Version Packages

[workers-devprod]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

[email protected]

Minor Changes

• #12746 211d75d Thanks @NuroDev! - Add support for inheritable bindings in type generation

  When using wrangler types with multiple environments, bindings from inheritable config properties (like assets) are now correctly inherited from the top-level config in all named environments. Previously, if you defined assets.binding at the top level with named environments, the binding would be marked as optional in the generated Env type because the type generation didn't account for inheritance.

  Example:

  {
  	"assets": {
  		"binding": "ASSETS",
  		"directory": "./public"
  	},
  	"env": {
  		"staging": {},
  		"production": {}
  	}
  }

  Before this change, ASSETS would be typed as ASSETS?: Fetcher (optional). Now, ASSETS is correctly typed as ASSETS: Fetcher (required). This fix currently applies to the assets binding, with an extensible mechanism to support additional inheritable bindings in the future.

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump node-forge to ^1.3.2 to address security vulnerabilities

  node-forge had ASN.1 unbounded recursion, OID integer truncation, and ASN.1 validator desynchronization vulnerabilities. This is a bundled dependency used for local HTTPS certificate handling.

• #12795 82cc2a8 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260301.1	1.20260306.1

• Updated dependencies [5451a7f, 82cc2a8]:

  • [email protected]

[email protected]

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump glob to ^10.5.0 to address command injection vulnerability in glob CLI

• #12787 d6d75a7 Thanks @petebacondarwin! - Bump create-qwik from 1.19.0 to 1.19.1

  This update fixes an upstream issue where create-qwik installed @eslint/js at "latest", which resolved to v10 and conflicted with the project's eslint 9.x.

[email protected]

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump hono to ^4.12.5 and devalue to ^5.6.3 to address security vulnerabilities

  Hono had multiple advisories including arbitrary file access via serveStatic, JWT algorithm confusion, and XSS through ErrorBoundary. Devalue had denial of service vulnerabilities in devalue.parse. These are bundled dependencies so the fix is delivered via this patch.

• #12795 82cc2a8 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260301.1	1.20260306.1

@cloudflare/[email protected]

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump glob to ^10.5.0 to address command injection vulnerability in glob CLI

• Updated dependencies [5451a7f, 82cc2a8]:

  • [email protected]

@cloudflare/[email protected]

Patch Changes

• Updated dependencies [5451a7f, 5451a7f, 82cc2a8, 211d75d]:
  • [email protected]
  • [email protected]

@cloudflare/[email protected]

Patch Changes

• #12790 5451a7f Thanks @petebacondarwin! - Bump devalue to ^5.6.3 to address security vulnerabilities

  Devalue had denial of service and prototype pollution vulnerabilities. This is a bundled dependency.

• Updated dependencies [5451a7f, 5451a7f, 82cc2a8, 211d75d]:

  • [email protected]
  • [email protected]

@cloudflare/[email protected]

Patch Changes

• #12756 c7d0d18 Thanks @petebacondarwin! - Fix error formatting to reliably return fallback responses on failure

  Previously, if something went wrong while formatting a pretty error page, the failure could go unhandled, resulting in no response being returned to the user. Now, errors during formatting are properly caught, ensuring users always receive a 500 JSON fallback response.

@cloudflare/[email protected]

Patch Changes

• #12779 b2f8b47 Thanks @NuroDev! - Refactors KV & sidebar to use route loaders.

  This change improves the user experience of the Local Explorer dashboard by ensuring that the data used for the initial render is fetched server-side and passed down to the client. This avoids the initial flicker when loading in. Both D1 & Durable Object routes already incorporate this system.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

✅ All changesets look good

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@12789

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@12789

miniflare

npm i https://pkg.pr.new/miniflare@12789

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@12789

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@12789

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@12789

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@12789

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@12789

wrangler

npm i https://pkg.pr.new/wrangler@12789

commit: 99c7460