miniflare

1. 4.20260730.0

   30 Jul 2026

   • Add JSON output to /cdn-cgi/handler/email

     The /cdn-cgi/handler/email endpoint now accepts ?format=json to return the email handler result as JSON, including its outcome, rejection reason, forwarded messages, and replies. Requests without format=json still return the existing text outcome for backward compatibility.

   • Fix the local Images binding transform (env.IMAGES.input(...).transform(...)) ignoring the fit, gravity, and background options. Previously, local dev always letterboxed transformed images with black bars regardless of the options passed in. Local dev now respects fit, gravity, and background, matching production Images binding behavior.

   • Disable the keep-alive timeout on the loopback server

     The loopback server (which serves custom service bindings, @cloudflare/vite-plugin's module transport, and other workerd → Node callbacks) used Node's default server.keepAliveTimeout of 5 seconds. workerd pools and reuses connections to the loopback server, so Node closing an idle pooled socket raced with workerd sending the next request on it, making that request fail with Network connection lost. The failure is probabilistic and load-dependent; under @cloudflare/vite-plugin with a large SSR module graph and a cold optimizer cache (thousands of fetchModule calls with multi-second idle gaps between bursts), it broke most dev sessions. Disable the idle keep-alive timeout on the loopback server, mirroring the undici pools used for dispatch in the opposite direction.

   Read the full note · 1 more change, 1 internal

2. 4.20260722.1

   28 Jul 2026

   • Support passing V8 flags to workerd via the MINIFLARE_WORKERD_V8_FLAGS environment variable

     The generated workerd config already supports v8Flags, but Miniflare never populated it, so the runtime always ran with V8's default heap limit (~1.4 GB). Large dev applications (e.g. big SSR module graphs under @cloudflare/vite-plugin, where each server-file edit grows the runner isolate's heap) can reach that limit, at which point workerd aborts with V8 fatal error; location = Reached heap limit and every subsequent dispatchFetch() fails with fetch failed until the dev server is manually restarted.

     Setting e.g. MINIFLARE_WORKERD_V8_FLAGS="--max-old-space-size=4096" raises the limit and keeps long dev sessions alive. The variable follows the same space-separated format as MINIFLARE_WORKERD_AUTOGATES.

   • Add a local S3-compatible API for R2 buckets at /cdn-cgi/local/r2/s3/<bucket-id>, where <bucket-id> is the ID the bucket is configured with in the r2Buckets option

     Buckets configured with s3Credentials: { accessKeyId, secretAccessKey } in r2Buckets are served over an S3-compatible HTTP API, authenticated with AWS Signature Version 4 (both Authorization header and presigned URL query authentication). Supported operations: GetObject, HeadObject, PutObject, CopyObject, DeleteObject, DeleteObjects, ListObjects, ListObjectsV2, HeadBucket, ListBuckets, CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, and AbortMultipartUpload. Status codes, error responses, and unsupported-header screening mirror R2's S3 endpoint, including its static responses for bucket-configuration reads and its named errors for unimplemented operations.

   • Support connect() on remote VPC Network and VPC Service bindings in local development

     Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

     This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

   Read the full note · 2 more changes

3. 4.20260722.0

   23 Jul 2026

   • Add local-dev observability

     wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

     You can explore this data two ways:

     While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

   • Fix incorrect byte limit reported in the local Queues batch-size error

     When a queue batch exceeded the maximum batch byte size in local dev, the thrown PayloadTooLargeError hardcoded the limit as 256000, even though the value actually enforced is 288000 bytes ((256 + 32) * 1000). The message now interpolates the real limit, consistent with the other Queue limit errors in the same file.

   • Update sharp to 0.35.2

     sharp 0.35 removes its install lifecycle script, so package managers that block dependency build scripts by default (such as pnpm 11+) no longer require an explicit build approval for it when installing miniflare/wrangler. The local Images binding keeps using the same prebuilt sharp binaries, so image transforms in local dev are unaffected.

     This release also reworked sharp's FormatEnum types: libvips reports AVIF inputs under the heif container. The local Images binding /info endpoint and the cf.image transform path now correctly report AVIF as image/avif instead of treating it as an unsupported/unknown type.

   Read the full note · 1 more change, 1 internal

4. 4.20260721.0

   21 Jul 2026

5. 4.20260714.0

   17 Jul 2026

Notes older than 90 days are read on the Releases tab.