[pull] main from cloudflare:main

.changeset/add-reauth-hint-to-account-errors.md

@@ -0,0 +1,7 @@
+---
+"wrangler": patch
+---
+
+Add re-authentication hint to account fetch error messages
+
+When Wrangler fails to automatically retrieve account IDs, the error messages now suggest running `wrangler login` as a troubleshooting step. This addresses confusion for users who encounter these errors after OAuth system changes or other authentication issues.

.changeset/bump-am-i-vibing.md

@@ -0,0 +1,7 @@
+---
+"wrangler": patch
+---
+
+Bump `am-i-vibing` from 0.1.1 to 0.4.0
+
+This updates the agentic environment detection library to the latest version, which includes improved detection coverage for newer AI coding agents.

.changeset/c3-frameworks-update-14128.md

@@ -0,0 +1,11 @@
+---
+"create-cloudflare": patch
+---
+
+Update dependencies of "create-cloudflare"
+
+The following dependency versions have been updated:
+
+| Dependency      | From    | To      |
+| --------------- | ------- | ------- |
+| @angular/create | 21.2.12 | 21.2.13 |

.changeset/c3-frameworks-update-14129.md

@@ -0,0 +1,11 @@
+---
+"create-cloudflare": patch
+---
+
+Update dependencies of "create-cloudflare"
+
+The following dependency versions have been updated:
+
+| Dependency          | From   | To     |
+| ------------------- | ------ | ------ |
+| create-react-router | 7.15.1 | 7.16.0 |

.changeset/cf-vite-delegate-binary.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/vite-plugin": patch
+---
+
+Add an experimental, internal `cf-vite` delegate binary
+
+This adds an experimental `bin/cf-vite` binary that is spawned by Cloudflare's own parent tooling to drive the plugin as a long-running dev-server subprocess. It is not part of the plugin's public API surface, is not intended to be invoked directly, and its contract may change at any time without notice.

.changeset/filter-categories-by-platform.md

@@ -0,0 +1,7 @@
+---
+"create-cloudflare": minor
+---
+
+Hide non-framework categories when `--platform=pages` is specified
+
+When running C3 with `--platform=pages`, the "Hello World example" and "Application Starter" categories are now hidden since they only produce Workers projects. The framework list is also filtered to only show frameworks that support the Pages platform. This makes it clear that C3 can only create Pages projects when using a framework.

.changeset/fix-assets-watcher-emfile-graceful.md

@@ -0,0 +1,13 @@
+---
+"wrangler": patch
+---
+
+Gracefully handle EMFILE error when assets directory exceeds OS watcher limit
+
+Previously, when `wrangler dev` was pointed at an assets directory with more than ~4,096 subdirectories, the chokidar file watcher threw an `EMFILE: too many open files` error that was not caught, causing an infinite error loop that made the dev server unresponsive.
+
+Now the error is caught and wrangler:
+
+1. Logs a clear warning explaining the platform watcher limit was hit
+2. Recommends reducing the number of subdirectories by flattening or restructuring the assets directory
+3. Disables the assets watcher gracefully so the dev server continues working without hot-reload

.changeset/fix-inspector-localhost.md

@@ -0,0 +1,9 @@
+---
+"miniflare": patch
+---
+
+Use `127.0.0.1` instead of `localhost` for the runtime inspector address
+
+On systems where `getaddrinfo("localhost")` returns `::1` but IPv6 is disabled at the kernel level, `workerd` fails to bind the inspector socket and silently continues without emitting the `listen-inspector` event to the control FD. This caused `wrangler dev` to hang indefinitely at "Starting local server..." with no error output.
+
+Using `127.0.0.1` explicitly is consistent with `DEFAULT_HOST`, `--debug-port`, and `resolveLocalhost()` already in the codebase.

.changeset/fix-json-binding-mapping.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/workers-utils": patch
+---
+
+Correctly map JSON bindings in `mapWorkerMetadataBindings`
+
+The `json` binding case used literal keys `name` and `json` instead of a computed property key `[binding.name]: binding.json`. This caused JSON bindings to always produce `{ name: "<binding_name>", json: <value> }` instead of `{ <binding_name>: <value> }`, clobbering any existing vars with those keys. This is now consistent with how `plain_text` bindings are mapped.

.changeset/fix-kv-metadata-invalid-json.md

@@ -0,0 +1,5 @@
+---
+"wrangler": patch
+---
+
+Show a clear error when `--metadata` is not valid JSON instead of silently ignoring the value

.changeset/fix-trailing-period-urls.md

@@ -0,0 +1,10 @@
+---
+"wrangler": patch
+"miniflare": patch
+"@cloudflare/vitest-pool-workers": patch
+"@cloudflare/workers-utils": patch
+---
+
+Remove trailing periods from URLs in terminal output
+
+URLs printed to the terminal with a sentence-ending period (e.g. `https://example.com/path.`) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.

.changeset/fix-wrangler-json-binding-init-from-dash.md

@@ -0,0 +1,12 @@
+---
+"wrangler": patch
+---
+
+Fix JSON variable bindings in `wrangler init --from-dash` and remote config diff
+
+When fetching a remote Worker's configuration, JSON variable bindings (e.g. `{"my_value": 5}`) were incorrectly serialized as `{ "name": "MY_JSON", "json": {"my_value": 5} }` instead of `{ "MY_JSON": {"my_value": 5} }`. This affected two areas:
+
+- `wrangler init --from-dash` would generate a `wrangler.json` with broken `vars` entries
+- Remote config diff checks would always report JSON bindings as changed, since the malformed remote representation could never match the local config
+
+Both issues are now fixed and remote JSON bindings are now correctly mapped.

.changeset/move-fetch-helpers-workers-utils.md

@@ -0,0 +1,9 @@
+---
+"@cloudflare/workers-utils": patch
+"@cloudflare/deploy-helpers": patch
+"wrangler": patch
+---
+
+Move fetch helpers into `@cloudflare/workers-utils`
+
+Shared Cloudflare API fetch helper types and plumbing now live in `@cloudflare/workers-utils` so Wrangler and other clients can use the same implementation.

.changeset/pin-non-bundled-dependencies.md

@@ -0,0 +1,11 @@
+---
+"wrangler": patch
+"miniflare": patch
+"@cloudflare/vitest-pool-workers": patch
+"@cloudflare/workers-editor-shared": patch
+"@cloudflare/cli-shared-helpers": patch
+---
+
+Pin non-bundled runtime dependencies to exact versions
+
+Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new `pnpm check:pinned-deps` lint enforces this for all published packages (and for the shared pnpm catalog) going forward.