fix(deps): update dependency @opennextjs/cloudflare to ^1.20.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opennextjs/cloudflare (source)	^1.19.0 → ^1.20.2

---

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.20.2

Compare Source

Patch Changes

• #​1312 38ea40b Thanks @​james-elicx! - fix: handle encoded middleware and cache paths safely

  Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.

• #​1313 766eee9 Thanks @​james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11

• #​1306 97ef330 Thanks @​james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

  Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

v1.20.1

Compare Source

Patch Changes

• #​1297 780a21c Thanks @​james-elicx! - fix: disable response compression for skew protection API requests

  Avoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.

v1.20.0

Compare Source

Minor Changes

• #​1290 46c50fc Thanks @​james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

  Key Changes:

  1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.

     • R2_ACCESS_KEY_ID
     • R2_SECRET_ACCESS_KEY
     • CF_ACCOUNT_ID

  2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.

  3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.

  Usage:

  Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:

  pnpm add rclone.js
  pnpm approve-builds # select rclone.js
  pnpm rebuild rclone.js
  R2_ACCESS_KEY_ID=your_key
  R2_SECRET_ACCESS_KEY=your_secret
  CF_ACCOUNT_ID=your_account
  
  opennextjs-cloudflare deploy --rclone

  You can also set the environment variables for CI builds.

  Notes:

  • You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.
  • rclone may not be supported on all platforms.

Patch Changes

• #​1289 eef243f Thanks @​thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges run

  BucketCachePurge.alarm() passed its tag bindings to SqlStorage.exec as a
  single array. exec(query, ...bindings) is variadic over its bindings, so for a
  multi-tag DELETE ... WHERE tag IN (?, ?, …) the binding count (1) disagreed
  with the placeholder count (N) and exec threw "Wrong number of parameter
  bindings" on every flush. On-demand revalidateTag purges therefore never
  reached the Cloudflare cache, and with bypassTagCacheOnCacheHit enabled pages
  served stale until the ISR TTL expired.

  Spread the bindings, normalise the INSERT to the same variadic form, and
  tighten the drain loop's guard from while (tags.length >= 0) (which never
  exits via the condition) to while (tags.length > 0).

• #​1291 51439b1 Thanks @​james-elicx! - fix: disable response compression when provisioning R2 cache buckets

  Avoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.

v1.19.11

Compare Source

Patch Changes

• #​1270 802047e Thanks @​alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping

  Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.

  Closes #​1230

v1.19.10

Compare Source

Patch Changes

• #​1261 780dd4f Thanks @​vicb! - Allow populating R2 when the domain is protected by Cloudflare Access

  You need to:

  • create a "Service Auth" policy for "open-next-cache-populate..workers.dev"
  • add an "Include" rule for "Any Access Service Token" or for a given service token ("Service Token")
  • populate the env variables CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET

v1.19.9

Compare Source

Patch Changes

• #​1259 3b35c6e Thanks @​vicb! - chore: bump Next.js to 15.5.18 / 16.2.6 and @​opennextjs/aws to 4.0.2

v1.19.8

Compare Source

Patch Changes

• #​1256 9696cd0 Thanks @​vicb! - bump @opennextjs/aws to 4.0.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.0.1

v1.19.7

Compare Source

Patch Changes

• #​1252 29fe15d Thanks @​vicb! - bump the number of retries for r2 cache uploads

  Increase the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.

• #​1255 364b7d9 Thanks @​vicb! - Bump react and next

v1.19.6

Compare Source

Patch Changes

• #​1246 5d2014f Thanks @​vicb! - fix: do not log expected expected D1 errors

  The populateCache command adds columns to the D1 tag cache for SWR support.
  This is required for older deployments made before those column were added.
  SQLite errors when the columns exist and we should not log those errors.

• #​1244 01babce Thanks @​tahmid-23! - fix: drop streaming wasm calls in Turbopack runtime

  Turbopack replaces wasm imports using WebAssembly.compileStreaming and
  WebAssembly.instantiateStreaming. These functions are not available in
  the workerd runtime.

  We add a helper loadWasmChunkFn. This is a generated switch statement
  that contains an import for each wasm chunk. We use static strings for
  all imports to ensure that all necessary wasm chunks will be detected
  and bundled for the final build.

  The Turbopack patcher replaces the invocations in loadWebAssembly and
  loadWebAssemblyModule, using the synchronous WebAssembly.instantiate
  and redirecting to loadWasmChunkFn.

• #​1243 1c815de Thanks @​tahmid-23! - fix: detect object-valued conditions

  The pre-existing build condition transform logic had subtle errors:

  • failed to recognize object conditions
    (e.g. "workerd": { "import": ..., "require": ... })
  • sibling pruning only applied to strings, not objects

  Now, we fully support object conditions. Furthermore, we prune siblings,
  unless its subtree also contains the build condition.

v1.19.5

Compare Source

Patch Changes

• #​1240 dd7de1d Thanks @​vicb! - fix: add missing git ignored files for the migrate command

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	floren	796065b	Commit Preview URL Branch Preview URL	Jul 25 2026, 07:05 AM