Support forPython 3.14 runtime is inPreview.

To increase security, starting in March 2025, support for Transport Layer Security (TLS) version 1.1 and earlier is deprecated.Update your application settings in the App Engine flexible environment to use TLS version 1.2 and later, along with a corresponding secure set of cipher suites (Preview).

Support forPython 3.13 runtime is inGeneral availability (GA).

Python 3.13 is now availablein Preview.

Container Registry is nowshut down. We recommend that you useArtifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, seeMigrate App Engine container images to Artifact Registry.

In the App Engine page in the Google Cloud console, you can now filter your existing App Engine versions byruntime lifecycle stages. After you apply this filter, the console displays a warning icon for App Engine versions that are approaching end of support, have reached end of support, are deprecated, and are decomissioned.

Deployments for new projects might be impacted from the following changes to orgpolicies:

• Starting in May 2024, Google Cloud enforcessecure-by-default organization policies for all organization resources. This policyprevents App Engine from granting theEditor role to the App Engine defaultservices accounts by default.
• Starting in June 2024, Cloud Build has changed the default behavior for how Cloud Build uses service accounts in new projects. This change is detailed inCloud Build Service Account Change. As a result of this change, new projects deploying versions for the first time may be using the default App Engine service account withinsufficient permissions for deploying versions.

If you are impacted by this change, you can do the following:

• Review the Cloud Build guidance on changes to the default service account andopt out of these changes.
• Grant theEditor role to the App Engine default service account.

Python version 3.7 and earlier have reachedend of support. You cannot re-deploy versions that use runtimesafter their end of support date. We recommend that you upgrade your app to use thelatest version of Python.

A warning message now appears before you publish a container image to a public repository.

Python 3.12 is nowgenerally available.

Python 3.12 is now availablein preview.

Accessing a service that's prohibited by theInternal orInternal and Cloud Load Balancingingress setting now results in a404 rather than403 error code.

You can now usessh to log in to App Engine flexible environment instances that use onlyinternal IP addresses.

Python 3.8, 3.9, 3.10, and 3.11 are nowgenerally available. These versions require you to specify an operating system version in your app.yaml.Learn more.

ThePython runtime versions 3.8, 3.9, 3.10, and 3.11 are now available inpreview and are built on modern and secure operating systems (Ubuntu 18 and 22). These new runtime versions use Google Cloud'sbuildpacks and require updates to your app.yaml.Learn more.

You can now use any configuredservice account in your Cloud project as theapp-level default service account, while creating and updating your App Engine applications.

The option to setIP mode tointernal for App Engine flexible environment instances is now generally available.

You can now disable external ephemeral IP addresses for App Engine Flex services. Read our documentation tolearn how. This feature is at thePreview launch stage.

Specifying auser-managed service account for each App Engine version during deployment is nowgenerally available.

Specifying auser-managed service account for each App Engine version during deployment is now available in preview. This feature lets you grant different privileges to each version, based on the specific tasks it performs, and avoid granting more privileges than necessary.

Requests from internal services to the App Engine flexible environment no longer originate from10.0.0.1. The IP ranges are as follows:

• Cron requests from newly created or updated App Engine Cron jobs sent to the App Engine flexible environment now come from0.1.0.2. For Cron jobs created with older gcloud versions (earlier than 326.0.0), Cron requests will come from0.1.0.1. Previously, these requests only came from both0.1.0.1 and10.0.0.1.
• For other Cloud Scheduler jobs and Cloud Tasks queues (including App Engine Task Queues), requests sent to the App Engine flexible environment now only come from0.1.0.2. Previously, these requests came from both0.1.0.2 and10.0.0.1.
• For URL Fetch, requests sent to the App Engine flexible environment now only come from0.1.0.40. Previously, these requests came from both0.1.0.40 and10.0.0.1.

For more information, seeUnderstanding the App Engine firewall.

App Engine is now available in theus-west1 (Oregon),asia-southeast1 (Singapore), andasia-east1 (Taiwan) regions.

App Engine is now available in theeurope-central2 region (Warsaw).

You can usenetwork ingress controls so your app only receives requests that are sent from your project's VPC or that are routed through the Cloud Load Balancing load balancer. This feature is now generally available.

You can usenetwork ingress controls so your app only receives requests that are sent from your project's VPC or that are routed through the Cloud Load Balancing load balancer.

External HTTP(S) Load Balancing is now supported for App Engine viaServerless network endpoint groups. Notably, this feature allows you to useCloud CDN with App Engine.
This feature is available in Beta.

App Engine is now available in theasia-southeast2 region (Jakarta).

To get a fine-grained view of billing data for each resource used by your App Engine services, you can apply labels to the services, export your billing data to BigQuery, and run queries. For more information, seeLabeling App Engine resources.

App Engine is now available in theus-west4 region (Las Vegas, NV).

Quotas for sockets have been removed. There is no longer a limit on the number of socket connections or the amount of data you can send and receive through a socket.

App Engine is now available in theasia-northeast3 region (Seoul).

App Engine is now available in theus-west3 region (Salt Lake City, Utah).

App Engine is changing the URLs that you use to send requests to your apps. URLs nowinclude a region ID to help Google route your requests more efficiently and reliably. For example, an app can receive requests athttps://PROJECT_ID.REGION_ID.r.appspot.com. This new URL is optional for existing apps and is provided for all new apps.

To ensure a smooth transition, we are slowly updating App Engine to use region IDs. If we haven't updated your Google Cloud project yet, you won't see a region ID for your app. Since the ID is optional for existing apps, you don't need to update URLs or make other changes once the region ID is available for your existing apps.

• App Engine is now available in theasia-northeast2 region (Osaka, Japan).

• App Engine is now available in theeurope-west6 region (Zürich, Switzerland).

Cloud Tasks is now GA and can be used to set up tasks to be performed asynchronously, outside of user requests.

Cloud Scheduler is now GA and can be used to set up scheduled units of work (cron jobs).

• You can now useWebSockets and session affinity to create persistent connections to an App Engine instance.

• App Engine is now available in theasia-east2 region (Hong Kong).

• App Engine is now available in theus-west2 region (Los Angeles).

• Applications in the App Engine flexible environment currently use a Debian 8 "Jessie" operating system. The Debian 8 "Jessie" OS will lose full support from the Debian maintainers in June 2018. In advance of this change, Google will migrate customers to an Ubuntu-based OS starting on May 30, 2018. To update your application to the Ubuntu 16.04 OS, re-deploy your application after May 30, 2018.

  If for some reason you need to opt-out of this automatic upgrade, you canpin your application to the old Debian 8 "Jessie" OS.

• The Python 3.4 runtime isdeprecated and will be shut down on March 29, 2019. Update to a more recent Python version as soon as possible.

• The Python 3.4 runtime is updated to version3.4.8. This includes some security and bug fixes.

• The Python 3.5 runtime is now updated to version3.5.5. This includes some security and bug fixes.

• The Python 3.6 runtime is now updated to version3.6.4. This includes some security and bug fixes.

• App Engine is now available in thenorthamerica-northeast1 region (Montréal, Canada).

• Improved access control documentation around deploying apps with IAM roles and service accounts:

  • Predefined App Engine roles
  • Deploying using IAM roles
  • Require permissions

• App Engine is now available in theasia-south1 region (Mumbai, India).

• Announced general availability ofApp Engine firewall.

• The App Engine flexible environment now defaults to Python 3.6 when Python 3 is requested. Update yourCloud SDK to version 174.0.0 or later to use this new default. To revert to Python 3.5, specifypython_version: 3.5 in theruntime_config element of yourapp.yaml configuration file

• For the App Engine flexible environment, all responses are now compressed with gzip by default once you redeploy your app. No changes need to be made to yourapp.yaml file.

• For the App Engine flexible environment, billing increments for instances are reduced from per-minute increments to per-second increments. Additionally, the minimum usage cost for instance resources is reduced from 10 minutes to 1 minute.

Legacy health checks will no longer be available after September 30th, 2018.

• Updated health checks are now the default for new projects. To upgrade a project from legacy health checks, run the commandgcloud app update --split-health-checks.

• If you have an existing domain mapping and SSL certificate, then it continues to function as expected. You can alsoupgrade to managed SSL certificates.

• Thegcloud commands and Admin API methods used tomap custom domains are now generally available. This includesgcloud domains verify andapps.authorizedDomains.list. However, if you want to use managed SSL certificates, use the beta commands and methods that are specified inSecuring Custom Domains with SSL.

• You can now use managed certificates to add SSL to your custom domain. Once you map your custom domain to your application, App Engine provisions an SSL certificate automatically and handles renewing the certificate before it expires and revoking it if you remove the custom domain. Managed certificates are in beta. For more information, seeSecuring Custom Domains with SSL.

• App Engine is now available in thesouthamerica-east1 region (São Paulo, Brazil).

• The Python 3.5 runtime is now updated to version3.5.4. This includes some security and bug fixes.

• Beta release of theApp Engine firewall.

• App Engine is now available in theeurope-west3 region (Frankfurt, Germany).

• The Python 3.6 runtime is now updated to version3.6.2. This includes some security and bug fixes.

• App Engine is now available in theaustralia-southeast1 region (Sydney, Australia).

• If you use updated health checks, deployments will fail if your application does not reach a ready state.

• You can now use updated health checks, which allow you to use separate checks to confirm that your instance is running and ready to serve content. You must enable updated health checks, which are currently in Beta. For more information, seeHealth checks.

• You can now use the beta-level features in the Admin API andgcloud command-line tool tocreate and manage your custom domains and SSL certificates .

• App Engine is now available in theeurope-west2 region (London).

• The flexible environment now includes Python 3.6 support (Beta). To use the Python 3.6 runtime, specifypython_version: 3.6 in theruntime_config element of yourapp.yaml configuration file.

• App Engine is now available in theus-east4 region (North Virginia).

• Addedinformation about upgrading from the App Engine Task Queue API in the compat runtimes to using Cloud Tasks in the flexible environment and added information for how to verify requests from the Task Queue API.

• The flexible environment is now available in theeurope-west region.

• ThePHP 7 runtime for the App Engine flexible environment is now in Beta.

• The App Engine flexible environment is now generally available (GA). You can run Node.js, Ruby, Python, Java, and Go applications with a99.95% SLA.

• The.NET core runtime for the App Engine flexible environment is now in Beta.

• New applications that have not been deployed in the flexible environment must specifyenv: true in theapp.yaml file instead ofvm:true. Applications that were previously deployed can continue to usevm:true but will need to switch toenv:true in the future. For more details, seeupgrade guide.

• Python support updated from version 3.4 to version 3.5 for flexible environment apps that specify using the latest version of the Python runtime (python_version: 3). Apps can specifically target this version by specifyingpython_version: 3.5 in their [app.yaml configuration file (/appengine/docs/flexible/python/configuring-your-app-with-app-yaml).

This release also marks the deprecation of a few features:

• The python-compat runtime.
• The python27 runtime.
• The java-compat runtime.
• The jetty9-compat runtime.
• TheGo App Engine package no longer works on the App Engine flexible environment. Instead, use thecloud.google.com/go/... package.

There are also a few breaking changes:

• HTTP headers have been changed.
• Environment variables have been changed.
• There are multiple changes to theapp.yaml schema.

For details and a full list of changes, visit theupgrade guide.

There is a new release of the App Engine flexible environment. To choose this environment, useenv:flex instead ofvm:true in yourapp.yaml configuration file. You can learn more about the details of this release by visiting theupgrade guide.

This release includes a few key new features:

• Multi-zonal deployment support.
• A modern networking stack with increased throughput.
• Custom machine types.
• Asia-Northeast1 region availability.

• TheRuby runtime is now available for the App Engine flexible environment.

• App Engine Managed VMs is renamed toApp Engine flexible environment.

• Container construction choices for Managed VMs

  Thegcloud preview app deploy (andmvn gcloud:deploy) commands upload your artifacts to our servers and build a container to deploy your app to the Managed VM environment.

  There are two mechanisms for building the container image remotely. The default behavior is to build the container on a transient Compute Engine Virtual Machine which has Docker installed. Alternatively, you can use theCloud Build service, which is in Beta. To use the Cloud Build service, follow these steps:

  1. Activate the Cloud Build API for your project.
  2. Use the commandgcloud config set app/use_cloud_build True. This will cause all invocations ofgcloud preview app deploy to use the service. To return to the default behavior, use the commandgcloud config set app/use_cloud_build False.