--- collection: application-platforms collection_name: Application Platforms week_start: 2026-10-26 title: Cloudflare rewires its developer primitives while Vercel chases Node 26 and AI routing release_count: 238 generated: 2026-11-02 canonical: https://releases.sh/collections/application-platforms/digest/2026-10-26 --- # Cloudflare rewires its developer primitives while Vercel chases Node 26 and AI routing Cloudflare retired the classic DNS records page, made Durable Objects defer code updates so live agents survive deploys, and turned Agent Skills into plain workspace files, while D1 set a hard cap on query result size. Vercel made Node.js 26 LTS the default and shipped virtual models in AI Gateway. ### Durable Objects learn to wait; skills become files The week's biggest shift for anyone running stateful Workers code is that Durable Objects no longer swap code the instant you deploy. Active objects can [keep running their current version for up to five minutes](https://developers.cloudflare.com/changelog/post/2026-10-30-durable-objects-deferred-code-updates/) while they wait to hibernate, so in-flight work finishes and Hibernation-API WebSockets stay connected; the window is configurable in Wrangler from zero up to a day, or per deployment when you need an immediate cutover. The runtime moved in step, adding [onHibernate dispatch](https://github.com/cloudflare/workerd/releases/tag/v1.20261028.1), [Durable Object facets](https://github.com/cloudflare/workerd/releases/tag/v1.20261101.1) in the cluster, and [deferred cross-context actions on idle objects](https://github.com/cloudflare/workerd/releases/tag/v1.20261031.1) rather than aborts. The Agents SDK pushed hard on the same "agents should survive and self-modify" theme. [Agent Skills are now files](https://developers.cloudflare.com/changelog/post/2026-10-29-agent-skills-from-files/): drop a `SKILL.md` into the agent's Computer Workspace and it's available on the next turn with no build or deploy — the agent can write its own. That's a breaking change for code importing `agents/skills` directly. Agents also got [internal hostnames](https://developers.cloudflare.com/changelog/post/2026-10-28-browser-internal-hostnames/), letting the persistent browser preview a dev server inside its sandbox via something like `preview.internal` without exposing it publicly. ### Security defaults tighten, and one leak closes Cloudflare's asset pipeline had a bad week that it spent fixing. Autoconfig was comparing a relative output directory to an absolute project path, which meant projects serving from the root uploaded `.env`, `.dev.vars`, `.git` and `node_modules` as public assets. Wrangler now [resolves the real assets directory before writing .assetsignore](https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.156.0), the standalone autoconfig build got the [same protective ignore file](https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/autoconfig%400.8.3), and a follow-up patch made [Pages deploys respect the directory you asked for](https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.156.1) and stopped repeated slashes from bypassing Pages Functions middleware. On the network side, Workers subrequests to BYOIP hostnames now [keep their context and original client bot signals](https://developers.cloudflare.com/changelog/post/2026-10-30-byoip-workers-subrequest-context/) so security rules evaluate the real end user. Keyless SSL gained [TLS 1.3 for ECDSA certificates](https://developers.cloudflare.com/changelog/post/2026-10-30-keyless-ssl-tls13-ecdsa/), and China Network zones now serve [Challenge Pages with locally hosted Turnstile](https://developers.cloudflare.com/changelog/post/2026-10-28-china-native-challenge-pages/) to avoid cross-border round trips. The WAF team pushed rule updates for [Nuxt Image and IPX](https://developers.cloudflare.com/changelog/post/2026-10-30-emergency-waf-release/) and refined its [PHP out-of-memory and RCE detections](https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/). ### Deadlines and deprecations worth planning around Two items deserve a spot on the calendar. D1 will begin [failing any query returning more than 50 MB](https://developers.cloudflare.com/changelog/post/2026-10-30-query-result-size-limit/) on November 4 — imports and exports are exempt, but `SELECT *` habits need pagination before then. Meanwhile the [classic DNS records page is gone](https://developers.cloudflare.com/changelog/post/2026-10-30-classic-dns-records-page-retired/) for every plan including Enterprise, and the batch DNS endpoint now lets you change an existing record's type. Smaller but useful: static assets can [serve from a URL path prefix](https://developers.cloudflare.com/changelog/post/2026-10-28-static-assets-base-path/) without rearranging directories, VPC bindings can [target a specific virtual network](https://developers.cloudflare.com/changelog/post/2026-10-28-virtual-network-bindings/) so one Worker reaches backends sharing a private IP, Miniflare supports [remote Analytics Engine bindings](https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20261023.2-beta) in local dev, and the Vite plugin added [remote Hyperdrive bindings](https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/vite-plugin%401.66.0). WebCrypto picked up [SHA-3, ChaCha20-Poly1305 and MLKEM768-X25519](https://github.com/cloudflare/workerd/releases/tag/v1.20261030.1), while the TypeScript stream implementation [stopped corrupting binary formData parts](https://github.com/cloudflare/workerd/releases/tag/v1.20261029.1). Audit Logs v2 got an [analytics dashboard](https://developers.cloudflare.com/changelog/post/2026-10-30-audit-logs-v2-account-analytics/), and Browser Run moved to [Chrome 152 by default](https://developers.cloudflare.com/changelog/post/2026-10-30-chrome-152/). ### Vercel standardizes the runtime and abstracts the model Vercel's week reads as consolidation: [Node.js 26 LTS is now generally available and the default](https://vercel.com/changelog#node-js-26-lts-is-now-generally-available-on-vercel) for new projects' builds and Functions, so the runtime story is no longer something teams have to decide. [Vercel CI entered beta](https://vercel.com/changelog#vercel-ci-is-now-in-beta), running all Turborepo tasks rather than just builds, and the firewall split its bot blocking into [separate managed rulesets for AI crawlers and AI assistants](https://vercel.com/changelog#control-ai-crawlers-and-assistants-separately-in-vercel-fire) — you can now let one in and keep the other out. AI Gateway's [virtual models](https://vercel.com/changelog#virtual-models-now-available-on-ai-gateway) let you store routing, fallbacks and compliance choices behind a custom model slug usable by apps and coding agents. On the SDK side, the [harness adapter now runs on the host](https://vercel.com/changelog#the-fx-adapter-now-runs-the-harness-on-the-host) for faster responses, [Flags cold-start roughly 7x faster](https://vercel.com/changelog#vercel-flags-starts-7x-faster-and-no-longer-extends-function) with reporting that no longer extends function duration, and a [Vercel plugin for Antigravity](https://vercel.com/changelog#vercel-plugin-is-now-available-in-antigravity) teaches that agent your Vercel APIs. In AI SDK, [LanguageModelStreamPart and filterActiveTools graduated to stable](https://github.com/vercel/ai/releases/tag/ai%407.0.157) (old names remain as deprecated aliases, so migration can be gradual), and the Pi harness [dropped its workspace mirror](https://github.com/vercel/ai/releases/tag/%40ai-sdk/harness-pi%401.0.170) — sessions suspended before that change resume fresh and lose history, so move project context into instructions. Railway, for its part, now [patches and redeploys services automatically after credential regeneration](https://railway.com/changelog#automatic-security-patches-redeploys-after-credential-regene), quietly removing a manual step from incident response. ## Releases covered ### Cloudflare - [Cloudflare Durable Objects now defer code updates by default, up to 5 minutes](https://developers.cloudflare.com/changelog/post/2026-10-30-durable-objects-deferred-code-updates/) - [Cloudflare Workers workerd v1.20261028.1 adds Durable Object onHibernate dispatch](https://github.com/cloudflare/workerd/releases/tag/v1.20261028.1) - [Cloudflare Workers runtime v1.20261101.1 adds Durable Object facets](https://github.com/cloudflare/workerd/releases/tag/v1.20261101.1) - [Workers workerd v1.20261031.1 defers cross-context actions on idle Durable Objects](https://github.com/cloudflare/workerd/releases/tag/v1.20261031.1) - [Cloudflare Agents SDK turns Agent Skills into workspace files](https://developers.cloudflare.com/changelog/post/2026-10-29-agent-skills-from-files/) - [Cloudflare Agents SDK adds internal hostnames for private dev-server browser previews](https://developers.cloudflare.com/changelog/post/2026-10-28-browser-internal-hostnames/) - [Wrangler 4.156.0 stops uploading .env and .git as public assets](https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.156.0) - [Workers autoconfig 0.8.3 stops leaking .env and .git as public assets](https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/autoconfig%400.8.3) - [Wrangler 4.156.1 fixes Pages deploy uploading files outside requested directory](https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.156.1) - [Cloudflare Workers subrequests to BYOIP destinations keep context and client bot signals](https://developers.cloudflare.com/changelog/post/2026-10-30-byoip-workers-subrequest-context/) - [Cloudflare Keyless SSL now supports TLS 1.3 with ECDSA certificates](https://developers.cloudflare.com/changelog/post/2026-10-30-keyless-ssl-tls13-ecdsa/) - [Cloudflare China Network serves Challenge Pages with China-hosted Turnstile](https://developers.cloudflare.com/changelog/post/2026-10-28-china-native-challenge-pages/) - [Cloudflare adds WAF rule for Nuxt Image and IPX vulnerability](https://developers.cloudflare.com/changelog/post/2026-10-30-emergency-waf-release/) - [Cloudflare updates WAF rules for PHP OOM vulnerabilities CVE-2026-109618 and CVE-2026-109619](https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/) - [Cloudflare D1 to enforce 50 MB maximum query result size on November 4](https://developers.cloudflare.com/changelog/post/2026-10-30-query-result-size-limit/) - [Cloudflare retires classic DNS records page for all users](https://developers.cloudflare.com/changelog/post/2026-10-30-classic-dns-records-page-retired/) - [Cloudflare Workers Static Assets can now be served from a URL path prefix](https://developers.cloudflare.com/changelog/post/2026-10-28-static-assets-base-path/) - [Cloudflare Workers VPC lets each Network binding select its own virtual network](https://developers.cloudflare.com/changelog/post/2026-10-28-virtual-network-bindings/) - [Miniflare 5.20261023.2-beta adds remote Analytics Engine bindings in local dev](https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20261023.2-beta) - [Cloudflare Vite plugin 1.66.0 adds remote Hyperdrive bindings and new dev registry path](https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/vite-plugin%401.66.0) - [Workers runtime v1.20261030.1 adds SHA-3, ChaCha20-Poly1305, and MLKEM768-X25519 to WebCrypto](https://github.com/cloudflare/workerd/releases/tag/v1.20261030.1) - [Workers runtime v1.20261029.1 fixes formData binary corruption in TS streams](https://github.com/cloudflare/workerd/releases/tag/v1.20261029.1) - [Cloudflare Audit Logs v2 adds account-level analytics dashboard](https://developers.cloudflare.com/changelog/post/2026-10-30-audit-logs-v2-account-analytics/) - [Cloudflare Browser Run defaults to Chrome 152 with updated User-Agent](https://developers.cloudflare.com/changelog/post/2026-10-30-chrome-152/) ### Railway - [Railway adds automatic security patches and redeploys after credential regeneration](https://railway.com/changelog#automatic-security-patches-redeploys-after-credential-regene) ### Vercel - [Vercel makes Node.js 26 LTS generally available and default for new projects](https://vercel.com/changelog#node-js-26-lts-is-now-generally-available-on-vercel) - [Vercel CI enters beta to run all Turborepo tasks on Vercel](https://vercel.com/changelog#vercel-ci-is-now-in-beta) - [Vercel Firewall adds separate managed rulesets for AI crawlers and AI assistants](https://vercel.com/changelog#control-ai-crawlers-and-assistants-separately-in-vercel-fire) - [Vercel AI Gateway adds virtual models with routing and fallbacks](https://vercel.com/changelog#virtual-models-now-available-on-ai-gateway) - [Vercel fx adapter runs harness on host for faster responses](https://vercel.com/changelog#the-fx-adapter-now-runs-the-harness-on-the-host) - [Vercel Flags starts 7x faster on cold starts and no longer extends function duration](https://vercel.com/changelog#vercel-flags-starts-7x-faster-and-no-longer-extends-function) - [Vercel plugin brings Vercel API guidance to Antigravity agents](https://vercel.com/changelog#vercel-plugin-is-now-available-in-antigravity) - [AI SDK ai@7.0.157 graduates stream part and filterActiveTools to stable](https://github.com/vercel/ai/releases/tag/ai%407.0.157) - [AI SDK harness-pi 1.0.170 drops workspace mirror and breaks suspended sessions](https://github.com/vercel/ai/releases/tag/%40ai-sdk/harness-pi%401.0.170)