> ## Documentation Index > Fetch the complete documentation index at: https://docs.vertracloud.app/llms.txt > Use this file to discover all available pages before exploring further. # v26.4.7 — October 22, 2026 > Released October 22, 2026: Deno, .NET and Elixir support, updated runtimes, more reliable language detection with a LANGUAGE override, vCPU that scales with project RAM, and missing_dependencies removed **v26.4.7** October 22, 2026 ### Deno, .NET and Elixir Three new languages are available when you create an application. * **Deno** (`deno`): 2.9.8 recommended and latest, plus 2.8.3. Detected from `deno.json`, `deno.jsonc` or `deno.lock`. `MAIN` is the entry file, such as `main.ts`. * **.NET** (`dotnet`, shown as .NET (C#)): 10.0.402. Detected from `.csproj`, `.fsproj`, `.sln` or `global.json`. `MAIN` is the `.csproj`, and the app listens on the port in `ASPNETCORE_HTTP_PORTS`, which is already set to 80. * **Elixir** (`elixir`): 1.20.4 on OTP 28. Detected from `mix.exs`. Phoenix is supported with `SECRET_KEY_BASE` and `PHX_HOST` set as environment variables. Run `mix assets.deploy` before zipping, or use a project without assets. Step-by-step guides: [Deno](/tutorials/deno.md), [.NET](/tutorials/dotnet.md) and [Elixir](/tutorials/elixir.md). ### Updated runtimes and end of support Every runtime moved to its latest patch release: | Language | Recommended | Latest | | - | - | - | | JavaScript and TypeScript | Node.js 22.23.4 | 24.22.1 | | Bun | 1.3.14 | 1.4.4 | | Python | 3.13.17 | 3.13.17 (3.12.15 and 3.11.17 also available) | | Go | 1.26.10 | 1.27.3 | | PHP | 8.3.36 | 8.4.27 (8.2.35 stays until the end of its support on December 31, 2026) | | Ruby | 3.3.12 | 3.4.11 | | Rust | 1.99.1 | 1.99.1 | Versions that reached end of support were removed: Node.js 18 and 20, Bun 1.2, Go 1.21 to 1.23, Ruby 3.2, and Rust 1.97 and 1.98. An application saved on an older version now runs on the newest release of the same line (for example, Python 3.11 runs on 3.11.17). If the whole line was removed, it runs on the `recommended` version. Check the full list in the [knowledge base](/knowledge-base.md#2-supported-languages) or with [List Runtimes](/api-reference/endpoint/apps/runtimes.md). ### Security fixes in the updated runtimes The new versions include these upstream security fixes. Applications pick them up on their next deploy or restart. * **Node.js 22.23.4 and 24.22.1**: seven fixes, including CVE-2026-111497 in the Brotli decoder. 24.22.1 also fixes CVE-2026-105483. [Node.js advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) \ `CVE-2026-105481` `CVE-2026-105482` `CVE-2026-106069` `CVE-2026-106072` `CVE-2026-106073` `CVE-2026-106074` * **PHP 8.2.35, 8.3.36 and 8.4.27**: CVE-2026-109618 and CVE-2026-109619, both in the PHP core. [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) * **Python 3.11.17, 3.12.15 and 3.13.17**: eight fixes, including CVE-2026-82049 in `tarfile`. 3.13.17 also ships updated root certificates. [3.11.17](https://www.python.org/downloads/release/python-31117/), [3.12.15](https://www.python.org/downloads/release/python-31215/) and [3.13.17](https://www.python.org/downloads/release/python-31317/) release notes \ `CVE-2026-15310` `CVE-2026-15806` `CVE-2026-17084` `CVE-2026-19445` `CVE-2026-19553` `CVE-2026-19672` `CVE-2026-87910` * **Go 1.26.10 and 1.27.3**: CVE-2026-56866 in `net/http`, CVE-2026-111943 in `crypto/x509` and the other fixes of the 1.26 and 1.27 lines. [Go release history](https://go.dev/doc/devel/release) * **Bun 1.3.14 and 1.4.4**: fixes for HTTP request smuggling, TLS, WebSocket and the package manager. [Bun 1.3.14](https://bun.sh/blog/bun-v1.3.14) and [Bun 1.4.4](https://bun.sh/blog/bun-v1.4.4) ### More reliable language detection The platform now reads only the manifest files at the root of the project and checks each ecosystem before `package.json`. A Python, PHP (Laravel) or Ruby (Rails) project that also has a front-end `package.json` is no longer taken for JavaScript. `bun.lock` is recognized as Bun, Java projects are also recognized by `build.gradle.kts`, `settings.gradle(.kts)`, `mvnw` and `gradlew`, and `MAIN=./src/index.js` is accepted. To force a language, set `LANGUAGE=` in `vertracloud.config` (the key is `"language"` in `vertracloud.config.json`) or send `language` on `POST /v1/apps`. The precedence is the API field, then the config file, then detection. See [Configuration](/configuration.md). ### The creation wizard shows what was detected Before you create an application, the creation wizard in the dashboard now shows the detected language, the main file and the version, so you can check them (or set them yourself) before anything is built. ### vCPU now scales with each project's RAM A project's vCPU now grows with its RAM, up to the plan's vCPU: on plans with up to 2 vCPU, +1 vCPU for every 512 MB, and on plans with more than 2 vCPU, +1 vCPU for every 1 GB. Projects with 512 MB or more get at least 2 vCPU (never above the plan), and smaller ones get at least 1. Small projects on smaller plans gain vCPU, and on plans with more than 2 vCPU a project's vCPU now follows its RAM (for example, 4 GB = 4 vCPU). The change applies the next time the project restarts or is deployed. See [Plans and limits](/plans-and-limits.md). ### Breaking change: `missing_dependencies` removed The warning about missing dependencies shown before you send a project is gone, and the `missing_dependencies` field is no longer returned by the upload and application responses. If your code reads this field, remove it. When an application crashes because a dependency is missing, the application's logs still show it. ### Automatic cleanup when the language changes When you change an application's language, the dependencies of the previous language are now cleaned up automatically on the next restart. The `cleanup_old_runtime_language` field of the restart route was removed and is ignored if sent. ### `INVALID_LANGUAGE` answers 400 `INVALID_LANGUAGE` is now documented, and returned, as HTTP `400` instead of `500`, because it reports a value the request sent. See [Errors](/api-reference/errors.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.