cloudflare/workers-sdk miniflare@5.20261104.0-beta

on GitHub

Minor Changes

• #16186 f1d81a2 Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #16700 dc35efb Thanks @cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

  devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

• #16700 dc35efb Thanks @cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

  Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

• #16700 dc35efb Thanks @cjol! - Bump bundled hono from 4.12.5 to 4.13.11 to pick up security fixes

  hono is bundled into Miniflare, and 4.12.5 is affected by several published advisories. Version 4.13.11 includes their fixes. Miniflare's own behaviour does not change.

• #16700 dc35efb Thanks @cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16686 b8387a5 Thanks @FlorentCollin! - Skip D1 comment-only statements that start at offset 0

  Local D1 skipped a comment-only statement only when whitespace came before the --. A statement such as -- comment at offset 0 failed with "SQL code did not contain a statement." Local D1 now skips these statements, as remote D1 does.

• #16687 4cde694 Thanks @FlorentCollin! - Stop local D1 reads outside sessions from writing to the database file

  Before, local D1 stored a new session bookmark for each query. Thus, each SELECT committed a write transaction with a WAL append and an fsync. Now, local D1 gets a bookmark only when the request has a session bookmark or constraint. Requests from a withSession() session and query() calls with a bookmark have one. Other queries do not get a bookmark. Production D1 operates in the same way.

• #16695 b2061f4 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16695 b2061f4 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20261103.1	^5.20261104.1
  workerd	1.20261103.1	1.20261104.1

• #16611 4bb491b Thanks @petebacondarwin! - Restrict access to local Secrets Store persistence directories

  On POSIX systems, new and existing local Secrets Store directories are restricted to their owner before storage is opened. Startup fails if the directory cannot be secured, belongs to another user, or is a symbolic link. Windows continues to use inherited filesystem access controls.

• #16306 36e64f2 Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

  When a remote bindings request reached a workers.dev host protected by Access without valid Access credentials (for example, Access was added after the dev server started, the CF_Authorization cookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed with TypeError: Too many redirects and an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.

  The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.

• #16607 92c4b97 Thanks @petebacondarwin! - Prevent Workers from changing local static assets and Workers Sites files during development

  Asset files remain available to serve and can still be updated by editing them on disk.