chore(deps): bump wrangler to 4.110.0 to match workers-types v5

[waynesun09]

Summary

The Deploy Site workflow's npm ci step has been failing since ~03:13 UTC today with an ERESOLVE peer dependency conflict. This fixes an internally inconsistent version pin in package.json left over from #4002.

Related Issue

None filed — root cause identified from the failing Deploy Site run.

Changes

• package.json / package-lock.json: bump wrangler devDependency from ^4.36.0 to ^4.110.0.
• .github/workflows/site-deploy.yml: bump the two wranglerVersion inputs and the two inline npx wrangler@ invocations in preCommands from 4.36.0 to 4.110.0, so the wrangler-action install step stays consistent with the npm-resolved version.

Root cause

#4002 bumped @cloudflare/workers-types from ^4.x to ^5.20260708.1 in package.json to satisfy the peer requirement of wrangler@4.110.0, which is pulled in transitively via @cloudflare/vitest-pool-workers@0.18.4. That PR did not also bump the direct wrangler devDependency, which stayed at ^4.36.0 — and wrangler@4.36.0's own peer dependency wants @cloudflare/workers-types@^4.x. This left the root project simultaneously requiring v4 and v5 of @cloudflare/workers-types, which npm ci correctly refuses to resolve. The conflict was latent until a new @cloudflare/workers-types 5.x patch published today and the floating ^5.20260708.1 range diverged from what was in the lockfile, turning it into a hard failure.

Note: the renovate/cloudflare-workers grouping rule added in #4007 doesn't cover this — #4002 was a manual/agent-assisted bump that didn't go through Renovate, so the two Cloudflare packages drifted apart in the same commit despite the grouping rule.

Testing

• make lint passes (staged changes first)
• npm ci succeeds cleanly (previously failed with ERESOLVE)
• npx wrangler --version resolves to 4.110.0
• Tests added/updated for new or modified logic — not applicable, dependency version bump only

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• Commits are signed off (DCO) — human and human-directed agent sessions only
• I wrote this contribution myself and can explain all changes in it

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 12:32 PM UTC · Ended 12:37 PM UTC
Commit: 2941769 · View workflow run →

[qodo-code-review]

PR Summary by Qodo

Fix Cloudflare Wrangler peer-dep mismatch by bumping wrangler to 4.110.0

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump project wrangler devDependency to align with workers-types v5 peer requirements.
• Update site deploy workflow to use wrangler 4.110.0 consistently in action + preCommands.
• Prevent npm ci ERESOLVE failures caused by conflicting Cloudflare peer dependency ranges.

Diagram

graph TD
  A[".github/workflows/site-deploy.yml"] --> B["wrangler-action"] --> C["wrangler@4.110.0"] --> D["@cloudflare/workers-types v5"]
  A --> E["npx wrangler@4.110.0"] --> C
  F["package.json"] --> C

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Downgrade workers-types back to v4

• ➕ Avoids changing Wrangler version
• ➕ Potentially lower risk if Wrangler 4.110.0 introduces behavior changes
• ➖ Conflicts with transitive requirements (e.g., vitest pool / newer Wrangler peer deps)
• ➖ Moves the project away from the already-adopted v5 types and likely reintroduces drift

2. Use npm overrides/resolutions to force a single compatible set

• ➕ Can unblock installs without changing direct dependency declarations
• ➕ Centralized control over transitive versions
• ➖ More complex and less transparent than aligning the direct devDependency
• ➖ Can mask real incompatibilities and surprise future upgrades

3. Pin workers-types to an exact patch version (avoid caret range drift)

• ➕ Prevents sudden CI breakage when new patches publish
• ➕ Improves reproducibility for fresh installs
• ➖ Requires more frequent manual updates
• ➖ Does not fix the underlying wrangler/workers-types major mismatch by itself

Recommendation: Aligning the direct wrangler devDependency with the already-required workers-types major version (and keeping the workflow pins consistent) is the simplest and most maintainable fix. It resolves npm's peer conflict at the root rather than relying on overrides, and reduces the risk of future CI drift by ensuring the action and npx invocations match the npm-resolved Wrangler version.

Files changed (2) +5 / -5

Other (2) +5 / -5

site-deploy.ymlAlign workflow Wrangler pins to 4.110.0 +4/-4

Align workflow Wrangler pins to 4.110.0

• Updates both wrangler-action inputs and the inline 'npx wrangler@...' preCommands to use 4.110.0. This keeps the workflow's installed Wrangler consistent with the repo's dependency resolution and avoids peer-dependency mismatches during CI deploys.

.github/workflows/site-deploy.yml

package.jsonBump wrangler devDependency to ^4.110.0 +1/-1

Bump wrangler devDependency to ^4.110.0

• Raises the direct 'wrangler' devDependency from ^4.36.0 to ^4.110.0 so its peer dependency expectations match '@cloudflare/workers-types' v5. This resolves the npm ERESOLVE failure caused by conflicting peer ranges.

package.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 Group Cloudflare packages in Renovate config to prevent broken lockfile-only PRs

✅ Compliance rules (platform): 54 rules

✅ Skills: writing-user-docs, writing-adrs

1. Duplicated Wrangler version pin ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The Deploy Site workflow pins Wrangler twice (wranglerVersion for wrangler-action and a separate
npx wrangler@... in preCommands), which is easy to let drift in future edits and adds an extra
npm download per deploy run. Centralizing on a single Wrangler invocation avoids version-skew
maintenance and reduces workflow work.

Code

.github/workflows/site-deploy.yml[R136-140]

+          wranglerVersion: "4.110.0"
          workingDirectory: cloudflare_site
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          preCommands: set -eu; secrets_file="$(mktemp)"; printf '%s\n' "GITHUB_APP_CLIENT_SECRET=${GITHUB_APP_CLIENT_SECRET}" "TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY}" >"$secrets_file"; npx wrangler@4.36.0 versions secret bulk "$secrets_file" --message "Production secrets (workflow-run ${{ github.event.workflow_run.id }})"; rm -f "$secrets_file"
+          preCommands: set -eu; secrets_file="$(mktemp)"; printf '%s\n' "GITHUB_APP_CLIENT_SECRET=${GITHUB_APP_CLIENT_SECRET}" "TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY}" >"$secrets_file"; npx wrangler@4.110.0 versions secret bulk "$secrets_file" --message "Production secrets (workflow-run ${{ github.event.workflow_run.id }})"; rm -f "$secrets_file"

Relevance

⭐⭐⭐ High

Team has accepted fixing version-skew/duplication for pinned tooling (e.g., shared pin to avoid
drift in #2535).

PR-#2535
PR-#2508

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow sets a Wrangler version for the action but also hard-codes the same version again in an
npx wrangler@... call inside preCommands, creating two separate pins to keep in sync.

.github/workflows/site-deploy.yml[131-141]
.github/workflows/site-deploy.yml[157-166]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow step sets `wranglerVersion`, but separately calls `npx wrangler@<version>` in `preCommands`. This duplicates the version pin and increases the chance of future drift (editing one but not the other), and it adds an extra npm download.

### Issue Context
`cloudflare/wrangler-action` already installs the specified Wrangler version via the `wranglerVersion` input.

### Fix Focus Areas
- .github/workflows/site-deploy.yml[131-173]

### Suggested change
Replace `npx wrangler@4.110.0 versions secret bulk ...` with `wrangler versions secret bulk ...` (reusing the version installed by the action), so the version is controlled only by `wranglerVersion`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Docs reference old Wrangler ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The deployment troubleshooting doc still says the Deploy Site workflow pins Wrangler 4.36.0, but the
workflow now pins 4.110.0. This can mislead operators when debugging preview-alias or deploy
behavior.

Code

.github/workflows/site-deploy.yml[136]

+          wranglerVersion: "4.110.0"

Relevance

⭐⭐⭐ High

Docs drift fixes are commonly accepted (e.g., updating outdated labels/refs in docs in #1039 and
#242).

PR-#1039
PR-#242

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow pin was updated to 4.110.0, while the troubleshooting doc still explicitly claims it is
pinned to 4.36.0.

.github/workflows/site-deploy.yml[133-141]
docs/web-admin-deployment.md[81-84]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The documentation references the old pinned Wrangler version (4.36.0), but the workflow now pins 4.110.0.

### Issue Context
This is troubleshooting guidance for deployment behavior.

### Fix Focus Areas
- docs/web-admin-deployment.md[81-84]

### Suggested change
Update the referenced pinned version to 4.110.0 (or reword to avoid a hard-coded version, e.g., “the deploy workflow pins a Wrangler version; see `.github/workflows/site-deploy.yml`”).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:38 PM UTC · Completed 12:50 PM UTC
Commit: 0f14ac0 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/site-deploy.yml — This file is under the .github/ protected path. No linked issue exists to formally authorize the change. While the PR description provides clear rationale (fixing ERESOLVE peer dependency conflict from chore(deps): bump @cloudflare/workers-types from v4 to v5 #4002), human approval is always required for protected-path changes, and a linked issue provides traceability.
  Remediation: File an issue documenting the CI breakage and link it to this PR, or obtain explicit human approval.

Low

• [pattern-consistency] .github/workflows/site-deploy.yml:140 — The preCommands wrangler invocation changed from an explicit version pin (npx wrangler@4.36.0) to unpinned (wrangler). The wrangler-action's wranglerVersion input installs 4.110.0 into PATH, so bare wrangler resolves correctly at runtime. The prior pattern was more defensive against potential changes in the action's install behavior.
  Remediation: Consider using npx wrangler@4.110.0 in preCommands to maintain the explicit version pin pattern.

• [stale-version-reference] docs/superpowers/specs/2026-04-09-site-cloudflare-pages-design.md:99 — The spec states "Wrangler: pinned 4.30.0 in workflow" but the workflow now pins 4.110.0. This staleness predates this PR (the workflow was at 4.36.0 before) but is widened by it.
  Remediation: Update to "pinned 4.110.0."

[fullsend-ai-review]

See the review comment for full details.

required to update

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 5:20 PM UTC · Completed 5:28 PM UTC
Commit: 0f14ac0 · View workflow run →

[fullsend-ai-retro]

Retro: PR #4102 — chore(deps): bump wrangler to 4.110.0 to match workers-types v5

This PR fixed a peer dependency conflict that broke the Deploy Site workflow ~12 hours after PR #4002 merged. The review agent on #4102 performed well — it flagged the protected path without a linked issue, the unpinned wrangler in preCommands, and a stale docs reference. The human addressed all feedback in a follow-up commit. However, the root cause traces back to the review agent on PR #4002, which approved a partial dependency bump without detecting the resulting peer dependency inconsistency.

Timeline

1. 2026-07-10 10:37 — PR chore(deps): bump @cloudflare/workers-types from v4 to v5 #4002 opens (bumps @cloudflare/workers-types v4→v5, does NOT bump wrangler)
2. 2026-07-10 10:43 — Review agent approves with "Looks good to me" (6 min, no findings)
3. 2026-07-10 15:18 — PR chore(deps): bump @cloudflare/workers-types from v4 to v5 #4002 merges
4. 2026-07-11 ~03:13 — Deploy Site CI breaks — npm ci ERESOLVE conflict (wrangler@^4.36.0 peer-requires workers-types@^4.x)
5. 2026-07-11 12:31 — PR chore(deps): bump wrangler to 4.110.0 to match workers-types v5 #4102 opens (bumps wrangler to ^4.110.0, aligns workflow)
6. 2026-07-11 12:50 — Review agent posts findings (protected path, pattern consistency, stale docs)
7. 2026-07-11 12:36 — Second commit addresses review feedback
8. 2026-07-13 06:33 — Human approves
9. 2026-07-14 17:18 — PR chore(deps): bump wrangler to 4.110.0 to match workers-types v5 #4102 merges (CI fixed after ~3 days)

Proposals

1. Review agent correctness sub-agent should verify npm peer dependency consistency on dependency version bumps — [proposal below]

Proposals filed

• Correctness sub-agent: verify peer dependency consistency on npm version bump PRs (in fullsend-ai/fullsend)
• Track autonomy readiness: review agent on PR #4102 fully covered human review findings (in fullsend-ai/fullsend)