Cloudflare trims its model catalog as the Workers toolchain hardens

A model catalog cull on Workers AI

The biggest deadline of the week comes from Cloudflare, which is retiring sixteen LLMs plus several image, speech, and embedding models from Workers AI on November 15, 2026. Frontier models like deepseek-v4-pro, kimi-k2.6, and glm-5.2 are on the list, as are workhorses such as llama-3.2-1b-instruct and image and audio models like stable-diffusion-xl-base-1.0 and whisper-tiny-en. Cloudflare names replacements by workload — deepseek-v4.1-flash and glm-5.3 for frontier needs, gemma-4-26b and qwen3.8-27b for smaller jobs, flux-2-klein-9b for retired image models — so anyone with hardcoded model IDs has a migration to do this month.

The Agents SDK got a performance story worth noting: its Pi harness upgrade batches streamed answers and tool output instead of persisting every update, cutting SQLite storage transactions by about 27x on long answers and reducing CPU and memory on large tool calls. The same release reworks the session API, with session.watch() replacing session.events() and session.continue() starting a fresh run without a new message, so expect some code changes alongside the speedup.

AI Gateway spent the week on credential hygiene. New gateways now require authentication, and it can't be switched off afterward — creating one with authentication set to false returns HTTP 400, while existing open gateways keep working and Workers bindings stay pre-authenticated. To help teams audit what they've stored, Gateway also shows per-key activity for provider credentials, with masked previews and last-used dates, and flags keys untouched for over 90 days for rotation or removal.

Workers runtime and tooling stabilize

The workerd releases were mostly compatibility plumbing, but a few items are worth a look before they land by default. Incoming Request.signal becomes default for compatibility dates from November 17, the new module registry turns on the same day, and the python_shared_standard_library flag is now on by default. Non-hibernatable WebSocket connections are now limited per Durable Object, and a workerd deploy command lets you serve deployments from the cluster bucket while the old untrusted inspector policy goes away. Separately, Durable Objects now retry failed fetch and RPC calls up to four times within ten seconds when the error is retryable and didn't originate in your code — though existing user-level retry loops will stack with the runtime's.

The local dev toolchain shipped a coordinated feature: Artifacts bindings can now run against Miniflare's local simulator with persistent repositories by setting remote: false. That landed across Wrangler, Miniflare, the Workers Vite plugin, Workers Vitest, and the Workers SDK, with Vitest defaulting to local so tests stop touching real repositories. The same batch swept in security bumps for brace-expansion and minimatch.

AI SDK tightens the edges

Vercel's AI SDK shipped a wide, mostly defensive set of patches. The security theme is clear: provider-utils now blocks private-destination URLs and HTTPS-to-HTTP redirects, MCP's HTTP transport rejects redirects by default, request URLs are sanitized before reaching telemetry so credentials don't leak into traces, and Google provider tools are omitted entirely when toolChoice is none so disabled File Search or Vertex RAG tools can't fetch data server-side.

On the feature side, OpenAI models now return GPT Image 2.6 with markup-guided edits and animated GIF output, plus Secure MCP tunnel support. Anthropic gained inline tools added mid-conversation and message threads, Mistral added Voxtral realtime transcription and voice agents, and Deepgram added live Nova streaming transcription. A cluster of fixes also stops silently swallowing refusals — OpenAI refusals now surface as text content instead of empty responses — and Deepgram's callback option is rejected outright rather than returned as corrupt audio.

Access, scheduling, and previews

Cloudflare One made sign-in less annoying with passkey login for Access-protected apps and the App Launcher, added fast flux detection to UEBA risk scoring, and introduced a read-only keyboard mode for Browser Isolation that blocks data entry while keeping copy, print, and zoom. Elsewhere, Vercel Schedules entered public beta for cron and one-off tasks dispatched to Functions or Queue topics, and Render warned that from November 18 it will create previews for every PR in a GitHub stack — handy for stacked work, but each preview bills resources.