OpenAICloudflare Developer PlatformJul 9, 2026, 12:00 AM

Workers - Send npm package dependency metadata with Worker uploads

A condensed section focused on the key takeaways first.

Original Post

OpenAI Claude

Quick Digest

Summary

A condensed section focused on the key takeaways first.

openaienmodel: gpt-5-mini-2025-08-07

Workers - Send npm package dependency metadata with Worker uploads

wrangler workers npm package.json supply-chain security

Key Points

Wrangler sends npm dependency metadata
Records declared and exact installed versions
Opt out via dependencies_instrumentation.enabled=false

Summary

Wrangler now collects npm dependency metadata from your project's package.json during wrangler deploy and wrangler versions upload and includes it in the upload metadata sent to the Cloudflare API. For each dependency Wrangler records the package name, the declared version range, and the exact installed version. This data enables dependency analytics and future supply-chain security features such as vulnerability alerting.

Key Points

Collected fields: package name, declared version range, and exact installed version.
Collected during wrangler deploy and wrangler versions upload and included in Cloudflare upload metadata.
To opt out set dependencies_instrumentation.enabled to false in your Wrangler config. Examples: JSONC: {"dependencies_instrumentation": {"enabled": false}}; TOML: [dependencies_instrumentation] and enabled = false.
Recommended: ensure package.json and your lockfile reflect installed versions (use npm ci or npm install) and upgrade Wrangler to receive this behavior.

Full Translation

Translations

A translation section that keeps the flow of the original article.

openaijamodel: gpt-5-mini-2025-08-07

Workers — Worker のアップロード時に npm パッケージ依存関係メタデータを送信

Wrangler は現在、wrangler deploy および wrangler versions upload の実行時にプロジェクトの package.json から npm パッケージの依存関係情報を収集し、Cloudflare API に送信するアップロードメタデータに含めます。

収集されるデータ項目:
- 依存関係の名前
- 宣言されたバージョン範囲（declared version range）
- 実際にインストールされている正確なバージョン（exact installed version）

このデータは依存関係の分析（dependency analytics）や、脆弱性アラートなど将来のサプライチェーンセキュリティ機能を可能にします。

オプトアウトするには、Wrangler の設定ファイルで dependencies_instrumentation.enabled を false に設定してください。

wrangler.jsonc

{
  "dependencies_instrumentation": {
    "enabled": false
  }
}

wrangler.toml

[dependencies_instrumentation]
enabled = false

詳細は Wrangler configuration を参照してください。