Skip to content

chore(deps): bump wrangler from 4.110.0 to 4.112.0#161

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/wrangler-4.112.0
Closed

chore(deps): bump wrangler from 4.110.0 to 4.112.0#161
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/wrangler-4.112.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps wrangler from 4.110.0 to 4.112.0.

Release notes

Sourced from wrangler's releases.

wrangler@4.112.0

Minor Changes

  • #14470 3de70df Thanks @​DiogoSantoss! - Add a top-level addresses field to Wrangler configuration for Email Routing

    You can now declare the inbound email addresses handled by your Worker directly in wrangler.json:

    {
      "name": "my-worker",
      "main": "src/index.ts",
      "compatibility_date": "2026-05-21",
      "addresses": ["support@example.com", "*@example.com"]
    }
  • #14706 cb6c3f9 Thanks @​edmundhung! - Add Durable Object storage access to createTestHarness()

    You can now execute SQL against a SQLite-backed Durable Object to seed or assert the storage state.

    const server = createTestHarness({
      workers: [{ configPath: "./wrangler.json" }],
    });
    await server.listen();
    const worker = server.getWorker();
    const storage = await worker.getDurableObjectStorage("COUNTER", {
    name: "user-123",
    });
    await worker.fetch("/counter/user-123");
    const rows = await storage.exec(
    "SELECT value FROM counters WHERE id = ?",
    "user-123"
    );
    expect(rows).toEqual([{ value: 1 }]);

  • #14562 9f04a7e Thanks @​martijnwalraven! - Emit a typed runtimeError event on the unstable_startWorker DevEnv for uncaught Worker exceptions

    Uncaught Worker exceptions were only source-mapped and printed, so programmatic consumers had to scrape terminal output to observe them. The DevEnv now re-emits a RuntimeErrorEvent (like reloadComplete) carrying the exception text and source-mapped stack — fed from Miniflare's pretty-error seam via the new handleUncaughtError option for exceptions the runtime catches, and from the inspector for those it does not.

Patch Changes

  • #14682 d39ae01 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

... (truncated)

Commits
  • 82918ad Version Packages (#14699)
  • 24731b5 [wrangler] Wait for workerd cleanup in port conflict E2E (#14730)
  • 028ce1f [wrangler] Wait for workers.dev propagation in E2Es (#14728)
  • c79504f fix(wrangler): support containers in test harness (#14725)
  • 4c1309e [wrangler] Use default readiness timeout in local dev E2Es (#14729)
  • b38f494 chore: consolidate most packages on zod 4.4.3 in pnpm catalog (#14707)
  • cb6c3f9 feat(wrangler): access do storage with test harness (#14706)
  • c7dbe1a fix(wrangler): type the public startWorker input as WranglerStartDevWorkerInp...
  • 9f04a7e feat: surface uncaught Worker exceptions as a typed runtimeError event in loc...
  • 3de70df [wrangler] Add top-level addresses config field for Email Routing (#14470)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) from 4.110.0 to 4.112.0.
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.112.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: wrangler
  dependency-version: 4.112.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 20, 2026
agjs added a commit that referenced this pull request Jul 20, 2026
* chore(deps): consolidate the 14 open dependabot bumps

Single PR superseding the open dependabot PRs:
- fast-check 3.23.2 → 4.9.0 (packages/core) — full suite green on v4 (#93/#99)
- astro 7.0.9 → 7.1.3 (root + apps/docs) — clears GHSA-4g3v-8h47-v7g6 (#158/#162)
- @astrojs/react 5.0.6 → 6.0.1 (#114), @astrojs/sitemap 3.7.2 → 3.7.3 (#116)
- astro-mermaid 2.0.1 → 2.1.0 (#119)
- tailwindcss + @tailwindcss/vite 4.3.2 → 4.3.3 (#115/#117)
- wrangler 4.110.0/4.111.0 → 4.112.0 (#161), @ast-grep/cli 0.43.0 → 0.44.1 (#118)

Validated: typecheck + lint + full suite (2820) green. Docs build + osv run by CI.
NOTE: the transitive brace-expansion CVE (not a dependabot PR) is separate and may
still need an override; GH Actions bumps (#160 checkout, #112 lychee) are workflow
YAML, follow-up.

* fix(deps): pin brace-expansion to patched 5.0.7 (CVE-2026-13149)

New high-severity ReDoS advisory CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (published
~2026-07-20 21:00) affects brace-expansion <1.1.16 / <2.1.2 / <5.0.7. The lockfile
had 1.1.15 and 5.0.6 (transitive via eslint→minimatch/glob — a real runtime dep of
the published package, so it is FIXED, not ignored). Override forces all instances
to 5.0.7 (patched; API is a single stable expand() fn across majors). typecheck +
lint (uses minimatch/glob) + full suite green.

* fix(deps): pin js-yaml to patched 4.3.0 (GHSA-52cp-r559-cp3m)

The astro/tooling bumps pulled js-yaml 4.2.0 (High ReDoS, GHSA-52cp-r559-cp3m,
fixed 4.3.0). Transitive, 4.x only (no 3.x consumers) → override to 4.3.0.
osv-scanner local run: 'No issues found', exit 0. typecheck + lint + full suite green.
@agjs

agjs commented Jul 20, 2026

Copy link
Copy Markdown
Owner

Superseded by #164 (consolidated dependabot bumps), merged to main.

@agjs agjs closed this Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/wrangler-4.112.0 branch July 20, 2026 22:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant