chore(deps): bump the cloudflare group across 1 directory with 2 updates

[dependabot]

Bumps the cloudflare group with 2 updates in the / directory: @opennextjs/cloudflare and wrangler.

Updates @opennextjs/cloudflare from 1.15.1 to 1.20.2

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.2

Patch Changes

• #1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

  Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

• #1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

• #1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

  Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

@​opennextjs/cloudflare@​1.20.1

Patch Changes

• #1297 780a21c Thanks @​james-elicx! - fix: disable response compression for skew protection API requests

  Avoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.

@​opennextjs/cloudflare@​1.20.0

Minor Changes

• #1290 46c50fc Thanks @​james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

  Key Changes:

  1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.

     • R2_ACCESS_KEY_ID
     • R2_SECRET_ACCESS_KEY
     • CF_ACCOUNT_ID

  2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.

  3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.

  Usage:

  Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:

  pnpm add rclone.js
  pnpm approve-builds # select rclone.js
  pnpm rebuild rclone.js
  R2_ACCESS_KEY_ID=your_key
  R2_SECRET_ACCESS_KEY=your_secret
  CF_ACCOUNT_ID=your_account
  opennextjs-cloudflare deploy --rclone

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.2

Patch Changes

• #1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

  Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

• #1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

• #1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

  Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

1.20.1

Patch Changes

• #1297 780a21c Thanks @​james-elicx! - fix: disable response compression for skew protection API requests

  Avoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.

1.20.0

Minor Changes

• #1290 46c50fc Thanks @​james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

  Key Changes:

  1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.

     • R2_ACCESS_KEY_ID
     • R2_SECRET_ACCESS_KEY
     • CF_ACCOUNT_ID

  2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.

  3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.

  Usage:

  Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:

  pnpm add rclone.js
  pnpm approve-builds # select rclone.js
  pnpm rebuild rclone.js
  R2_ACCESS_KEY_ID=your_key
  R2_SECRET_ACCESS_KEY=your_secret
  CF_ACCOUNT_ID=your_account

... (truncated)

Commits

• da4b7fc Version Packages (#1307)
• 38ea40b fix: upgrade OpenNext AWS encoded path handling (#1312)
• 766eee9 chore: bump Next.js to 15.5.21 and 16.2.11 (#1313)
• 97ef330 fix: normalize Windows paths in Turbopack runtime patch (#1306)
• 1a70b33 Version Packages (#1298)
• 780a21c fix: disable compression for worker version requests (#1297)
• 127942d Version Packages (#1292)
• 46c50fc feat: add opt-in rclone cache population (#1290)
• eef243f fix(cache-purge): spread SQLite bindings in BucketCachePurge alarm so tag pur...
• 51439b1 fix: disable compression for R2 provisioning (#1291)
• Additional commits viewable in compare view

Updates wrangler from 4.98.0 to 4.120.0

Release notes

Sourced from wrangler's releases.

wrangler@4.120.0

Minor Changes

• #15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name

  wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

• #15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output

  Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

• #15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

• #15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

  Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

  Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

  The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

• Updated dependencies [b4f0c97, 8cf78c8, a60ff4d, 99eb50c]:

  • miniflare@5.20260801.1-alpha

wrangler@4.119.0

Minor Changes

• #14952 20470fa Thanks @​nelsonjsduarte! - Add --parse-type flag to wrangler ai-search create

  wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.

  Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.

  wrangler ai-search create my-instance \
    --type web-crawler \
    --source https://example.com \
    --parse-type discover

  The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.

• #14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #14064 a9e5abb Thanks @​petebacondarwin! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login

... (truncated)

Commits

• b0aea76 Version Packages (#15036)
• 386ff6e [miniflare] Register workers in the dev registry by default (#15061)
• 35c87e9 CC-8338, CC-8340: Improve Wrangler container instance listings (#15008)
• 99eb50c [miniflare] Restrict dev registry registration to user workers (#15040)
• 2938c01 Version Packages (#15021)
• b6a8629 Revert "Version Packages (#14977)" (#15033)
• 42c4227 Version Packages (#14977)
• 511635c [wrangler] Skip the CAA half of the unenv-preset testDns E2E (#15016)
• ebd1dfd [vite-plugin] Surface Local Explorer API to headless agents, matching wrangle...
• a9e5abb [wrangler] Add OAuth 2.0 Device Authorization Grant support (#14064)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[royalpinto007]

Closing, and splitting it. wrangler is now on ^4.122.0 on main (dd7aa75), verified against tsc, prettier, vitest and next build.

The adapter half cannot land, and it is worth recording why so this does not get retried every week.

@opennextjs/cloudflare@1.20.2 declares a peer of next >=15.5.21 <16 || >=16.2.11. This project is on next ^14.2.35, so npm ci fails outright, which is exactly the Install dependencies failure on this PR.

Checking the whole range rather than guessing:

adapter	peer next
1.15.1 (pinned here)	^14.2.35 || ~15.0.7 … ^16.0.10
1.16.0 to 1.18.0	~15.0.8 and up, no 14
1.19.0	>=15.5.15 || >=16.2.3
1.20.2	>=15.5.21 <16 || >=16.2.11

1.15.1 is the last release that accepts Next 14 at all, so we are already at the ceiling. Moving the adapter means migrating Next 14 to 15, which is a framework upgrade and its own piece of work, not a dependency bump.

Worth adding an ignore for @opennextjs/cloudflare in the dependabot config until that migration happens, otherwise this PR comes back every week and fails the same way.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml