chore(deps): update dependency wrangler to v4.136.3 [automerge]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wrangler (source)	4.134.0 → 4.136.3

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.136.3

Compare Source

Patch Changes

• #​15662 59267fc Thanks @​oddharsh! - Update smol-toml to 1.8.0

  This updates the bundled TOML parser that reads wrangler.toml to a version that addresses two advisories against 1.5.2: GHSA-7w5x-hrqm-74c2 (a value followed by a comment with no trailing newline, such as a=[1 #, put the parser in an infinite loop) and GHSA-v3rj-xjv7-4jmq (thousands of consecutive comment lines overflowed the stack). On the old version, wrangler deploy against a wrangler.toml ending in a=[1 # never returned; it now fails with Invalid TOML document: cannot find end of structure.

• #​15760 6906bf0 Thanks @​yomna-shousha! - Warn when wrangler preview returns only non-custom-domain URLs even though custom-domain Preview URLs are configured.

• #​15761 354ebdb Thanks @​podonnell-dev! - Fix Preview output artifacts to always include the resolved parent Worker name

  Preview artifacts now use Wrangler's resolved Worker name instead of relying on the Preview API response to include it.

• Updated dependencies []:

  • miniflare@5.20260921.0-alpha

v4.136.2

Compare Source

Patch Changes

• #​15762 ad20547 Thanks @​podonnell-dev! - Fix wrangler types generating runtime headers with trailing whitespace

  Runtime type headers without compatibility flags now end at the compatibility date, keeping generated types reproducible when tools remove trailing whitespace.

• #​15703 02c1d83 Thanks @​KianNH! - Improve Container image listing and deletion

  List all image pages using read-only credentials, validate tags before deletion, and report successful deletion when the garbage-collection request fails.

• #​15700 275184d Thanks @​KianNH! - Fix Container SSH connection setup and shutdown

  Prevent SSH connections from stalling during setup and ensure proxy processes exit when sessions close.

• #​15759 bd59eca Thanks @​petebacondarwin! - Show valid sha256-prefixed tags in Container image listings

  Container image listings now distinguish valid OCI tags such as sha256-release from synthetic digest entries such as sha256:<digest>.

• Updated dependencies []:

  • miniflare@5.20260921.0-alpha

v4.136.1

Compare Source

Patch Changes

• #​15744 0ed4c54 Thanks @​podonnell-dev! - Improve wrangler preview onboarding guidance

  Wrangler now displays placeholder replacement guidance directly beneath the suggested Preview configuration instead of as a separate warning. JSON output continues to include the guidance in its structured onboarding messages.

• #​15678 703922d Thanks @​christhorwarth! - Read workers.dev URLs from the Worker resource during deployment

  Wrangler no longer requires account-level subdomain permission to display Worker and version-preview URLs. It now uses the Worker-scoped URL fields while preserving account-level registration for accounts without a workers.dev subdomain.

• Updated dependencies [14d946d]:

  • @​cloudflare/unenv-preset@2.16.2

v4.136.0

Compare Source

Minor Changes

• #​15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

  The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

• #​15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

  Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export default defineConfig({
  	accountId: "...",
  	complianceRegion: "public",
  	worker: {
  		name: "my-worker",
  		compatibilityDate: "2026-09-18",
  		entrypoint,
  	},
  });

• #​15720 35668d7 Thanks @​alexkli! - Add experimental --zone and --zone-id flags to wrangler deploy and wrangler triggers deploy to attach a zone to routes passed via --route

  Routes passed on the command line were always sent to the Cloudflare API as bare patterns. Zones with an SSL for SaaS entitlement reject such routes with error 10082 ("When using wildcard host ssl for saas entitlement you must specify the zone per route using zone_id or zone_name"), and until now the only way to set a zone was in the config file, which --route overrides.

  The new flags are experimental and must be enabled with --experimental-route-zones (alias --x-route-zones). Pass a single zone to apply it to all routes, or one zone per route in the same order as the --route flags:

  wrangler deploy --x-route-zones --route "app.example.com/*" --route "api.example.com/*" --zone example.com

  wrangler deploy --x-route-zones --route "a.example.com/*" --zone example.com --route "b.example.net/*" --zone example.net

  --zone sets zone_name and --zone-id sets zone_id on each route. The two flags cannot be combined, and passing more than one zone requires exactly one per --route. Routes without zone flags behave exactly as before.

• #​15699 45b3b81 Thanks @​skepticfx! - Remove the experimental Container image environment binding

  Durable Object-managed Containers now use ctx.container.images without Wrangler generating env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Update code using the experimental environment binding to read ctx.container.images and regenerate your Worker types.

  Version deployments identify managed applications from native named images, and --containers-rollout=none preserves native Container metadata. Containers without named images must first be provisioned with wrangler deploy; versions upload verifies that their applications already exist. The old binding is no longer read or reserved, including on previously uploaded versions. keep_vars retains existing variables as usual; redeploy without it to remove an existing experimental binding.

• #​15702 8235e6a Thanks @​podonnell-dev! - Return structured configuration errors from wrangler preview --json

  When a Worker is missing its Preview configuration, JSON mode now returns an error, a suggested_config patch, and any associated onboarding messages without interactive output or terminal formatting. This changes the private-beta Preview command to make automated onboarding reliable.

• #​15577 731a2ee Thanks @​sdnts! - Add support for jurisdictions to Queues subcommands

Patch Changes

• #​15711 91e2f86 Thanks @​ghostwriternr! - Allow local Container images without exposed ports

  Wrangler and the Cloudflare Vite plugin no longer reject images that omit Docker EXPOSE metadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port.

• #​15740 c5913a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260918.1	^5.20260921.1
  workerd	1.20260918.1	1.20260921.1

• #​15471 0751490 Thanks @​edmundhung! - Fix cf builds for static projects that serve assets from the project root

  The experimental Build Output path now omits the reserved .cloudflare directory when the project root is used for static assets. This prevents recursive output copying in Wrangler while preserving the existing behaviour for other asset directories.

• #​15440 43b1f85 Thanks @​HuzaifaAbdulRehman! - Rebase absolute non-JavaScript module specifiers when preserve_file_names is enabled

  With preserve_file_names set, a non-JS module imported by an absolute path kept that path as its module name. The build machine's filesystem layout ended up inside the deployed Worker, and the module was never written to --outdir. A local dry run reported success while the upload failed server-side with error code 10021. Tooling that rewrites externals to absolute paths hits this, which is how it was found in @opennextjs/cloudflare with WASM imports.

  Absolute specifiers are now rebased to ./<basename>, which is what the hashed branch of the same code already does minus the hash prefix. Relative specifiers keep the behaviour they had.

• Updated dependencies [c5913a6, 3c75cad]:

  • miniflare@5.20260921.0-alpha

v4.135.0

Compare Source

Minor Changes

• #​15609 1f070c8 Thanks @​emily-shen! - Build Containers when emitting experimental Build Output

  Wrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under .cloudflare/output/v0/containers with local image references, while existing registry references pass through unchanged.

• #​15329 c4c9b75 Thanks @​akshitsinha! - Evaluate Flagship flags locally during development

  Flagship bindings now use the local Miniflare store by default in Wrangler and the Vite plugin, keeping development offline and isolated from production flags. Set remote: true on a binding to continue using its remote app.

  Use wrangler flagship flags pull <APP_ID> to seed the store from a remote app. Flag management commands also accept --local to read and update the local store directly.

• #​15701 643e5cc Thanks @​WillTaylorDev! - Pass Preview intent to defineWorker and upload its resolved configuration

  Preview builds now evaluate programmatic Worker configuration with ctx.isPreview set to true and record that intent in Build Output. The shared Preview uploader deploys the resolved bindings and settings while preserving configured Preview base values when it creates a Preview.

Patch Changes

• #​15705 a0485d5 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260917.1	^5.20260918.1
  workerd	1.20260917.1	1.20260918.1

• #​15587 629ddef Thanks @​Kuldeeep18! - Fix duration calculation for running workflow instances, steps, and attempts in wrangler workflows instances describe

  wrangler workflows instances describe previously distorted the elapsed duration of in-progress instances, steps, and attempts across non-UTC timezones by stripping " GMT" from toUTCString(), causing new Date(...) to parse the timestamp in the local client timezone. The duration is now correctly computed against the current time.

• Updated dependencies [a0485d5]:

  • miniflare@5.20260918.0-alpha

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: bc4d33b3-c54a-41fd-8335-52ff31d226ef

📥 Commits

Reviewing files that changed from the base of the PR and between 496c049 and 5ead6c6.

📒 Files selected for processing (1)

• .github/workflows/pages.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Pages workflow now uses Wrangler 4.136.3 instead of 4.134.0.

Changes

Pages workflow

Layer / File(s)	Summary
Update configured Wrangler version .github/workflows/pages.yml	The workflow uses Wrangler 4.136.3 instead of 4.134.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: devsecninja

Merge Risk: ⚪ Minimal · up to 5ead6

No specific issue in the Pages workflow change is identified that should block merging.

Architecture Summary

Architecture risk: 🔵 Low · up to 5ead6

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/pages.yml: The configured Wrangler version changes from 4.134.0 to 4.136.3.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the Wrangler dependency update from the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}