---
collection: application-platforms
collection_name: Application Platforms
week_start: 2026-07-27
title: Miniflare 5.0.0-alpha reshapes local development, Vercel Passport hits GA
release_count: 218
generated: 2026-08-03
canonical: https://releases.sh/collections/application-platforms/digest/2026-07-27
---

# Miniflare 5.0.0-alpha reshapes local development, Vercel Passport hits GA

Cloudflare shipped Miniflare 5.0.0-alpha with a major consolidation of persistence options, while Vercel made Passport generally available for deployment protection. Wrangler gained startup profiling, and Workers AI restricted three models to paid plans.

### Miniflare 5.0.0-alpha consolidates the local dev layer

The biggest story of the week is [Miniflare 5.0.0-alpha](/release/rel_S-TIBjPR2NRFGSSfGKusP-workers-miniflare-5-0-0-alpha-consolidates-persistence-options-drops-live-reload), which overhauls how local Workers testing works. The per-resource persistence options (`kvPersist`, `r2Persist`, `d1Persist`, etc.) have been replaced by a single `resourcePersistencePath` and `resourceTmpPath` — a welcome simplification for anyone managing a dev environment with multiple bindings. The `liveReload` feature and its `/cdn-cgi/mf/reload` endpoint are gone, along with `fetchMock`, `createFetchMock`, `wrappedBindings`, and the old `miniflare` CLI binary. The `containerEngine` option moves to the instance level, and local testing paths under `/cdn-cgi/*` are now rewritten to `/cdn-cgi/local/*` or `/__cf_local/*` to avoid collision with production routes.

These changes cascade through the Workers ecosystem. The [vitest-pool-workers v0.20.0](/release/rel_a7C6TTOpRodtIVBmBlw9o-workers-vitest-pool-workers-v0-20-0-removes-several-miniflare-override-options) update removes the same options from miniflare override settings, directing users to `outboundService` instead of `fetchMock` and `createTestHarness()` for container testing. Wrangler [4.117.0](/release/rel_NMTB5RLC5UxV3-OKJfeDG-wrangler-4-117-0-removes-containerengine-from-unstable-getminiflareworkeroptions) and [4.118.0](/release/rel_8_P1FMWi7cB_iDXTx-lAU-wrangler-4-118-0-enables-local-observability-by-default-fixes-dev-shutdown-leaks) both reflect the path rewrite and the `containerEngine` removal from `unstable_getMiniflareWorkerOptions`. The [`formatZodError` helper](/release/rel_BI2vZjiiEXDLzt1gi2GB7-workers-sdk-v0-31-0-moves-formatzoderror-from-miniflare-to-workers-utils) has moved from miniflare to `@cloudflare/workers-utils`. If you're running a local Workers test suite, you'll want to update your configurations this week.

### Wrangler gains startup profiling and observability by default

[Wrangler 4.116.0](/release/rel_OkQbxpz99i8S71kkOa-Kp-cloudflare-workers-wrangler-4-116-0-adds-startup-profiling-command) introduces `wrangler check startup`, a command that reports raw and compressed bundle sizes and summarizes local CPU activity during startup — including sampled, active, garbage collection, and idle time. A `.cpuprofile` file is saved for flamegraph analysis in Chrome DevTools or VS Code. This is a practical tool for tracking down cold-start latency before it reaches production. The same release graduated the startup check from alpha and added a `createTestHarness` email method for dispatching directly to a Worker's email handler.

Meanwhile, [Wrangler 4.118.0](/release/rel_8_P1FMWi7cB_iDXTx-lAU-wrangler-4-118-0-enables-local-observability-by-default-fixes-dev-shutdown-leaks) and the [Workers Vite plugin v1.50.0](/release/rel_i_IjQR4VkcS74NNt2j8VY-workers-vite-plugin-v1-50-0-enables-local-observability-capture-by-default-in) now enable local observability capture by default in `wrangler dev` — request traces and console logs flow into the Local Explorer's Observability tab without any opt-in flag. Opt out with `X_LOCAL_OBSERVABILITY=false` if you prefer leaner dev sessions. The release also fixes bugs where `wrangler dev` left work running after stop or reload, ran custom builds concurrently, and ignored the `jsx_fragment` setting.

### Vercel Passport GA and AI Gateway budgets

[Vercel Passport](/release/rel_9UY1g7L6uuNs5-Deg2uGa-vercel-passport-ga-protects-deployments-with-your-own-identity-provider) is now generally available, letting you protect deployments with Okta, Microsoft Entra ID, or any OIDC provider. The companion [@vercel/passport v1.0.0](/release/rel_TCZHudWZeXPMyfTQDK6Dn-vercel-passport-v1-0-0-stable-release) stable release makes the package ready for production use. For teams managing AI costs, [Vercel AI Gateway](/release/rel_t90hGfBtRThtr6bUKsaOo-vercel-ai-gateway-adds-team-and-project-spend-budgets) now supports spend budgets at the team and project level, with email alerts and default budgets that new projects and keys inherit automatically. A [dedicated logs page](/release/rel_G_ZyEAVpj7ORFquud6u2o-vercel-adds-dedicated-ai-gateway-logs-page-with-cost-and-token-filters) lets you inspect every request's cost, token counts, duration, and fallback path across providers, with shareable URL-based filters.

### Workers AI paid-model changes and security updates

[Workers AI](/release/rel_2hQbN-igrvFrtKL1JV6_m-workers-ai-now-requires-paid-plan-for-three-models) now requires the Workers Paid plan for three models: `@cf/moonshotai/kimi-k2.6`, `@cf/moonshotai/kimi-k2.7-code`, and `@cf/zai-org/glm-5.2`. Free plan requests to these models return a 403 error, while many other models remain free. On the security front, [Cloudflare WAF](/release/rel_CbK0zPwP-SZEA_7smSGl_-cloudflare-waf-blocks-nuxt-server-island-rce-and-fastjson-exploit-attempts) added rules blocking unauthenticated RCE in Nuxt Server Islands and Alibaba Fastjson ≤1.2.83 deserialization, and promoted SSRF detection for cloud metadata and obfuscated command injection from Log to Block. The [AI SDK](/release/rel_EWORm9pTcARZqHuoYuQ_b-ai-sdk-6-0-238-prevents-dns-rebinding-attacks-on-validated-downloads) hardened validated downloads against DNS rebinding attacks by pinning resolved addresses at connection time on Node.js. The [Vercel CLI build-utils](/release/rel_DP7KsOs1y3SRksqZ_MVuX-vercel-cli-build-utils-13-36-2-fixes-edge-function-corruption-from-4-byte-utf-8) fixed an Edge Function corruption bug caused by 4-byte UTF-8 characters not being preserved during `vercel build`.

### Smaller releases worth noting

The [Cloudflare Workers Builds](/release/rel_zhzzeW543t64gOIEe5i6d-cloudflare-workers-builds-now-defaults-to-node-js-24-18-0) image now defaults to Node.js 24.18.0 (with Node.js 22.23.2 also preinstalled). [AI Search](/release/rel_0G2MGB8LHqbGbhC9xZk9Q-cloudflare-ai-search-now-integrates-with-ai-sdk-langchain-and-agents-sdk) integrates with the Vercel AI SDK, LangChain, and the Cloudflare Agents SDK via new packages and guides. [Wrangler 4.115.0](/release/rel_Ep-sFGOtu356Mx2P2iRwq-wrangler-4-115-0-retries-429-rate-limits-and-adds-local-s3-credentials-for-r2) retries 429 rate limits with respect for the `Retry-After` header and adds experimental local S3 credentials for R2. The new [Pages Functions SDK v0.1.0](/release/rel_I5OQfsWSjDj4-0U4Wv-Bl-workers-pages-functions-sdk-v0-1-0-publishes-helpers-for-compiling-pages) publishes helpers for compiling a Pages `functions/` directory into a Workers bundle. [Vercel CLI 58.3.0](/release/rel_xVVgnPmBEdt1DUATnqmz4-vercel-cli-58-3-0-replaces-vercel-workers-with-vercel-queue-sdk-for-python) replaces the legacy `vercel-workers` integration for Python with the new `vercel-queue` SDK. The [Vercel Chat SDK](/release/rel_DTwazVUZbHWIg-0eaYARz-vercel-chat-sdk-adds-reactions-and-ephemeral-messages-for-teams) added Microsoft Teams reactions and ephemeral messages, and [Vercel MCP](/release/rel_mMmD39374WGXe-ypZvTM1-vercel-mcp-updates-to-2026-07-28-spec-with-stateless-protocol-core) updated to the 2026-07-28 spec with a stateless protocol core.

## Releases covered

### Cloudflare

- [Workers Miniflare 5.0.0-alpha consolidates persistence options, drops live reload](https://releases.sh/release/rel_S-TIBjPR2NRFGSSfGKusP-persistence-options-consolidated-live-reload-fetchmock-removed)
- [Workers vitest-pool-workers v0.20.0 removes several miniflare override options](https://releases.sh/release/rel_a7C6TTOpRodtIVBmBlw9o-miniflare-override-options-pruned-cache-renamed-to-cacheapi)
- [Wrangler 4.117.0 removes containerEngine from unstable_getMiniflareWorkerOptions](https://releases.sh/release/rel_NMTB5RLC5UxV3-OKJfeDG-containerengine-removed-from-unstable-getminiflareworkeroptions-local-testing)
- [Wrangler 4.118.0 enables local observability by default, fixes dev shutdown leaks](https://releases.sh/release/rel_8_P1FMWi7cB_iDXTx-lAU-local-observability-now-on-by-default-dev-shutdown-leaks-fixed)
- [Workers SDK v0.31.0 moves formatZodError from miniflare to workers-utils](https://releases.sh/release/rel_BI2vZjiiEXDLzt1gi2GB7-formatzoderror-moves-from-miniflare-to-workers-utils)
- [Cloudflare Workers: Wrangler 4.116.0 adds startup profiling command](https://releases.sh/release/rel_OkQbxpz99i8S71kkOa-Kp-wrangler-startup-profiling-bundle-sizes-and-cpu-activity)
- [Workers Vite plugin v1.50.0 enables local observability capture by default in dev](https://releases.sh/release/rel_i_IjQR4VkcS74NNt2j8VY-local-observability-capture-now-on-by-default-in-dev)
- [Workers AI now requires Paid plan for three models](https://releases.sh/release/rel_2hQbN-igrvFrtKL1JV6_m-kimi-k2-6-k2-7-glm-5-2-require-workers-paid-plan)
- [Cloudflare WAF blocks Nuxt Server Island RCE and Fastjson exploit attempts](https://releases.sh/release/rel_CbK0zPwP-SZEA_7smSGl_-nuxt-server-island-rce-blocked-fastjson-deserialization-blocked)
- [Cloudflare Workers Builds now defaults to Node.js 24.18.0](https://releases.sh/release/rel_zhzzeW543t64gOIEe5i6d-node-js-24-18-0-is-now-default-for-workers-builds)
- [Cloudflare AI Search now integrates with AI SDK, LangChain, and Agents SDK](https://releases.sh/release/rel_0G2MGB8LHqbGbhC9xZk9Q-ai-search-gets-sdk-integrations-for-vercel-ai-sdk-langchain-and-agents-sdk)
- [Wrangler 4.115.0 retries 429 rate limits and adds local S3 credentials for R2](https://releases.sh/release/rel_Ep-sFGOtu356Mx2P2iRwq-429-api-errors-now-auto-retried-local-s3-for-r2-workbenches)
- [Workers Pages Functions SDK v0.1.0 publishes helpers for compiling Pages Functions to Workers](https://releases.sh/release/rel_I5OQfsWSjDj4-0U4Wv-Bl-pages-functions-directory-compiler-ships-as-cli-and-programmatic-api)

### Vercel

- [Vercel Passport GA protects deployments with your own identity provider](https://releases.sh/release/rel_9UY1g7L6uuNs5-Deg2uGa-vercel-passport-ga-enforces-private-deployments-via-okta-entra-id-or-oidc)
- [@vercel/passport v1.0.0 stable release](https://releases.sh/release/rel_TCZHudWZeXPMyfTQDK6Dn-vercel-passport-reaches-stable-1-0-0)
- [Vercel AI Gateway adds team and project spend budgets](https://releases.sh/release/rel_t90hGfBtRThtr6bUKsaOo-team-and-project-spend-budgets-with-email-alerts)
- [Vercel adds dedicated AI Gateway logs page with cost and token filters](https://releases.sh/release/rel_G_ZyEAVpj7ORFquud6u2o-ai-gateway-logs-get-dedicated-page-with-shareable-filters)
- [AI SDK 6.0.238 prevents DNS rebinding attacks on validated downloads](https://releases.sh/release/rel_EWORm9pTcARZqHuoYuQ_b-dns-rebinding-attacks-blocked-per-step-model-settings-supported)
- [Vercel CLI build-utils 13.36.2 fixes Edge Function corruption from 4-byte UTF-8 characters](https://releases.sh/release/rel_DP7KsOs1y3SRksqZ_MVuX-edge-functions-no-longer-corrupted-by-4-byte-utf-8-characters)
- [Vercel CLI 58.3.0 replaces vercel-workers with vercel-queue SDK for Python](https://releases.sh/release/rel_xVVgnPmBEdt1DUATnqmz4-python-queue-subscribers-migrate-from-vercel-workers-to-vercel-queue-sdk)
- [Vercel Chat SDK adds reactions and ephemeral messages for Teams](https://releases.sh/release/rel_DTwazVUZbHWIg-0eaYARz-teams-reactions-ephemeral-messages-and-author-emails-land)
- [Vercel MCP updates to 2026-07-28 spec with stateless protocol core](https://releases.sh/release/rel_mMmD39374WGXe-ypZvTM1-mcp-spec-2026-07-28-stateless-core-hardened-auth)