Releasesby IbisHeroku-22, Heroku-24 and Heroku-26 stacks updated
Update2 days agoUnverifiedAdded Oct 22, 2026
We have updated the heroku-22 , heroku-24 and heroku-26 stacks to pick up security and bug fixes in upstream packages. The new base images for each stack will roll out automatically to the Common Runtime over the next 48 hours, followed by Private Spaces .
Topics: Streaming, Security, Observability
More Heroku releases
Every Heroku releaseRuby version 4.0.8 is now available
Ruby v4.0.8 is now available on Heroku. To run your app using this version of Ruby, add the following ruby directive to your Gemfile: ruby "4.0.8" For more information on Ruby 4.0.8, you can view the release announcement .
Python 3.15.1, 3.14.9 and 3.13.17 are now available
Python 3.15.1, 3.14.9 and 3.13.17 are now available for use by Python apps on Heroku. In addition, we have updated the Python 3.15, 3.14 and 3.13 major version aliases to resolve to these new Python patch versions.
Platform API Update: OAuth Session Resource
We updated the Heroku Platform API schema and reference documentation to include OAuth Session operations. Use this resource and endpoints to list and manage the active OAuth sessions for your user account. New Resource: OAuth Session : Represents a group of OAuth access and refresh tokens for an account.
PHP updates - October 2026 (CVE-2026-109618 and CVE-2026-109619)
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (see the PHP security advisory and blog post ). Redeploy your apps to pick up the fixed versions.
Node.js 26.12.1, 24.22.1, and 22.23.4 now available
Node.js versions 26.12.1, 24.22.1, and 22.23.4 have been made available for builds on Heroku. For additional information, please see our article on Node.js Support .
Python buildpacks updated to pip 26.2.2, Pipenv 2026.10.2 and uv 0.13.4
We have updated the package managers used during the build of Python apps as follows: pip updated from 26.2.1 to 26.2.2 ( changelog ) uv updated from 0.13.1 to 0.13.4 ( changelog ) And for Cedar-generation Python apps only: Pipenv updated from 2026.9.1 to 2026.10.2 ( changelog )
Heroku-22, Heroku-24 and Heroku-26 stacks updated
We have updated the heroku-22 , heroku-24 and heroku-26 stacks to pick up security and bug fixes in upstream packages. The new base images for each stack will roll out automatically to the Common Runtime over the next 48 hours, followed by Private Spaces .
Go 1.27.3 and 1.26.10 are now available
Go 1.27.3 and 1.26.10 are now available for use by Go apps on Heroku. In addition, we have updated the Go 1.27 and 1.26 version aliases to resolve to these new Go patch versions. See Go Versions for details on how to configure the Go version for your app.
Also shipped on Oct 22, 2026
Heroku in October 2026Trace and evaluate Cursor agents with Langfuse, powered by ClickHouse
Users can now connect Cursor to Langfuse to trace agent turns and analyze model and tool calls, with ClickHouse providing the underlying analytics infrastructure.
The AI.TRANSLATE function lets you translate text strings between languages
The AI.TRANSLATE function lets you translate text strings between languages. AI.TRANSLATE supports standard Neural Machine Translation (NMT) workloads and Translation LLM (TLLM) capabilities. This function is generally available (GA).
Replit Monitoring Agent: Your very own software engineering team
Replit Monitoring Agent is an autonomous tool that investigates production alerts, identifies causes, applies fixes, and deploys them to production for internal apps.
Microsoft Entra ID connector is available in Beta
The managed Microsoft Entra ID connector is now available in Beta in Databricks Lakeflow Connect. Use the connector to ingest Microsoft Entra ID users, groups, applications, service principals, directory roles, identity configuration, and audit and sign-in logs into Databricks.
You can configure Direct VPC ingress for Cloud Run instances ( Preview )
You can configure Direct VPC ingress for Cloud Run instances ( Preview ). Direct VPC ingress lets Cloud Run instances on a VPC network use their own ephemeral private IP address to communicate with each other and with other resources on the VPC network.
Gemini Enterprise: Single-user quota limits
Gemini Enterprise administrators can configure single-user quota limits on the Usage & Spending > Usage page in the Google Cloud console to prevent an individual user from using all of an edition's shared subscription quota pool.