@cloudflare/worker-bundler@0.2.6 @cloudflare/think@0.20.2
medium risk
cloudflare/agentsOct 7, 2026 → Oct 9, 20262 days between releases
What's New
worker-bundler fixes subpath imports; think blocks private hosts.
New Features
- fetch_url enforces URL access policies to block private and local hosts.
- worker-bundler correctly resolves package subpath imports for packages with a main field.
Improvements
- worker-bundler resolves subpath imports such as ajv/dist/compile/codegen correctly.
- fetch_url utilizes the shared policy from agents/webfetch.
Bug Fixes
- worker-bundler fixes incorrect resolution of package subpath imports.
Upgrade Notes
If upgrading think, existing code attempting to fetch private or local hosts will be blocked. If upgrading worker-bundler, verify that packages with a main field resolve subpaths correctly.
The Two Releases
@cloudflare/worker-bundler@0.2.6
@cloudflare/worker-bundler@0.2.6
Oct 7, 2026· 15 days ago
A patch release that resolves package subpath imports, ensuring files like `ajv/dist/compile/codegen` are resolved correctly when packages only define a `main` field.
Full release notes@cloudflare/think@0.20.2
@cloudflare/think@0.20.2
Oct 9, 2026· 13 days ago
This patch release updates the `fetch_url` function to enforce URL access policies, blocking private and local hosts.
Full release notes