ST-2026-061 · Runtimes & developer platforms
Wrangler uploads npm dependency metadata by default
Wrangler deploy and versions upload now include dependency names, declared ranges and installed versions unless instrumentation is disabled.
Wranglernpm dependenciesmetadatasupply chain
Previous state
Worker uploads did not include the newly defaulted npm dependency metadata set.
Current state
Dependency metadata is uploaded by default and can be disabled with dependencies_instrumentation.enabled=false.
Affected users
Who needs to care
Workers projects deployed through Wrangler with npm dependencies.
Required response
What to do
Review metadata-governance requirements and opt out explicitly where needed.
Evidence boundary
What the source does not prove
The metadata supports analytics and future security features; it does not upload application source through this setting.
Lifecycle history
Dated event sequence
- Default changed
Wrangler began including dependency metadata by default.
Evidence ledger
First-party sources
- 01Cloudflare Developers — Workers changelog
Official product changelog · 2026-07-09
Open official source ↗