Workers Builds default runtime and package manager versions updated
Workers Builds now uses newer default versions for Node.js, Python, Ruby, Go, and package managers including Yarn, Bun, pip, pipx, Poetry, and uv. Projects with explicit version specifications will continue using their configured versions.
Workers Builds now uses updated default versions of supported runtimes and package managers:
| Tool | Previous version | New version |
|---|---|---|
| Node.js | 24.18.0 | 24.21.0 |
| Yarn | 4.9.1 | 4.18.1 |
| Bun | 1.2.15 | 1.4.3 |
| Python | 3.13.3 | 3.14.8 |
| Ruby | 3.4.7 | 3.4.11 |
| Go | 1.24.3 | 1.27.2 |
| pip | 25.1.1 | 26.2.1 |
| pipx | 1.7.1 | 1.17.2 |
| Poetry | 2.1.3 | 2.4.3 |
| uv | 0.7.13 | 0.12.10 |
Bun 1.4.3 supports both v1 and v2 lockfiles. Projects that specify runtime or package manager versions continue to use those versions.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Rules - Remove surrounding bytes with trim functions
Cloudflare Rules now supports three new functions—trim(), trim_start(), and trim_end()—to remove surrounding bytes from values before comparison. These functions work across all HTTP products on all plans and can remove ASCII whitespace by default or custom byte sets specified as an optional parameter.
Infrastructure applications support configurable session duration
Infrastructure applications now support configurable session duration with a default of 24 hours, set via dashboard or API. When the session duration expires, active SSH connections are closed and users must reconnect, improving security and predictability compared to the previous behavior where sessions could persist unpredictably.
Emergency WAF managed rule for active RCE vulnerability
Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.