Evidence ledger
24 sources
Checked 13 Sep 2026
Evidence ledger
One row per claim in Ten years of changing a runtime you are not allowed to break: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Field guide: Ten years of changing a runtime you are not allowed to break Research date: 2026-09-13. All links fetched on 2026-09-13.
Method note: this session's network egress policy reached code hosts and package registries only (github.com, raw.githubusercontent.com, registry.npmjs.org, crates.io). Cloudflare's engineering blog, its documentation site, conference video hosts, arxiv.org, usenix.org, web.archive.org and every third-party engineering blog were blocked by the proxy, which is why this corpus contains no blog, paper or talk tier at all. The result is a corpus of artefacts nobody wrote for an audience: schema comments, patch filenames, security advisories, archive banners, issue threads and registry timestamps. Where a claim rests on a single Cloudflare-authored artefact, the ledger says so. The two incident sources are GitHub security advisories, which are narrower than a postmortem: they give cause and patch, not duration or tenant impact.
| # | Org | Title | Tier | Published | Checked | URL | Claim taken from it | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Cloudflare | workerd compatibility-date.capnp | source | file evolving since 2021-11 | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | The contract's purpose, in the schema's own words | "Flags that change the basic behavior of the runtime API, especially for backwards-compatibility with old bugs." |
| 2 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | Flags are two-directional, and the "rare" opt-out is the common case | "A disable-flag is used when a worker needs to keep long-term backwards compatibility with one bug but doesn't want to hold back everything else. This is hopefully rare! Most features should have a disable-flag defined." Counted: 187 Bool flag fields, 146 with compatDisableFlag |
| 3 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | Only half the flag namespace is on a default path, and dating is accelerating | Counted: 90 fields carry compatEnableDate; dates by year 2021:4, 2022:11, 2023:10, 2024:17, 2025:20, 2026:26 (earliest 2021-11-03, latest 2026-09-15) |
| 4 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | The break-everyone escape hatch exists, is documented as dangerous, and has been used once | "NOTE: This is almost NEVER what you actually want because you're most likely breaking back compat. Note that workers uploaded with the flag will fail validation, so this will break uploads for anyone still using the flag." One use, on r2PublicBetaApi |
| 5 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | A correctness fix had to be rolled back behind a retroactive flag | setToStringTag … $compatEnableDate("2024-09-26"); "A change was made that set the Symbol.toStringTag on all jsg::Objects in order to fix several spec compliance bugs. Unfortunately it turns out that was more breaking than expected." |
| 6 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | The same fix shipped twice because the first flag missed a call site | specCompliantUrl (2022-10-31) plus a second flag: "the specCompliantUrl flag did not contemplate the redirect usage. This flag is specifically about the usage in a redirect()." |
| 7 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | A known bug left unfixed for five years because the dependent population is unknown | esiIncludeIsVoidTag … "Our original implementation of esi:include treated it as needing an end tag. We're worried that fixing this could break existing workers." No compatEnableDate |
| 8 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | The runtime still negotiates behaviour with the older proxy tier, per request | "A tag to tell us which fields we'll need to propagate to FL on subrequests and responses." 8 fields annotated neededByFl; a 2021 flag comment notes fetch() "happily sent any scheme to FL in the X-Forwarded-Proto header" |
| 9 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | Node.js compatibility became a default in 2026, after four years as opt-in | nodeJsCompat … $compatEnableDate("2026-08-04"); nodeJsCompatV2 $impliedByAfterDate(name = "nodeJsCompat", date = "2024-09-23") |
| 10 | Cloudflare | workerd compatibility-date.capnp | source | as above | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/src/workerd/io/compatibility-date.capnp | A second language runtime needed its own compatibility axis | annotation pythonSnapshotRelease … "marks a compat flag as introducing a potentially breaking change to Python memory snapshots"; pythonWorkers20250116 $impliedByAfterDate(name = "pythonWorkers", date = "2025-09-29") |
| 11 | Cloudflare | workerd docs: JavaScript API Updates | adr | repo doc, current | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/docs/api-updates.md | Documentation is a gate on the flag, not a follow-up task | "all compatibility flags MUST be documented BEFORE their enable date … It is the responsibility of whoever introduces the flag to update the documentation at the same time as the flag." |
| 12 | Cloudflare | workerd docs: V8 Updates | adr | repo doc, current | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/docs/v8-updates.md | The engine is upgraded by rebasing a local patch series, not by forking | "Create a V8 branch for workerd's V8 patches in your local copy of V8 … git rebase --onto |
| 13 | Cloudflare | workerd patches/v8 | source | directory, current | 2026-09-13 | https://github.com/cloudflare/workerd/tree/main/patches/v8 | The size of the divergence from upstream V8 | 41 patch files, including 0006-Implement-Promise-Context-Tagging.patch and 0013-Implement-cross-request-context-promise-resolve-hand.patch |
| 14 | Cloudflare | workerd docs: Hardening | adr | repo doc, current | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/workerd/main/docs/hardening.md | The compensating rules for a C++ runtime that tenant input reaches | "We have kj_enable_irequire flag enabled in all configurations"; "Raw reference types are incredibly dangerous, because they don't offer any lifetime protection." |
| 15 | Cloudflare | workerd README | source | current | 2026-09-13 | https://github.com/cloudflare/workerd/blob/main/README.md | The promise the contract exists to keep, and the version-is-a-date scheme | "Updating workerd to a newer version will never break your JavaScript code. workerd's version number is simply a date, corresponding to the maximum 'compatibility date' supported by that version." Also "WARNING: workerd is not a hardened sandbox" |
| 16 | Cloudflare | workerd releases | source | daily | 2026-09-13 | https://github.com/cloudflare/workerd/releases | The release train is daily and its version is the date | Tags v1.20260913.1, v1.20260912.1, v1.20260911.1 … one per day |
| 17 | Cloudflare | workerd commit history | source | daily | 2026-09-13 | https://github.com/cloudflare/workerd/commits/main | The daily cut is automated and sits between ordinary PR merges | Commits "Release 2026-09-13", "Release 2026-09-12" by workers-devprod, interleaved with named-engineer merges |
| 18 | Cloudflare | workerd PR 6444, Enable nodejs_compat by default (closed unmerged) | adr | opened 2026-03-27, closed 2026-04-17 | 2026-09-13 | https://github.com/cloudflare/workerd/pull/6444 | The argument against a dated default, in the reviewers' own words | Proposed $compatEnableDate("2026-04-14"); review lists "setTimeout and setInterval returning an object rather than a number" and calls it the change that "likely has the greatest potential for introducing problems"; "pushed out another week or two depending on how long it takes to resolve the 'should we really do this' question" |
| 19 | Cloudflare | workerd issue 6907, Temporal clock stuck at epoch 0 | source | 2026-07-31 | 2026-09-13 | https://github.com/cloudflare/workerd/issues/6907 | Behaviour inherited from the engine bypassed the contract and broke deployed code | "Temporal.Now.instant().epochMilliseconds returns 0 even at request time and after I/O, while Date.now() correctly returns real time"; polyfill guards deactivated, producing JWTs that "downstream verifiers correctly reject"; "the deployed runtime has diverged here" |
| 20 | Cloudflare | GHSA-g76q-p3jj-mm56 (CVE-2023-48230) | postmortem | 2023-11-21 | 2026-09-13 | https://github.com/cloudflare/workerd/security/advisories/GHSA-g76q-p3jj-mm56 | A dated default enlarged the reachable dependency surface | "a remote client may be able to induce workerd to crash"; affects Workers handling WebSocket messages, compression being default "for compatibility dates on or after 2023-08-15"; patched v1.20231121.0 |
| 21 | Cloudflare | GHSA-8vx6-69vg-c46f (CVE-2023-2512) | postmortem | 2023-05-12 | 2026-09-13 | https://github.com/cloudflare/workerd/security/advisories/GHSA-8vx6-69vg-c46f | Memory-unsafety in the runtime the Rust argument has not reached | FormData beyond 2^31 elements could "read from the wrong location in memory while iterating over elements"; needed ~160GB RAM; patched v1.20230419.0, CVSS 6.5 |
| 22 | Cloudflare | cloudflare/wrangler-legacy | source | archived 2023-08-03 | 2026-09-13 | https://github.com/cloudflare/wrangler-legacy | The Rust CLI was retired in favour of a TypeScript rewrite | Archive banner "This repository was archived by the owner on Aug 3, 2023"; README "This repository is for Wrangler version 1, which is deprecated and no longer updated"; 3.2k stars, 2,775 commits |
| 23 | npm / Cloudflare | registry metadata for wrangler | source | published continuously | 2026-09-13 | https://registry.npmjs.org/wrangler | Dates the TypeScript CLI line | time: 2.0.0 2022-05-08, 3.0.0 2023-05-17, 4.0.0 2025-03-13, modified 2026-09-11 |
| 24 | npm / Cloudflare | registry metadata for @cloudflare/wrangler | source | 2019-2023 | 2026-09-13 | https://registry.npmjs.org/@cloudflare%2fwrangler | Dates the Rust CLI line and the nine-month overlap | time: created 2019-06-01 (1.0.0), last 1.21.0 2023-02-21, 79 versions |
| 25 | npm / Cloudflare | registry metadata for miniflare | source | 2021-2026 | 2026-09-13 | https://registry.npmjs.org/miniflare | The emulator's absorption into the runtime, by version dates | time: 0.1.0 2021-05-20, 2.0.0 2022-01-07, 3.0.0 2023-05-17 (same day as wrangler 3.0.0), latest 5.20260911.0-alpha |
| 26 | crates.io / Cloudflare | pingora crate metadata | source | first publish 2022-12-07 | 2026-09-13 | https://crates.io/api/v1/crates/pingora | Dates the proxy framework and its public adoption | created_at 2022-12-07; 0.9.0 published 2026-09-09; 9,176,279 downloads |
| 27 | crates.io / Cloudflare | quiche crate metadata | source | first publish 2019-01-24 | 2026-09-13 | https://crates.io/api/v1/crates/quiche | Dates the start of Rust in the network path | created_at 2019-01-24; 0.29.3 published 2026-07-14; 2,582,283 downloads |
| 28 | crates.io / Cloudflare | boringtun crate metadata | source | first publish 2019-03-22 | 2026-09-13 | https://crates.io/api/v1/crates/boringtun | Second Rust network component, still published in 2026 | created_at 2019-03-22; latest version published 2026-05-01; 744,015 downloads |
| 29 | crates.io / Cloudflare | lol_html crate metadata | source | first publish 2019-11-26 | 2026-09-13 | https://crates.io/api/v1/crates/lol_html | The streaming HTML rewriter behind the Workers HTML API | created_at 2019-11-26; 3.0.1 published 2026-07-29; 5,636,838 downloads |
| 30 | Cloudflare | pingora README | vendor | current | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/pingora/main/README.md | The scale claim and the stated reason to adopt Rust, both unverified here | "serving more than 40 million Internet requests per second"; "Security is your top priority: Pingora is a more memory safe alternative for services that are written in C/C++" |
| 31 | Cloudflare | quiche README | vendor | current | 2026-09-13 | https://raw.githubusercontent.com/cloudflare/quiche/master/README.md | The component left the building and became someone else's dependency | "quiche powers Cloudflare edge network's HTTP/3 support"; separate section documenting use on Android |
| 32 | Cloudflare | cloudflare/foundations | source | crate first publish 2024-01-23 | 2026-09-13 | https://github.com/cloudflare/foundations | The shared operability library the Rust rewrites depend on | README lists logging, distributed tracing, metrics, memory profiling, "security features, such as seccomp-based syscall sandboxing"; pingora ships a pingora-foundations crate |
| 33 | Cloudflare | cloudflare-docs compatibility-flags tree | vendor | current | 2026-09-13 | https://github.com/cloudflare/cloudflare-docs/tree/production/src/content/compatibility-flags | Each flag is documented in its own file, which is what the contributor rule points at | Directory of per-flag markdown files: allow-custom-ports.md, brotli-content-encoding.md, commonjs-modules-dont-export-a-module-namespace.md, … |
| 34 | Node.js / OpenJS | doc/api/deprecations.md | source | current | 2026-09-13 | https://raw.githubusercontent.com/nodejs/node/main/doc/api/deprecations.md | The contrasting contract: numbered deprecations that are actually removed | Counted: 206 DEP headings; Type counts 131 End-of-Life, 42 Documentation-only, 23 Runtime |
| 35 | Fastly | js-compute-runtime CHANGELOG 3.19.0 | source | 2024-07-29 | 2026-09-13 | https://raw.githubusercontent.com/fastly/js-compute-runtime/main/CHANGELOG.md | A whole JavaScript engine swapped under customers, with a named opt-out | "## 3.19.0 (2024-07-29) … use StarlingMonkey by default, --disable-starlingmonkey flag" |
| 36 | WinterTC | wintercg/admin standardization.md and README | adr | Sept 2024 decision, Dec 2024 formed | 2026-09-13 | https://raw.githubusercontent.com/wintercg/admin/main/standardization.md | Cross-runtime compatibility needed a venue that can publish a specification | "technical standards development work will need to take place in a TC or WG, rather than a W3C CG"; README: "WinterTC was initially started as a W3C Community Group called WinterCG, but in December 2024 we decided to move to Ecma." |
| 37 | Vercel | vercel/edge-runtime | source | active, not archived | 2026-09-13 | https://github.com/vercel/edge-runtime | A third vendor maintaining its own definition of the same API surface | Description "Developing, testing, and defining the runtime Web APIs for Edge infrastructure"; 915 stars; no archive banner |
Tier mix
- postmortem: 2 (both GitHub security advisories; no full incident postmortem was reachable)
- source: 26
- adr: 6
- vendor: 3
- blog / paper / talk: 0, because the hosts that carry them were blocked for this session
What this ledger cannot support
- Any claim about how many deployed Workers sit on old compatibility dates, or how that population is monitored. No artefact in this corpus addresses it.
- Any independent verification of the 40 million requests per second figure.
- Cloudflare's own account of its outages, its proxy rewrite, or its configuration distribution plane. Those are published on a host this session could not reach.