Repository navigation
chore(deps-dev): bump wrangler from 4.120.0 to 4.120.1 - #377
Merged
Merged
Conversation
Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) from 4.120.0 to 4.120.1. - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.120.1/packages/wrangler) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.120.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Dependabot site reviewDependency: wrangler Dependabot's PR description contains the upstream release notes/changelog and commit details. Review those before merging. Site leverage checklist
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | 0c24699 | Aug 14 2026, 05:13 PM |
Contributor
Wire-size diff vs merge base
Brotli q11, the quality the edge serves. Every number here is deterministic: Client assetsNo change. 20 files, 73.98 KiB Brotli total. PagesNo change. 48 files, 496.54 KiB Brotli total. Worker bundleNo change. 284.56 KiB gzip. Dictionary deltas (
|
oddharsh
added a commit
that referenced
this pull request
Aug 14, 2026
docs/DEPENDENCIES.md states version pins in prose and dependabot rewrites those pins on a daily schedule, so the file goes stale on a cadence rather than by accident. It did so twice in two days: #371 corrected Wrangler 4.112.0 -> 4.120.0 and merged, then #377 bumped the pin to 4.120.1 hours later. Both times a human found it. This is the same class as gotcha 29's "one version pin in two files", and check-tools.mjs #375 is the precedent for the answer. The check adds NO third copy. tools.json had to declare what no manifest recorded; every number here is already in package.json or requirements.txt, so this reads those as the source of truth and holds the prose to them. Two directions, because either alone is decoration. Forward: every version the doc states for a known package must match its pin. Reverse: every root dependency must be documented or exempted by name with a reason, so adding a dependency forces a documentation decision instead of landing unmentioned. IT FOUND TWO THINGS ON ITS FIRST RUN, and the second is the one worth having. Wrangler was the expected drift. @noble/post-quantum was not documented at all, and it is the ONLY dependency in this repo that reaches a visitor: workerd ships no post-quantum algorithm in WebCrypto, so AadharshBot's ML-DSA-44 sig2 is pure JavaScript in the Worker bundle. It is now documented as such, with the note that its releases want reading for bundle size as well as correctness, because it is Worker bytes rather than build bytes. The scanner is deliberately not a general "Name 1.2.3" sweep. That would be the fourth naive scanner this repo has caught, and DEPENDENCIES.md breaks it three ways in its own text: `CSS Overflow 5`, `Vite 8`, and `TypeScript 7.0` (two components, discussing the major line rather than the pin) all read as version claims. It matches a known alias followed by a full three-component version, and a test asserts those four real sentences yield zero claims. auditDependencyDocs is pure and takes its policy as parameters, so the negative cases run against two-line fixtures rather than needing the whole manifest reconstructed to keep the other rules quiet. Same reasoning as lib/cron.js. Six negative cases assert the check has teeth, including the floor, because a version of this that only ever agreed with the current tree would be the third check here to pass while asserting nothing. Verified: 274/274 contract tests, lint 0, typecheck 0, build 0, pages:check 0. oxlint flagged a useless spread fallback in the first draft, which is the linter that landed this morning earning its place on the same day. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com>
oddharsh
added a commit
that referenced
this pull request
Aug 14, 2026
…oes not pin (#382) docs/DEPENDENCIES.md is the stated entry point for an agent reviewing a dependency PR, and it restates pins in PROSE, so it goes stale the moment dependabot merges. Measured twice in one day on 2026-08-14: found claiming Wrangler 4.112.0 against a 4.120.0 pin, corrected, then wrong again within hours when #377 took wrangler to 4.120.1. A doc that names a version nobody checks is a doc that will misinform the next reader, and this one is read precisely when someone is deciding whether a bump is safe. Same shape as checkTwinFacts() in gen-md-twins.mjs, which pins the load-bearing strings in www/md/*.md against the Worker in both directions. The mapping is EXPLICIT rather than a scan for `<Name> <semver>`, because a scan over this file is wrong twice. It reads "Minify 0.144.0" and "CSS 1.33.0" out of the middle of two names, and it reads 0.28.1 and 0.28.2 out of the paragraph explaining that esbuild is no longer a direct dependency and that the two remaining copies belong to wrangler and vitest. Those are versions this repo deliberately does NOT pin, so a scan would demand they match a manifest entry that is correctly absent. The matcher also requires a FULL three-part version, which was found the naive way: `<Name> <digits>` reads "TypeScript 7.0 ships no stable programmatic API" out of the Oxlint bullet and reports the pin as 7.0 against a 7.0.2 manifest. Same family as the quote-aware scanner in link-integrity.mjs and the `<script` scanner in gotcha 17, and the third time prose that MENTIONS a version has been mistaken for the sentence that CLAIMS one. It is scoped to the Current baseline section for the same reason. Both directions are asserted, so the table cannot go stale either: a package that leaves package.json has to leave this table, which is the assertion that would have spoken up when esbuild was retired earlier today. The count guard is the one the pnpm-bootstrap test above it carries, for the same reason. Verified with four controls rather than trusting a green run, since a check that can only agree with itself is decoration: unmodified PASS doc states a wrong version FAIL doc claim deleted FAIL package retired, doc stale FAIL restored PASS It caught the live 4.120.0 against 4.120.1 drift on its first run; that correction is the one-line doc change here. 272 contract tests pass, typecheck and lint green. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps wrangler from 4.120.0 to 4.120.1.
Release notes
Sourced from wrangler's releases.
Commits
d2f377eVersion Packages (#15111)fe14247[wrangler] Don't requireconsole.createTaskin the unenv-preset e2e test (#...2194f88new config miniflare attempt 3 (#14994)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)