npm / @astrojs/cloudflare
@astrojs/cloudflare
What changed in @astrojs/cloudflare 13 to 14, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
1 breaking1 security1 behavior and defaults8 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@astrojs/cloudflare 1410 changes
Breaking changes 1
This release requires astro@^7.4.0.
Behavior and default changes 1
Image processing on prerendered pages now uses Astro's built-in image pipeline, so images behave the same as on other adapters.
Fixes and other changes 8
astro sync, astro check, and astro build no longer overwrite the dependency cache of a running astro dev server and cause it to fail.
The endpoint now responds with a 404 or 400 when href points to a missing file or a file that isn't an image, instead of returning a 500 error.
Options passed to sharpImageService() are now respected when generating images at build time with imageService: 'compile'.
Fixes custom src/fetch.ts rendering truncated pages without islands or hoisted scripts in astro dev when prerenderEnvironment: 'node' is set.
Fixes Cannot find package errors when prismjs is not hoisted, including with pnpm's global virtual store or hoist=false.
The assetQueryParams option is now applied to images on prerendered pages the same way as everywhere else.
The build.assetsPrefix option is now applied to images on prerendered pages the same way as everywhere else.
Images optimized with the Cloudflare Images binding are now properly cached between builds.
@astrojs/cloudflare 131 changes
Security 1
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)