[pull] main from cloudflare:main

.changeset/getplatformproxy-cross-script-workflows.md

@@ -0,0 +1,11 @@
+---
+"wrangler": minor
+---
+
+`getPlatformProxy()` now passes through workflow bindings that have a `script_name`
+
+Workflows without a `script_name` are still stripped (and warned about) because the engine for an internal workflow can't run inside the empty proxy worker that backs `getPlatformProxy()`. Workflows with a `script_name` are handed to miniflare unchanged; miniflare reroutes the engine's `USER_WORKFLOW` binding through the dev-registry-proxy when the target worker is running in another Miniflare instance — the same mechanism Durable Objects already use.
+
+This means SvelteKit/Remix (and similar split-process setups) can call `platform.env.MY_WORKFLOW.create({ ... })` directly from their server-side request handlers in dev, as long as the workflow class is exposed by another worker registered in the dev registry.
+
+Closes [#7459](https://github.com/cloudflare/workers-sdk/issues/7459).

.changeset/rename-web-search-binding-to-websearch.md

@@ -0,0 +1,18 @@
+---
+"@cloudflare/workers-utils": minor
+"miniflare": minor
+"wrangler": minor
+---
+
+Rename the `web_search` binding kind to `websearch`
+
+Pre-launch rename of the public binding type from `web_search` to `websearch` so the on-the-wire shape matches the product name (Web Search). The wrangler config key, the binding-type string sent to the Cloudflare API, and the miniflare option key all move from `web_search` / `webSearch` to `websearch`.
+
+Update your wrangler config:
+
+```diff
+- "web_search": { "binding": "WEBSEARCH" }
++ "websearch": { "binding": "WEBSEARCH" }
+```
+
+The runtime `WebSearch` type exposed on `env.WEBSEARCH` is unchanged.

.changeset/workflow-cross-worker-bindings.md

@@ -0,0 +1,13 @@
+---
+"miniflare": minor
+---
+
+Support cross-worker workflow bindings via the dev registry
+
+When a workflow binding has a `scriptName` that refers to a worker registered in another Miniflare instance (via `unsafeDevRegistryPath`), miniflare now reroutes the engine's `USER_WORKFLOW` binding through the dev-registry-proxy worker — the same mechanism Durable Objects already use for cross-worker `scriptName` bindings.
+
+Previously the workflow engine was bound directly to a local service `core:user:<scriptName>`, so workerd refused to start when that script lived in a different process.
+
+This unblocks `getPlatformProxy()` (and any other split-Miniflare setup) for users whose workflow class is defined in a separate worker — for example SvelteKit/Remix on Cloudflare, where `adapter-cloudflare`'s dev integration runs the user's worker in a sidecar.
+
+See [#7459](https://github.com/cloudflare/workers-sdk/issues/7459).

fixtures/get-platform-proxy/tests/get-platform-proxy.env.test.ts

@@ -293,16 +293,22 @@ describe("getPlatformProxy - env", () => {
 			expect(warn).not.toHaveBeenCalled();
 		});
 
-		it("warns about Workflows and doesn't crash", async ({ expect }) => {
+		it("warns only about internal Workflows, not cross-script ones, and doesn't crash", async ({
+			expect,
+		}) => {
 			await getPlatformProxy<Env>({
 				configPath: path.join(__dirname, "..", "wrangler_workflow.jsonc"),
 			});
+			// Only MY_WORKFLOW_INTERNAL (no script_name) is unsupported in
+			// getPlatformProxy(); MY_WORKFLOW_EXTERNAL (script_name set) is
+			// passed through to miniflare, which routes it via the dev-registry
+			// proxy to the named worker.
+			expect(warn).toHaveBeenCalledTimes(1);
 			expect(warn.mock.calls[0][0].replaceAll(/[\r\n]+/g, "\n"))
 				.toMatchInlineSnapshot(`
-					"▲ [WARNING] 				You have defined bindings to the following Workflows:
-					  				- {"binding":"MY_WORKFLOW_INTERNAL","name":"my-workflow-internal","class_name":"MyWorkflowInternal"}
-					  - {"binding":"MY_WORKFLOW_EXTERNAL","name":"my-workflow-external","class_name":"MyWorkflowExternal","script_name":"OtherWorker"}
-					  				These are not available in local development, so you will not be able to bind to them when testing locally, but they should work in production.
+					"▲ [WARNING] You have defined bindings to the following Workflows without a script_name:
+					  - {"binding":"MY_WORKFLOW_INTERNAL","name":"my-workflow-internal","class_name":"MyWorkflowInternal"}
+					  These are not available in local development, so you will not be able to bind to them when testing locally, but they should work in production.
 					"
 				`);
 		});

packages/cli/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @cloudflare/cli
 
+## 0.1.6
+
+### Patch Changes
+
+- [#14112](https://github.com/cloudflare/workers-sdk/pull/14112) [`3a746ac`](https://github.com/cloudflare/workers-sdk/commit/3a746ac56a40b805e38f26ef5328e44917b543e6) Thanks [@penalosa](https://github.com/penalosa)! - Pin non-bundled runtime dependencies to exact versions
+
+  Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new `pnpm check:pinned-deps` lint enforces this for all published packages (and for the shared pnpm catalog) going forward.
+
+- Updated dependencies [[`e86489a`](https://github.com/cloudflare/workers-sdk/commit/e86489a5743ff9bad7bcb5b444ad3d952d5b0164), [`337e912`](https://github.com/cloudflare/workers-sdk/commit/337e9124cfa461a99ce7ffb800dcc341f7b2f026), [`65b5f9e`](https://github.com/cloudflare/workers-sdk/commit/65b5f9e1855651c2df2c1bdfc8930141e36413d5)]:
+  - @cloudflare/workers-utils@0.22.1
+
 ## 0.1.5
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cloudflare/cli-shared-helpers",
-	"version": "0.1.5",
+	"version": "0.1.6",
 	"description": "Internal shared CLI helpers for workers-sdk. Not intended for external use — APIs may change without notice.",
 	"keywords": [
 		"cli",

packages/create-cloudflare/CHANGELOG.md

@@ -1,5 +1,39 @@
 # create-cloudflare
 
+## 2.70.0
+
+### Minor Changes
+
+- [#14095](https://github.com/cloudflare/workers-sdk/pull/14095) [`8b4e917`](https://github.com/cloudflare/workers-sdk/commit/8b4e9174a496ede02b97ed81779d1e3f450b7d53) Thanks [@dario-piotrowicz](https://github.com/dario-piotrowicz)! - Hide non-framework categories when `--platform=pages` is specified
+
+  When running C3 with `--platform=pages`, the "Hello World example" and "Application Starter" categories are now hidden since they only produce Workers projects. The framework list is also filtered to only show frameworks that support the Pages platform. This makes it clear that C3 can only create Pages projects when using a framework.
+
+### Patch Changes
+
+- [#14128](https://github.com/cloudflare/workers-sdk/pull/14128) [`7868998`](https://github.com/cloudflare/workers-sdk/commit/7868998b047e77b71ff58dabd448434e3612a70b) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency      | From    | To      |
+  | --------------- | ------- | ------- |
+  | @angular/create | 21.2.12 | 21.2.13 |
+
+- [#14129](https://github.com/cloudflare/workers-sdk/pull/14129) [`fe97ff8`](https://github.com/cloudflare/workers-sdk/commit/fe97ff8e8e5c74a03cf040c4fefb425f0cc59467) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency          | From   | To     |
+  | ------------------- | ------ | ------ |
+  | create-react-router | 7.15.1 | 7.16.0 |
+
+- [#14113](https://github.com/cloudflare/workers-sdk/pull/14113) [`063d98e`](https://github.com/cloudflare/workers-sdk/commit/063d98e96e39a4e08cad6d6bccf4f382bc654967) Thanks [@petebacondarwin](https://github.com/petebacondarwin)! - Switch the `react-router` template to scaffold from the upstream `create-react-router` default template and overlay Cloudflare-specific files locally
+
+  Previously, C3 invoked `create-react-router` with `--template <pinned GitHub URL>` pointing at a specific commit of `remix-run/react-router-templates/cloudflare`. This pinning was needed because the upstream Cloudflare template had been deleted before, leaving us reliant on a third-party source we don't control.
+
+  We now invoke `create-react-router` without `--template` (using the upstream default template) and overlay all Cloudflare-specific files — `workers/app.ts`, `wrangler.jsonc`, split `tsconfig`s, a Cloudflare-flavored `vite.config.ts`, `entry.server.tsx`, etc. — from `templates/react-router/ts/`. A `configure` step deletes `Dockerfile`/`.dockerignore` and the `@react-router/node`/`@react-router/serve` dependencies and `start` script that ship with the default template.
+
+  This brings the `react-router` template in line with how `astro`, `svelte`, and `react` already work and removes our dependency on a deleted upstream template. The scaffolded project is functionally equivalent to before.
+
 ## 2.69.0
 
 ### Minor Changes

packages/create-cloudflare/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "create-cloudflare",
-	"version": "2.69.0",
+	"version": "2.70.0",
 	"description": "A CLI for creating and deploying new applications to Cloudflare.",
 	"keywords": [
 		"cloudflare",