Bump bundled execa from ^6.1.0 to ^9.5.3

[kirkouimet]

Heads up

This is an opportunistic hygiene PR. The motivating CI warning that started this investigation turned out to be coming from @opennextjs/cloudflare, not from wrangler — that fix is at opennextjs-cloudflare#1248. So this PR isn't fixing any user-reported issue. Take it or leave it — happy to close if it's not worth the review cycles.

That said, the work is done and the fix is real for anyone using a wrangler [build] command = "..." config under Node 22+, so figured I'd share.

Background

Per #13805, wrangler bundles execa@^6.1.0. execa@6.1.0 is the highest 6.x ever published and predates the Node 24 DEP0190 workaround, which only landed in execa@9.5.3 (sindresorhus/execa#1199). The fix concatenates command + args into a single string before handing off to node:child_process when shell: true is set, so the runtime doesn't see the deprecated args-array-with-shell pattern.

In the wrangler tree, shell: true only appears in packages/wrangler/src/deployment-bundle/run-custom-build.ts, so the warning fires when a [build] command = "..." runs under Node 22+. Bumping to execa 9 silences it.

Audit

execa is imported in three production files:

File	Usage	execa 9 compat
init.ts:139	execa(packageManager.type, c3Arguments, { stdio }) + childProcess.stdout?.pipe(...) (immediate) + e as ExecaError / .shortMessage	All APIs stable; ExecaError and shortMessage still exported in execa 9 final-error.d.ts
package-manager.ts:110	execaCommandSync(\${name} --version`, { stdio: "ignore" })`	execaCommandSync still exported in execa 9
deployment-bundle/run-custom-build.ts:21	execaCommand(command, { shell: true, cwd, env }) + immediate .pipe() to Writable	execaCommand still exported; .pipe() happens immediately so the #658 timing constraint is met

Breaking changes that don't affect us: error.killed → error.isTerminated (not accessed), signal → cancelSignal option (not used), encoding value renames (default), Buffer → Uint8Array for 'buffer' encoding (not used), subprocess.cancel() removal (not used), execPath → nodePath (not used), serialization default (not used).

Breaking change to be aware of: dropped support for Node <18.19.0 and 20.0.0–20.4.0. Wrangler's engines.node is already >=22.0.0, so this is a no-op.

Test plan

Verified locally on macOS 14, Node 24.14.1, pnpm 10.33.0:

• pnpm check:type passes
• pnpm type:tests passes
• src/__tests__/init.test.ts — 21 tests pass
• src/__tests__/package-manager.test.ts — 8 tests pass
• src/__tests__/autoconfig/details/framework-detection/package-manager-detection.test.ts — 5 tests pass
• src/__tests__/custom-build.test.ts — 6 tests pass
• src/__tests__/pages/deploy.test.ts — 62 tests pass
• oxfmt --check passes
• End-to-end: wrangler build against a project with [build] command = "echo hello" on Node 24 — no DEP0190 emitted (was emitted with old execa)

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 242ed0b

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/wrangler-bump-execa.md: [@cloudflare/wrangler]
• packages/wrangler/package.json: [@cloudflare/wrangler]
• pnpm-lock.yaml: [@cloudflare/wrangler]

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13806

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13806

miniflare

npm i https://pkg.pr.new/miniflare@13806

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13806

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13806

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13806

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13806

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13806

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13806

wrangler

npm i https://pkg.pr.new/wrangler@13806

commit: 242ed0b