Cloudflare Workers' build environment now ships with newer defaults for the core runtimes and associated tooling. Node.js moves from 24.18.0 to 24.21.0, Python from 3.13.3 to 3.14.8, Ruby from 3.4.7 to 3.4.11, Go from 1.24.3 to 1.27.2, Bun from 1.2.15 to 1.4.3, Yarn from 4.9.1 to 4.18.1, and the Python package managers pip, pipx, Poetry, and uv also receive version bumps. The change is transparent for most projects, but the new defaults can affect build behavior, compatibility, and security posture.
Runtime version changes
- Node.js: 24.18.0 → 24.21.0 (override with
NODE_VERSION) - Python: 3.13.3 → 3.14.8 (override with
PYTHON_VERSION) - Ruby: 3.4.7 → 3.4.11 (override with
RUBY_VERSION) - Go: 1.24.3 → 1.27.2 (override with
GO_VERSION)
Tooling and package manager updates
- Bun: 1.2.15 → 1.4.3 (override with
BUN_VERSION) – supports bothbun.lockbandbun.locklockfile formats. - Yarn: 4.9.1 → 4.18.1 (override with
YARN_VERSION) - pip: 25.1.1 → 26.2.1
- pipx: 1.7.1 → 1.17.2
- Poetry: 2.1.3 → 2.4.3
- uv: 0.7.13 → 0.12.10
Operational considerations
Builds automatically adopt the new defaults unless a version is explicitly pinned. Pinning can happen in three ways:
- Setting the corresponding environment variable (e.g.,
PYTHON_VERSION=3.13.3). - Providing a version file such as
.nvmrc,.node-version,.python-version, or.ruby-version. - Hard‑coding a tool version inside the build script.
If you rely on the previous defaults, add the appropriate environment variable to your build configuration to lock the older version. Otherwise, let the platform upgrade you to the newer runtime and toolset.
Security and stability impact
Each version bump includes upstream bug fixes and security patches, reducing the exposure surface of the build environment. However, newer runtimes can also introduce subtle behavior changes or deprecate APIs. Practitioners should verify that their code, dependencies, and CI pipelines remain functional after the upgrade. The Bun lockfile compatibility note indicates that existing projects will continue to resolve dependencies without modification, but similar compatibility guarantees are not stated for the other runtimes.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
- Audit your CI/CD definitions for any explicit version overrides; decide whether to keep them or adopt the new defaults.
- Run a test build against the updated environment to catch regressions early.
- Check that lockfile formats (e.g.,
bun.lock) are still recognized if you use Bun. - Monitor build logs for warnings about deprecated APIs or unexpected version changes.
- Document the new default versions in your internal tooling matrix to keep future onboarding consistent.