Skip to navigation

Changelog

November 9, 2026

v2.16.0: Portable code library bundles, a session per region, and Webflow Cloud deploy updates

v2.16.0 adds portable bundles for code libraries, keeps a separate login session for each region, and updates Webflow Cloud deploys and the apps commands.

Portable code library bundles

Add --portable to webflow devlink bundle or webflow devlink import to produce a production client bundle that you can host at a different origin or path.

webflow devlink bundle --portable --public-path https://example.com/assets/

A portable bundle:

  • Loads its assets relative to the bundle, so you can serve it from any origin or path.
  • Lists every emitted client asset under portable.files in Client/wf-manifest.json, so a host knows which files to copy.
  • Keeps images, fonts, and other binary files intact. Before, binary files in a bundle could be corrupted.

Server-side rendering still uses absolute asset URLs. With devlink bundle --portable, pass --public-path with the URL prefix your host serves assets from. If you leave it out, server-rendered assets use http://localhost/ and the CLI prints a warning. With devlink import --portable, the CLI gets the prefix from Webflow.

--portable needs a production build, so it can’t be used with --dev. If your bundler configuration sets output.publicPath, remove it when you use --portable.

One login session per region

webflow auth login now keeps one session for each region. Logging in to the US region no longer signs you out of the EU region.

webflow auth logout clears only the active region. Use --region to choose a different one.

Webflow Cloud deploys

  • webflow apps deploy accepts --environment-id and reuses the environment linked in webflow.json. A linked directory can deploy with --json without repeating --environment and --mount. The success JSON now includes branch and mount.
  • webflow apps env-vars import accepts --secret-env-file <path>, so you can import a file of secrets together with a plain .env file in one request.
  • Deploys accept build output up to the limit that Webflow sends, currently 4 GiB. The limit used to be a fixed 100 MB. The CLI also streams the archive during upload instead of loading the whole file into memory.

Consistent JSON output for apps commands

apps commands that write data now include every --dry-run plan key in their success --json output, plus dryRun: false, so one parser handles both. Existing keys are unchanged.

  • apps deployments redeploy reports the deployment it ran again as sourceDeploymentId.
  • apps init --dry-run --json also reports manifestPath in its plan.

Other fixes

  • Fixed the CLI printing “Command completed successfully” in verbose mode after a command failed.
  • Fixed apps deployments trigger --wait and apps deployments redeploy --wait not following the requested deployment when other deployments run at the same time, or when you retry an identical request.
  • Upgraded Zod to 4.x. Validation errors for invalid configuration files and Sync API responses now use Zod 4’s wording. For example, a missing results array now reports result.results: Invalid input: expected array, received undefined instead of result.results: Required.
  • Updated the adm-zip dependency to 0.6.1 to address ZIP processing vulnerabilities.

Upgrading

npm install -g @webflow/webflow-cli@latest