Node.js 22, the minimum HubSpot names, itself reaches end of life on 30 April 2027, so teams upgrading CI runners now have a reason to go straight to Node.js 24.
HubSpot ends design manager serverless functions on 1 February 2027
EditorialBy TrustList Editorial
New functions and new Node.js 20 workflow code actions are blocked from 3 November, edits stop on 17 November, and HubSpot cannot migrate the functions itself. Existing Node.js 20 actions keep running.
- United States
- Massachusetts
- Cambridge, Massachusetts
- CRM Software
- +3 more
About HubSpot ends design manager serverless functions on 1 February 2027
HubSpot ends design manager serverless functions on 1 February 2027
3 November 2026: HubSpot will switch off serverless functions built in its design manager on 1 February 2027, after which requests to their /_hcms/api/ endpoints will fail. The company says they run on Node.js 18 or 20, which it cannot upgrade and which no longer get security updates. A second change, for workflow custom code actions on Node.js 20, shares two of the dates but does not end in a switch-off.
Not yet independently verified. HubSpot gives no end date for existing Node.js 20 custom code actions and no figure for how many customers use either feature. This rests on HubSpot's own changelog entry. We will update this when it can be confirmed, and remove this note.
Three dates for design manager functions
The sunset runs in stages, and the first has already passed:
- from 3 November 2026, no new design manager serverless functions can be created;
- from 17 November 2026, existing ones can no longer be edited, including staging and deploying packages through the design manager private beta;
- from 1 February 2027, they stop running.
Between the second and third dates the functions keep working, so the first sign of trouble for a site that does nothing will be on 1 February, when a form, calculator or lookup that calls one stops answering. HubSpot cannot migrate them for the owner, because each function's code and the pages that call it are specific to a site. The migration is a rebuild in a developer project, where the function is served from /hs/serverless/ instead of /_hcms/api/, followed by changes to every template, module and setting that calls the old path.
Code actions: new Node.js 20 blocked, old ones left running
For workflows, Node.js 24 is now available for custom code actions. From 3 November no new Node.js 20 actions can be created, and from 17 November changes to existing ones cannot be saved, as is already true for Node.js 16. Existing actions continue to run, and HubSpot states no end date for them. It warns that the upgrade is not only a version number: Node.js 24 does not support callback-style handlers, and the libraries available to the code have new versions, so each action needs updating and testing. Its Breeze assistant can update the actions in a workflow.
Developer projects on older platform versions
The same page reminds teams with functions in developer projects that the Node.js version follows the project's platform version. Projects on 2026.03 and 2026.09 run Node.js 24 and need nothing now. Those on 2023.1, 2023.2 or 2025.1 run Node.js 18 or 20 without security updates, and HubSpot says builds and deploys on those versions are already blocked; the fix is hs project migrate and a redeploy.
What is new since the CLI notice
This is separate from the end of Node.js 20 support in HubSpot's developer command line tool on 8 January 2027, which we covered in an earlier item. That change affects the tooling developers run; this one affects code already running inside customers' websites and workflows.
Related on TrustList:
Sources
Categories & features
- United States
- Massachusetts
- Cambridge, Massachusetts
- CRM Software
- Node.js
- CMS
- API
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
The default ceiling sits up to 50% above an account's monthly credits. Customers can also cap their marketing contacts tier and buy credits in flat monthly packs or pay as they go.
Neither bulletin reports exploitation, but ColdFusion servers have been attacked soon after past patch days; AEM 6.5 customers must apply named hotfixes on top of their service pack.
CVE-2026-111497 is rated 9.2 by Google and hits every Brotli release from 1.0.3 to 1.2.0. Envoy, the PyPI packages and Debian have shipped fixes; Ubuntu still ranks it medium.
A four-month, non-equity programme for robotics start-ups in healthcare and life sciences. Applications close on 31 December, and the cohort runs from February to June 2027.
Three high severity flaws affect customer-managed zones on version 5; version 6 is not affected, and Italy's national cyber agency rates the systemic impact as medium.
PTC and Schneider Electric signed a merger agreement on 4 October and announced it on 5 October: $205 in cash per share, about $22.6bn for the equity, closing anticipated by Q3 2027 subject to shareholder, HSR and CFIUS approval.
Italy's ACN and the Dutch NCSC report attacks on the core update race condition fixed in WordPress 7.1.4, in which an unauthenticated attacker runs code from the staging folder during an update. Backports go to 4.7.39.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More United StatesThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.