Developer Platform Changelog

Workers with a compatibility date of 2026-11-17 or later receive client disconnection events through request.signal by default, removing the need for the enable_request_signal flag. Existing Workers keep current behavior until their compatibility date changes; the new date also supports opting out with disable_request_signal, and does not enable request_signal_passthrough.

JavaScript Workers with a compatibility date of 2026-11-17 or later use the new module registry by default and no longer need the new_module_registry flag, while Python Workers stay on the legacy registry. The new registry rejects invalid import attributes and fails require() calls when the module or a dependency uses top-level await; add legacy_module_registry to keep the old behavior.

Flagship bindings now evaluate flags against a local flag store during local development instead of calling the remote app, applying to wrangler dev, the Vite plugin, Vitest integration, and cf dev. The store starts empty so evaluations return the default value in code, and flags can be managed via --local in wrangler and cf commands, Local Explorer, or pulled from the remote app with wrangler flagship flags pull; set remote: true to keep evaluating remotely.

AI Search billing now begins December 1, 2026 instead of November 1, 2026, with pricing and included usage unchanged. The default sync interval for AI Search instances changes from 6 hours to 24 hours, though any interval from 15 minutes to 24 hours remains selectable via the Sync interval setting or the sync_interval API field.

Workers subrequests to Cloudflare-proxied BYOIP hostnames are now identified as Cloudflare-to-Cloudflare traffic, preserving the CF-Worker header and cf.worker.upstream_zone field so security rules and Bot Management evaluate the original end-user connection instead of an internal one. Cross-zone subrequests now set CF-Connecting-IP to 2a06:98c0:3600::103, while same-zone subrequests still reflect the client IP.

Browser Run now runs Chrome 152 by default, and the default User-Agent for Quick Actions reports Chrome 152 instead of Chrome 119, so allowlist or User-Agent matching rules may need updating. Also fixes large response headers not loading, makes /links return absolute URLs while links-only crawls follow relative links, preserves code block languages in Markdown output, and removes distrusted root certificates.

Beginning November 4, 2026, D1 queries returning more than 50 MB will fail with a "query result exceeded the maximum response size limit" error, a threshold that covers the 99.999th percentile of requests. Import and export via the REST API are exempt; users with large results should select specific columns instead of SELECT * and paginate with LIMIT and OFFSET.

Deploying new Durable Objects code no longer applies immediately; an active object can keep running its current code for up to 300 seconds while waiting to hibernate, letting in-flight work finish and Hibernation API WebSockets stay connected. The delay is configurable via code_update_strategy in Wrangler with max_delay from 0 to 86400 seconds, or per deployment with --durable-objects-code-update-mode immediate or deferred.

Skills are now loaded from a folder with a SKILL.md written into the agent's Computer Workspace under /workspace/.agents/skills/, with no build step or deploy required, and the agent can write its own skills. Skills can come from a Workspace, an R2 bucket, or code, each validated against the Agent Skills specification. This is a breaking change for code using agents/skills directly: the agents:skills Vite import, agents/skills/compile, SkillRegistry, and Think's skillWorkspace are removed, and runner() moved to agents/skills/runner.

VPC Network bindings can now target a specific virtual network by setting network_id to cf1:vnet:, while cf1:network still selects the account's default virtual network. Multiple bindings in one Worker can point at different virtual networks, reaching separate backends that share the same private IP address.

Workers Builds now retains each build and its build logs for 90 days after the build finishes, viewable under View build history in the Deployments tab or via the Workers Builds API. After 90 days the build and logs are removed, but the versions and deployments it created remain in version history for rollbacks; longer-term logs can be downloaded with the Get build logs API endpoint.

Workers Static Assets can now serve assets from a URL path prefix without changing their directory structure, configured via assets.base_path in Wrangler or worker.assets.basePath in cloudflare.config.ts. The option requires Wrangler 4.148.0 or later, or cf 1.0.0-beta.13 or later for cloudflare.config.ts.

Setting jurisdiction on a workflows binding or on a Workflow declared in exports makes its instances run and store data only within that jurisdiction; supported values are eu, us, and fedramp. Jurisdiction is fixed at creation, and wrangler deploy or wrangler versions upload stops before uploading if an existing Workflow has a different jurisdiction, requiring Wrangler 4.152.0 or above.

Custom spans in Workers now support three more OpenTelemetry span methods: spanContext() returns traceId, spanId, and traceFlags matching Workers Observability and exported traces, setStatus() sets unset/ok/error with an optional error message, and updateName() renames a span after it starts, including the root span from tracing.getActiveSpan(). Span status appears in traces exported to OpenTelemetry destinations but is not yet shown in the Workers Observability dashboard.

Setting the packageManager field in package.json now controls which npm version Workers Builds installs before dependencies, so lockfiles written by a newer npm install the same way in builds as locally. The field also sets Yarn, pnpm, and Bun versions and requires an exact version rather than a range; engines.npm is not used for npm version selection.

Flagship evaluation context now accepts nested objects, arrays, and null, so targeting rules can use dot-separated paths like profile.plan and the has/not_has operators for array membership without flattening data. Structured context works through the Workers binding, the evaluation REST API, and the TypeScript, Python, and Go OpenFeature SDKs from version 0.6.0.

Workers Builds and Pages build images now reject the eight compromised eMudhra intermediate CA certificates when cloning repositories, installing dependencies, or making HTTPS requests, shipping patched CA bundles with Node.js 22.23.4 and 24.22.1, Bun 1.4.4, and pip 26.2.2. Projects setting BUN_VERSION below 1.4.4 or overriding SSL_CERT_FILE, PIP_CERT, or REQUESTS_CA_BUNDLE must verify their own certificates do not trust the compromised intermediates.

The D1 undelete API now only accepts requests for databases deleted within the last 7 days; undelete requests for older deletions fail and return an error.