Google Cloud Run Functions 1stgen-2026-09-03

Use these rules for Cloud Run functions (1st gen), managed through the Cloud Functions API and deployed explicitly with gcloud functions deploy --no-gen2. Apply compatible language and runtime security guidance for the function's selected runtime. Cloud Run services and second-generation functions have different controls and require their own guidance.

Generation, runtimes, and migration

• Verify the deployed generation, project, region, runtime, and trigger before changing a function; retain --no-gen2 for maintenance deployments. Do not infer the generation from a cloudfunctions.net URL, which second-generation functions can also expose.
• Select a nondeprecated runtime explicitly with --runtime: nodejs22, python311, python312, java17, or ruby33, subject to its published lifecycle. Migrate deprecated python310 functions to a supported runtime before its published decommission date.
• Stop deploying with decommissioned ruby32 and migrate any remaining functions to a supported runtime. Upgrade deprecated nodejs20 before its 2026-10-30 decommission. Migrate Go, PHP, and .NET workloads to a generation with supported runtimes; their listed 1st gen runtimes have already reached decommission. Do not copy runtime IDs from old samples without checking the generation column.
• Plan upgrades before the published deprecation date; the 90-day period is advance notification, not an earlier start of deprecation. Decommission blocks creation and redeployment and can lead to existing functions being disabled.
• Retain --runtime-update-policy=automatic and