# What changed in @opennextjs/cloudflare

> 97 changes in @opennextjs/cloudflare 1 from its official release notes, upgrade guides and advisories: 9 breaking, 1 deprecations, 4 security, 13 new APIs and options. Each one cited. Sources checked 2026-10-22. HTML: https://unstale.sh/npm/@opennextjs/cloudflare/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @opennextjs/cloudflare 1

### Breaking changes

- Raises the supported version floor to 15.5.27 and 16.3.8 to include the latest security fixes. (1.20.8) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.8)
- Raises the supported Next.js version floor to 15.5.26 or 16.3.6 because versions 16.2.0 through 16.3.5 are affected by a critical next/og remote code execution vulnerability. (1.20.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.7)
- The override of process.version is removed; unenv now provides the behavior. (1.19.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.3)
- The override of process.versions.node is removed; unenv now provides the behavior. (1.19.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.3)
- Raises the minimum Next.js release version to 15.5.15 or 16.2.3 to fix CVE-2026-23869. (1.19.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.0)
- The build now errors for unsupported Next versions, which may contain unpatched security vulnerabilities. (1.16.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.0)
- The package no longer injects setImmediate or clearImmediate into the global scope. (1.14.9) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.9)
- Building Next 16.1+ requires wrangler >= 4.59.2 so workerd has a required setImmediate fix. (1.14.9) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.9)
- A node middleware is detected early and produces an error. (1.11.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.11.1)

### Security

- Encoded paths are handled safely so they cannot bypass middleware matching or select partially decoded cache entries. (1.20.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.2), [security advisory](https://github.com/advisories/GHSA-2VC4-C4R6-P6V6)
- opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass (1.17.1) — [security advisory](https://github.com/advisories/GHSA-C7MQ-GH6Q-6Q7C)
- Fixes CVE-2025-67779. (1.14.6) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.6)
- Next, React, and @opennextjs/aws were bumped to fix vulnerabilities CVE-2025-55184 and CVE-2025-55183. (1.14.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.5)

### Deprecations

- Warns when using Next 16, alerting developers to the framework version. (1.13.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.13.1)

### New APIs and options

- Adds experimental support for Next.js Node.js middleware, bundling it into a Workers-compatible handler; requires the nodejs_compat compatibility flag. (1.20.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.3)
- Provide this credential when using the opt-in rclone upload path for remote cache population. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Add --rclone to opt in to rclone-based batch uploads when populating a remote R2 cache; the worker-based path remains the default. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Provide this credential when using the opt-in rclone upload path for remote cache population. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Provide this credential when using the opt-in rclone upload path for remote cache population. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- An optional peer dependency used for rclone-based batch uploads to populate a remote R2 cache. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Adds support for stale-while-revalidate (SWR) in revalidateTag. (1.19.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.0)
- The CLI accepts `-h` or `--help` to display its help message. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- The CLI accepts `-v` or `--version` to display the package's version. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- This flag bypasses the check for unsupported Next versions. (1.16.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.0)
- Adds a command that automatically sets up the configuration files, dependencies, and scripts needed to migrate an existing Next.js application to the OpenNext Cloudflare adapter. (1.16.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.0)
- Running wrangler deploy adds this environment variable so Wrangler knows it is being run by OpenNext. (1.14.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.5)
- The Wrangler configuration template now includes an image binding. (1.14.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.1)

### Performance

- When the app does not use ImageResponse or opengraph-image, the real @vercel/og library is no longer pulled into the Worker bundle, reducing bundle size. (1.19.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.4)
- Large repeated values are factored in manifests, reducing the size of generated code. (1.19.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.3)
- Tag data fetched from the Durable Object on a shard miss is reused when populating the regional cache, avoiding a second identical read. (1.19.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.2)
- og is no longer bundled when unused, saving about 500 kB. (1.15.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.15.0)
- Unused react-dom modules are dropped, saving about 500 kB in the output bundle. (1.15.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.15.0)
- R2 cache population can use batch uploads when R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, and CF_ACCOUNT_ID are configured. Supported deployment commands use batch upload automatically; otherwise, the CLI falls back to standard Wrangler uploads. (1.11.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.11.0)

### Behavior and default changes

- R2 can be populated when the domain is protected by Cloudflare Access; configure a Service Auth policy and set CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET. (1.19.10) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.10)
- R2 cache uploads now retry up to 15 times with capped exponential backoff, improving resilience against transient write failures during cache population. (1.19.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.7)
- Build condition transforms now support object-valued conditions and prune siblings unless their subtree also contains the build condition. (1.19.6) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.6)
- The command attempts to create an R2 bucket for caching; if that is not possible, it generates an application without caching enabled. (1.17.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.17.0)
- Regional cache can now be used with KV. (1.16.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.2)
- Any local path is allowed when localPatterns are not specified. (1.14.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.4)
- R2 cache population now uses this Wrangler command. (1.13.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.13.0)

### Tooling

- More Wrangler command logs are output when a command fails, making failures easier to diagnose. (1.14.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.5)
- create-cloudflare will use a standard Next template generated from create-next-app. (1.12.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.12.0)
- Turbopack is now supported. (1.12.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.12.0)

### Fixes and other changes

- Next.js 15 builds no longer fail as unsupported now that Next.js 15 is two years old; a major version stays supported until the second next major is released. (1.20.13) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.13)
- Server action redirects now use the host of the request. (1.20.13) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.13)
- Named webpack chunks are bundled into the Worker and load correctly, fixing 500 errors when server code loads chunks named with webpackChunkName. (1.20.13) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.13)
- Adds support for Next.js 16.4. (1.20.12) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.12)
- Includes preview-props.json in loadManifest build-time inlining. (1.20.12) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.12)
- The Node.js middleware no longer bundles @vercel/og when it is not used. (1.20.11) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.11)
- Image responses now use the format produced by the Images binding, so the Content-Type matches the image bytes when the binding falls back to another format. (1.20.10) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.10)
- The build no longer logs `Failed to copy` for packages whose exports is a string. (1.20.10) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.10)
- The build skips route directories matching internal manifest globs, avoiding EISDIR errors or unresolved imports; only manifest files are inlined. (1.20.10) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.10)
- Isolates module-loading cache signals between requests to prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic when timers cross Cloudflare Worker request contexts. (1.20.9) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.9)
- Renaming esbuild's __require helper now skips property accesses, avoiding SSR failures for packages with @rollup/plugin-commonjs lazy-init wrappers. (1.20.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.7)
- Replaces the whole loadCustomCacheHandlers method body so Next.js 16.3 runtime chunks no longer fail with ReferenceError; older versions remain unaffected. (1.20.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.7)
- The missing optional dependency stub now sets the MODULE_NOT_FOUND code, allowing Next.js to fall back to react-dom/server.browser. (1.20.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.7)
- Stubs out the instrumentation loader in the Node.js middleware bundle, avoiding unsupported dynamic requires while the server function continues registering the hook. (1.20.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.3)
- Turbopack chunks are patched for both server and Node.js middleware bundles so wasm-backed imports do not rely on workerd’s unsupported WebAssembly.compileStreaming. (1.20.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.3)
- Normalizes Windows paths when patching the Turbopack runtime so traced chunks are included in generated runtime loaders on Windows builds. (1.20.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.2)
- Response compression is disabled for skew protection API requests to avoid truncated Cloudflare API responses causing worker version lookups to fail during deployment. (1.20.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.1)
- Response compression is disabled during provisioning to avoid truncated compressed Cloudflare API responses causing provisioning to fail. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Tag purges now reach the Cloudflare cache instead of failing on multi-tag binding counts, preventing stale pages when bypassTagCacheOnCacheHit is enabled. (1.20.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.20.0)
- Metadata-only worker versions are filtered out so they cannot become the latest target and cause /_next/static/* requests on past deployments to return 404. (1.19.11) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.11)
- Expected SQLite errors when the D1 tag-cache columns already exist are no longer logged. (1.19.6) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.6)
- Turbopack WebAssembly loading uses synchronous instantiation and statically imported chunks because streaming WebAssembly calls are unavailable in workerd. (1.19.6) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.6)
- Adds missing Git-ignored files to the migrate command. (1.19.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.5)
- Cache keys now use OPEN_NEXT_BUILD_ID instead of NEXT_BUILD_ID, which can be fixed when deploymentId is set explicitly in Next 16.2. (1.19.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.4)
- Fixes the logic that determines whether the tag cache is stale. (1.19.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.4)
- When required config is missing, prompts in non-TTY environments now fail with actionable guidance instead of hanging or failing cryptically; interactive behavior is unchanged. (1.19.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.3)
- Environment resolution now uses the selected Wrangler config and environment passed from CLI arguments. (1.19.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.2)
- Peer dependency support now covers Next.js 15.5.15 and above in the 15.x line, and 16.2.3 and above in the 16.x line. (1.19.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.2)
- Turbopack external modules listed in serverExternalPackages are discovered and included in the worker bundle. (1.19.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.2)
- Forwards isStale() in withFilter, preserving stale-state behavior when filtering tag-cache entries. (1.19.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.1)
- Fixes `use cache` not working as expected in Next.js 16 and later. (1.19.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.19.0)
- Checks longer route paths first so suffix routes are resolved correctly and do not collide with shorter paths. (1.18.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.18.1)
- Fixes OG behavior with Next 16.2.2. (1.18.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.18.1)
- R2 cache population uses remote dev, avoiding the Cloudflare API rate limit that caused failures for large applications with thousands of prerendered pages. (1.18.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.18.0)
- Included in build-time inlining by the patched loadManifest(), preventing a runtime throw when NextNodeServer.getPrefetchHints() loads the manifest. (1.17.3) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.17.3)
- The adapter now handles specific known optional manifests when they are missing, preventing dynamic routes from crashing with 500; unknown manifests still throw. (1.17.2) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.17.2)
- In development, /cdn-cgi/image behaves like it does in production for consistency. (1.17.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.17.1)
- The CLI caps the compatibility date it sets in the wrangler config to the current date, preventing it from setting a future date when workerd publishes a matching version. (1.16.6) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.6)
- Prevents the Worker from hanging on HEAD requests to static assets. (1.16.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.5)
- The migrate command now creates a Next.js config file if one doesn't exist, as required by open-next. (1.16.5) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.5)
- The command no longer errors when the target application does not have a public directory. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- The command now updates Next.js config files. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- The command avoids adding unnecessary newlines when creating files. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- Unknown commands now display a clear and helpful error message. (1.16.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.16.4)
- Next 16 is now supported. (1.15.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.15.0)
- Fixes detection of whether the runtime is webpack or Turbopack. (1.15.0) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.15.1), [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.15.0)
- Patches Next config for missing fields in Next 16.1.0–16.1.3. (1.14.10) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.10)
- R2 bulk put now respects bucket jurisdiction. (1.14.8) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.8)
- Composable cache is supported in Next 16. (1.14.7) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.7)
- The wrangler.jsonc created by the CLI now includes the missing WORKER_SELF_REFERENCE service binding. (1.14.4) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.4)
- Fixed response.validate with the turbo pages runtime. (1.14.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.14.1)
- Missing awaits were added. (1.11.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.11.1)
- Compiled config is imported using pathToFileURL to avoid crashes on Windows. (1.11.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.11.1)
- Shell quoting on Windows is fixed to avoid upload errors for routes with `[...path]` segments. (1.11.1) — [release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases/tag/%40opennextjs/cloudflare%401.11.1)