Skip to main content
​
October 22, 2026

​
Deno, .NET and Elixir

Three new languages are available when you create an application.
  • Deno (deno): 2.9.8 recommended and latest, plus 2.8.3. Detected from deno.json, deno.jsonc or deno.lock. MAIN is the entry file, such as main.ts.
  • .NET (dotnet, shown as .NET (C#)): 10.0.402. Detected from .csproj, .fsproj, .sln or global.json. MAIN is the .csproj, and the app listens on the port in ASPNETCORE_HTTP_PORTS, which is already set to 80.
  • Elixir (elixir): 1.20.4 on OTP 28. Detected from mix.exs. Phoenix is supported with SECRET_KEY_BASE and PHX_HOST set as environment variables. Run mix assets.deploy before zipping, or use a project without assets.
Step-by-step guides: Deno, .NET and Elixir.

​
Updated runtimes and end of support

Every runtime moved to its latest patch release:Versions that reached end of support were removed: Node.js 18 and 20, Bun 1.2, Go 1.21 to 1.23, Ruby 3.2, and Rust 1.97 and 1.98. An application saved on an older version now runs on the newest release of the same line (for example, Python 3.11 runs on 3.11.17). If the whole line was removed, it runs on the recommended version. Check the full list in the knowledge base or with List Runtimes.

​
Security fixes in the updated runtimes

The new versions include these upstream security fixes. Applications pick them up on their next deploy or restart.
  • Node.js 22.23.4 and 24.22.1: seven fixes, including CVE-2026-111497 in the Brotli decoder. 24.22.1 also fixes CVE-2026-105483. Node.js advisory
    CVE-2026-105481 CVE-2026-105482 CVE-2026-106069 CVE-2026-106072 CVE-2026-106073 CVE-2026-106074
  • PHP 8.2.35, 8.3.36 and 8.4.27: CVE-2026-109618 and CVE-2026-109619, both in the PHP core. GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp
  • Python 3.11.17, 3.12.15 and 3.13.17: eight fixes, including CVE-2026-82049 in tarfile. 3.13.17 also ships updated root certificates. 3.11.17, 3.12.15 and 3.13.17 release notes
    CVE-2026-15310 CVE-2026-15806 CVE-2026-17084 CVE-2026-19445 CVE-2026-19553 CVE-2026-19672 CVE-2026-87910
  • Go 1.26.10 and 1.27.3: CVE-2026-56866 in net/http, CVE-2026-111943 in crypto/x509 and the other fixes of the 1.26 and 1.27 lines. Go release history
  • Bun 1.3.14 and 1.4.4: fixes for HTTP request smuggling, TLS, WebSocket and the package manager. Bun 1.3.14 and Bun 1.4.4

​
More reliable language detection

The platform now reads only the manifest files at the root of the project and checks each ecosystem before package.json. A Python, PHP (Laravel) or Ruby (Rails) project that also has a front-end package.json is no longer taken for JavaScript. bun.lock is recognized as Bun, Java projects are also recognized by build.gradle.kts, settings.gradle(.kts), mvnw and gradlew, and MAIN=./src/index.js is accepted.To force a language, set LANGUAGE=<slug> in vertracloud.config (the key is "language" in vertracloud.config.json) or send language on POST /v1/apps. The precedence is the API field, then the config file, then detection. See Configuration.

​
The creation wizard shows what was detected

Before you create an application, the creation wizard in the dashboard now shows the detected language, the main file and the version, so you can check them (or set them yourself) before anything is built.

​
vCPU now scales with each project’s RAM

A project’s vCPU now grows with its RAM, up to the plan’s vCPU: on plans with up to 2 vCPU, +1 vCPU for every 512 MB, and on plans with more than 2 vCPU, +1 vCPU for every 1 GB. Projects with 512 MB or more get at least 2 vCPU (never above the plan), and smaller ones get at least 1. Small projects on smaller plans gain vCPU, and on plans with more than 2 vCPU a project’s vCPU now follows its RAM (for example, 4 GB = 4 vCPU). The change applies the next time the project restarts or is deployed. See Plans and limits.

​
Breaking change: missing_dependencies removed

The warning about missing dependencies shown before you send a project is gone, and the missing_dependencies field is no longer returned by the upload and application responses. If your code reads this field, remove it. When an application crashes because a dependency is missing, the application’s logs still show it.

​
Automatic cleanup when the language changes

When you change an application’s language, the dependencies of the previous language are now cleaned up automatically on the next restart. The cleanup_old_runtime_language field of the restart route was removed and is ignored if sent.

​
INVALID_LANGUAGE answers 400

INVALID_LANGUAGE is now documented, and returned, as HTTP 400 instead of 500, because it reports a value the request sent. See Errors.