You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The new --check flag allows you to verify that your generated types file is up-to-date without regenerating it. This is useful for CI/CD pipelines, pre-commit hooks, or any scenario where you want to ensure types have been committed after configuration changes.
When types are up-to-date, the command exits with code 0:
$ wrangler types --check
✨ Types at worker-configuration.d.ts are up to date.
When types are out-of-date, the command exits with code 1:
$ wrangler types --check
✘ [ERROR] Types at worker-configuration.d.ts are out of date. Run `wrangler types` to regenerate.
Wrangler can now read asset count limits from JWT claims during Pages deployments,
allowing users to be enabled for higher limits (up to 100,000 assets) on a per-account
basis. The default limit remains at 20,000 assets.
#117550f8d69d Thanks @nikitassharma! - Users can now specify constraints.tiers for their container applications. tier is deprecated in favor of tiers.
If left unset, we will default to tiers: [1, 2].
Note that constraints is an experimental feature.
Wrangler now detects when commands are executed by AI coding agents (such as Claude Code, Cursor, GitHub Copilot, etc.) using the am-i-vibing library. This information is included as an agent property in all analytics events, helping Cloudflare understand how developers interact with Wrangler through AI assistants.
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
We reviewed changes in 94dc4ba...5958d92 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR addresses a security vulnerability (CVE-2026-22036) by updating undici and wrangler. However, the analysis shows that the PR is currently not up to standards due to a new quality issue regarding dependency versioning. There are also significant structural changes in package-lock.json—specifically the removal of peer dependency flags—that warrant investigation to ensure the lockfile wasn't inadvertently corrupted or generated with an incompatible npm version. Finally, there is a mismatch between the versions cited in the PR description and those actually implemented in the code.
About this PR
The package-lock.json contains major structural changes, including the removal of peer: true flags for core packages like react and acorn. This often indicates the lockfile was regenerated using a different npm version or configuration. Please verify that these changes do not break peer dependency resolution in production.
There is a discrepancy between the PR description and the implementation: the description specifies an upgrade to wrangler v4.59.1, but the code implements v4.59.3. Additionally, the starting version in the diff is 4.22.0, not 4.54.0 as stated.
Test suggestions
Verify successful dependency installation and environment stability with the updated lockfile structure.
Verify the new 'wrangler types --check' command functions as expected in a local environment.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify successful dependency installation and environment stability with the updated lockfile structure.
2. Verify the new 'wrangler types --check' command functions as expected in a local environment.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Pin the version of 'wrangler' to '4.59.3' instead of using a range ('^') to improve security and build consistency. This ensures all environments use the identical verified version, mitigating supply chain risks. Note that this implemented version (4.59.3) also differs slightly from the version mentioned in the PR description (4.59.1).
Suggested change
"wrangler": "^4.59.3"
"wrangler": "4.59.3"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
LCSOGthb
force-pushed
the
dependabot/npm_and_yarn/npm_and_yarn-4e339a75da
branch
from
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps the npm_and_yarn group with 2 updates in the / directory: wrangler and undici.
Updates
wranglerfrom 4.54.0 to 4.59.1Release notes
Sourced from wrangler's releases.
... (truncated)
Commits
37a8607Version Packages (#11890)99b1f32fix: execute git commands in pages deploy safely (#11889)e98c95aVersion Packages (#11836)ad65efaAdd--checkflag towrangler types(#11852)beb96affeat(unenv-preset): add support for native node:sqlite module (#11841)b0e54b2[wrangler] Add AI agent detection to analytics events (#11820)2203af4Add Node.js 24 and 25 compatibility to the test suites for Miniflare, Wrangle...b6148edchore(deps): bump the workerd-and-workers-types group with 2 updates (#11872)0eb973dDo not warn user when using a redirected config that came from a config with ...0f8d69dcontainers: users can set multiple tiers for constraints (#11755)Updates
undicifrom 7.14.0 to 7.18.2Release notes
Sourced from undici's releases.
... (truncated)
Commits
7e5cb2dBumped v7.18.2 (#4730)b04e3cbfix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...2bcb77bBumped v7.18.1 (#4728)58a12b7build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)5fa2930build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)fbbe283docs: add security warning for strictContentLength option (#4726)ce12d9efix: do not crash if Node.js is compiled without SSL (#4727)ebe3e33Bumped v7.18.0 (#4725)4e9b88bfix: limit Content-Encoding chain to 5 to prevent resource exhaustiond560767Bumped v7.17.0 (#4724)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.