cloudflare/workers-sdk miniflare@5.20260910.0-alpha

miniflare@5.20260910.0-alpha

Repository: cloudflare/workers-sdk

Tag: miniflare@5.20260910.0-alpha

Published: 2026-09-10T15:21:09Z

Prerelease: yes

Release notes:

Minor Changes

• #15578 `15cd6e1` Thanks @ThomasRubini! - Add Miniflare#dispatchConnect() for testing Worker TCP handlers

Tests can now open a Node.js socket to a Worker's configured TCP trigger without reserving and connecting to a fixed port manually. Miniflare waits for startup, resolves OS-assigned ports, supports selecting Workers and triggers, and closes dispatched sockets during disposal.

Patch Changes

• #15432 `f45b596` Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindings

Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 `f69f95a` Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

| Dependency | From | To | | ------------------------- | ------------- | ------------- | | @cloudflare/workers-types | ^5.20260908.1 | ^5.20260910.1 | | workerd | 1.20260908.1 | 1.20260910.1 |

• #14814 `a549e58` Thanks @chinesepowered! - Match Content-Type case-insensitively when simulating Cloudflare's response compression

Locally, responses were only compressed when the Content-Type matched the compressible media type list exactly. Because HTTP media types are case-insensitive and may carry whitespace before their parameters, headers such as Application/JSON or text/html ; charset=utf-8 were treated as non-compressible, diverging from production behaviour. The media type is now trimmed and lowercased before matching.

• #15540 `dbb3ff4` Thanks @NAVEENKUMARKR777! - Fix DevalueError: Cannot stringify arbitrary non-POJOs when passing a Headers instance to a proxied binding method

R2Object#writeHttpMetadata(), R2Bucket#put()'s onlyIf option, and other proxied APIs that accept a Headers argument previously only worked if that Headers instance came from the exact same Headers implementation Miniflare uses internally (undici). In practice, user code almost always constructs Headers using the platform global instead (for example inside Next.js, Astro, Remix, or SvelteKit dev servers), which is backed by a different copy of undici and isn't instanceof the one Miniflare imports. This mismatch caused serialisation to fail with a confusing DevalueError, even though the exact same code worked fine when deployed.

Headers, Request, and Response values are now also recognised by their Symbol.toStringTag, which is realm-independent, so any spec-compliant instance is accepted regardless of which copy of the class created it.

• #15485 `fea3cd0` Thanks @RealBhupesh! - Reject loopback server bind failures during Miniflare startup instead of leaving ready and dispose() hanging

#startLoopbackServer now attaches an error listener before listen, matching the inspector proxy. When the configured host cannot be bound (e.g. 192.0.2.1), ready rejects and dispose() still settles even if the loopback server never started.

• #15580 `6bd7b6c` Thanks @petebacondarwin! - Update sharp to 0.35.4

This updates the image-processing dependency used by Miniflare's local Images binding to a version that addresses GHSA-rgj7-g3m4-5g8c, covering vulnerabilities in its bundled libheif library.

• #15515 `be1caec` Thanks @Wichtowski! - Handle Miniflare listener startup failures consistently

Loopback and inspector servers now remove startup-only error handlers after binding and close the server after bind failures. Inspector bind failures are observed immediately and propagated through readiness, URL access, and disposal.

• #15403 `dbc9506` Thanks @james-elicx! - Reduce the size of Miniflare's embedded asset and router Workers

Miniflare does not configure Sentry credentials for its asset services, so their builds now replace the unused production Sentry setup with a no-op instead of bundling Toucan.