# Changelog

## Unreleased

## wdl.20261110.1 - 2026-11-11

- Updated workerd and Workers types to `1.20261110.1` and `5.20261110.1`, raising the maximum compatibility date to `2026-11-17`. Includes module-loading crash fixes, stdio buffer safety, RPC cancellation cleanup, and Node BlockList and integer-conversion fixes. No WDL state migration is required.
- Dynamic Workers explicitly retain the legacy module registry, including at newer compatibility dates, to preserve WDL wrapper semantics. Incoming `Request.signal` defaults on at compatibility date `2026-11-17`; static worker flags remain unchanged.
- Refreshed the Distroless base image, OpenAI SDK and OXC test tooling, and Rust dependency patches.

## wdl.20261108.1 - 2026-11-09

- Updated workerd and Workers types to `1.20261108.1` and `5.20261108.1`, raising the maximum compatibility date to `2026-11-15`. Includes SQLite 3.54.1, native GC/response-cancellation fixes, Rust-backed buffer transcoding, and Zstd flushing fixes. Static worker flags are unchanged; no WDL state migration is required.
- Native RPC readable cancellation now reaches the source, and abandoned native writable streams abort their sinks. Durable Objects enforce a separate 32,768 non-hibernatable WebSocket limit across compatibility dates.
- Added native `tracing.withActiveSpan()` and the `nodejs_process_version_24` version-reporting opt-in.
- Refreshed Node tooling and Rust dependencies, including TypeScript `7.0.2`, the OpenAI SDK test dependency `7.53.0`, and Croner `4.0.3`. Fixed Scheduler last-Sunday scheduling and duplicate occurrences after a DST gap.

## wdl.20261103.1 - 2026-11-03

- Updated workerd and Workers types to `1.20261103.1` and `5.20261103.1`, raising the maximum compatibility date to `2026-11-10`. Includes V8 15.8 and native stream/RPC finalization fixes. Static worker flags and enabled autogates are unchanged; no WDL state migration is required.
- Fixed Control routing to reject extra worker-write and auth-token path segments and prevent non-GET log-tail session activation.
- Qualified CLI `1.9.4`; the minimum supported CLI remains `1.9.0`.
- Removed redundant internal interfaces and configuration, strengthened contract tests, and synchronized bilingual documentation.

## wdl.20261101.1 - 2026-11-01

- Updated workerd and Workers types to `1.20261101.1` and `5.20261101.1`, raising the maximum compatibility date to `2026-11-08`. Includes native GC/RPC lifetime and cached-EXPLAIN safety fixes; SQLite's compiled-opcode allocation limit rises from 25,000 to 250,000. No WDL state migration is required.
- Documented native WebAssembly support and accepted opt-in `wasm_source_url_support` and `temporal`; static worker flags remain unchanged.
- Reduced eager byte-array copies for R2 Blob PUTs by preserving immutable bodies through RPC and signing, retaining the 25 MiB cap and transient retries. Arbitrary stream PUTs still validate the complete body before writing.
- Enabled negotiated gzip for live log-tail SSE while preserving incremental event delivery, identity clients, and independent session/idle cleanup.
- Refreshed the pinned Distroless `base-debian13` image and Node/Rust dependencies, including Redis `1.8.1` and Tokio `1.54.1`, with patched Minimatch for the ESLint toolchain.
- Updated Croner to JavaScript `11.0.0` and Rust `4.0.2`, aligning Control and Scheduler DST calculations: fixed times in a spring-forward gap run at the first valid post-gap time, while interval schedules cover both occurrences of a repeated hour.

## wdl.20261021.1 - 2026-10-21

- Updated workerd and Workers types to `1.20261021.1` and `5.20261021.1`, raising the maximum compatibility date to `2026-10-28`. Includes V8 15.7, pooled Rust-server connections, native stream/GC and compression safety fixes, and reduced microtask/tracing allocations. No WDL state migration is required.
- Added compact WebAssembly imports and opt-in `wasm_esm_integration_builtins`, `pipe_to_backward_propagation`, and `cache_option_preserves_cache_control`; static worker flags are unchanged. Exposed `Span.spanContext()` without span export; restored best-effort disconnect cancellation and `new Function("")` rejection when dynamic code generation is disabled.
- Updated Rust to `1.99.1`, refreshed Rust/Node dependencies and the pinned Distroless image, and qualified CLI `1.9.3` with minimum `1.9.0`.
- Disabled local Envoy's 15-second total response timeout to preserve active streams, matching Service Connect; connection, idle, and application deadlines remain.
- **Deployment:** Audit retained bundles for `cloudflare:durable-objects` `@retryable`. Before rollout, remove the decorator or switch to `retryable()`, redeploy affected workers, and retire references to old decorator-based versions. The marker still does not enable retries in WDL.

## wdl.20261008.1 - 2026-10-09

- Updated workerd and Workers types to `1.20261008.1` and `5.20261008.1`, raising the maximum compatibility date to `2026-10-15`. Includes GC allocation and exception-handling fixes, console crash fixes, and native stream and WebSocket memory-safety fixes; enables Socket transfer over JSRPC and accepts opt-in `webcrypto_modern_algorithms`. No WDL state migration is required.
- Bound Runtime R2 and Control R2/ASSETS S3 operations to 60 seconds and each cleanup page to 30 seconds. GET streams have a 30-second pending-read timeout and five-minute no-progress cleanup, without cutting off active downloads by total duration. Cancel stalled reads and retry waits without reporting ambiguous mutations as successful or advancing cleanup checkpoints.
- Refreshed Node 24 development tooling and the OpenAI SDK test dependency to `7.30.0`; updated the transitive `brace-expansion` and `smol-toml` dependencies to fix denial-of-service advisories.
- **Deployment:** Redeploy `__system__/s3-cleanup` from this release to activate the cleanup deadlines. Updating platform images does not replace its stored Worker bundle; preserve its existing D1 state, binding, and secrets. No new cleanup schema migration is required.

## wdl.20260928.1 - 2026-09-30

- Updated workerd and Workers types to `1.20260928.1` and `5.20260928.1`, raising the maximum compatibility date to `2026-10-05`. The SQLite string, BLOB, and row length limit for D1 and Durable Objects rises from a nominal 4 MiB to 8 MiB; D1 query bodies remain capped at 8 MiB, which does not bound values generated inside SQL. `1.20260929.1` is skipped: one tenant `console.log()` whose formatting throws aborts the whole workerd process ([cloudflare/workerd#7576](https://github.com/cloudflare/workerd/issues/7576)). No WDL state migration is required.
- CI and install docs now qualify `@wdl-dev/cli` `1.9.2`; the minimum supported CLI remains `1.9.0`.

## wdl.20260923.1 - 2026-09-23

- Updated workerd and Workers types to `1.20260923.1` and `5.20260923.1`, raising the maximum compatibility date to `2026-09-30`. Includes upstream native stream disconnect and BYOB fixes; new JSRPC stream cancellation remains behind disabled autogates. No WDL state migration is required.
- Refreshed the pinned Distroless `base-debian13` image used by workerd-based services.

## wdl.20260922.1 - 2026-09-23

- Updated workerd and Workers types to `1.20260922.1` and `5.20260922.1`, raising the maximum compatibility date to `2026-09-29`. Includes V8 15.4, Tokio-backed I/O, native compression buffering, and Node filesystem fixes: missing files without create flags return `ENOENT`, and `createWriteStream()` defaults to `w`. Upgrades from `wdl.20260916.1` require no WDL state migration.
- Reject oversized Queue messages and AI WebSocket frames before avoidable encoding or copying; Queue batches apply their remaining byte budget before constructing each envelope.
- Bound each Gateway WebSocket client send queue to 32 MiB in addition to its message-count limit, releasing queued payloads on close without changing reconnect ordering.
- **Operations:** Account for one additional Unix descriptor per socket monitored for disconnects when sizing process open-file limits.

## wdl.20260916.1 - 2026-09-17

- Updated workerd and Workers types to `1.20260916.1` and `5.20260916.1`, raising the maximum compatibility date to `2026-09-23`. Includes upstream facet lifetime and Node stream, filesystem, and HTTP fixes; upgrades from `wdl.20260911.1` require no state migration.
- Raised Durable Object fetch/WebSocket limits to 128 KiB of aggregate request headers and 16 KiB URLs, removing the per-header-value cap. Proxy and native HTTP limits, including internal forwarding overhead, still apply.
- Fixed KV read admission leaks when callers return before response headers arrive, retaining the single five-second total deadline.
- Rejected unsupported Workflow rollback and restart-from options, including inherited fields, before backend operations. Step rollback rejection remains terminal even when caught.

## wdl.20260911.1 - 2026-09-13

- Updated workerd and Workers types to `1.20260911.1` and `5.20260911.1`, raising the maximum compatibility date to `2026-09-18` and accepting non-experimental `auto_grpc_convert`. Includes upstream isolation, crypto-export, and Promise/stream fixes; `spec_compliant_dispatch_exceptions` defaults on for worker compatibility dates from `2026-09-15`.
- Added Workflow definition pagination with per-worker limits of 1024 retained names and 1 MiB of definition data. Capped instance-list responses at 8 MiB with cursor continuation and a five-second Control read deadline.
- Bounded Workflow deletion preflight with batched, token-fenced cleanup and lock renewal. Requests returning `workflow_lifecycle_check_incomplete` can be retried without losing completed cleanup work.
- Capped retained, active/detached, and in-flight replay bytes at 64 MiB per Runtime isolate, with retryable saturation. Enforced persisted-result limits for list/get/status and validated restart params before mutation.
- Added Terraform `system_runtime_desired_count` (default `1`), allowing system-runtime to scale to zero for maintenance.
- **Deployment:** Upgrade CLI clients to `1.9.0` or later before Control, and Workflows before system-runtime. Upgrades from `wdl.20260906.1` require no state migration.

## wdl.20260906.1 - 2026-09-07

- Updated workerd and Workers types to `1.20260906.1` and `5.20260906.1`, advancing the maximum compatibility date to `2026-09-13`; upstream runtime behavior, experimental flags, static dates, and autogates are unchanged.
- Upgraded Rust to `1.98.1` for the trait-object vtable miscompilation fix and refreshed compatible Rust dependencies.
- Refreshed the pinned Distroless `base-debian13` runtime image.
- Added offline `schema3-migrate check|apply|resume` to restore schema-2 Workflow state/history and DO alarm jobs into schema 3 while preserving replay values and identities. Ordinary Workflow APIs and deletion checks resume after verified migration; DB 15 remains archived unless explicitly deleted with `--delete-archive`.
- **Deployment:** Follow the [schema-3 migration runbook](https://github.com/wdl-dev/wdl/blob/wdl.20260906.1/docs/modules/workflows.md#deployment--rollout-notes): quiesce affected surfaces, drain old participants, and complete migration before starting final Workflows, Runtime participants, and Scheduler in order. Review shared-Valkey COPY stalls and archive memory costs; never migrate a shared database.

## wdl.20260905.1 - 2026-09-06

- Updated workerd and Workers types to `1.20260905.1` and `5.20260905.1`, raising the bundled maximum compatibility date from `2026-09-02` to `2026-09-12`. Refreshed experimental flags and documented the existing `spec_compliant_dispatch_exceptions` opt-in; static compatibility dates and autogates remain unchanged. Added active-span lookup and exception recording without span export. Object default exports preserve lazy unrelated accessors with original receivers and snapshot four wrapped handlers once.
- Bounded KV reads with 32 MiB task-level admission, 36 MiB response envelopes, and a 5-second total deadline; enforced 25 MiB values and 1024-byte serialized metadata on writes and reads. Metadata JSON is validated before persistence.
- Hardened Workflow replay with schema-3 operation kinds, exact terminal variants, and sender-owned absolute deadlines. Dispatch retries on provenance-checked KV read Errors escaping `run()` or step callbacks.
- Bounded Durable Object alarm responses to 16 KiB with 5-second body deadlines, sanitized mutation failures, and retained ambiguous-result claims until lease expiry; confirmed pre-dispatch failures and settled handler errors retry normally.
- Reduced Redis head-of-line blocking with two connections per redis-proxy logical pool and shared `TCP_NODELAY`; reduced Base64, secret-buffer, and suppressed logging allocations. Private Rust HTTP clients bypass ambient proxies and reject redirects.
- **Compatibility:** `no_rpc` is rejected. Retained SQLite defaults using disallowed functions may fail on insertion. Oversized legacy KV metadata fails closed; no DB 1 scan or migration is included.
- **Deployment:** Follow the [schema-3 runbook](https://github.com/wdl-dev/wdl/blob/134e512e13cc03d3c94a8927d154c36ccc100d3f/docs/modules/workflows.md#deployment--rollout-notes): quiesce affected surfaces, drain old Scheduler/Workflows, update user-runtime, system-runtime, and do-runtime, then start new Workflows/Scheduler. Dedicated DB 2 supports preservation into empty DB 15 or confirmed-disposable greenfield. Preservation retains DO alarm jobs but gates ordinary Workflows and deletion in `archive_pending`; migration/finalize tooling is not included. Review shared-Valkey COPY stalls and archive memory costs; never reset a shared database.

## wdl.20260826.1 - 2026-08-27

- Updated the bundled workerd and Workers types to `1.20260826.1` and `5.20260826.1`, raising the maximum tenant compatibility date to `2026-09-02`. Hibernatable WebSocket tags now retain owned storage across manager teardown.
- Refreshed the pinned Distroless `base-debian13` image.
- Allowed DeepSeek model descriptors to advertise model-owned input/output modalities and `previousResponseId` support while retaining provider-level protocol, conversation-state, stored-response, embeddings, and WebSocket restrictions. Existing-shape provider mutations remain rolling-safe, but descriptors using newly admitted capabilities must not be saved until Control and all runtime redis-proxy readers have converged on the accepting release.
- Updated root build and lint tooling, qualified OpenAI Node SDK `7.5.0`, upgraded the Rust toolchain to `1.98.0`, refreshed Rust lockfile dependencies, and removed unused integration-helper barrel exports surfaced by stricter Knip analysis.

## wdl.20260825.1 - 2026-08-26

- Updated workerd and Workers types to `1.20260825.1` and `5.20260825.1`, raising the maximum tenant compatibility date to `2026-09-01`; redundant explicit positive compatibility flags already enabled by date no longer fail Worker cold-load, and hibernatable WebSocket auto-response state now survives actor revival. Application `send()` and `close()` can still race actor eviction, so the resident default remains unchanged. Kept `new_module_registry` disabled because WDL's platform wrapper cannot preserve tenant `import.meta.main`, refreshed the experimental flag mirror, and continued rejecting Python Workers.
- Removed repeated work from Runtime hot paths by bounding live-tail negative state to 10,000 worker keys, skipping inactive payload construction, rejecting oversized Tail values and unsupported AI modalities before proportional work, resetting Redis subscriber backoff only after established subscriptions, and publishing dynamic Gateway, Runtime, and Durable Object gauges at scrape time. Removed zero-valued synchronous cold-load stage metrics and misleading per-actor Durable Object gauges.
- Carried D1 BLOB parameters and results as native `Uint8Array` values through the facade, host binding, binary wire, actor, and read cache; successful responses pass opaquely through routers, cache admission and retained bytes are bounded, wide null/empty results count against the actor budget, and ordinary mutations invalidate before dispatch and after settlement with conservative invalidation after takeover or an unknown result.
- Shared Durable Object owner hints by canonical shard, routed the first uncached fetch/RPC once, and moved route-fence authority to the host actor, removing repeated owner snapshots while preserving drain, delete, storage, session-policy, lease, and generation checks. Bounded RPC responses to 1 MiB, mapped unreadable success to `do_rpc_result_unknown`, and sanitized ownership-control failures.
- Ordered every per-object alarm backend mutation and lineage-fenced deletion, completion, repair, and transaction side effects while preserving native rollback and closed-transaction semantics. Retained the transaction-free, best-effort `deleteAll()` shim with bounded 128-key KV pages; its KV/SQL/Workflows sequence remains non-atomic, so rejection may leave a partial result and concurrent mutation remains unsupported. Native `ctx.abort(..., { retryAlarm: false })` does not control WDL's Workflows-backed alarm retries.
- Rejected unsupported Workflow `locationHint` placement before backend I/O. Kept transient backend and Redis failures retryable, including late admitted parallel-step failures, and bounded settlement by a Workflows-owned absolute dispatch deadline. Required tagged terminal payloads, fenced suspension against authoritative waiting state, and preserved committed waiting state when a Runtime response is lost or invalid.
- Made Queue delivery fail closed before destructive acknowledgement: malformed, incomplete, conflicting, or unknown decisions retry the complete batch, while specified permanent `400` errors and authoritative `413` split/single-message terminal handling remain unchanged. Bounded Queue and cron Runtime responses and D1/DO supervisor drain/renew bodies to 256 KiB, and Workflow ticks to 64 KiB, before parsing or diagnostic retention.
- Qualified CLI `1.8.1` while retaining `1.8.0` as the minimum complete CLI.
- **Deployment:** Roll Workflows first and wait for old sender tasks to drain. Next roll user-runtime, system-runtime (including Control), and do-runtime, then wait for all old D1 readers to drain. Finally scale d1-runtime to zero, wait for old tasks, targets, and in-flight requests to exit, and start the new version without old/new d1-runtime overlap; D1 is unavailable during this transition because an old router can expand native BLOB results into large number arrays while classifying them. Other services may use normal start-before-stop replacement, and normal D1 rolling may resume after this transition.

## wdl.20260818.1 - 2026-08-19

- Updated workerd and Workers types to `1.20260818.1` and `5.20260818.1`, advanced the maximum compatibility date to `2026-08-25`, and rejected the new experimental `wasm_memory_discard` flag.
- Reported the exact root `VERSION` through `/whoami` and declared CLI `1.8.0` compatibility.
- **Breaking:** Reserved every root module name beginning `_wdl-` for generated platform modules. Existing immutable versions using this prefix fail on cold load and must be renamed and redeployed before rollout.
- Moved Durable Object routing and retries into the host adapter. Pause Control mutations during the reader-first rollout until all runtime and Control tiers converge.
- Restricted D1/DO owner TTL and drain timeout settings to bounded canonical positive decimals; invalid values use the documented defaults.

## wdl.20260817.1 - 2026-08-17

- Updated the bundled workerd and Workers types pins to `1.20260817.1` and `5.20260817.1`, raising the maximum tenant compatibility date to `2026-08-24`.
- Added an opt-in namespace-scoped AI binding with encrypted BYO credentials, official OpenAI/xAI/DeepSeek adapters, OpenAI-compatible HTTP/SSE and WebSocket protocols, `run()`/`models()` helpers, public-only egress, and bounded host resources. Roll out redis-proxy and Gateway before user-runtime/do-runtime; pause Control mutations while system-runtime rolls its reader and Control writer, then publish the CLI.
- Tightened host binding and WebSocket lifecycle boundaries: Workflow identity stays exclusively in binding-scoped host props, generated tenant facades carry only public operation fields, and application-terminal backend closes propagate through Gateway instead of reconnecting to a replacement session.
- Unified Terraform ECS Fargate services on start-before-stop rolling replacement.
- Changed the private DO WebSocket object-name header to canonical ASCII encoding. This wire change is not mixed-version compatible: after rolling redis-proxy and Gateway, quiesce all tenant dispatch and terminate existing public and DO WebSockets, update user-runtime, system-runtime, and do-runtime during a maintenance window, and resume dispatch only after no old runtime task remains.

## wdl.20260815.1 - 2026-08-15

- Updated the bundled workerd and Workers types pins to `1.20260815.1` and `5.20260815.1`, raising the maximum tenant compatibility date to `2026-08-22`; adopted upstream EventTarget, stream, sandbox-boundary, WorkerLoader, HTMLRewriter, and public Web IDL error-name fixes. Affected Blob and stream adapter paths now perform O(n) safety copies, and Dynamic Workers reject `streams_disable_constructors`.
- Upgraded the vendored `@wdl-dev/aws-sigv4` signer from 3.0.1 to 3.0.4 with intrinsic bounds for typed-array and `DataView` snapshots, constructor-based snapshots that preserve large-body performance in workerd, and abort checks before payload hashing.
- Aligned R2 `BufferSource`, `Blob`, stream, and body-consumption handling with workerd: detached or out-of-bounds views fail before host calls, oversized Blobs fail before materialization, buffered chunks are snapshotted, and convenience readers reject after partial raw reads. Direct fixed-`ArrayBuffer` `Uint8Array` PUTs and raw GET chunks remain zero-copy; resizable or shared raw GET chunks are snapshotted.

## wdl.20260811.1 - 2026-08-11

- Updated the bundled workerd and Workers types pins to `1.20260811.1` and `5.20260811.1`, raising the maximum tenant compatibility date to `2026-08-18`; BYOB reads now honor live buffer bounds after resize or transfer, and Control accepts ada-url 4-preserved literal `xn--` host labels while retaining potential-IPv4 rejection. New Module Registry-only APIs remain unavailable.

## wdl.20260810.1 - 2026-08-10

- Added strict `DO_PREVENT_EVICTION` configuration: actors remain resident by default, while explicit `false` enables stock workerd eviction for workloads that accept current in-flight hibernating WebSocket limitations. Task-scoped session-policy fences prevent stale native facet reuse across host reconstruction and owner movement while preserving SQLite and quiescent hibernating WebSocket continuity.
- Updated the bundled workerd and Workers types pins to `1.20260810.1` and `5.20260810.1`, raising the maximum tenant compatibility date to `2026-08-17`.

## wdl.20260809.1 - 2026-08-10

- Updated the bundled workerd and Workers types pins to `1.20260809.1` and `5.20260809.1`, raised the maximum tenant compatibility date to `2026-08-16`, moved isolates to V8 15.1, and adopted upstream reliability fixes, zero module clocks, stateless `ctx.abort(reason?)`, expanded tracing spans, SQLite R*Tree support, and bounded console `Error` metadata.
- Reflected workerd's `2026-08-04` default enablement of `nodejs_compat` and `nodejs_compat_v2` (full opt-out requires both `no_nodejs_compat` and `no_nodejs_compat_v2`), split workerd and Node type-check programs, and continued rejecting Python modules and unsupported experimental flags.
- Kept Workflow identity out of `process.env`, reserved wrapper budgets across immutable version bumps, and documented native Workflow instance and batch deletion as unsupported by WDL's custom facade. Roll out user-runtime and do-runtime before system-runtime/Control, pausing Control mutations while the writer tier rolls.
- Pinned Quick Start and CLI integration to `@wdl-dev/cli@1.7.1`, including session-policy deploy support and fail-fast rejection of unsupported event subscriptions.

## wdl.20260804.2 - 2026-08-05

- Renamed the opt-in Durable Object restart rollout to the worker session policy: deploy and promote use `sessionPolicy`, Redis state moved to `worker:session-policy:*`, `worker:session-policy-seq:*`, and the `session-policy:restart` channel, and bundle metadata persisted under the retired `durableObjectRollout` field is dual-read.
- Allowed `sessionPolicy: "restart"` without a Durable Object binding. The policy governs established sessions only: open WebSockets close with `1012` at promotion and stale DO facets abort on their next dispatch, so a pure WebSocket worker can opt into Cloudflare-style deploy disconnects.
- For this upgrade, deploy Gateway, Workflows, and do-runtime before system-runtime/Control and keep Control mutations paused for the entire roll. A worker last promoted with `restart` behaves as `preserve` until its next promotion; leftover `worker:do-rollout*` keys are inert repair-only cleanup.

## wdl.20260804.1 - 2026-08-04

- Added opt-in Durable Object restart rollouts through the Control API's `durableObjectRollout: "restart"`, defaulting to `preserve`. Promotion commits the active projection and permanent restart sequence atomically, and do-runtime aborts superseded facets on their next dispatch without deleting SQLite state.
- Made Redis projection state the durable rollout authority, with Pub/Sub only requesting prompt Gateway reconciliation. Deploy Gateway, Workflows, and do-runtime readers before system-runtime/Control writers, and pause Control mutations while that writer tier rolls.
- Closed Gateway WebSocket sessions with `1012` when their version is superseded or their worker is deleted, and revalidated the active route before admitting a replacement backend so an already-inactive version is never reloaded.
- Removed platform code with no production callers and validation a stronger gate already guarantees, and inlined single-caller abstractions; no observable contract changed.
- Updated the bundled workerd and Workers types pins to `1.20260804.1` and `5.20260804.1`; upstream changes only advance release and maximum compatibility dates.

## wdl.20260801.1 - 2026-08-02

- Closed both sides of completed or failed Gateway WebSocket sessions, preserved status-free closes, normalized unsendable abnormal close codes, enabled bidirectional binary-frame forwarding, and restored public and backend close handshakes so abandoned sockets do not remain pinned until an external idle timeout.
- Removed the per-session `GatewayWsHolder` Durable Object; Gateway now terminates the public WebSocket pair directly and reconnects through the resolved runtime binding with the same bounded retry and client-frame buffer contracts.
- Updated the bundled workerd and Workers types pins to `1.20260801.1` and `5.20260801.1`; upstream changes only advance release and maximum compatibility dates.

## wdl.20260730.1 - 2026-07-30

- Further reduced Valkey round trips, command bytes, and request-path allocation across platform control and data paths through a shared typed command surface, bounded mixed pipelines, cached Lua scripts, and reusable RESP buffers.
- Kept Queue streams with different batch caps progressing alongside idle or slow streams through a shared readiness probe and bounded non-blocking top-ups, limited delayed-message materialization per chunk, and revalidated missing consumers immediately before destructive orphan transitions.
- Preserved Workflow replay outputs as exact persisted JSON snapshots across run claims, capped cross-request replay retention at 16 MiB per runtime isolate while bounding active-controller working sets, batched `createBatch()` preflight reads, and aligned Runtime JSON depth and lone-surrogate rejection with Rust.
- Scoped Gateway projection retries to the affected namespace or host after membership gates are warm, avoiding invalidation from unrelated deployments. Reduced serialization, copying, and allocation in D1/DO transport, R2, module loading, live-tail forwarding, and JS/Rust observability.
- Bounded sparse KV list scans to one unfinished Valkey `HSCAN` window per request; incomplete pages may contain fewer than the requested limit, including zero, and callers must follow the cursor until `list_complete`.
- Consolidated duplicated runtime, ownership, Redis/RESP, and Rust support helpers under canonical owners, refreshed compatible Rust dependencies, and pinned Quick Start and CLI integration to `@wdl-dev/cli@1.6.1`.
- Updated the bundled workerd and Workers types pins to `1.20260730.1` and `5.20260730.1`; upstream workerd changes only advance release and maximum compatibility dates.

## wdl.20260727.1 - 2026-07-27

- Hardened custom route and host declarations by normalizing them to canonical ASCII DNS hostnames and rejecting URL-authority delimiters or non-canonical IPv4 shorthand before routing metadata is written.
- Pinned Quick Start and CLI integration to `@wdl-dev/cli@1.6.0` and added end-to-end coverage for Wrangler `workers_dev` opt-out and route-only URL output.
- Updated the bundled workerd and Workers types pins to `1.20260727.1` and `5.20260727.1`.

## wdl.20260724.1 - 2026-07-25

- Added Control API `workersDev=false` support for workers with custom route patterns, allowing pattern routes to remain active while that Worker's platform-domain path returns 404; promote responses now report the active platform and pattern-route URL hints. Cloudflare uses the corresponding Wrangler `workers_dev` field for the Worker's `*.workers.dev` route, while versioned preview URLs are controlled separately by `preview_urls`, which defaults to `workers_dev`. WDL maps the setting to an ordinary platform-domain serving route, so the opt-out requires at least one route pattern.
- Updated the bundled workerd and Workers types pins to `1.20260724.1` and `5.20260724.1`.

## wdl.20260723.1 - 2026-07-23

- Reduced Valkey round trips and request bytes across Durable Object ownership, KV, queues, Workflows, Auth, Gateway routing, and log-tail paths with bounded typed pipelines, cached direct Rust scripts, atomic snapshots, and reusable RESP buffers.
- Shortened Control WATCH windows and owner lease renew/release paths with batched reads and exact-value compare-and-set operations while preserving generation, storage-pointer, and persisted-state fences.
- Made Queue retry and dead-letter transitions atomic per message: target writes complete before the source entry is acknowledged, one failed transition no longer blocks the rest of its batch, and stale discovery-index members are removed by key type with periodic repair off the reconcile hot path.
- Fenced Workflow mutations against same-id instance recreation through the persisted creation timestamp, bounded Gateway routing lookups under invalidation churn behind a new `gateway_routing_unavailable` 503, and restricted KV expiration inputs to positive JavaScript safe integers.
- Made Cron generations permanent across projection and worker deletion, and revalidated exact Cron configuration atomically before claim and advance. For this upgrade, pause Control mutations while system-runtime rolls, wait for it to stabilize, then resume mutations and deploy Scheduler and the remaining services.
- Updated the bundled workerd and Workers types pins to `1.20260723.1` and `5.20260723.1`.

## wdl.20260719.2 - 2026-07-20

- Decoupled Scheduler ticks from tenant Workflow and DO alarm completion: ticks now perform bounded maintenance and admission while admitted work continues in tracked per-replica tasks. Workflow permits remain held through runtime dispatch and fenced commit, and Scheduler uses an independent 60-second tick deadline.
- Replaced tick completion counters with admission and capacity-pressure signals, added bounded metrics for fenced Workflow commits and unknown in-flight alarm outcomes, and made Scheduler response-body read failures explicit.

## wdl.20260719.1 - 2026-07-19

- Removed shard-serial Workflows queueing by interleaving at most 128 ready candidates through a global dispatch pool, running workflow and DO alarm pools concurrently with defaults of 128 and 32, and aligning Scheduler's 130-second tick deadline with Terraform's 120-second dispatch timeout.
- Updated the bundled workerd and Workers types pins to `1.20260719.1` and `5.20260719.1`, and pinned CLI integration and Quick Start to `@wdl-dev/cli@1.5.0`.

## wdl.20260718.1 - 2026-07-19

- Upgraded the bundled runtime to workerd `1.20260718.1` and Workers types `5.20260718.1`; this date-only upstream release extends the maximum compatibility date to `2026-07-25` without runtime or schema changes.
- Made Kubernetes overlays pull the published `latest` WDL images directly instead of requiring node-local `:dev` image imports.
- Replaced the local ingress-nginx overlay with Gateway API resources for NGINX Gateway Fabric 2.6.7, preserving wildcard tenant routing, long-lived gateway requests, and the read-only ASSETS facade.
- Reduced the default retention for newly created completed, failed, and terminated Workflow instances from 7 days to 8 hours so terminal instances release worker-version deletion blockers sooner.

## wdl.20260717.1 - 2026-07-18

- Upgraded the bundled runtime to workerd `1.20260717.1` and Workers types `5.20260717.1`; tenant JSRPC can serialize `Blob` values and delegate opaque service and Durable Object class stubs, while WDL continues to reject irrevocable long-term stub storage.
- Upgraded the Rust toolchain baseline from `1.96.0` to `1.97.1` and the CLI integration pin from `1.4.0` to `1.4.1`.
- Established WDL's default forward-only, greenfield-oriented upgrade policy: downgrades are not generally guaranteed, and the documented retained compatibility-date, Durable Object `Blob`, and D1/DO localDisk metadata steps are best-effort operator guidance.

## wdl.20260701.2 - 2026-07-17

- Updated maintenance dependencies and image baselines: workerd images now use pinned distroless `base-debian13`, local and Kubernetes deployments use `valkey/valkey:9.1-alpine`, and `@wdl-dev/aws-sigv4` 3.0.1 adds stable request snapshots, redirect rejection, lowercase region validation, and non-blocking response cleanup.
- Consolidated duplicated Control, Auth, runtime, and Rust request, retry, Redis-key, projection, and observability contracts into canonical shared owners.
- Hardened gateway/runtime isolation by stripping private headers in both directions, validating scoped D1/DO owners and private forwarding endpoints, and limiting non-idempotent DO rediscovery to authenticated pre-dispatch ownership failures; request ids remain best-effort diagnostics.
- Tightened forward-only management inputs: explicit dynamic-worker compatibility dates must be at least `2026-04-01`; unsupported compatibility flags, ambiguous internal-auth/request-id values, reserved secret keys, and runtime-reserved module names are rejected.
- Tightened tenant data contracts: DO RPC accepts at most 1 MiB of structural JSON without `toJSON()` hooks, DO identities require well-formed Unicode and bounded host ids, and `Headers`-form R2 expiry requires canonical IMF-fixdate syntax.
- Made required bundle/workflow metadata, queue base64 bodies, persisted secret envelopes, and D1/DO ownership and alarm state fail closed; Control D1 lifecycle 5xx responses no longer expose raw backend diagnostics.
- Closed delegated-token, worker-delete, DO-owner, and workflow restart/version-delete races, and made whole-worker deletion clean up orphan workflow definitions without interrupting active DO traffic during inactive-version deletion.
- Normalized `PLATFORM_DOMAIN`, made the published-image Compose overlay pull-only, restricted Kubernetes user-runtime loader ingress to gateway, aligned scheduler/Workflows drain and stop windows across deployment targets, and removed the unsupported DO inline worker-code hook.

## wdl.20260701.1 - 2026-07-08

- Adapted the platform to stock workerd `1.20260701.1`, splitting process-level and loaded-worker experimental usage so `--experimental` stays only on the workerLoader-owning runtimes; see `docs/compatibility.md` for the tenant-visible runtime behavior the bump carries (notably `node:tls` unsupported-option and certificate-hostname-validation changes).
- Enforced the workerd dynamic-worker limits in the control plane before deploy and secret mutations: the estimated `workerLoader` env is held under a headroomed 1 MiB budget (`worker_env_too_large`) and total module bytes under 64 MiB (`worker_code_too_large` / `worker_code_invalid`), so oversized workers fail fast instead of at cold-load.
- Rejected tenant-declared experimental compatibility flags at deploy (`experimental_compat_flag_unsupported`) and on retained runtime metadata load, pinned against a mirror of the workerd `1.20260701.1` experimental flag set, and removed the blanket loaded-worker `experimental` flag.
- Rejected Python Worker modules at deploy and on load (`python_workers_unsupported`); WDL bundles stay JavaScript/WebAssembly/data only.
- Made worker-secret mutations commit the secret write, bundle copy, and route flip in one WATCH/MULTI transaction with an exact-version env budget recheck (removing the earlier write-then-rollback path), and moved namespace-secret mutations to an optimistic WATCH/MULTI transaction that re-estimates every affected worker/version env budget and backpressures under contention (`namespace_secret_mutation_contention`).
- Made the Durable Object `deleteAll` shim skip workerd's `_cf_`-reserved SQLite names case-insensitively, matching workerd's reserved-name enforcement.
- Bounded log-tail sessions against the workerd 2026-06-19+ behavior where client disconnects no longer reliably cancel response streams, using independent max-session and idle-pull watchdogs.
- Fixed S3 asset cleanup to checkpoint retry pagination one List/Delete page per run with a cumulative deleted count, so large-prefix cleanups drain across cron ticks without burning failure attempts, and to build the ListObjectsV2 query with S3 canonical percent-encoding so prefixes containing spaces sign and list correctly.
- Moved the Terraform stack to Fargate with explicit D1/DO runtime container memory ceilings, validated task sizing, ECS capacity-provider dependency ordering, and enhanced Container Insights.
- Upgraded the vendored `@wdl-dev/aws-sigv4` signer to 2.0.0 and the Rust `redis-proxy` `aes-gcm` (0.11) and `redis` (1.3) dependencies, preserving secret-envelope decryption behavior.
- Upgraded the local/dev stack images: S3Mock to 5.1.0 (with its renamed initial-buckets environment variable), Envoy pinned to v1.38.3, and Valkey to 9.1.
- Adopted `HGETEX` to refresh tail-activation TTLs in one round-trip, and converged secret Redis key construction and runtime injection-source ownership into single shared owners.

## wdl.20260617.2 - 2026-06-27

- Added `VERSION` as the release tag source of truth and relaxed release tag validation so multiple WDL patch releases can ship on the same locked workerd date.
- Documented HA/public ingress behavior and added configurable additional public ALB hosts for future public surfaces.
- Added the CLI integration delegated token template.
- Replaced the vendored `aws4fetch` signer with `@wdl-dev/aws-sigv4` across S3/R2 paths while preserving transient retry behavior.
- Fixed S3 list query encoding for prefixes containing spaces and expanded signer coverage for retry and signed-header behavior.
- Redacted D1 and Durable Object owner task IDs from tenant-visible metadata and error paths.
- Bounded Durable Object fetch body reads before buffering.

## wdl.20260617.1 - 2026-06-17

Initial WDL open source release

- Opens WDL as a self-hosted multi-tenant Workers platform built on stock Cloudflare workerd.
- Supports dynamic worker loading, namespace routing, control/auth, service and platform bindings, live tailing, and Prometheus metrics.
- Provides the core runtime surfaces: KV, R2, D1, Durable Objects, queues, cron triggers, Workflows, and ASSETS.
- Ships public Docker images, Docker Compose local development, Terraform greenfield AWS deployment, and Kubernetes manifests.
- Published under the Apache License, Version 2.0.