Bump miniflare from 4.20260317.2 to 4.20260317.3

[dependabot]

Bumps miniflare from 4.20260317.2 to 4.20260317.3.

Release notes

Sourced from miniflare's releases.

miniflare@4.20260317.3

Minor Changes

• #13027 9fcdfca Thanks @​G4brym! - feat: Add ai_search_namespaces and ai_search binding types

  Two new binding types for AI Search:

  • ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
  • ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace

  Both are remote-only in local dev.

• #13030 0386553 Thanks @​natewong1313! - Add local mode support for Stream bindings

  Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

  Supported operations:

  • upload() — upload video via URL
  • video(id).details(), .update(), .delete(), .generateToken()
  • videos.list()
  • captions.generate(), .list(), .delete()
  • downloads.generate(), .get(), .delete()
  • watermarks.generate(), .list(), .get(), .delete()

  The following are not yet supported in local mode and will throw:

  • createDirectUpload()
  • Caption upload via File
  • Watermark generation via File

  Data is persisted across restarts by default. You must set streamPersist: false in Miniflare options to disable persistence.

Patch Changes

• #12686 1faff35 Thanks @​edmundhung! - Move internal proxy endpoint to reserved /cdn-cgi/ path

  The internal HTTP endpoint used by getPlatformProxy has been moved to a reserved path. This is an internal change with no impact on the getPlatformProxy API.

• #13080 f4ea4ac Thanks @​penalosa! - fix: glob patterns for module rules no longer match double-extension filenames like foo.wasm.js

  Previously, the globsToRegExps helper compiled glob patterns without a trailing $ anchor. This caused patterns like **/*.wasm to match any path containing .wasm as a substring — including filenames such as foo.wasm.js or main.wasm.test.ts.

  When using @cloudflare/vitest-pool-workers with a wrangler.configPath, Wrangler's default CompiledWasm module rule (**/*.wasm) was silently applied to test files whose names contained .wasm, causing them to be loaded as WebAssembly binaries instead of JavaScript and failing at runtime.

  The fix restores the $ end anchor in the compiled regex so that **/*.wasm only matches paths that literally end in .wasm, while the leading ^ remains absent to allow matching anywhere within an absolute path.

Changelog

Sourced from miniflare's changelog.

4.20260317.3

Minor Changes

• #13027 9fcdfca Thanks @​G4brym! - feat: Add ai_search_namespaces and ai_search binding types

  Two new binding types for AI Search:

  • ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
  • ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace

  Both are remote-only in local dev.

• #13030 0386553 Thanks @​natewong1313! - Add local mode support for Stream bindings

  Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

  Supported operations:

  • upload() — upload video via URL
  • video(id).details(), .update(), .delete(), .generateToken()
  • videos.list()
  • captions.generate(), .list(), .delete()
  • downloads.generate(), .get(), .delete()
  • watermarks.generate(), .list(), .get(), .delete()

  The following are not yet supported in local mode and will throw:

  • createDirectUpload()
  • Caption upload via File
  • Watermark generation via File

  Data is persisted across restarts by default. You must set streamPersist: false in Miniflare options to disable persistence.

Patch Changes

• #12686 1faff35 Thanks @​edmundhung! - Move internal proxy endpoint to reserved /cdn-cgi/ path

  The internal HTTP endpoint used by getPlatformProxy has been moved to a reserved path. This is an internal change with no impact on the getPlatformProxy API.

• #13080 f4ea4ac Thanks @​penalosa! - fix: glob patterns for module rules no longer match double-extension filenames like foo.wasm.js

  Previously, the globsToRegExps helper compiled glob patterns without a trailing $ anchor. This caused patterns like **/*.wasm to match any path containing .wasm as a substring — including filenames such as foo.wasm.js or main.wasm.test.ts.

  When using @cloudflare/vitest-pool-workers with a wrangler.configPath, Wrangler's default CompiledWasm module rule (**/*.wasm) was silently applied to test files whose names contained .wasm, causing them to be loaded as WebAssembly binaries instead of JavaScript and failing at runtime.

  The fix restores the $ end anchor in the compiled regex so that **/*.wasm only matches paths that literally end in .wasm, while the leading ^ remains absent to allow matching anywhere within an absolute path.

Commits

• 81b2b9b Version Packages (#13038)
• baec845 [vitest-pool-workers] Add adminSecretsStore() to cloudflare:test (#13073)
• f4ea4ac [miniflare] Fix glob patterns matching double-extension filenames (#13080)
• 1faff35 refactor(miniflare): centralize internal paths and move platform proxy endpoi...
• 9fcdfca feat: add ai_search_namespaces and ai_search binding types (#13027)
• 0386553 [Stream] Add Stream binding local mode (#13030)
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	miniflare@​4.20260317.3

View full report