One flaw sits in image optimisation of SVG files and reaches back to Next.js 10; the other hits the use cache directive in 16.x and has no workaround. A third advisory fixes a Server Actions denial of service.
Deno Deploy to shut in six months as Deno team joins Cloudflare
EditorialBy TrustList Editorial
The Deno runtime gets a year of monthly bug and security releases, then development ends; JSR keeps running on Cloudflare, and paying Deploy customers get help moving to Workers.
About Deno Deploy to shut in six months as Deno team joins Cloudflare
Deno Deploy to shut in six months as Deno team joins Cloudflare
9 October 2026: The whole Deno team is joining Cloudflare, and the company is winding down its own products to do it. Deno Deploy, its serverless hosting service, will keep running for six months and then shut down, and the Deno runtime itself will get one more year of monthly releases with bug fixes and security updates before Deno ends its development. Ryan Dahl, who created both Node.js and Deno, announced the move on Deno's blog.
What happens to each product
Dahl's post sets out the plan product by product:
- Deno runtime: supported for another year with monthly releases containing bug fixes and security updates, after which Deno ends its development. The runtime stays open source, and Dahl says others are welcome to continue it.
- Deno Deploy: operates for six more months, then shuts down. Paying customers will get migration support for a move to Cloudflare Workers.
- JSR, the TypeScript-first package registry: continues operating, with its infrastructure moving to Cloudflare.
- rusty_v8, the Rust bindings to the V8 engine that many projects use: still supported, with work towards integrating it into workerd, the runtime behind Workers.
"We know this is a consequential change for people who have built on Deno," Dahl wrote.
Why the team is moving
Dahl ties the decision to celld, a system Deno built on the Cloudflare Workers programming model to make distributed applications simpler to build and operate. At Cloudflare the team will combine that work with the Workers and Durable Objects teams, aiming to make the model "the default way to build servers", on Cloudflare's network or on a customer's own infrastructure. He singles out AI agents as the main use, because Durable Objects combine cheap serverless execution with persistent state and WebSockets. Cloudflare's own post, written jointly by Dahl and Cloudflare's Kenton Varda, says more announcements about running the platform on one's own infrastructure will follow in the coming months.
What Deno users should plan for
Neither post gives calendar dates, only the periods. Counting from the announcement on 9 October, Deno Deploy would close around April 2027 and runtime support would end around October 2027, but customers should confirm the exact dates with Deno. Teams hosting on Deno Deploy have the shorter deadline and should start testing their applications on Workers or another host now. Teams running the Deno runtime themselves have a year, after which they depend on whoever takes over the open-source project, or they move to Node.js or Bun. Anything that pulls packages from JSR is unaffected for now.
Cloudflare and Deno in our catalogue
We list Deno and Cloudflare as companies.
Related on TrustList:
- Deno joins Cloudflare: Deno Deploy shuts down in six months
- Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6
- Next.js 16.4.1 fixes two critical flaws that need no login to exploit
Sources
- Deno: Deno is joining Cloudflare (Ryan Dahl), 9 October 2026
- Cloudflare: Deno joins Cloudflare (Kenton Varda and Ryan Dahl), 9 October 2026
- heise online: Cloudflare stoppt Deno-Runtime, 14 October 2026
Categories & features
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
Vercel’s advisory of 30 September 2026 says the Node.js ImageResponse in next/og, in Next.js 16.2.0 up to 16.3.6, can allow remote code execution when attacker-controlled values reach SVG content. Upgrade to 16.3.6.
The open-source runtime gets a year of monthly fixes before development stops; JSR keeps running on Cloudflare and paying Deploy customers are offered migration help to Workers.
WebKit says Safari and WebKit on iOS, iPadOS, macOS and visionOS 27 cut off network access to identity resolution providers by domain, so marketers who rely on hashed-email IDs lose that signal from Apple users.
The rewrite took effect the day it was posted: plan credits end with the term, bought credits after a year, and a company can take over an account on its email domain after notice.
The alias and rewrite overflow affects every release since 0.1.29. The fix release also moves HTTP/2 to RFC 9218 prioritisation and adds MaxMind DB support to the GeoIP modules.
Neither bulletin reports exploitation, but ColdFusion servers have been attacked soon after past patch days; AEM 6.5 customers must apply named hotfixes on top of their service pack.
All calls to discover.shopifyapps.com/global fail from that day, saved catalogs included; apps must move to Global Catalog MCP, while the new Shop MCP adds carts and Shop Pay checkout for agents.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More United StatesThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.