perf(wrangler): remove execa by 43081j · Pull Request #12369 · cloudflare/workers-sdk

43081j · 2026-02-02T17:32:49Z

This removes execa and uses the much smaller, more modern tinyexec
instead.

Reasoning:

execa 640KB vs tinyexec 26KB
execa 23 packages vs tinyexec 1 package
tinyexec is widely adopted by most of the modern CLIs today (tsdown,
vite, vitest, storybook, etc.)

Part of #11854.

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s): N/A
- Documentation not necessary because: Internal code change only

changeset-bot · 2026-02-02T17:32:54Z

🦋 Changeset detected

Latest commit: c47d183

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-02-02T17:39:05Z

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@12369

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@12369

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@12369

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@12369

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@12369

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@12369

miniflare

npm i https://pkg.pr.new/miniflare@12369

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@12369

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@12369

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@12369

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@12369

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@12369

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@12369

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@12369

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@12369

wrangler

npm i https://pkg.pr.new/wrangler@12369

commit: c47d183

ascorbic

Thanks, @43081j!

petebacondarwin · 2026-02-03T22:36:28Z

The windows CI job appears to keep hanging but also this needs another rebase.

43081j · 2026-02-03T22:41:46Z

Strange. When I'm next on a Windows machine I can try run them locally and see what happens if that helps

petebacondarwin · 2026-04-28T12:54:20Z

Hi @43081j — we're doing some cleanup of stale draft PRs.

This PR has been quiet since 2026-02-13. Could you let us know within 14 days whether you're still planning to continue?

If yes: please leave a comment with a status update or push a rebase, and we'll keep it open.
If no: no need to reply — we'll close it after 14 days, and you can always reopen later if you pick it back up.

Thanks!

workers-devprod

Codeowners reviews satisfied

workers-devprod · 2026-04-28T13:43:41Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

43081j · 2026-04-28T13:43:47Z

@petebacondarwin i've revived it, thanks for the ping as i also forgot about this one.

assuming CI is happy, let me know if there's any changes you or any other maintainers want

workers-devprod · 2026-05-05T11:08:47Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

workers-devprod · 2026-06-01T15:12:46Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

43081j · 2026-06-01T16:23:21Z

@jamesopstad other than that seemingly stuck windows task, it builds!

looks like it is just stuck building for some reason

workers-devprod · 2026-07-31T12:48:23Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

petebacondarwin · 2026-07-31T13:21:14Z

Rebased this onto latest main (it was ~450 commits behind and conflicting) and fixed up a few things found along the way. The migration commit is preserved with your authorship; my changes are in a separate follow-up commit.

Conflict resolution

run-custom-build.ts gained AbortSignal + tree-kill teardown on main since this was opened. Merged that with the tinyexec change and retyped the helper from ExecaChildProcess to tinyexec's Result.

Behavioural gaps between execa and tinyexec

Signal termination was silently treated as success. throwOnError only fires for non-zero exit codes. A process killed by a signal reports exitCode === undefined and tinyexec resolves — execa rejected. For custom builds this meant an aborted build looked like a successful one. Both existing abort tests in custom-build.test.ts fail without a guard, so this would have shipped a real regression in wrangler dev. Guarded at all three call sites.
C3 failure messages. NonZeroExitError.message is just Process exited with non-zero status (1) — it doesn't name the command the way execa's shortMessage did. Concatenating the captured stdout/stderr to compensate had three problems: the output is already streamed live so it printed twice; the command name was still lost; and every failure got a unique message, which defeats Sentry grouping (the whole point of the original comment there). Now the message is `npm create cloudflare` failed with exit code 1 and the captured output travels on the cause, which is what Sentry reports.
nodePath. Defaults to true, which prepends every ancestor node_modules/.bin and dirname(process.execPath) to PATH. execa v6 didn't (preferLocal defaulted to false). You had this on init/package-manager but not run-custom-build; set consistently.
execaCommand normalised whitespace (it split the string into file + args). We now hand the raw string to the shell, so command.trim() — on Windows the shell is cmd.exe /d /s /c "<command>", which is not whitespace tolerant.

Other

package-manager.supports() now checks exitCode === 0 instead of relying on throwOnError, which covers non-zero exits, signals and ENOENT in one go.
e as NonZeroExitError → instanceof; the cast was unsound for ENOENT (a plain Error with no .output).
The tinyexec mock in vitest.setup.ts returned a bare Promise, so .process was undefined and the piping path was a silent no-op in tests. Now returns something Result-shaped.
Added tests for the signal path and the C3 failure paths (all verified to fail without the corresponding fix).
Regenerated the lockfile; dropped execa from the cSpell dictionary.

Not addressed — worth a follow-up

execa v6 defaulted to cleanup: true, registering a signal-exit hook that killed the direct child when the parent exited. tinyexec has no equivalent and wrangler has no global child cleanup, so a subprocess can now be orphaned if wrangler exits without going through the abort path (deploy/versions upload/types custom builds and autoconfig pass no AbortSignal). It's narrow — Ctrl-C still kills the process group on POSIX, and dev teardown is handled explicitly by BundlerController — and execa only killed the direct child rather than the tree, so it was already partial. Still, it deserves its own PR rather than being bolted on here.

Verification: pnpm check clean; full wrangler suite (4826) and C3 (241) pass locally. The four red checks on the previous run (Tests (Windows, fixtures), Tests (Windows, packages-and-tools), C3 E2E (pnpm@11.5.1) - frameworks, Vite Plugin Playground (macos, vite-8)) are pre-existing flakes — they reproduce on unrelated PRs (#14924, #14952), and wrangler's own tests passed in the Windows run.

One thing worth adding to the changeset if you like: x(command, [], { shell: true }) passes zero args, which sidesteps Node's DEP0190 deprecation warning that execaCommand triggered on Node >= 22.

43081j · 2026-07-31T16:02:45Z

Signal termination was silently treated as success. throwOnError only fires for non-zero exit codes. A process killed by a signal reports exitCode === undefined and tinyexec resolves — execa rejected

this is a bug and was fixed in tinylibs/tinyexec#146 which should be in the next tinyexec release.

2. C3 failure messages. NonZeroExitError.message is just Process exited with non-zero status (1) — it doesn't name the command the way execa's shortMessage did. Concatenating the captured stdout/stderr to compensate had three problems: the output is already streamed live so it printed twice; the command name was still lost; and every failure got a unique message, which defeats Sentry grouping (the whole point of the original comment there). Now the message is `npm create cloudflare` failed with exit code 1 and the captured output travels on the cause, which is what Sentry reports.

This may be solved by tinylibs/tinyexec#151

execa v6 defaulted to cleanup: true, registering a signal-exit hook that killed the direct child when the parent exited. [...]

signal-exit is basically a brute-force, catch-all solution too. basically listens on a whole bunch of signals and events in the hope that it can brute force some code into running before the process exits.

i do wonder if there is a simpler way, knowing exactly what we've spawned and the cases in which it can be left dangling. worth some thought instead of trying to port a "lazy" solution like that i think

edit: 1.3.0 is out which should fix those two 👀

Two behavioural differences surfaced while migrating: - `throwOnError` only covers non-zero exit codes, so a process killed by a signal resolved successfully where execa rejected. For custom builds this silently turned an aborted build into a successful one. Guard all three call sites on a missing exit code. - `NonZeroExitError.message` does not name the command the way execa's `shortMessage` did. Embedding C3's captured stdout/stderr to compensate printed the output twice (it is already streamed live) and gave every failure a unique message, defeating Sentry grouping. Name the command and exit code instead, and let the output travel on the cause. Also narrows the C3 error with `instanceof` rather than an unchecked cast, trims the custom build command before handing it to the shell (`cmd.exe` is not whitespace tolerant, and `execaCommand` used to normalise this), and adds coverage for the abort, signal and C3 failure paths.

workers-devprod · 2026-08-12T06:32:01Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

petebacondarwin · 2026-08-12T06:35:52Z

We recently landed #14994, a large change to Miniflare's configuration internals that touched ~177 files across the repo. Leaving this PR on its old base was likely to cause conflicts, so we've rebased it onto the latest main and force-pushed the result.

Your local copy of this branch is now out of date. Before you push again, please reset to the new version:

git fetch origin
git checkout execaless
git reset --hard origin/execaless

Because the base moved a long way, it's also worth reinstalling before you carry on — the lockfile changed:

pnpm install

Sorry for the interruption. If the rebase looks wrong, or CI now fails in a way that seems related to the Miniflare config change rather than your own work, comment here and we'll help get it sorted.

devin-ai-integration

Devin Review found 1 new potential issue.

View 1 additional finding in Devin Review.

devin-ai-integration · 2026-08-12T06:38:03Z

+		const { exitCode } = await x(name, ["--version"], {
+			nodeOptions: { stdio: "ignore" },
+			// Disable tinyexec's default PATH manipulation, which prepends every
+			// ancestor `node_modules/.bin` and the directory holding the running Node
+			// binary, so that we only detect package managers that are actually
+			// available on the user's own PATH.
+			nodePath: false,
+		});


🔴 Package managers may no longer be found on Windows, breaking project creation

Package managers are now looked up by launching them directly (x(name, ["--version"], …) at packages/wrangler/src/package-manager.ts:89) instead of through the previous helper that knew how to start Windows command shims, so on Windows npm/pnpm/yarn can appear to be missing.
Impact: Windows users may see "Unable to find a package manager" and wrangler init can fail to start the project-creation tool.

Mechanism: execa used cross-spawn for Windows `.cmd` shims, tinyexec spawns directly

execa@6 depends on cross-spawn, which exists precisely to make spawn("npm", …) work on Windows, where npm/pnpm/yarn are npm.cmd shims. libuv's PATH search only appends .com and .exe, so a bare spawn("npm") without shell: true fails with ENOENT (and Node rejects an explicit .cmd target without shell). tinyexec calls node:child_process.spawn directly and does not perform cross-spawn-style shim resolution.

Two call sites are affected:

packages/wrangler/src/package-manager.ts:89-96 — a spawn failure is swallowed by the catch and reported as "not supported", so every detection returns false and getPackageManager() throws the "Unable to find a package manager" UserError.

packages/wrangler/src/init.ts:139 — x(packageManager.type, c3Arguments, …) spawns the package manager binary directly to delegate to C3.

The existing Windows test path exercises exactly this: packages/wrangler/src/__tests__/helpers/mock-bin.ts:22-27 creates the mock binaries as cmd-shims on win32.

Note that runCommand in run-custom-build.ts is unaffected because it passes shell: true.

Prompt for agents

On Windows, `npm`, `pnpm` and `yarn` are `.cmd` shims. `execa` (the previous implementation) depended on `cross-spawn`, which resolves and runs those shims correctly; `tinyexec` calls `node:child_process.spawn` directly, and libuv's PATH search only tries `.com`/`.exe`, so `x("npm", ["--version"])` fails with ENOENT on Windows. Verify tinyexec@1.2.4's behaviour here (run the Windows unit tests for `packages/wrangler/src/__tests__/package-manager.test.ts`, which install cmd-shims via `helpers/mock-bin.ts`). If it does not resolve shims, both `supports()` in packages/wrangler/src/package-manager.ts and the C3 delegation spawn in packages/wrangler/src/init.ts need a Windows-safe strategy (e.g. keeping cross-spawn for these two call sites, appending `.cmd` on win32, or passing `shell: true` with properly escaped arguments).

Was this helpful? React with 👍 or 👎 to provide feedback.

Tinyexec does the same work as cross-spawn under the hood, so this comment doesn't seem right 👀

It too handles windows specific resolution of binaries

43081j requested review from a team as code owners February 2, 2026 17:32

workers-devprod added this to workers-sdk Feb 2, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk Feb 2, 2026

43081j mentioned this pull request Feb 2, 2026

Dependency cleanup/syntax modernisation #11854

Open

43081j changed the title ~~perf: remove execa~~ perf(wrangler): remove execa Feb 2, 2026

This comment was marked as resolved.

Sign in to view

43081j force-pushed the execaless branch from 878dea9 to a613735 Compare February 2, 2026 18:00

This comment was marked as resolved.

Sign in to view

ascorbic approved these changes Feb 3, 2026

View reviewed changes

github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Feb 3, 2026

This comment was marked as resolved.

Sign in to view

petebacondarwin approved these changes Feb 3, 2026

View reviewed changes

petebacondarwin force-pushed the execaless branch 4 times, most recently from 3723c61 to 56b361e Compare February 3, 2026 20:50

petebacondarwin force-pushed the execaless branch from 56b361e to 9499795 Compare February 3, 2026 22:45

petebacondarwin moved this from Approved to In Progress in workers-sdk Feb 4, 2026

petebacondarwin marked this pull request as draft February 4, 2026 09:42

43081j force-pushed the execaless branch 2 times, most recently from 40277f9 to 5f1a98a Compare February 7, 2026 10:14

workers-devprod approved these changes Apr 28, 2026

View reviewed changes

github-project-automation Bot moved this from In Progress to Approved in workers-sdk Apr 28, 2026

43081j marked this pull request as ready for review April 28, 2026 13:43

This comment was marked as resolved.

Sign in to view

jamesopstad reviewed May 6, 2026

View reviewed changes

Comment thread packages/wrangler/src/package-manager.ts Outdated

This was referenced May 11, 2026

Bump bundled execa from ^6.1.0 to ^9.5.3 #13806

Closed

Bump bundled execa from ^6.1.0 to ^9.5.3 to silence Node 24 DEP0190 warning #13805

Closed

petebacondarwin force-pushed the execaless branch from 50e7e94 to 8929563 Compare July 31, 2026 12:47

This comment was marked as resolved.

Sign in to view

petebacondarwin force-pushed the execaless branch from 8929563 to fe2f069 Compare July 31, 2026 13:20

This comment was marked as resolved.

Sign in to view

petebacondarwin force-pushed the execaless branch from fe2f069 to 590c8f5 Compare July 31, 2026 13:40

43081j and others added 2 commits August 12, 2026 07:01

perf(wrangler): remove execa in favour of tinyexec

66f1181

petebacondarwin force-pushed the execaless branch from 590c8f5 to c47d183 Compare August 12, 2026 06:31

devin-ai-integration Bot reviewed Aug 12, 2026

View reviewed changes

Uh oh!

Conversation

43081j commented Feb 2, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

ascorbic left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

petebacondarwin commented Feb 3, 2026

Uh oh!

43081j commented Feb 3, 2026

Uh oh!

petebacondarwin commented Apr 28, 2026

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

workers-devprod commented Apr 28, 2026

Uh oh!

43081j commented Apr 28, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

workers-devprod commented May 5, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

workers-devprod commented Jun 1, 2026

Uh oh!

43081j commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

workers-devprod commented Jul 31, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

petebacondarwin commented Jul 31, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

43081j commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

workers-devprod commented Aug 12, 2026

Uh oh!

petebacondarwin commented Aug 12, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

43081j Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

43081j commented Feb 2, 2026 •

edited by devin-ai-integration Bot

Loading

changeset-bot Bot commented Feb 2, 2026 •

edited

Loading

pkg-pr-new Bot commented Feb 2, 2026 •

edited

Loading

43081j commented Jun 1, 2026 •

edited

Loading

43081j commented Jul 31, 2026 •

edited

Loading