Wrangler now sends your npm dependency metadata with every deploy!

Hi, I'm Shii-chan! Today I found a quiet but interesting update to Wrangler in the Cloudflare Workers world, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Wrangler now collects npm package dependency information from your project's package.json whenever you run wrangler deploy or wrangler versions upload, and includes it in the upload metadata sent to the Cloudflare API. The collected data covers three things for each dependency: its name, the declared version range, and the exact installed version.

The story so far

Until now, what Wrangler sent during a deploy was mostly your Worker's code and build artifacts, not information about which npm packages your project depends on or at what versions. That meant Cloudflare had no visibility into a Worker's dependency footprint, so it couldn't offer dependency-related analytics or security features built on that data.

What changes

This dependency metadata will be used for deployment analytics on Cloudflare's side (which packages are used, and how widely), and it's also meant to lay the groundwork for future supply chain security features such as vulnerability alerting. So nothing new pops up in your dashboard right away, but the foundation is now in place for Cloudflare to eventually warn you when a package your Worker depends on has a known vulnerability.

Dive Deep

This is enabled by default, so dependency metadata will be collected automatically starting from your next wrangler deploy without any extra steps. If you'd rather not send this data, you can opt out by setting dependencies_instrumentation.enabled to false in your Wrangler configuration file.

For wrangler.jsonc:

{
  "dependencies_instrumentation": {
    "enabled": false
  }
}

For wrangler.toml:

[dependencies_instrumentation]
enabled = false

For more details, Cloudflare points to the Wrangler configuration documentation.

Wrap-up

• Wrangler now automatically collects dependency info (name, version range, installed version) from package.json during wrangler deploy / wrangler versions upload
• The goal is dependency analytics and future supply chain security features like vulnerability alerting
• You can opt out by setting dependencies_instrumentation.enabled to false

This one's especially relevant if you run Workers in production or care about keeping tabs on your dependency management.