Miniflare 5.0.0-alpha reshapes local development, Vercel Passport hits GA

Miniflare 5.0.0-alpha consolidates the local dev layer

The biggest story of the week is Miniflare 5.0.0-alpha, which overhauls how local Workers testing works. The per-resource persistence options (kvPersist, r2Persist, d1Persist, etc.) have been replaced by a single resourcePersistencePath and resourceTmpPath — a welcome simplification for anyone managing a dev environment with multiple bindings. The liveReload feature and its /cdn-cgi/mf/reload endpoint are gone, along with fetchMock, createFetchMock, wrappedBindings, and the old miniflare CLI binary. The containerEngine option moves to the instance level, and local testing paths under /cdn-cgi/* are now rewritten to /cdn-cgi/local/* or /__cf_local/* to avoid collision with production routes.

These changes cascade through the Workers ecosystem. The vitest-pool-workers v0.20.0 update removes the same options from miniflare override settings, directing users to outboundService instead of fetchMock and createTestHarness() for container testing. Wrangler 4.117.0 and 4.118.0 both reflect the path rewrite and the containerEngine removal from unstable_getMiniflareWorkerOptions. The formatZodError helper has moved from miniflare to @cloudflare/workers-utils. If you're running a local Workers test suite, you'll want to update your configurations this week.

Wrangler gains startup profiling and observability by default

Wrangler 4.116.0 introduces wrangler check startup, a command that reports raw and compressed bundle sizes and summarizes local CPU activity during startup — including sampled, active, garbage collection, and idle time. A .cpuprofile file is saved for flamegraph analysis in Chrome DevTools or VS Code. This is a practical tool for tracking down cold-start latency before it reaches production. The same release graduated the startup check from alpha and added a createTestHarness email method for dispatching directly to a Worker's email handler.

Meanwhile, Wrangler 4.118.0 and the Workers Vite plugin v1.50.0 now enable local observability capture by default in wrangler dev — request traces and console logs flow into the Local Explorer's Observability tab without any opt-in flag. Opt out with X_LOCAL_OBSERVABILITY=false if you prefer leaner dev sessions. The release also fixes bugs where wrangler dev left work running after stop or reload, ran custom builds concurrently, and ignored the jsx_fragment setting.

Vercel Passport GA and AI Gateway budgets

Vercel Passport is now generally available, letting you protect deployments with Okta, Microsoft Entra ID, or any OIDC provider. The companion @vercel/passport v1.0.0 stable release makes the package ready for production use. For teams managing AI costs, Vercel AI Gateway now supports spend budgets at the team and project level, with email alerts and default budgets that new projects and keys inherit automatically. A dedicated logs page lets you inspect every request's cost, token counts, duration, and fallback path across providers, with shareable URL-based filters.

Workers AI paid-model changes and security updates

Workers AI now requires the Workers Paid plan for three models: @cf/moonshotai/kimi-k2.6, @cf/moonshotai/kimi-k2.7-code, and @cf/zai-org/glm-5.2. Free plan requests to these models return a 403 error, while many other models remain free. On the security front, Cloudflare WAF added rules blocking unauthenticated RCE in Nuxt Server Islands and Alibaba Fastjson ≤1.2.83 deserialization, and promoted SSRF detection for cloud metadata and obfuscated command injection from Log to Block. The AI SDK hardened validated downloads against DNS rebinding attacks by pinning resolved addresses at connection time on Node.js. The Vercel CLI build-utils fixed an Edge Function corruption bug caused by 4-byte UTF-8 characters not being preserved during vercel build.

Smaller releases worth noting

The Cloudflare Workers Builds image now defaults to Node.js 24.18.0 (with Node.js 22.23.2 also preinstalled). AI Search integrates with the Vercel AI SDK, LangChain, and the Cloudflare Agents SDK via new packages and guides. Wrangler 4.115.0 retries 429 rate limits with respect for the Retry-After header and adds experimental local S3 credentials for R2. The new Pages Functions SDK v0.1.0 publishes helpers for compiling a Pages functions/ directory into a Workers bundle. Vercel CLI 58.3.0 replaces the legacy vercel-workers integration for Python with the new vercel-queue SDK. The Vercel Chat SDK added Microsoft Teams reactions and ephemeral messages, and Vercel MCP updated to the 2026-07-28 spec with a stateless protocol core.