build(deps): bump the cloudflare group across 1 directory with 3 updates

[dependabot]

Bumps the cloudflare group with 3 updates in the / directory: agents, @cloudflare/workers-types and wrangler.

Updates agents from 0.21.0 to 0.22.0

Release notes

Sourced from agents's releases.

agents@0.22.0

Minor Changes

• #2071 9620b58 Thanks @​ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

  Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

  To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

• #2133 d536067 Thanks @​mattzcarey! - Vendor the required PartyServer runtime into agents/lifecycle and add a reusable Durable Object lifecycle for startup, request interception, alarms, and WebSockets. Agent now directly extends Cloudflare's DurableObject and composes the same lifecycle used by standalone objects; standalone hosts use the explicit Lifecycle.install(this) factory (or the expanded new ... plus installHandlers() form). Both Agent subclasses and standalone hosts use the existing routeAgentRequest() API and /agents URL prefix; the lifecycle entry point does not introduce a second public router.

  Lifecycle WebSockets always use Cloudflare's Hibernation API; the static options.hibernate switch and in-memory connection mode are removed. Named Durable Objects use native ctx.id.name, while a read-only __ps_name fallback migrates objects created by older releases without writing new compatibility state.

• #2058 381b9bb Thanks @​ben-reitz! - Throttle chat UI updates by default in useAgentChat

  Streaming writes chat state once per chunk, and each write re-renders. When chunks arrive in a burst — a resumed stream replaying a long turn, for example — React reaches its 50-render limit and throws "Maximum update depth exceeded", which the AI SDK reports as a failed turn even though the server completed it (#1913).

  useAgentChat now coalesces those updates every 50ms, which removes about 78% of renders on a fast stream and matches the value the AI SDK documents. The first chunk of a stream is never delayed. Pass throttle: false to render every chunk as it arrives, or a number to change the interval. The deprecated experimental_throttle is still honoured. Message snapshots, functional updates, and streamed continuations resolve against the current chat store, so coalescing renders cannot roll assistant content back to an older snapshot.

• #1897 29b0107 Thanks @​mattzcarey! - Add Scheduler, a reusable Lifecycle capability for persistent delayed, dated, cron, and interval callbacks, under agents/schedules. Scheduled callbacks are registered on the Scheduler itself (new Scheduler({ callbacks: { ... } })), and set() / every() type both the callback name and the payload against that registration, so the typed scheduling surface and the runtime dispatch target are the same object. LifecycleCapability supplies every capability with storage, readiness, startup state, alarm coordination, a host invocation boundary, best-effort events, and generic capability routing — Scheduler consumes only that standard surface plus its callbacks and policy options, so any host that installs it configures nothing else. Lifecycle owns the physical Durable Object alarm and routes matching capability messages between Agent facets through one internal transport aperture, preserving existing root-owned facet schedule rows without Scheduler-specific Agent RPC methods or an Agent adapter. Agent uses the same Scheduler behind its existing APIs — name-based this.schedule(60, "methodName") keeps dispatching to Agent methods through a composition-root resolver — and preserves callback context, observability, retries, OOM handling, and alarm behavior. MCP now receives storage from Lifecycle when installed. Explicit destruction disposes live capability resources once, then clears shared Durable Object storage with deleteAll(). Think workflow notifications now contribute their wake time through Lifecycle instead of writing the physical alarm directly. The previous agents/schedule parser entry point remains as a deprecated compatibility alias. Agent exposes the composition root as experimental this.lifecycle and this.scheduler properties. The agents/lifecycle entry point and the capability surfaces built on it (Scheduler, installing MCPClientManager directly as a capability) are experimental and may change between releases; Agent's established APIs are unaffected.

  Compatibility notes: MCPClientManagerOptions.storage is removed — the manager receives storage from the Lifecycle it is installed on, so standalone construction with an explicit DurableObjectStorage is no longer supported. Scheduled callbacks now receive the documented parsed Schedule object as their second argument (previously the raw storage row, whose payload was an unparsed JSON string). The internal _cf_*ForFacet schedule RPC methods are replaced by the generic _cf_routeLifecycle capability aperture; facets always run the same deployed script, so no coordination is required.

• #2161 ded09c6 Thanks @​mattzcarey! - Remove the published agents command-line binary. Its advertised init, dev, deploy, and mcp commands were placeholders that printed "not implemented yet" and exited successfully. Use the documented C3 starter, Vite and Wrangler commands, and MCP APIs instead.

• #1895 4ba9a37 Thanks @​mattzcarey! - Make MCPClientManager a reusable Durable Object lifecycle capability. It now owns schema initialization, persisted HTTP and RPC connection restoration, and OAuth callback interception when installed with Lifecycle.use(), while preserving Agent.this.mcp and the existing Agent MCP APIs. agents/lifecycle exports the LifecycleObject host interface and canonical getCurrentAgent() accessor; Lifecycle supplies that context to host hooks while capability hooks remain self-contained.

Patch Changes

• #2027 e87ad62 Thanks @​cjol! - Route asynchronous callable and streaming responses through the facet WebSocket frame that originated each RPC.

• #1978 b7c7696 Thanks @​Ankcorn! - Add Agents SDK instrumentation and agent instance identity attributes to SDK-created spans.

• #2050 3b43c33 Thanks @​ben-reitz! - Batch replayed chunks during stream resume so long turns do not exceed React's update limit and report a false error.

• #2120 b038440 Thanks @​ben-reitz! - Keep Session compaction overlays scoped to their selected conversation branch and preserve deterministic ordering for overlays created in the same second.

• #2090 2f957bc Thanks @​ben-reitz! - Keep sub-agent WebSocket operations routable and ordered across live and delayed contexts and before broadcasts, report routing failures, and preserve nested sub-agent broadcasts across RPC callbacks.

... (truncated)

Changelog

Sourced from agents's changelog.

0.22.0

Minor Changes

• #2071 9620b58 Thanks @​ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

  Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

  To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

• #2133 d536067 Thanks @​mattzcarey! - Vendor the required PartyServer runtime into agents/lifecycle and add a reusable Durable Object lifecycle for startup, request interception, alarms, and WebSockets. Agent now directly extends Cloudflare's DurableObject and composes the same lifecycle used by standalone objects; standalone hosts use the explicit Lifecycle.install(this) factory (or the expanded new ... plus installHandlers() form). Both Agent subclasses and standalone hosts use the existing routeAgentRequest() API and /agents URL prefix; the lifecycle entry point does not introduce a second public router.

  Lifecycle WebSockets always use Cloudflare's Hibernation API; the static options.hibernate switch and in-memory connection mode are removed. Named Durable Objects use native ctx.id.name, while a read-only __ps_name fallback migrates objects created by older releases without writing new compatibility state.

• #2058 381b9bb Thanks @​ben-reitz! - Throttle chat UI updates by default in useAgentChat

  Streaming writes chat state once per chunk, and each write re-renders. When chunks arrive in a burst — a resumed stream replaying a long turn, for example — React reaches its 50-render limit and throws "Maximum update depth exceeded", which the AI SDK reports as a failed turn even though the server completed it (#1913).

  useAgentChat now coalesces those updates every 50ms, which removes about 78% of renders on a fast stream and matches the value the AI SDK documents. The first chunk of a stream is never delayed. Pass throttle: false to render every chunk as it arrives, or a number to change the interval. The deprecated experimental_throttle is still honoured. Message snapshots, functional updates, and streamed continuations resolve against the current chat store, so coalescing renders cannot roll assistant content back to an older snapshot.

• #1897 29b0107 Thanks @​mattzcarey! - Add Scheduler, a reusable Lifecycle capability for persistent delayed, dated, cron, and interval callbacks, under agents/schedules. Scheduled callbacks are registered on the Scheduler itself (new Scheduler({ callbacks: { ... } })), and set() / every() type both the callback name and the payload against that registration, so the typed scheduling surface and the runtime dispatch target are the same object. LifecycleCapability supplies every capability with storage, readiness, startup state, alarm coordination, a host invocation boundary, best-effort events, and generic capability routing — Scheduler consumes only that standard surface plus its callbacks and policy options, so any host that installs it configures nothing else. Lifecycle owns the physical Durable Object alarm and routes matching capability messages between Agent facets through one internal transport aperture, preserving existing root-owned facet schedule rows without Scheduler-specific Agent RPC methods or an Agent adapter. Agent uses the same Scheduler behind its existing APIs — name-based this.schedule(60, "methodName") keeps dispatching to Agent methods through a composition-root resolver — and preserves callback context, observability, retries, OOM handling, and alarm behavior. MCP now receives storage from Lifecycle when installed. Explicit destruction disposes live capability resources once, then clears shared Durable Object storage with deleteAll(). Think workflow notifications now contribute their wake time through Lifecycle instead of writing the physical alarm directly. The previous agents/schedule parser entry point remains as a deprecated compatibility alias. Agent exposes the composition root as experimental this.lifecycle and this.scheduler properties. The agents/lifecycle entry point and the capability surfaces built on it (Scheduler, installing MCPClientManager directly as a capability) are experimental and may change between releases; Agent's established APIs are unaffected.

  Compatibility notes: MCPClientManagerOptions.storage is removed — the manager receives storage from the Lifecycle it is installed on, so standalone construction with an explicit DurableObjectStorage is no longer supported. Scheduled callbacks now receive the documented parsed Schedule object as their second argument (previously the raw storage row, whose payload was an unparsed JSON string). The internal _cf_*ForFacet schedule RPC methods are replaced by the generic _cf_routeLifecycle capability aperture; facets always run the same deployed script, so no coordination is required.

• #2161 ded09c6 Thanks @​mattzcarey! - Remove the published agents command-line binary. Its advertised init, dev, deploy, and mcp commands were placeholders that printed "not implemented yet" and exited successfully. Use the documented C3 starter, Vite and Wrangler commands, and MCP APIs instead.

• #1895 4ba9a37 Thanks @​mattzcarey! - Make MCPClientManager a reusable Durable Object lifecycle capability. It now owns schema initialization, persisted HTTP and RPC connection restoration, and OAuth callback interception when installed with Lifecycle.use(), while preserving Agent.this.mcp and the existing Agent MCP APIs. agents/lifecycle exports the LifecycleObject host interface and canonical getCurrentAgent() accessor; Lifecycle supplies that context to host hooks while capability hooks remain self-contained.

Patch Changes

• #2027 e87ad62 Thanks @​cjol! - Route asynchronous callable and streaming responses through the facet WebSocket frame that originated each RPC.

• #1978 b7c7696 Thanks @​Ankcorn! - Add Agents SDK instrumentation and agent instance identity attributes to SDK-created spans.

• #2050 3b43c33 Thanks @​ben-reitz! - Batch replayed chunks during stream resume so long turns do not exceed React's update limit and report a false error.

• #2120 b038440 Thanks @​ben-reitz! - Keep Session compaction overlays scoped to their selected conversation branch and preserve deterministic ordering for overlays created in the same second.

• #2090 2f957bc Thanks @​ben-reitz! - Keep sub-agent WebSocket operations routable and ordered across live and delayed contexts and before broadcasts, report routing failures, and preserve nested sub-agent broadcasts across RPC callbacks.

... (truncated)

Commits

• 676b3d3 Version Packages (#2128)
• 29b0107 feat(lifecycle): add composable Scheduler (#1897)
• 2f957bc Fix delayed sub-agent WebSocket operations (#2090)
• ded09c6 chore: remove stale artifacts and no-op CLI (#2161)
• 4ba9a37 feat(mcp): make the client manager a Durable Object capability (#1895)
• 381b9bb feat(chat): throttle chat UI updates by default (#2058)
• 3b43c33 fix(chat): batch replayed chunks on stream resume (#2050)
• 4890dc6 feat(channels): add stateless channels package (#2129)
• e87ad62 Fix dropped async callable replies on facets (#2027)
• a0e134b refactor(agents): keep request routing under routeAgentRequest (#2140)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260818.1 to 5.20260905.1

Commits

• See full diff in compare view

Updates wrangler from 4.124.0 to 4.129.0

Release notes

Sourced from wrangler's releases.

wrangler@4.129.0

Minor Changes

• #15460 93d72a5 Thanks @​QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

  Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

• #15358 d2d8eea Thanks @​pombosilva! - Add a --json flag to the wrangler workflows commands

  Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

  wrangler workflows instances list my-workflow --json

  The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes

• #15469 d40a634 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260831.1	^5.20260902.1
  workerd	1.20260831.1	1.20260902.1

• #15481 7c1b2a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260902.1	^5.20260903.1
  workerd	1.20260902.1	1.20260903.1

• #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

  wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

• #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing resource permissions during resource provisioning

  When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

• #15476 dc24057 Thanks @​christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

  Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

  • miniflare@5.20260903.0-alpha

... (truncated)

Commits

• be87ff0 Version Packages (#15461)
• f6fb347 tolerate missing permissions for pre-flight checks (#15472)
• dc24057 [wrangler] Use worker-scoped preview sessions (#15476)
• d2d8eea [wrangler] Add --json output to Workflows commands (#15358)
• 93d72a5 PIPE-635: Support gzip compression for JSON sinks (#15460)
• b7b4ff8 Version Packages (#15450)
• ea28cc3 [wrangler] Add observability query string redaction (#15379)
• 1809c5e [wrangler] Stop publishing build metafile (#15398)
• 10d6bfb Support partial manifests in build output (#15388)
• dbbb795 Move binding utilities into workers-utils (#15454)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	mongodb-mcp	568bffe	Sep 08 2026, 05:51 AM