cloudflare/workers-sdk miniflare@4.20260124.0

on GitHub

Minor Changes

• #12008 e414f05 Thanks @penalosa! - Add support for customising the inspector IP address

  Adds a new --inspector-ip CLI flag and dev.inspector_ip configuration option to allow customising the IP address that the inspector server listens on. Previously, the inspector was hardcoded to listen only on 127.0.0.1.

  Example usage:

  # CLI flag
  wrangler dev --inspector-ip 0.0.0.0

  // wrangler.json
  {
  	"dev": {
  		"inspector_ip": "0.0.0.0",
  	},
  }

• #12034 05714f8 Thanks @emily-shen! - Add a no-op local explorer worker, which is gated by the experimental flag X_LOCAL_EXPLORER.

Patch Changes

• #11853 014e7aa Thanks @43081j! - Use built-in stripVTControlCharacters utility rather than the strip-ansi package.

• #12040 77e82d2 Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260120.0	1.20260122.0

• #12061 f08ef21 Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260122.0	1.20260123.0

• #12088 0641e6c Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260123.0	1.20260124.0

• #11897 bbd8a5e Thanks @dario-piotrowicz! - Bundle the zod dependency to reduce supply chain attack surface

  In order to prevent possible npm vulnerability attacks, the team's policy is to bundle
  dependencies in our packages where possible. This helps ensure that only trusted code
  runs on the user's system, even if compromised packages are later published to npm.

  This change bundles zod (a pure JavaScript validation library with no native dependencies)
  into miniflare and @cloudflare/vitest-pool-workers.

  Other dependencies remain external for technical reasons:

  • sharp: Native binary with platform-specific builds
  • undici: Dynamically required at runtime in worker threads
  • ws: Has optional native bindings for performance
  • workerd: Native binary (Cloudflare's JavaScript runtime)
  • @cspotcode/source-map-support: Uses require.cache manipulation at runtime
  • youch: Dynamically required for lazy loading