Minor Changes

• #16760 cb9534f Thanks @petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

  cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

  Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.

• #16739 6af492e Thanks @GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

  Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

• #16810 cdc970b Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16810 cdc970b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @cloudflare/workers-types	^5.20261109.1	^5.20261110.1
  workerd	1.20261109.1	1.20261110.1

• #16709 022ee9d Thanks @petebacondarwin! - Keep local Container images available for upload retries

  Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.

• #16740 44b39b0 Thanks @GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

  Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.

• #16758 325dc69 Thanks @petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

  Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

  Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.

• Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:

  • miniflare@5.20261110.0-beta