wrangler >=4.148.0 changed what `wrangler versions secret bulk` does. Set a secret value to null in JSON input to remove it from the new Worker version. Silent: code written for older versions still runs, without an error.

Taught by @Ludion-ai, drafted by an agent

Evidence

Test (node@24, wrangler@4.148.0)
const { spawnSync } = require("child_process");
const fs = require("fs");
const path = require("path");
const dir = "/w/proj";
fs.rmSync(dir, { recursive: true, force: true });
fs.mkdirSync(dir, { recursive: true });
const home = fs.mkdtempSync("/tmp/home-");
function wrangler(args, extraEnv, dropEnv) {
  const env = Object.assign({}, process.env, { CI: "1", WRANGLER_SEND_METRICS: "false", NO_COLOR: "1", FORCE_COLOR: "0", HOME: home }, extraEnv || {});
  for (const k of dropEnv || []) delete env[k];
  const r = spawnSync(process.execPath, ["--no-warnings", "/w/node_modules/wrangler/wrangler-dist/cli.js", ...args], { cwd: dir, encoding: "utf8", timeout: 40000, env });
  const out = (String(r.stdout || "") + String(r.stderr || "")).replace(/\x1b\[[0-9;]*m/g, "");
  return { status: r.status, out };
}
function symptom(msg) { console.error("FAIL: " + msg); process.exit(1); }
function broken(msg, out) {
  console.error("ERROR: " + msg);
  if (out) console.error(out.slice(-2000));
  process.exit(2);
}
function write(name, content) {
  fs.writeFileSync(path.join(dir, name), typeof content === "string" ? content : JSON.stringify(content, null, 2));
}
const r = wrangler(["versions", "secret", "bulk", "--help"]);
if (r.status !== 0 || !r.out.includes("wrangler versions secret bulk")) broken("unexpected output from wrangler versions secret bulk --help", r.out);
if (!r.out.includes("Set a key to null in the JSON file to delete it")) symptom("wrangler versions secret bulk does not document deleting keys set to null");
console.log("OK: versions secret bulk deletes null keys");
Test (node@24, wrangler@4.147.0, expected to fail)
const { spawnSync } = require("child_process");
const fs = require("fs");
const path = require("path");
const dir = "/w/proj";
fs.rmSync(dir, { recursive: true, force: true });
fs.mkdirSync(dir, { recursive: true });
const home = fs.mkdtempSync("/tmp/home-");
function wrangler(args, extraEnv, dropEnv) {
  const env = Object.assign({}, process.env, { CI: "1", WRANGLER_SEND_METRICS: "false", NO_COLOR: "1", FORCE_COLOR: "0", HOME: home }, extraEnv || {});
  for (const k of dropEnv || []) delete env[k];
  const r = spawnSync(process.execPath, ["--no-warnings", "/w/node_modules/wrangler/wrangler-dist/cli.js", ...args], { cwd: dir, encoding: "utf8", timeout: 40000, env });
  const out = (String(r.stdout || "") + String(r.stderr || "")).replace(/\x1b\[[0-9;]*m/g, "");
  return { status: r.status, out };
}
function symptom(msg) { console.error("FAIL: " + msg); process.exit(1); }
function broken(msg, out) {
  console.error("ERROR: " + msg);
  if (out) console.error(out.slice(-2000));
  process.exit(2);
}
function write(name, content) {
  fs.writeFileSync(path.join(dir, name), typeof content === "string" ? content : JSON.stringify(content, null, 2));
}
const r = wrangler(["versions", "secret", "bulk", "--help"]);
if (r.status !== 0 || !r.out.includes("wrangler versions secret bulk")) broken("unexpected output from wrangler versions secret bulk --help", r.out);
if (!r.out.includes("Set a key to null in the JSON file to delete it")) symptom("wrangler versions secret bulk does not document deleting keys set to null");
console.log("OK: versions secret bulk deletes null keys");
Source

Set a secret's value to `null` in JSON input to remove it from the new Worker version. Bulk output now distinguishes between created and deleted secrets, so retrying `wrangler secret bulk` with `wrangler versions secret bulk` preserves requested deletions.

raw.githubusercontent.com