chore(deps): update dependency wrangler to v4.148.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	OpenSSF
wrangler (source)	devDependencies	minor	4.147.0 → 4.148.0	4.149.0

---

Release Notes

cloudflare/workers-sdk (wrangler)

v4.148.0

Compare Source

Minor Changes

• #​16051 b4e1299 Thanks @​devteamaegis! - Add --source-namespace and --source-repo-name to wrangler queues subscription create for the artifacts.repo source

  The Event Subscriptions API requires source.namespace and source.repo_name for artifacts.repo subscriptions, but Wrangler had no way to pass them, so --source artifacts.repo always failed with a validation error. Both flags are now required for this source, and wrangler queues subscription get shows the subscription's resource as <namespace>/<repo-name>.

• #​15998 b75421f Thanks @​dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

  Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

• #​16005 4d308f6 Thanks @​oOPa! - Add a --experimental-mode instant option to wrangler kv namespace create

  This lets entitled accounts create Workers KV Instant namespaces while the feature is in private beta.

• #​16030 aa2f9b7 Thanks @​edmundhung! - Add email-protected Quick Tunnels to wrangler dev

  Pass one or more --tunnel-allowed-mail flags to require email authentication when exposing a local development server through a Quick Tunnel. Each value can be an exact email address or a domain pattern.

• #​15283 2dde890 Thanks @​shubhxho! - Support deleting secrets with wrangler versions secret bulk

  Set a secret's value to null in JSON input to remove it from the new Worker version. Bulk output now distinguishes between created and deleted secrets, so retrying wrangler secret bulk with wrangler versions secret bulk preserves requested deletions. Deploy the new version with wrangler versions deploy to apply the changes to production traffic.

Patch Changes

• #​15534 2b1a0ca Thanks @​vahidshaik1901! - Improve guidance for conflicting Wrangler configuration files

  When user and generated deploy configurations are found under different base paths, Wrangler now identifies the expected deploy configuration location, suggests how to resolve the conflict, and links to the relevant documentation.

• #​16014 c492d63 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261001.1	^5.20261005.1
  workerd	1.20261001.1	1.20261005.1

• #​16079 ba52118 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261005.1	^5.20261006.1
  workerd	1.20261005.1	1.20261006.1

• #​15573 14f0339 Thanks @​xgame92! - Include default module rules in generated Worker types

  wrangler types now declares the built-in Text, Data, and WebAssembly module patterns even when they are not repeated in the Wrangler configuration, keeping generated types aligned with deployment behavior.

  Service-worker declaration files are emitted as global scripts so that the generated wildcard module types are visible to imports.

  Directory-specific rules retain their scope when TypeScript can represent it; ambiguous relative imports use a union of the possible deployed module types.

  When generating combined types for named environments, each environment's effective rules are resolved independently and differing import types are represented as unions.

• #​15261 42c7219 Thanks @​ondraulehla! - Fix r2 object put and r2 bulk put storing a different key in local mode

  Keys that are not URL-safe were mangled on the way into local storage.

  • A key with a space or a non-ASCII character was stored under its percent-encoded name, so a later r2 object get for that key reported that the key does not exist.
  • Two keys that differ only after a # collapsed into a single object, and the second upload replaced the first.
  • A key with a % that is not a valid escape failed outright with "Invalid URL string.", and one with a valid escape, such as %41.txt, was stored as A.txt.

  Spaces, non-ASCII characters, # and % now survive the trip into local storage. Objects already in local state are left where they are.

• #​15283 2dde890 Thanks @​shubhxho! - Show a useful error when wrangler secret bulk hits an undeployed latest version

  wrangler secret put already explained this case (API error 10215). secret bulk just dumped the raw API response, which for 10214 talks about logpush and tail_consumers even though you were only uploading secrets.

  Both commands now point at wrangler versions secret … instead.

• #​16068 26e03e2 Thanks @​edevil! - Print temporary account notices to stderr

  The terms notice, the proof-of-work message, and the "Temporary account ready" claim details printed by --temporary now go to stderr instead of stdout. Previously they corrupted command output on stdout, such as the JSON from wrangler kv namespace list --temporary or the raw value from wrangler kv key get --temporary. Commands that lower the log level for --json, such as wrangler d1 execute --json --temporary, also hid the claim URL; it is now shown unless logging is disabled with WRANGLER_LOG=none.

  Scripts that read the claim URL from stdout should read stderr instead.

• Updated dependencies [b75421f, 0ec13b7, c492d63, ba52118, 946aaa7, 48f3c04, 5606a74, f8cdcb9, e44cf6b, 0b51fec]:

  • miniflare@5.20261006.0-alpha

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@​4.147.0 ⏵ 4.148.0	+1		+1

View full report

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 454d9705-bce5-475c-be49-1cd58905c919

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}