miniflare@4.20260124.0 — Workers SDK

Minor Changes

#12008 e414f05 Thanks @penalosa! - Add support for customising the inspector IP address

Adds a new --inspector-ip CLI flag and dev.inspector_ip configuration option to allow customising the IP address that the inspector server listens on. Previously, the inspector was hardcoded to listen only on 127.0.0.1.

Example usage:
```
# CLI flag
wrangler dev --inspector-ip 0.0.0.0
```
```
// wrangler.json
{
	"dev": {
		"inspector_ip": "0.0.0.0",
	},
}
```
#12034 05714f8 Thanks @emily-shen! - Add a no-op local explorer worker, which is gated by the experimental flag X_LOCAL_EXPLORER.

Patch Changes

#11853 014e7aa Thanks @43081j! - Use built-in stripVTControlCharacters utility rather than the strip-ansi package.
#12040 77e82d2 Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To
workerd 1.20260120.0 1.20260122.0
#12061 f08ef21 Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To
workerd 1.20260122.0 1.20260123.0
#12088 0641e6c Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To
workerd 1.20260123.0 1.20260124.0
#11897 bbd8a5e Thanks @dario-piotrowicz! - Bundle the zod dependency to reduce supply chain attack surface

In order to prevent possible npm vulnerability attacks, the team's policy is to bundle dependencies in our packages where possible. This helps ensure that only trusted code runs on the user's system, even if compromised packages are later published to npm.

This change bundles zod (a pure JavaScript validation library with no native dependencies) into miniflare and @cloudflare/vitest-pool-workers.

Other dependencies remain external for technical reasons:
- sharp: Native binary with platform-specific builds
- undici: Dynamically required at runtime in worker threads
- ws: Has optional native bindings for performance
- workerd: Native binary (Cloudflare's JavaScript runtime)
- @cspotcode/source-map-support: Uses require.cache manipulation at runtime
- youch: Dynamically required for lazy loading