chore(fleet): ignore wrangler 4.111.0+ for npm consumers - #85
Merged
Conversation
Wrangler 4.111.0 rejects the legacy_env field emitted by the Astro/Cloudflare adapter's generated config, so the four Astro sites are pinned to exact 4.110.0. pkgstory/trigger is pinned too, for fleet-wide policy consistency. An exact pin alone is not durable: the daily grouped npm entry uses the catch-all "*" pattern and Dependabot rewrites declared requirements, so the pin would be lifted by routine dependency housekeeping within the cooldown window. Add the matching ignore so the bot leaves wrangler alone, and record the rationale in the reason field the way the existing typescript entry does. The ignore also suppresses security-update PRs for wrangler 4.111.0+. Dependabot alerts are unaffected, so detection is retained; only automated remediation pauses while the pin stands. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Patrick Linnane <patrick@linnane.io>
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wrangler 4.111.0 rejects the legacy_env field emitted by the Astro/Cloudflare adapter's generated config, so the four Astro sites pin wrangler to exactly 4.110.0 in their own repositories, and pkgstory/trigger pins alongside them so the policy is consistent across the fleet. An exact pin alone is not durable: every npm entry groups on the catch-all pattern daily and Dependabot rewrites declared requirements, so routine dependency housekeeping would lift the pin inside the cooldown window, bundled with unrelated bumps — macOSdb#572 moved wrangler ^4.100.0 to ^4.104.0 exactly that way, alongside astro and @astrojs/cloudflare majors. Add the matching ignore to all four npm consumers and record the rationale in reason, following the existing typescript entry. The ignore covers security updates as well as version updates, so Dependabot will not open a remediation pull request for a wrangler advisory fixed in 4.111.0 or later; alerts are unaffected, so detection is retained and only automated remediation pauses while the pin stands. The rendered .fleet.yml and .github/dependabot.yml are deliberately absent from the companion pin pull requests because fleet-guard rejects consumer edits to managed surfaces; they reach the consumers through the sync bot after a hub release.