During a one-time backfill that read values out of Cloudflare KV, my script started failing validation with an error I’ll never forget:
plaintext value is not valid auth-context JSON (head="There is a n")
“There is a n…” — the stored value apparently began with an English sentence. It took an embarrassing minute to see it: wrangler had printed its “There is a newer version of wrangler available” banner to stdout, and my script parsed the banner as the KV value. The actual data was fine. The tool’s helpful upgrade nag had been concatenated into the output my script captured.
This class of bug is endemic to scripting CLIs that assume a human is reading: version banners, telemetry notices, progress spinners — any of it can land on stdout and become “data” the moment you pipe the command. And it’s intermittent in the worst way, because the banner only appears when a newer version exists, so the script that worked all week breaks the day a release ships.
Defenses, in the order I now reach for them:
- Pin the wrangler version in the project (
bunx wrangler@<version>or a devDependency) so a new release can’t change output behavior mid-audit. - Check whether the command offers structured output and parse that instead of raw text.
- Validate the shape of what you read before acting on it — the only reason this backfill didn’t write garbage anywhere is that it refused to proceed when the value didn’t parse as JSON. The validation error was annoying; it was also the system working.
If a script’s input comes from a CLI’s stdout, treat that CLI as an untrusted data source.