Azure Functions: Time Zone, Node.js, Python, and Certificate Updates
Update (26 October 2026): The applicable time-zone, Node.js, and eMudhra / emSign certificate update rollouts are now complete for Windows Azure Functions on Consumption, App Service plans, and Elastic Premium through the App Service Windows patching process. The applicable time-zone, Node.js, Python, and certificate updates remain complete for Linux Azure Functions on Consumption, App Service plans, Elastic Premium, and Flex Consumption, and for Azure Static Web Apps managed functions.
The patching process depends on your function app’s operating system and hosting plan.
Rollout by hosting plan and operating system
| Hosting plan or offering | Windows | Linux |
|---|---|---|
| Consumption | App Service Windows rollout complete. | Azure Functions rollout complete. |
| App Service plan (Dedicated) | App Service Windows rollout complete. | Azure Functions rollout complete. |
| Elastic Premium | App Service Windows rollout complete. | Azure Functions rollout complete. |
| Flex Consumption | Not available on Windows. | Azure Functions rollout complete. |
| Static Web Apps managed functions | Not applicable. | Managed functions update rollout complete. |
Completion applies to the platform-managed updates covered here; application-managed dependencies, trust stores, and time-zone data require separate review. Python functions run on Linux; the Python runtime updates below do not apply to Windows function apps.
The separate .NET Brotli security update rollout is not covered by this completion notice.
Windows: Consumption, App Service plans, and Elastic Premium
Function apps on these Windows hosting plans receive the applicable platform updates through the App Service Windows patching process. Follow the corresponding posts for update details and rollout status:
- Time-zone updates: Rollout is complete through accelerated Safe Deployment Practices (SDP). See Time zone updates on App Service for Windows.
- Node.js runtime fixes: Rollout is complete. See Emergency Node.js runtime updates on App Service for Windows.
- Certificate trust updates: Rollout is complete. See eMudhra / emSign certificate security updates on App Service for Windows.
These are separate OS and runtime updates. Their completion does not replace application-managed dependencies, trust stores, or time-zone data.
Linux: Consumption, App Service plans, Elastic Premium, and Flex Consumption
The Azure Functions team has completed its separate rollout for Linux function apps on all four hosting plans.
This work covers the applicable time-zone, Node.js, Python, and certificate fixes. Completion does not change your app’s configured language release line or replace application-managed data and dependencies.
The App Service Linux posts provide background on the time-zone changes, Node.js and Python releases, and certificate issue. Their App Service completion statuses, runtime-version tables, and Platform Release Channel instructions are not Azure Functions rollout or support guidance, including for Linux functions hosted on App Service plans.
Azure Static Web Apps managed functions
The rollout of the applicable fixes for Azure Static Web Apps managed functions is also complete. These managed API backends are included in this Linux update guidance.
This status applies to managed functions, not a separately linked Azure Functions app. For a linked function app, use its hosting plan and OS to identify the rollout that applies.
What the updates address
Time-zone rules
Current time-zone data is needed to convert UTC timestamps to local time and calculate schedules correctly when governments change local timekeeping rules. UTC itself does not change.
Test the locations your app depends on using timestamps before and after the relevant rule change. Verify both local times and UTC offsets, and check the next execution times of recurring jobs. For timer-triggered functions, review the Azure Functions timer trigger documentation for the time-zone settings supported by your OS and hosting plan; this patch does not add support for a previously unsupported setting.
An OS update does not replace time-zone databases bundled with your application or libraries. Test through the APIs and scheduling code your function actually uses.
Node.js runtime fixes
The updates address the recent Node.js security releases described in the linked App Service posts. Use a Node.js version supported by Azure Functions and verify the actual runtime in your running function worker.
An upstream patched version or its availability in App Service does not, by itself, establish availability for your Functions hosting plan or configured release line.
Python runtime and dependency fixes
The Python updates address the recent Python releases and related certificate-bundle changes described in the linked runtime post. Use a Python version supported by Azure Functions for your hosting plan.
A platform runtime update does not update packages already deployed with your app, including packages in an existing virtual environment. Review application-managed certificate bundles and affected dependencies, update them through your trusted package source, and rebuild and redeploy as needed.
eMudhra / emSign certificate trust issue
The certificate updates address trust associated with the eMudhra / emSign CA incident. Applications can use OS certificate stores, runtime-specific trust stores, or CA bundles supplied by dependencies.
An updated platform trust store does not prove that every TLS client in your function app uses updated trust data. Review custom trust stores and bundled CA data separately. Test outbound TLS connections after updating, and work with endpoint owners to resolve certificate-chain failures rather than disabling certificate validation.
What you should do
- Identify your hosting plan and OS. Use the table above to determine which rollout applies.
- Review the updates for your platform. The applicable Windows, Linux Functions, and Static Web Apps managed functions rollouts covered here are complete. Follow the linked posts for update details.
- Use supported runtime versions. Check Azure Functions support for your language version and hosting plan rather than copying the App Service runtime tables.
- Verify your running workers. Use existing application logging or diagnostics to check
process.versionfor Node.js orsys.versionfor Python inside the function worker. Verify across instances; avoid exposing diagnostics through an unauthenticated public endpoint. - Test date/time behavior and outbound TLS. Verify the code paths your functions actually use, including timers, application-managed time-zone data, and certificate bundles.
- Update custom container contents yourself. For function apps using customer-provided images, update the image’s OS data, runtimes, and dependencies, then rebuild, test, and redeploy. Platform patching does not patch the contents of your custom image.
