code · pull · Mar 16, 2026 · Mar 16, 2026 · Mar 16, 2026 · Mar 16, 2026
diff --git a/.changeset/bump-undici.md b/.changeset/bump-undici.md
@@ -0,0 +1,6 @@
+---
+"wrangler": patch
+"miniflare": patch
+---
+
+Bump undici from 7.18.2 to 7.24.4
diff --git a/.changeset/c3-frameworks-update-12907.md b/.changeset/c3-frameworks-update-12907.md
@@ -0,0 +1,11 @@
+---
+"create-cloudflare": patch
+---
+
+Update dependencies of "create-cloudflare"
+
+The following dependency versions have been updated:
+
+| Dependency   | From   | To    |
+| ------------ | ------ | ----- |
+| create-astro | 4.13.2 | 5.0.0 |
diff --git a/.changeset/quick-items-shine.md b/.changeset/quick-items-shine.md
@@ -0,0 +1,7 @@
+---
+"wrangler": patch
+---
+
+Simplify description of --json option
+
+Remove extraneous adjectives in the description of the `--json` option.
diff --git a/.changeset/warm-mirrors-allow.md b/.changeset/warm-mirrors-allow.md
@@ -0,0 +1,7 @@
+---
+"wrangler": patch
+---
+
+Reject cross-drive module paths in Pages Functions routing
+
+On Windows, module paths using a different drive letter could be parsed in a way that bypassed the project-root check. These paths are now parsed correctly and rejected when they resolve outside the project.
diff --git a/packages/create-cloudflare/src/frameworks/package.json b/packages/create-cloudflare/src/frameworks/package.json
@@ -5,7 +5,7 @@
 		"so that we can use dependabot to update these dependencies automatically."
 	],
 	"dependencies": {
-		"create-astro": "4.13.2",
+		"create-astro": "5.0.0",
 		"create-analog": "2.3.1",
 		"@angular/create": "21.2.2",
 		"create-docusaurus": "3.9.2",

diff --git a/packages/vite-plugin-cloudflare/README.md b/packages/vite-plugin-cloudflare/README.md
@@ -23,13 +23,15 @@ Full documentation can be found [here](https://developers.cloudflare.com/workers
 - Uses the Vite [Environment API](https://vite.dev/guide/api-environment) to integrate Vite with the Workers runtime
 - Provides direct access to [Workers runtime APIs](https://developers.cloudflare.com/workers/runtime-apis/) and [bindings](https://developers.cloudflare.com/workers/runtime-apis/bindings/)
 - Builds your front-end assets for deployment to Cloudflare, enabling you to build static sites, SPAs, and full-stack applications
-- Official support for [React Router v7](https://reactrouter.com/) with server-side rendering
+- Official support for [TanStack Start](https://tanstack.com/start/) and [React Router v7](https://reactrouter.com/) with server-side rendering
 - Leverages Vite's hot module replacement for consistently fast updates
 - Supports `vite preview` for previewing your build output in the Workers runtime prior to deployment
 
 ## Use cases
 
-- React Router v7 (support for more full-stack frameworks is coming soon)
+- [TanStack Start](https://tanstack.com/start/)
+- [React Router v7](https://reactrouter.com/)
+- Support for more full-stack frameworks is coming soon
 - Static sites, such as single-page applications, with or without an integrated backend API
 - Standalone Workers
 - Multi-Worker applications
diff --git a/packages/wrangler/src/__tests__/containers/instances.test.ts b/packages/wrangler/src/__tests__/containers/instances.test.ts
@@ -119,7 +119,7 @@ describe("containers instances", () => {
 
 			OPTIONS
 			      --per-page  Number of instances per page  [number] [default: 25]
-			      --json      Return output as clean JSON  [boolean] [default: false]"
+			      --json      Return output as JSON  [boolean] [default: false]"
 		`);
 	});
 

diff --git a/packages/wrangler/src/__tests__/pages/routes-module.test.ts b/packages/wrangler/src/__tests__/pages/routes-module.test.ts
@@ -0,0 +1,53 @@
+import { UserError } from "@cloudflare/workers-utils";
+import { describe, it } from "vitest";
+import { writeRoutesModule } from "../../pages/functions/routes";
+import { toUrlPath } from "../../paths";
+import { runInTempDir } from "../helpers/run-in-tmp";
+
+describe("routes module", () => {
+	runInTempDir();
+
+	it("accepts module paths when srcDir is a relative path", async ({
+		expect,
+	}) => {
+		await expect(
+			writeRoutesModule({
+				config: {
+					routes: [
+						{
+							routePath: toUrlPath("/"),
+							mountPath: toUrlPath("/"),
+							module: "hello.js:onRequest",
+						},
+					],
+				},
+				srcDir: "functions",
+				outfile: "_routes.js",
+			})
+		).resolves.toBeDefined();
+	});
+
+	it.skipIf(process.platform !== "win32")(
+		"rejects module paths on a different drive",
+		async ({ expect }) => {
+			const modulePath = String.raw`D:\evil.js`;
+			const config = {
+				routes: [
+					{
+						routePath: toUrlPath("/"),
+						mountPath: toUrlPath("/"),
+						module: modulePath,
+					},
+				],
+			};
+
+			await expect(
+				writeRoutesModule({
+					config,
+					srcDir: String.raw`C:\project`,
+					outfile: "_routes.js",
+				})
+			).rejects.toThrow(new UserError(`Invalid module path "${modulePath}"`));
+		}
+	);
+});
diff --git a/packages/wrangler/src/__tests__/vectorize/vectorize.test.ts b/packages/wrangler/src/__tests__/vectorize/vectorize.test.ts
@@ -122,7 +122,7 @@ describe("vectorize help", () => {
 			  -v, --version   Show version number  [boolean]
 
 			OPTIONS
-			      --json           Return output as clean JSON  [boolean] [default: false]
+			      --json           Return output as JSON  [boolean] [default: false]
 			      --deprecated-v1  Fetch a deprecated V1 Vectorize index. This must be enabled if the index was created with V1 option.  [boolean] [default: false]"
 		`);
 	});
@@ -1048,7 +1048,7 @@ describe("vectorize commands", () => {
 			OPTIONS
 			      --count   Maximum number of vectors to return (1-1000)  [number]
 			      --cursor  Cursor for pagination to get the next page of results  [string]
-			      --json    Return output as clean JSON  [boolean] [default: false]
+			      --json    Return output as JSON  [boolean] [default: false]
 
 			EXAMPLES
 			  wrangler vectorize list-vectors my-index                  List vector identifiers in the index 'my-index'

diff --git a/packages/wrangler/src/ai/listCatalog.ts b/packages/wrangler/src/ai/listCatalog.ts
@@ -15,7 +15,7 @@ export const aiModelsCommand = createCommand({
 	args: {
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/ai/listFinetune.ts b/packages/wrangler/src/ai/listFinetune.ts
@@ -16,7 +16,7 @@ export const aiFineTuneListCommand = createCommand({
 	args: {
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/containers/instances.ts b/packages/wrangler/src/containers/instances.ts
@@ -218,7 +218,7 @@ const instancesArgs = {
 		default: 25,
 	},
 	json: {
-		describe: "Return output as clean JSON",
+		describe: "Return output as JSON",
 		type: "boolean",
 		default: false,
 	},

diff --git a/packages/wrangler/src/d1/execute.ts b/packages/wrangler/src/d1/execute.ts
@@ -91,7 +91,7 @@ export const d1ExecuteCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 		preview: {

diff --git a/packages/wrangler/src/d1/info.ts b/packages/wrangler/src/d1/info.ts
@@ -28,7 +28,7 @@ export const d1InfoCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/d1/insights.ts b/packages/wrangler/src/d1/insights.ts
@@ -107,7 +107,7 @@ export const d1InsightsCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "return output as clean JSON",
+			description: "return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/d1/list.ts b/packages/wrangler/src/d1/list.ts
@@ -18,7 +18,7 @@ export const d1ListCommand = createCommand({
 	args: {
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/d1/timeTravel/info.ts b/packages/wrangler/src/d1/timeTravel/info.ts
@@ -33,7 +33,7 @@ export const d1TimeTravelInfoCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/d1/timeTravel/restore.ts b/packages/wrangler/src/d1/timeTravel/restore.ts
@@ -41,7 +41,7 @@ export const d1TimeTravelRestoreCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/pages/deployments.ts b/packages/wrangler/src/pages/deployments.ts
@@ -40,7 +40,7 @@ export const pagesDeploymentListCommand = createCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/pages/functions/routes.ts b/packages/wrangler/src/pages/functions/routes.ts
@@ -63,6 +63,7 @@ export async function writeRoutesModule({
 }
 
 function parseConfig(config: Config, baseDir: string) {
+	baseDir = path.resolve(baseDir);
 	const routes: RoutesCollection = [];
 	const importMap: ImportMap = new Map();
 	const identifierCount = new Map<string, number>(); // to keep track of identifier collisions
@@ -77,23 +78,32 @@ function parseConfig(config: Config, baseDir: string) {
 		}
 
 		return paths.map((modulePath) => {
-			const [filepath, name = "default"] = modulePath.split(":");
-			let { identifier } = importMap.get(modulePath) ?? {};
+			const resolvedPath = path.resolve(baseDir, modulePath);
+			const moduleRoot = path.parse(resolvedPath).root;
 
-			const resolvedPath = path.resolve(baseDir, filepath);
+			// Strip the drive letter (if any) to avoid confusing the drive colon with the export name separator
+			const strippedPath = resolvedPath.slice(moduleRoot.length - 1);
+			const [filepath, name = "default"] = strippedPath.split(":");
+
+			const fullFilepath = path.resolve(moduleRoot, filepath);
+			const relativePath = path.relative(baseDir, fullFilepath);
 
 			// ensure the filepath isn't attempting to resolve to anything outside of the project
-			if (path.relative(baseDir, resolvedPath).startsWith("..")) {
-				throw new UserError(`Invalid module path "${filepath}"`);
+			if (
+				moduleRoot !== path.parse(baseDir).root ||
+				relativePath.startsWith("..")
+			) {
+				throw new UserError(`Invalid module path "${fullFilepath}"`);
 			}
 
 			// ensure the module name (if provided) is a valid identifier to guard against injection attacks
 			if (name !== "default" && !isValidIdentifier(name)) {
 				throw new UserError(`Invalid module identifier "${name}"`);
 			}
 
+			let { identifier } = importMap.get(resolvedPath) ?? {};
 			if (!identifier) {
-				identifier = normalizeIdentifier(`__${filepath}_${name}`);
+				identifier = normalizeIdentifier(`__${relativePath}_${name}`);
 
 				let count = identifierCount.get(identifier) ?? 0;
 				identifierCount.set(identifier, ++count);
@@ -102,7 +112,11 @@ function parseConfig(config: Config, baseDir: string) {
 					identifier += `_${count}`;
 				}
 
-				importMap.set(modulePath, { filepath: resolvedPath, name, identifier });
+				importMap.set(resolvedPath, {
+					filepath: fullFilepath,
+					name,
+					identifier,
+				});
 			}
 
 			return identifier;

diff --git a/packages/wrangler/src/pages/projects.ts b/packages/wrangler/src/pages/projects.ts
@@ -29,7 +29,7 @@ export const pagesProjectListCommand = createCommand({
 	args: {
 		json: {
 			type: "boolean",
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 			default: false,
 		},
 	},

diff --git a/packages/wrangler/src/vectorize/create.ts b/packages/wrangler/src/vectorize/create.ts
@@ -55,7 +55,7 @@ export const vectorizeCreateCommand = createCommand({
 		json: {
 			type: "boolean",
 			default: false,
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 		},
 		"deprecated-v1": {
 			type: "boolean",

diff --git a/packages/wrangler/src/vectorize/get.ts b/packages/wrangler/src/vectorize/get.ts
@@ -21,7 +21,7 @@ export const vectorizeGetCommand = createCommand({
 		json: {
 			type: "boolean",
 			default: false,
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 		},
 		"deprecated-v1": {
 			type: "boolean",

diff --git a/packages/wrangler/src/vectorize/info.ts b/packages/wrangler/src/vectorize/info.ts
@@ -18,7 +18,7 @@ export const vectorizeInfoCommand = createCommand({
 			description: "The name of the Vectorize index.",
 		},
 		json: {
-			describe: "return output as clean JSON",
+			describe: "return output as JSON",
 			type: "boolean",
 			default: false,
 		},

diff --git a/packages/wrangler/src/vectorize/insert.ts b/packages/wrangler/src/vectorize/insert.ts
@@ -43,7 +43,7 @@ export const vectorizeInsertCommand = createCommand({
 			default: VECTORIZE_UPSERT_BATCH_SIZE,
 		},
 		json: {
-			describe: "return output as clean JSON",
+			describe: "return output as JSON",
 			type: "boolean",
 			default: false,
 		},

diff --git a/packages/wrangler/src/vectorize/list.ts b/packages/wrangler/src/vectorize/list.ts
@@ -16,7 +16,7 @@ export const vectorizeListCommand = createCommand({
 		json: {
 			type: "boolean",
 			default: false,
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 		},
 		"deprecated-v1": {
 			type: "boolean",

diff --git a/packages/wrangler/src/vectorize/listMetadataIndex.ts b/packages/wrangler/src/vectorize/listMetadataIndex.ts
@@ -19,7 +19,7 @@ export const vectorizeListMetadataIndexCommand = createCommand({
 			description: "The name of the Vectorize index.",
 		},
 		json: {
-			describe: "return output as clean JSON",
+			describe: "return output as JSON",
 			type: "boolean",
 			default: false,
 		},

diff --git a/packages/wrangler/src/vectorize/listVectors.ts b/packages/wrangler/src/vectorize/listVectors.ts
@@ -42,7 +42,7 @@ export const vectorizeListVectorsCommand = createCommand({
 		json: {
 			type: "boolean",
 			default: false,
-			description: "Return output as clean JSON",
+			description: "Return output as JSON",
 		},
 	},
 	positionalArgs: ["name"],

diff --git a/packages/wrangler/src/vectorize/upsert.ts b/packages/wrangler/src/vectorize/upsert.ts
@@ -40,7 +40,7 @@ export const vectorizeUpsertCommand = createCommand({
 			default: VECTORIZE_MAX_BATCH_SIZE,
 		},
 		json: {
-			describe: "return output as clean JSON",
+			describe: "return output as JSON",
 			type: "boolean",
 			default: false,
 		},

diff --git a/packages/wrangler/src/versions/deployments/list.ts b/packages/wrangler/src/versions/deployments/list.ts
@@ -25,7 +25,7 @@ export const deploymentsListCommand = createCommand({
 			requiresArg: true,
 		},
 		json: {
-			describe: "Display output as clean JSON",
+			describe: "Display output as JSON",
 			type: "boolean",
 			default: false,
 		},

diff --git a/packages/wrangler/src/versions/deployments/status.ts b/packages/wrangler/src/versions/deployments/status.ts
@@ -25,7 +25,7 @@ export const deploymentsStatusCommand = createCommand({
 			requiresArg: true,
 		},
 		json: {
-			describe: "Display output as clean JSON",
+			describe: "Display output as JSON",
 			type: "boolean",
 			default: false,
 		},
-Original file line number
+Diff line change
@@ Expand Up / @@ -119,7 +119,7 @@ describe("containers instances", () => { @@
     			OPTIONS
     			      --per-page  Number of instances per page  [number] [default: 25]
-    			      --json      Return output as clean JSON  [boolean] [default: false]"
+    			      --json      Return output as JSON  [boolean] [default: false]"
     		`);
     	});
@@ Expand Down @@