fix(deps): upgrade npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	4.20251014.0 -> 4.20251121.0
jose	6.1.0 -> 6.1.2
wrangler (source)	4.44.0 -> 4.50.0

---

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v4.20251121.0

Compare Source

v4.20251120.0

Compare Source

v4.20251119.0

Compare Source

v4.20251118.0

Compare Source

v4.20251117.0

Compare Source

v4.20251115.0

Compare Source

v4.20251113.0

Compare Source

v4.20251111.0

Compare Source

v4.20251109.0

Compare Source

v4.20251107.0

Compare Source

v4.20251106.1

Compare Source

panva/jose (jose)

v6.1.2

Compare Source

Refactor

• fallback to checking instanceof for CryptoKey (901cd90), closes #​765 #​803 #​821 #​827 #​828

v6.1.1

Compare Source

Documentation

• add link to RFC9864 (767edde)
• link to ML-DSA for JOSE (ed4252c)
• remove mention of Edge Runtime from the readme (94fdde7)
• update README.md (25098ef)

Refactor

• eliminate named exports in the source code (f6ae30d)
• expose setKeyManagementParameters also on a GeneralEncrypt Recipient (16e6b23)
• faster path for symmetric key checks (a44c2ec)
• improve en/decoding overheads (daee426)

cloudflare/workers-sdk (wrangler)

v4.50.0

Compare Source

Minor Changes

• #​11219 524a6e5 Thanks @​Ltadrian! - Implement Hyperdrive binding TLS miniflare proxy. This will allow for wrangler dev hyperdrive bindings to connect to external
  databases that require TLS.

• #​11233 c922a81 Thanks @​emily-shen! - Add containers.unsafe to allow internal users to use additional container features

Patch Changes

• #​11353 0cf696d Thanks @​vicb! - Use the native node:domain module when available

  It is enabled when the enable_nodejs_domain_module compatibility flag is set.

• #​11328 bb44120 Thanks @​ascorbic! - Fixes a bug that caused wrangler deploy to hang when deploying SvelteKit sites with experimental autoconfig

• #​11025 4a158e9 Thanks @​devin-ai-integration! - Use the native node:wasi module when available

  It is enabled when the enable_nodejs_wasi_module compatibility flag is set.

• Updated dependencies [0cf696d, 524a6e5, 4a158e9]:

  • @​cloudflare/unenv-preset@​2.7.11
  • miniflare@​4.20251118.1

v4.49.1

Compare Source

Patch Changes

• #​11344 c758809 Thanks @​dario-piotrowicz! - Fix: mark the r2 bulk command as hidden and experimental

• #​11339 dfba912 Thanks @​dario-piotrowicz! - Fix wrangler deploy erroring when it pulls down remote configs of workers containing an assets binding

• Updated dependencies [e5ec8cf]:

  • miniflare@​4.20251118.0

v4.49.0

Compare Source

Minor Changes

• #​10703 c5c4ee5 Thanks @​danlapid! - Add support for streaming tail consumers in local dev. This is an experimental new feature that allows you to register a tailStream() handler (compared to the existing tail() handler), which will receive streamed tail events from your Worker (compared to the tail() handler, which only receives batched events after your Worker has finished processing).

• #​11251 7035804 Thanks @​penalosa! - When the WRANGLER_HIDE_BANNER environment variable is provided, Wrangler will no longer display a version banner. This applies to all commands.

  For instance, previously running wrangler docs would give the following output:

  > wrangler docs
   ⛅️ wrangler 4.47.0
  ───────────────────
  Opening a link in your default browser: https://developers.cloudflare.com/workers/wrangler/commands/
  

  With WRANGLER_HIDE_BANNER, this is now:

  > WRANGLER_HIDE_BANNER=true wrangler docs
  Opening a link in your default browser: https://developers.cloudflare.com/workers/wrangler/commands/
  

• #​11285 d014fa7 Thanks @​vicb! - Implement the wrangler r2 bulk put bucket-name --filename list.json command.

  The command uploads multiple objects to an R2 bucket.

  The list of object is provided as a JSON encoded file via --filename. It is a list of key and file (respectively the name and the content for the object).

  [
    { "key": "/path/to/obj", "file": "/path/to/file_1"},
    { "key": "/path/to/other/obj", "file": "/path/to/file_2"},
    // ...
  ]
  

  Uploads are executed concurrently and the level of concurrency can be set via --concurrency.

  The command supports the same options as wrangler r2 object put, minus --file, and --pipe and plus --concurrency

• #​11268 15b8460 Thanks @​penalosa! - Support SvelteKit projects in autoconfig

• #​11258 2011b6a Thanks @​dario-piotrowicz! - Add --dry-run flag to wrangler setup and also a dryRun option to runAutoConfig

Patch Changes

• #​11261 a352c7f Thanks @​petebacondarwin! - Avoid using object lookup for OAuth Error classes

• #​11286 8e99766 Thanks @​dario-piotrowicz! - fix: make sure that experimental_patchConfig doesn't throw if it encounters a null value

• #​11279 d0d3fe6 Thanks @​vicb! - bump p-queue to ^9.0.0

• #​11278 92afbba Thanks @​ascorbic! - Fixes a bug that caused .dev.vars to be ignored in OpenNext

• #​11244 65b4afe Thanks @​petebacondarwin! - Internal refactoring to improve error traceability in wrangler dev

• #​11238 da8442f Thanks @​jamesopstad! - Add unstable_getDurableObjectClassNameToUseSQLiteMap export. This is an internal function for use in the Vite plugin.

• #​11266 09cb720 Thanks @​penalosa! - Use the smol-toml library for parsing TOML instead of @​iarna/toml

• #​11236 793e2b4 Thanks @​ascorbic! - Refresh expired preview tokens when running in remote dev mode

• #​11286 8e99766 Thanks @​dario-piotrowicz! - fix: wrangler deploy failing to patch local wrangler.jsonc files if the remote tail_consumers value is null

• #​11275 9cbf126 Thanks @​dario-piotrowicz! - Ensure that wrangler deploy run with a positional argument or with --assets does not trigger the autoconfig process (even with --experimental-autoconfig)

• #​11242 dd1e560 Thanks @​dario-piotrowicz! - Fix: make sure that remote proxy sessions's debug logs are enabled when the wrangler log level is set to "debug"

• Updated dependencies [c5c4ee5, d0041e2, 827d017]:

  • miniflare@​4.20251113.0

v4.48.0

Compare Source

Minor Changes

• #​11212 3908162 Thanks @​dario-piotrowicz! - Add autoconfig changes summary for wrangler deploy --x-autoconfig with the option for users to cancel the operation

• #​11229 14d79f2 Thanks @​dario-piotrowicz! - Enables experimental-deploy-remote-diff-check flag by default (the flag is still present for now so that users can turn it off if needed) and improves the remote config diffing logic (to include less noise in the diff presented to the user)

• #​11245 dfc6513 Thanks @​vicb! - Change how Wrangler selects default ports for dev sessions.

  If no port is specified, Wrangler now probes the default port and the 10 consecutive ports after it before falling back to a random port.
  This will help getting a stable port number across dev sessions.
  Both the http server and inspector ports are affected.

Patch Changes

• #​11177 43fe9f3 Thanks @​MattieTK! - Added bun detection to package manager analytics

• Updated dependencies [305ffb3, 46ccf0e]:

  • miniflare@​4.20251109.1

v4.47.0

Compare Source

Minor Changes

• #​11201 5286309 Thanks @​avenceslau! - Add wrangler workflows instances restart command

• #​11214 5cf8a39 Thanks @​penalosa! - Add the experimental wrangler setup command to run autoconfig outside of the deploy flow.

• #​11187 8abc789 Thanks @​dario-piotrowicz! - Add possibility for users to edit their project settings during autoconfig

  When running wrangler deploy --experimental-autoconfig, after the automatic project settings detection Wrangler will now present users the opportunity to customize the auto-detected project's settings

Patch Changes

• #​11143 2d16610 Thanks @​FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

• #​11178 63defa2 Thanks @​ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

• #​11199 70d3d4a Thanks @​penalosa! - Add telemetry to autoconfig

• #​11186 38396ed Thanks @​hoodmane! - Removed warning when deploying a Python worker

• #​11024 cdcecfc Thanks @​devin-ai-integration! - Use the native node:trace_events module when available

  It is enabled when the enable_nodejs_trace_events_module compatibility flag is set.

• #​11195 e85f965 Thanks @​ascorbic! - Ignores .dev.vars if --env-file has been explicitly passed

  Previously, .dev.vars would always be read first, and then any file passed with --env-file would override variables in .dev.vars. This meant there was no way to ignore .dev.vars if you wanted to use a different env file. Now, if --env-file is passed, .dev.vars will be ignored entirely.

• #​11181 88aa707 Thanks @​petebacondarwin! - add more logging around Wrangler authentication to help diagnose issues

• Updated dependencies [dd7d584, 4259256, cdcecfc]:

  • miniflare@​4.20251109.0
  • @​cloudflare/unenv-preset@​2.7.10

v4.46.0

Compare Source

Minor Changes

• #​11183 240ebeb Thanks @​dario-piotrowicz! - expose experimental_getDetailsForAutoConfig and experimental_runAutoConfig APIs that provide respectively the autoconfig detection and execution functionalities

• #​11180 53b0fce Thanks @​penalosa! - Detect non-framework static sites

• #​11162 c3ed531 Thanks @​dario-piotrowicz! - add a remoteBindings option to getPlatformProxy to allow the disabling of remote bindings

• #​11164 305d7bf Thanks @​penalosa! - Implement experimental autoconfig flow for static sites

• #​10605 b55a3c7 Thanks @​emily-shen! - Add command to configure credentials for non-Cloudflare container registries

  Note this is a closed/experimental command that will not work without the appropriate account-level capabilities.

• #​11078 5d7c4c2 Thanks @​simonha9! - Add jurisdiction support to d1 db creation via command-line argument

Patch Changes

• #​11160 05440a1 Thanks @​dario-piotrowicz! - Allows auto-update of the local Wrangler configuration file to match remote configuration when running wrangler deploy --env <TARGET_ENV>

  When running wrangler deploy, with --x-remote-diff-check and after cancelling the deployment due to destructive changes present in the local config file, Wrangler offers to update the Wrangler configuration file to match the remote configuration. This wasn't however enabled when a target environment was specified (via the --env|-e flag). Now this will also apply when an environment is targeted.

• #​11162 c3ed531 Thanks @​dario-piotrowicz! - Update the description of the --local flag for the wrangler dev command to clarify that it disables remote bindings, also un-deprecate and un-hide it

• #​11162 c3ed531 Thanks @​dario-piotrowicz! - Fix bindings with remote: true being logged as remote when run via wrangler dev --local

• Updated dependencies [1ae020d]:

  • miniflare@​4.20251105.0

v4.45.4

Compare Source

Patch Changes

• #​11133 8ffbd17 Thanks @​petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

  Now the argument values that are captured come from an allow list,
  and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

• #​11033 77ed7e2 Thanks @​dario-piotrowicz! - Offer to update the local Wrangler configuration file to match remote configuration when running wrangler deploy

  When running wrangler deploy, with --x-remote-diff-check, Wrangler will display the difference between local and remote configuration.
  If there would be a destructive change to the remote configuration, the user is given the option to cancel the deployment.
  In the case where the user does cancel deployment, Wrangler will now also offer to update the local Wrangler configuration file to match the remote configuration.

• #​11139 bb00f9d Thanks @​devin-ai-integration! - Updated cron trigger documentation links and improved error message to include instructions for testing cron triggers locally

• #​11135 ed666a1 Thanks @​penalosa! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

• #​11149 22f25fd Thanks @​penalosa! - Add no-op autoconfig logic behind an experimental flag

• Updated dependencies [90a2566, 14f60e8]:

  • @​cloudflare/unenv-preset@​2.7.9
  • miniflare@​4.20251011.2

v4.45.3

Patch Changes

• #​11117 6822aaf Thanks @​emily-shen! - fix: show local/remote status before D1 command confirmations

  D1 commands (execute, export, migrations apply, migrations list, delete, time-travel) now display whether they're running against local or remote databases before showing confirmation prompts. This prevents confusion about which database will be affected by the operation.

• #​11077 bce8142 Thanks @​petebacondarwin! - Ensure that process.env is case-insensitive on Windows

  The object that holds the environment variables in process.env does not care about the case of its keys
  in Windows. For example, process.env.SystemRoot and process.env.SYSTEMROOT will refer to the same value.

  Previously, when merging fields from .env files we were replacing this native object with a vanilla
  JavaScript object, that is case-insensitive, and so sometimes environment variables appeared to be missing
  when in reality they just had different casing.

v4.45.2

Patch Changes

• #​11097 55657eb Thanks @​penalosa! - Extract internal APIs into a new @cloudflare/workers-utils package

• #​11118 d47f166 Thanks @​zebp! - Fix validation of the persist field of observability logs and traces configuration

v4.45.1

Compare Source

Patch Changes

• #​10959 d0208fe Thanks @​devin-ai-integration! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

  --e now aliases --env only, and NOT --expires.

• #​10915 dbe51c1 Thanks @​devin-ai-integration! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

• #​10913 d4f2daf Thanks @​devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

v4.45.0

Compare Source

Minor Changes

• #​11030 1a8088a Thanks @​penalosa! - Enable automatic resource provisioning by default in Wrangler. This is still an experimental feature, but we're turning on the flag by default to make it easier for people to test it and try it out. You can disable the feature using the --no-x-provision flag. It currently works for R2, D1, and KV bindings.

  To use this feature, add a binding to your config file without a resource ID:

  {
  	"kv_namespaces": [{ "binding": "MY_KV" }],
  	"d1_databases": [{ "binding": "MY_DB" }],
  	"r2_buckets": [{ "binding": "MY_R2" }],
  }

  wrangler dev will automatically create these resources for you locally, and when you next run wrangler deploy Wrangler will call the Cloudflare API to create the requested resources and link them to your Worker. They'll stay linked across deploys, and you don't need to add the resource IDs to the config file for future deploys to work. This is especially good for shared templates, which now no longer need to include account-specific resource ID when adding a binding.

Patch Changes

• #​11037 4bd4c29 Thanks @​danielrs! - Better Wrangler subdomain defaults warning.

  Improves the warnings that we show users when either worker_dev or preview_urls are missing.

• #​10927 31e1330 Thanks @​dom96! - Implements python_modules.excludes wrangler config field

  [python_modules]
  excludes = ["**/*.pyc", "**/__pycache__"]

• #​10741 2f57345 Thanks @​penalosa! - Remove obsolete --x-remote-bindings flag

• Updated dependencies [ca6c010]:

  • miniflare@​4.20251011.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.