fix(deps): update dependency @opennextjs/cloudflare to ^1.20.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opennextjs/cloudflare (source)	^1.19.0 → ^1.20.6

---

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.20.6

Compare Source

Patch Changes

• #​1378 7a990e7 Thanks @​vicb! - Bump Next to 16.3.4 and @opennextjs/aws to 4.1.4

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.4

v1.20.5

Compare Source

Patch Changes

• #​1374 64a69ec Thanks @​conico974! - chore: bump @opennextjs/aws to 4.1.3

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.3

v1.20.4

Compare Source

Patch Changes

• #​1365 bf52109 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2

v1.20.3

Compare Source

Patch Changes

• #​1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

• #​1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

• #​1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

  Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and
  loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to
  resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks
  instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and
  WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

  Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at
  runtime, most visibly breaking Prisma with the workerd client runtime.

  The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js
  middleware bundles.

• #​1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

  Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

  The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs:
  the OpenNext config manifests are inlined at build time (as for the edge middleware) and the
  middleware compiled by Next.js is statically bundled instead of being loaded from the
  filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

  The support is experimental and requires the nodejs_compat compatibility flag.

• #​1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

  Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware
  does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js.
  workerd does not support dynamic requires so every request handled by the Node.js middleware
  (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

  The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it
  compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader
  is stubbed out instead, which matches the edge runtime behaviour: the server function - which
  shares the isolate - keeps registering the hook.

v1.20.2

Compare Source

Patch Changes

• #​1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

  Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

• #​1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

• #​1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

  Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

v1.20.1

Compare Source

Patch Changes

• #​1297 780a21c Thanks @​james-elicx! - fix: disable response compression for skew protection API requests

  Avoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.

v1.20.0

Compare Source

Minor Changes

• #​1290 46c50fc Thanks @​james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

  Key Changes:

  1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.

     • R2_ACCESS_KEY_ID
     • R2_SECRET_ACCESS_KEY
     • CF_ACCOUNT_ID

  2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.

  3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.

  Usage:

  Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:

  pnpm add rclone.js
  pnpm approve-builds # select rclone.js
  pnpm rebuild rclone.js
  R2_ACCESS_KEY_ID=your_key
  R2_SECRET_ACCESS_KEY=your_secret
  CF_ACCOUNT_ID=your_account
  
  opennextjs-cloudflare deploy --rclone

  You can also set the environment variables for CI builds.

  Notes:

  • You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.
  • rclone may not be supported on all platforms.

Patch Changes

• #​1289 eef243f Thanks @​thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges run

  BucketCachePurge.alarm() passed its tag bindings to SqlStorage.exec as a
  single array. exec(query, ...bindings) is variadic over its bindings, so for a
  multi-tag DELETE ... WHERE tag IN (?, ?, …) the binding count (1) disagreed
  with the placeholder count (N) and exec threw "Wrong number of parameter
  bindings" on every flush. On-demand revalidateTag purges therefore never
  reached the Cloudflare cache, and with bypassTagCacheOnCacheHit enabled pages
  served stale until the ISR TTL expired.

  Spread the bindings, normalise the INSERT to the same variadic form, and
  tighten the drain loop's guard from while (tags.length >= 0) (which never
  exits via the condition) to while (tags.length > 0).

• #​1291 51439b1 Thanks @​james-elicx! - fix: disable response compression when provisioning R2 cache buckets

  Avoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	website	9511d83	Commit Preview URL Branch Preview URL	Sep 03 2026, 11:52 PM