Deno hands the runtime to Cloudflare as platform SDKs broaden

Deno's runtime enters maintenance as its team joins Cloudflare

The week's biggest story is an ending. The entire Deno team is joining Cloudflare to work alongside the Workers and Durable Objects teams, and the Deno runtime will receive only monthly bug-fix and security releases for another year before development stops. Deno Deploy shuts down in six months, with migration support offered to paying customers moving onto Cloudflare Workers, while JSR keeps operating with its infrastructure relocating to Cloudflare. For anyone running Deno in production, the clock is now explicit: a year of patches, then nothing. The practical read is to start planning a move — Workers for edge functions, Node or Bun for local runtimes — and to treat any new Deno Deploy dependency as a dead end.

Cloudflare's device clients and account management reach GA

Cloudflare One's clients all graduated this week. On macOS, the client is generally available and now keeps its learned split tunnel configuration across reconnects, so excluded resources are no longer briefly blocked while the tunnel comes up. Linux got the same GA treatment plus fixes for reauthentication, MTU handling, DNS-over-HTTPS timeouts, and several crashes, and Windows followed with split tunnel and DNS fixes plus a scheduled task that restarts the client service on unlock. Alongside that, Cloudflare Organizations is now generally available for Enterprise and MSSP partners, giving large customers a single container for accounts, members, analytics, and shared policies — a smaller mirror of it landed on the core platform too.

AI Gateway and the AI SDK both widen their model surface

Vercel spent the week filling AI Gateway with models: Liquid AI's d1, FLUX 3 Image for generation and editing, Claude Haiku 5.5 with automatic fallbacks and spend tracking, free stealth access to Glyph Cluster, OpenAI Ultrafast mode for GPT-6 Astra and GPT-6.1 Sol, and OpenAI's Decisions API with GPT-6 Luna Decisions. The more interesting change is routing: Gateway can now escalate a decision to a fallback model when the primary answer trips a confidence condition you set. Firewall-mitigated traffic also stopped counting toward billed Microfrontends Routing requests. The AI SDK added a HeyGen provider for text, image, and reference-to-video generation, set up a persistent WebSocket chat transport with resume support and a top-level embeddings dimensions setting, and introduced a portable max reasoning level — a widening of the reasoning type that providers with exhaustive switches must handle before upgrading.

Worker tooling, security rules, and smaller shifts

Cloudflare's Workers chain moved together around assets.base_path, which serves an asset directory from a public URL prefix without changing its on-disk layout, a value now preserved across Wrangler, Miniflare, and generated build config. Wrangler also stopped mangling URL-unsafe R2 keys in local mode and renamed Analytics SQL bindings to bindings.analytics(). On security, the WAF added F5 BIG-IP heap-overflow detection and moved a command injection rule from log to block, and Workers AI gained Clef-omni, a decision model taking audio and video alongside text and images, with Clef-flash getting cheaper.

Smaller notes: Railway's CLI added --environment to its infrastructure-as-code plan, apply, and pull commands and then required an explicit --variables choice; Turborepo introduced task tags with query filtering; and 129 lower-priority releases shipped across the collection.