cloudflare/workers-sdk create-cloudflare@2.74.9

on GitHub

Patch Changes

• #16700 dc35efb Thanks @cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @cjol! - Bump bundled degit from 2.8.4 to 2.8.6 to pick up a security fix

  degit is bundled into create-cloudflare, which uses it to download remote templates. Version 2.8.4 is affected by a published advisory, and 2.8.6 includes the fix. Template downloads work as before.

• #16700 dc35efb Thanks @cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16695 b2061f4 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.