanks @dario-piotrowicz! - Fix local rate limit counters silently resetting after ~10s of inactivity

  The emulated Ratelimit binding kept its counters on the JS heap of an internal Durable Object. workerd evicts idle Durable Objects after around 10 seconds, taking the counters with them, so in wrangler dev you could hit your Worker, pause to look at something, and find your limit had silently reset part way through the window.

  Counters now live in the Durable Object's storage, which survives eviction. They are still cleared by deleteAllDurableObjects(), so reset() from @cloudflare/vitest-pool-workers continues to reset rate limit state between tests, exactly as it does for KV, R2 and D1. Counters are now also written to the persistence directory, so they survive a wrangler dev restart within the same window.

• #15033 b6a8629 Thanks @dario-piotrowicz! - Surface the full runtime crash report when workerd crashes, and warn when it is restarted

  When workerd crashed, the banner (e.g. *** std::terminate() called with no exception) was reported without its stack trace, because the stack trace was being filtered out along with the ordinary hex-stack noise workerd emits. The crash was therefore impossible to diagnose. The stack: line and the missing-$LLVM_SYMBOLIZER notice that follow a fatal crash banner are now kept, and the whole report is logged at error level.

  Miniflare also recovers from workerd crashes by restarting the runtime, but did so silently, which made a crash look like an unexplained dev server restart. It now warns, including a count so that a repeatedly-crashing runtime is distinguishable from a one-off.

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629]:
  • [email protected]

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629, b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629, b6a8629, b6a8629]:
  • [email protected]
  • [email protected]

@cloudflare/[email protected]

Patch Changes

• #15033 b6a8629 Thanks @dario-piotrowicz! - Use the inherited Worker name when generating container names in named environments

  When containers is declared inside a named environment and the container has no explicit name, the default container name was built from the environment's own name field. name is inheritable, so an environment that doesn't redeclare it left that value undefined, producing the error Must have either a top level "name" and "containers.class_name" field defined, or have field "containers.name" defined. even though a top level name was set — and, if the error was ignored, a container named undefined-<class_name>-<env>.

  {
    "name": "my-worker",
    "env": {
      "staging": {
        "containers": [{ "class_name": "MyContainer", "image": "./Dockerfile" }]
      }
    }
  }

  wrangler deploy --env staging on the configuration above now generates my-worker-mycontainer-staging, matching the documented worker_name-class_name[-env_name] default. A name declared on the environment still takes precedence over the top level one.

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629, b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629, b6a8629]:
  • @cloudflare/[email protected]
  • [email protected]
  • @cloudflare/[email protected]
  • @cloudflare/[email protected]
  • @cloudflare/[email protected]

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [b6a8629, 0d33cb8, b6a8629, b6a8629, b6a8629]:
  • [email protected]