{"collection":{"slug":"application-platforms","name":"Application Platforms"},"digest":{"id":"cwd_80LAZoyGRObJiBqOgEXpT","weekStart":"2026-07-27","title":"Miniflare 5.0.0-alpha reshapes local development, Vercel Passport hits GA","intro":"Cloudflare shipped Miniflare 5.0.0-alpha with a major consolidation of persistence options, while Vercel made Passport generally available for deployment protection. Wrangler gained startup profiling, and Workers AI restricted three models to paid plans.","body":"### Miniflare 5.0.0-alpha consolidates the local dev layer\n\nThe biggest story of the week is [Miniflare 5.0.0-alpha](/release/rel_S-TIBjPR2NRFGSSfGKusP-workers-miniflare-5-0-0-alpha-consolidates-persistence-options-drops-live-reload), which overhauls how local Workers testing works. The per-resource persistence options (`kvPersist`, `r2Persist`, `d1Persist`, etc.) have been replaced by a single `resourcePersistencePath` and `resourceTmpPath` — a welcome simplification for anyone managing a dev environment with multiple bindings. The `liveReload` feature and its `/cdn-cgi/mf/reload` endpoint are gone, along with `fetchMock`, `createFetchMock`, `wrappedBindings`, and the old `miniflare` CLI binary. The `containerEngine` option moves to the instance level, and local testing paths under `/cdn-cgi/*` are now rewritten to `/cdn-cgi/local/*` or `/__cf_local/*` to avoid collision with production routes.\n\nThese changes cascade through the Workers ecosystem. The [vitest-pool-workers v0.20.0](/release/rel_a7C6TTOpRodtIVBmBlw9o-workers-vitest-pool-workers-v0-20-0-removes-several-miniflare-override-options) update removes the same options from miniflare override settings, directing users to `outboundService` instead of `fetchMock` and `createTestHarness()` for container testing. Wrangler [4.117.0](/release/rel_NMTB5RLC5UxV3-OKJfeDG-wrangler-4-117-0-removes-containerengine-from-unstable-getminiflareworkeroptions) and [4.118.0](/release/rel_8_P1FMWi7cB_iDXTx-lAU-wrangler-4-118-0-enables-local-observability-by-default-fixes-dev-shutdown-leaks) both reflect the path rewrite and the `containerEngine` removal from `unstable_getMiniflareWorkerOptions`. The [`formatZodError` helper](/release/rel_BI2vZjiiEXDLzt1gi2GB7-workers-sdk-v0-31-0-moves-formatzoderror-from-miniflare-to-workers-utils) has moved from miniflare to `@cloudflare/workers-utils`. If you're running a local Workers test suite, you'll want to update your configurations this week.\n\n### Wrangler gains startup profiling and observability by default\n\n[Wrangler 4.116.0](/release/rel_OkQbxpz99i8S71kkOa-Kp-cloudflare-workers-wrangler-4-116-0-adds-startup-profiling-command) introduces `wrangler check startup`, a command that reports raw and compressed bundle sizes and summarizes local CPU activity during startup — including sampled, active, garbage collection, and idle time. A `.cpuprofile` file is saved for flamegraph analysis in Chrome DevTools or VS Code. This is a practical tool for tracking down cold-start latency before it reaches production. The same release graduated the startup check from alpha and added a `createTestHarness` email method for dispatching directly to a Worker's email handler.\n\nMeanwhile, [Wrangler 4.118.0](/release/rel_8_P1FMWi7cB_iDXTx-lAU-wrangler-4-118-0-enables-local-observability-by-default-fixes-dev-shutdown-leaks) and the [Workers Vite plugin v1.50.0](/release/rel_i_IjQR4VkcS74NNt2j8VY-workers-vite-plugin-v1-50-0-enables-local-observability-capture-by-default-in) now enable local observability capture by default in `wrangler dev` — request traces and console logs flow into the Local Explorer's Observability tab without any opt-in flag. Opt out with `X_LOCAL_OBSERVABILITY=false` if you prefer leaner dev sessions. The release also fixes bugs where `wrangler dev` left work running after stop or reload, ran custom builds concurrently, and ignored the `jsx_fragment` setting.\n\n### Vercel Passport GA and AI Gateway budgets\n\n[Vercel Passport](/release/rel_9UY1g7L6uuNs5-Deg2uGa-vercel-passport-ga-protects-deployments-with-your-own-identity-provider) is now generally available, letting you protect deployments with Okta, Microsoft Entra ID, or any OIDC provider. The companion [@vercel/passport v1.0.0](/release/rel_TCZHudWZeXPMyfTQDK6Dn-vercel-passport-v1-0-0-stable-release) stable release makes the package ready for production use. For teams managing AI costs, [Vercel AI Gateway](/release/rel_t90hGfBtRThtr6bUKsaOo-vercel-ai-gateway-adds-team-and-project-spend-budgets) now supports spend budgets at the team and project level, with email alerts and default budgets that new projects and keys inherit automatically. A [dedicated logs page](/release/rel_G_ZyEAVpj7ORFquud6u2o-vercel-adds-dedicated-ai-gateway-logs-page-with-cost-and-token-filters) lets you inspect every request's cost, token counts, duration, and fallback path across providers, with shareable URL-based filters.\n\n### Workers AI paid-model changes and security updates\n\n[Workers AI](/release/rel_2hQbN-igrvFrtKL1JV6_m-workers-ai-now-requires-paid-plan-for-three-models) now requires the Workers Paid plan for three models: `@cf/moonshotai/kimi-k2.6`, `@cf/moonshotai/kimi-k2.7-code`, and `@cf/zai-org/glm-5.2`. Free plan requests to these models return a 403 error, while many other models remain free. On the security front, [Cloudflare WAF](/release/rel_CbK0zPwP-SZEA_7smSGl_-cloudflare-waf-blocks-nuxt-server-island-rce-and-fastjson-exploit-attempts) added rules blocking unauthenticated RCE in Nuxt Server Islands and Alibaba Fastjson ≤1.2.83 deserialization, and promoted SSRF detection for cloud metadata and obfuscated command injection from Log to Block. The [AI SDK](/release/rel_EWORm9pTcARZqHuoYuQ_b-ai-sdk-6-0-238-prevents-dns-rebinding-attacks-on-validated-downloads) hardened validated downloads against DNS rebinding attacks by pinning resolved addresses at connection time on Node.js. The [Vercel CLI build-utils](/release/rel_DP7KsOs1y3SRksqZ_MVuX-vercel-cli-build-utils-13-36-2-fixes-edge-function-corruption-from-4-byte-utf-8) fixed an Edge Function corruption bug caused by 4-byte UTF-8 characters not being preserved during `vercel build`.\n\n### Smaller releases worth noting\n\nThe [Cloudflare Workers Builds](/release/rel_zhzzeW543t64gOIEe5i6d-cloudflare-workers-builds-now-defaults-to-node-js-24-18-0) image now defaults to Node.js 24.18.0 (with Node.js 22.23.2 also preinstalled). [AI Search](/release/rel_0G2MGB8LHqbGbhC9xZk9Q-cloudflare-ai-search-now-integrates-with-ai-sdk-langchain-and-agents-sdk) integrates with the Vercel AI SDK, LangChain, and the Cloudflare Agents SDK via new packages and guides. [Wrangler 4.115.0](/release/rel_Ep-sFGOtu356Mx2P2iRwq-wrangler-4-115-0-retries-429-rate-limits-and-adds-local-s3-credentials-for-r2) retries 429 rate limits with respect for the `Retry-After` header and adds experimental local S3 credentials for R2. The new [Pages Functions SDK v0.1.0](/release/rel_I5OQfsWSjDj4-0U4Wv-Bl-workers-pages-functions-sdk-v0-1-0-publishes-helpers-for-compiling-pages) publishes helpers for compiling a Pages `functions/` directory into a Workers bundle. [Vercel CLI 58.3.0](/release/rel_xVVgnPmBEdt1DUATnqmz4-vercel-cli-58-3-0-replaces-vercel-workers-with-vercel-queue-sdk-for-python) replaces the legacy `vercel-workers` integration for Python with the new `vercel-queue` SDK. The [Vercel Chat SDK](/release/rel_DTwazVUZbHWIg-0eaYARz-vercel-chat-sdk-adds-reactions-and-ephemeral-messages-for-teams) added Microsoft Teams reactions and ephemeral messages, and [Vercel MCP](/release/rel_mMmD39374WGXe-ypZvTM1-vercel-mcp-updates-to-2026-07-28-spec-with-stateless-protocol-core) updated to the 2026-07-28 spec with a stateless protocol core.","releaseIds":["rel_S-TIBjPR2NRFGSSfGKusP","rel_a7C6TTOpRodtIVBmBlw9o","rel_NMTB5RLC5UxV3-OKJfeDG","rel_8_P1FMWi7cB_iDXTx-lAU","rel_BI2vZjiiEXDLzt1gi2GB7","rel_OkQbxpz99i8S71kkOa-Kp","rel_i_IjQR4VkcS74NNt2j8VY","rel_9UY1g7L6uuNs5-Deg2uGa","rel_TCZHudWZeXPMyfTQDK6Dn","rel_t90hGfBtRThtr6bUKsaOo","rel_G_ZyEAVpj7ORFquud6u2o","rel_2hQbN-igrvFrtKL1JV6_m","rel_CbK0zPwP-SZEA_7smSGl_","rel_EWORm9pTcARZqHuoYuQ_b","rel_DP7KsOs1y3SRksqZ_MVuX","rel_zhzzeW543t64gOIEe5i6d","rel_0G2MGB8LHqbGbhC9xZk9Q","rel_Ep-sFGOtu356Mx2P2iRwq","rel_I5OQfsWSjDj4-0U4Wv-Bl","rel_xVVgnPmBEdt1DUATnqmz4","rel_DTwazVUZbHWIg-0eaYARz","rel_mMmD39374WGXe-ypZvTM1"],"releaseCount":218,"generatedAt":"2026-08-03T06:16:36.211Z","releases":[{"id":"rel_S-TIBjPR2NRFGSSfGKusP","title":"Workers Miniflare 5.0.0-alpha consolidates persistence options, drops live reload","path":"/release/rel_S-TIBjPR2NRFGSSfGKusP-persistence-options-consolidated-live-reload-fetchmock-removed","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_a7C6TTOpRodtIVBmBlw9o","title":"Workers vitest-pool-workers v0.20.0 removes several miniflare override options","path":"/release/rel_a7C6TTOpRodtIVBmBlw9o-miniflare-override-options-pruned-cache-renamed-to-cacheapi","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_NMTB5RLC5UxV3-OKJfeDG","title":"Wrangler 4.117.0 removes containerEngine from unstable_getMiniflareWorkerOptions","path":"/release/rel_NMTB5RLC5UxV3-OKJfeDG-containerengine-removed-from-unstable-getminiflareworkeroptions-local-testing","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_8_P1FMWi7cB_iDXTx-lAU","title":"Wrangler 4.118.0 enables local observability by default, fixes dev shutdown leaks","path":"/release/rel_8_P1FMWi7cB_iDXTx-lAU-local-observability-now-on-by-default-dev-shutdown-leaks-fixed","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_BI2vZjiiEXDLzt1gi2GB7","title":"Workers SDK v0.31.0 moves formatZodError from miniflare to workers-utils","path":"/release/rel_BI2vZjiiEXDLzt1gi2GB7-formatzoderror-moves-from-miniflare-to-workers-utils","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_OkQbxpz99i8S71kkOa-Kp","title":"Cloudflare Workers: Wrangler 4.116.0 adds startup profiling command","path":"/release/rel_OkQbxpz99i8S71kkOa-Kp-wrangler-startup-profiling-bundle-sizes-and-cpu-activity","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_i_IjQR4VkcS74NNt2j8VY","title":"Workers Vite plugin v1.50.0 enables local observability capture by default in dev","path":"/release/rel_i_IjQR4VkcS74NNt2j8VY-local-observability-capture-now-on-by-default-in-dev","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_9UY1g7L6uuNs5-Deg2uGa","title":"Vercel Passport GA protects deployments with your own identity provider","path":"/release/rel_9UY1g7L6uuNs5-Deg2uGa-vercel-passport-ga-enforces-private-deployments-via-okta-entra-id-or-oidc","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_TCZHudWZeXPMyfTQDK6Dn","title":"@vercel/passport v1.0.0 stable release","path":"/release/rel_TCZHudWZeXPMyfTQDK6Dn-vercel-passport-reaches-stable-1-0-0","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_t90hGfBtRThtr6bUKsaOo","title":"Vercel AI Gateway adds team and project spend budgets","path":"/release/rel_t90hGfBtRThtr6bUKsaOo-team-and-project-spend-budgets-with-email-alerts","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_G_ZyEAVpj7ORFquud6u2o","title":"Vercel adds dedicated AI Gateway logs page with cost and token filters","path":"/release/rel_G_ZyEAVpj7ORFquud6u2o-ai-gateway-logs-get-dedicated-page-with-shareable-filters","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_2hQbN-igrvFrtKL1JV6_m","title":"Workers AI now requires Paid plan for three models","path":"/release/rel_2hQbN-igrvFrtKL1JV6_m-kimi-k2-6-k2-7-glm-5-2-require-workers-paid-plan","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_CbK0zPwP-SZEA_7smSGl_","title":"Cloudflare WAF blocks Nuxt Server Island RCE and Fastjson exploit attempts","path":"/release/rel_CbK0zPwP-SZEA_7smSGl_-nuxt-server-island-rce-blocked-fastjson-deserialization-blocked","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_EWORm9pTcARZqHuoYuQ_b","title":"AI SDK 6.0.238 prevents DNS rebinding attacks on validated downloads","path":"/release/rel_EWORm9pTcARZqHuoYuQ_b-dns-rebinding-attacks-blocked-per-step-model-settings-supported","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_DP7KsOs1y3SRksqZ_MVuX","title":"Vercel CLI build-utils 13.36.2 fixes Edge Function corruption from 4-byte UTF-8 characters","path":"/release/rel_DP7KsOs1y3SRksqZ_MVuX-edge-functions-no-longer-corrupted-by-4-byte-utf-8-characters","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_zhzzeW543t64gOIEe5i6d","title":"Cloudflare Workers Builds now defaults to Node.js 24.18.0","path":"/release/rel_zhzzeW543t64gOIEe5i6d-node-js-24-18-0-is-now-default-for-workers-builds","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_0G2MGB8LHqbGbhC9xZk9Q","title":"Cloudflare AI Search now integrates with AI SDK, LangChain, and Agents SDK","path":"/release/rel_0G2MGB8LHqbGbhC9xZk9Q-ai-search-gets-sdk-integrations-for-vercel-ai-sdk-langchain-and-agents-sdk","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_Ep-sFGOtu356Mx2P2iRwq","title":"Wrangler 4.115.0 retries 429 rate limits and adds local S3 credentials for R2","path":"/release/rel_Ep-sFGOtu356Mx2P2iRwq-429-api-errors-now-auto-retried-local-s3-for-r2-workbenches","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_I5OQfsWSjDj4-0U4Wv-Bl","title":"Workers Pages Functions SDK v0.1.0 publishes helpers for compiling Pages Functions to Workers","path":"/release/rel_I5OQfsWSjDj4-0U4Wv-Bl-pages-functions-directory-compiler-ships-as-cli-and-programmatic-api","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_xVVgnPmBEdt1DUATnqmz4","title":"Vercel CLI 58.3.0 replaces vercel-workers with vercel-queue SDK for Python","path":"/release/rel_xVVgnPmBEdt1DUATnqmz4-python-queue-subscribers-migrate-from-vercel-workers-to-vercel-queue-sdk","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_DTwazVUZbHWIg-0eaYARz","title":"Vercel Chat SDK adds reactions and ephemeral messages for Teams","path":"/release/rel_DTwazVUZbHWIg-0eaYARz-teams-reactions-ephemeral-messages-and-author-emails-land","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_mMmD39374WGXe-ypZvTM1","title":"Vercel MCP updates to 2026-07-28 spec with stateless protocol core","path":"/release/rel_mMmD39374WGXe-ypZvTM1-mcp-spec-2026-07-28-stateless-core-hardened-auth","org":{"slug":"vercel","name":"Vercel"},"importance":3}]}}