The week: 16 Workers AI models end 20 November, Node.js patch day, Gemini 2.5 rerouted

On 5 November Cloudflare listed 16 language models that its Workers AI service stops serving on 20 November 2026. A request after that day gets HTTP 410 Gone (the status for an address that is gone for good) with error code 5028 ¹. Two of the 16, DeepSeek V4 Flash 0731 and GLM-5.3 Flash, are the models measured in Monday's and Friday's notes below. That list leads the five outside dates. First, the week's six notes.

Six notes, 2 to 7 November

Monday, models. GLM-5.3 on Workers AI sent 155 replies with other customers' text: from 27 August to 9 September, Cloudflare's hosted GLM-5.3 answered 155 over-long prompts with text from other customers' requests, each with HTTP 200 and a token count that looked right. The engine had rejected the prompt on paper, the queue let it through, and the decode step read cache pages with earlier users' text still in them. Our canary test, hidden codes in a long prompt asked back, found 78 of 78 codes on three models up to 77,000 tokens for US$0.46. The code is in the note.

Tuesday, last-mile. Vercel now blocks bad npm packages; the npm in every Node LTS still runs install scripts: Vercel's build check, on since 2 November, reads the lockfile against a blocklist. The first install happens earlier, on the laptop or inside the AI tool, where npm 10 and 11 run a package's install script by default. Two lines in .npmrc, min-release-age=7 and strict-allow-scripts=true, tested on npm 10, 11 and 12; npm 10 ignores both and says so.

Wednesday, security. WordPress's upgrade-window flaw: partial updates carry no installer, full ones do: CVE-2026-119977, on CISA's exploited list since 3 November, is a race while WordPress unpacks a full update, when the staged copy's installer sits in a web-served folder for a few seconds. We opened the packages the update API serves: the automatic point update is about 50 files with no installer; a jump between branches unpacks 3,338. One server rule blocks the folder, and a fixed release exists for every branch back to 4.7.

Thursday, automation. n8n 3.0: npm installs end, Code nodes time out at a minute, no way back to 2.x: beta 27 October, stable due in early December. Self-hosted n8n needs Docker, a Code node task fails at 60 seconds instead of 300, unverified community nodes stop loading, 22 kinds of node vanish, and the database migration is one way. Every latest tag still served 2.46.6 on 5 November. The migration report under Settings lists the affected workflows today.

Friday, models. Running totals over 32 changes: 0 of 10 in one go, 10 of 10 writing each step: a small version of Ai2's StateBench on two open models. Values set once or overwritten came back right at every length; running totals and swaps failed in one go from 32 changes on and passed when the model wrote the values after each step, at 30 to 46 output tokens a change. For an app: log the value, not the change, or apply the changes in code and hand the model the result.

Saturday, last-mile. Cloudflare's DNS scan is a list of common names; generated DKIM names fall outside it: the quick scan matches record type and name against a list drawn from other zones, so Amazon SES's generated DKIM names fall through. A 92-query script asks Cloudflare's new nameservers before the registrar points at them and diffs against the old ones. The .com and .net registries let resolvers cache nameserver records for 48 hours, so the old host's DNS stays as it is for two days after the switch.

Five dates, 10 November to 2 December

20 November: 16 Workers AI language models stop answering. Cloudflare's list names DeepSeek V4 Flash 0731, DeepSeek V4 Pro 0813, GLM-5.2, GLM-5.3 Flash, Kimi K2.6, Kimi K2.7 Code, Nemotron 3 120B, QwQ 32B, Qwen3 30B and seven smaller Llama, Gemma and DeepSeek R1 distill models; eight image, speech, vision and embedding models go with them, each with a named replacement ¹. The date moved from 15 to 20 November ¹. Cloudflare's replacements for the language models: DeepSeek V4.1 Flash 1017 and GLM-5.3 for frontier work, Gemma 4 26B and Qwen3.8 27B for smaller jobs ¹. On the pricing page, read 8 November 2026, the move from V4 Flash 0731 to V4.1 Flash 1017 lowers the price, US$0.44 to US$0.30 per million input tokens and US$1.32 to US$1.20 per million output; the move from GLM-5.3 Flash to GLM-5.3 raises it from US$0.15 to US$1.40 on input and from US$0.50 to US$4.40 on output, about nine times; GLM-5.3 Flash to Gemma 4 26B lowers it to US$0.10 and US$0.30 ². The model names above are the strings to search for in your code this week.

9 and 16 November, then 2 December: GitHub Actions blocks pull_request_target in public repositories. pull_request_target is a trigger that runs a workflow in the base repository, with the base repository's secrets, on a pull request from a fork ³. From 2 December GitHub blocks it by default in public repositories on Free, Team and Enterprise Cloud unless an Actions event policy allows it; private, internal and Enterprise Server repositories are not affected ³. Two brownouts, 9 and 16 November from 16:00 to 18:00 UTC, fail the runs the rule would block; between them the rule runs in evaluate mode and the Insights page shows what it would block ³. Enforcement was first set for 2 November ³. A policy can allow the trigger for named workflow files only ³.

11 November: Node.js security releases for 22, 24 and 26. The project's announcement, updated 3 November, puts the releases on or shortly after Wednesday 11 November, with the highest severity HIGH on each of the three lines ⁴. The newest releases today are 26.13.0, 24.22.2 and 22.23.4 ⁵. Lines past their end of life get no release ⁴. A Dockerfile or a host that pins node:24.22.2 needs a new pin on the day.

1 December: Gemini 2.5 Pro and 2.5 Flash requests go to other models. Google's deprecation page, read 8 November 2026: from 1 December, API requests to gemini-2.5-pro route automatically to gemini-3.8-flash, and requests to gemini-2.5-flash to gemini-3.5-flash-lite, billed at the new model's rates ⁶. The code still runs and the answers change. The same page puts the Gemini 3.1 Flash TTS and Live previews and the 2.5 TTS previews at 17 November ⁶. A test set run against the new model name before 1 December shows what changes.

10 November: Supabase turns off four TLS 1.2 ciphers; CLI v3 runs locally by default. TLS is the encryption under HTTPS, and a cipher suite is one of the methods a client and server can agree on. Supabase removes the four CBC-mode TLS 1.2 suites from project HTTP APIs (Auth, Data, Storage, Realtime, Edge Functions) on 10 November; TLS 1.3 and the six remaining 1.2 suites stay, direct Postgres and pooler connections are not touched, and under 0.0001% of connections in the past 30 days used the removed ones, from end-of-life operating systems and embedded devices ⁸. The CLI's version 3, out 4 November, is the change more builders meet: db push, db pull, migration list, gen types and the storage commands target the local stack unless --remote is given, so a deploy script's db push can succeed on the laptop and change nothing hosted ⁷. Commands that change a hosted project ask for confirmation with No as the default and fail in CI without --yes; piped input no longer counts ⁷. Pinning the npm package to the v2.stable tag stays on v2, which gets fixes and no features ⁷.