{"collection":{"slug":"application-platforms","name":"Application Platforms"},"digest":{"id":"cwd_p8x8FM7URTnEEFFIsw5Tj","weekStart":"2026-06-01","title":"Actionable threat intelligence and deeper platform control","intro":"Cloudflare turned threat indicators into instant WAF rules, Workflows gained saga-style rollbacks, and Workers traffic can now be filtered through Gateway policies. Vercel shipped experimental realtime voice support in the AI SDK and persistent drives for sandboxes.","body":"### Threat intelligence you can act on immediately\n\nThe week’s most significant development was Cloudflare’s Security Center upgrades. You can now [create WAF rules directly from Threat Events saved views](/release/rel_bg3hihp99MCdQpRiA4Nhi-security-center-create-waf-rules-directly-from-threat-events-saved-views), turning Cloudforce One indicators into active defense without manual extraction. Security teams can also [pivot from a blocked event to a full Threat Actor Profile](/release/rel_H3iXx0EG1FDe6anWqoo-n-security-center-introducing-threat-actor-profiles-in-threat-events), revealing the “who, why, and how” behind an attack. This closes the gap between detection and response — intelligence that isn’t immediately actionable is just noise.\n\n### A platform for building more resilient applications\n\nCloudflare Workflows now supports [saga-style rollbacks](/release/rel_dS7MXMtdbJydq-2wB1REa-workflows-rollback-support-now-available-in-workflows), letting you add compensating logic to each `step.do()` that executes in reverse order on failure — critical for multi-step operations touching inventory, payments, or external APIs. Separately, the [Workers VPC](/release/rel_eTCOPIAiZXz5st-jFLwn--gateway-cloudflare-mesh-workers-vpc-filter-workers-public-internet-traffic-using) binding now routes public Internet egress through Cloudflare Gateway, so Zero Trust policies that apply to WARP users also govern your Workers’ traffic. The [AI Gateway’s new spend limits](/release/rel_GYQZIuOktHxFyHE6OtyuS-ai-gateway-control-ai-costs-with-spend-limits) track cumulative dollar cost per model or user, blocking requests when budgets are exceeded — a practical alternative to rate limiting for cost control.\n\nWrangler 4.98.0 introduced a [migrations_pattern field for D1 bindings](/release/rel_9FSlKQZbOhcWiEGfFTwUv-workers-wrangler-4-98-0-adds-d1-migrations-pattern-and-generalizes-deploy-paths), supporting ORM-generated migration folders, while the deploy command now accepts a generic path argument that auto-detects whether the target is a Worker file or static assets. The [Vite Plugin gained experimental `cloudflare.config.ts` support](/release/rel_iG8Tc0x67LtBHaTd_diu5-workers-vite-plugin-v1-40-0-adds-experimental-cloudflare-config-ts-support), and the [SMTP submission beta](/release/rel_slwQctpAzyp2qt6vRmQ3O-email-service-authenticated-smtp-submission-now-available-in-beta) adds a third way to send transactional email from Workers. R2 SQL now supports [UNION, INTERSECT, EXCEPT, and SELECT DISTINCT](/release/rel_Og1agnhh9Kqdf4i0MWMKs-r2-sql-r2-sql-now-supports-union-intersect-except-and-select-distinct) for analytical queries on Iceberg tables.\n\n### Realtime voice, persistent sandboxes, and OIDC\n\nThe [AI SDK’s experimental Realtime API support](/release/rel_xL2dIA-OYA-RyCnP4YPqb-ai-sdk-ai-sdk-react-4-0-0-canary-168-adds-experimental-realtime-api-support) adds a `useRealtime` hook for speech-to-speech conversations, with provider implementations for OpenAI, Google, and xAI including server-side ephemeral token creation. Vercel’s [Sandbox Drives (private beta)](/release/rel_tLHCJo-l4mnSPXsrOGCk1-drives-for-vercel-sandbox-in-private-beta) provide persistent, attachable storage independent of any sandbox lifecycle — useful for keeping agent workspaces across disposable environments. The [skills.sh API](/release/rel_ABuLSN0f514zSvRVLy9K--the-skills-sh-api-is-now-available) is now available, querying 600,000+ open-source skills via short-lived OIDC tokens. Render added [OIDC authentication with AWS](/release/rel_wRtRr7UzZ16vThryIy8jU-authenticate-render-services-with-aws-using-oidc) in beta, and [Turborepo’s latest canary](/release/rel_v2vu976I4i8d_lyk-VZDv-turborepo-v2-9-17-canary-4-ignores-peer-dependencies-in-package-graph) ignores peer dependencies in the package graph, reducing false positives in dependency resolution.\n\nOn the smaller side, Railway shipped five CLI versions — durable streaming exec over WebSocket, agentic auth flows, and an interactive sandbox directory picker — and Next.js continued its canary cycle with Turbopack memory management improvements and App Shell staging.","releaseIds":["rel_bg3hihp99MCdQpRiA4Nhi","rel_H3iXx0EG1FDe6anWqoo-n","rel_dS7MXMtdbJydq-2wB1REa","rel_eTCOPIAiZXz5st-jFLwn-","rel_GYQZIuOktHxFyHE6OtyuS","rel_9FSlKQZbOhcWiEGfFTwUv","rel_iG8Tc0x67LtBHaTd_diu5","rel_slwQctpAzyp2qt6vRmQ3O","rel_Og1agnhh9Kqdf4i0MWMKs","rel_xL2dIA-OYA-RyCnP4YPqb","rel_tLHCJo-l4mnSPXsrOGCk1","rel_ABuLSN0f514zSvRVLy9K-","rel_wRtRr7UzZ16vThryIy8jU","rel_v2vu976I4i8d_lyk-VZDv"],"releaseCount":153,"generatedAt":"2026-07-11T16:50:54.346Z","releases":[{"id":"rel_bg3hihp99MCdQpRiA4Nhi","title":"Security Center - Create WAF rules directly from Threat Events saved views","path":"/release/rel_bg3hihp99MCdQpRiA4Nhi-security-center-create-waf-rules-directly-from-threat-events-saved-views","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_H3iXx0EG1FDe6anWqoo-n","title":"Security Center - Introducing Threat Actor Profiles in Threat Events","path":"/release/rel_H3iXx0EG1FDe6anWqoo-n-security-center-introducing-threat-actor-profiles-in-threat-events","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_dS7MXMtdbJydq-2wB1REa","title":"Workflows - Rollback support now available in Workflows","path":"/release/rel_dS7MXMtdbJydq-2wB1REa-workflows-rollback-support-now-available-in-workflows","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_eTCOPIAiZXz5st-jFLwn-","title":"Gateway, Cloudflare Mesh, Workers VPC - Filter Workers' public Internet traffic using Gateway policies","path":"/release/rel_eTCOPIAiZXz5st-jFLwn--gateway-cloudflare-mesh-workers-vpc-filter-workers-public-internet-traffic-using","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_GYQZIuOktHxFyHE6OtyuS","title":"AI Gateway - Control AI costs with spend limits","path":"/release/rel_GYQZIuOktHxFyHE6OtyuS-ai-gateway-control-ai-costs-with-spend-limits","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_9FSlKQZbOhcWiEGfFTwUv","title":"Workers wrangler@4.98.0 adds D1 migrations_pattern and generalizes deploy paths","path":"/release/rel_9FSlKQZbOhcWiEGfFTwUv-d1-migrations-pattern-supports-nested-layouts-deploy-accepts-directories","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_iG8Tc0x67LtBHaTd_diu5","title":"Workers Vite Plugin v1.40.0 adds experimental cloudflare.config.ts support","path":"/release/rel_iG8Tc0x67LtBHaTd_diu5-experimental-cloudflare-config-ts-configuration-now-available","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_slwQctpAzyp2qt6vRmQ3O","title":"Email Service - Authenticated SMTP submission now available in beta","path":"/release/rel_slwQctpAzyp2qt6vRmQ3O-email-service-authenticated-smtp-submission-now-available-in-beta","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_Og1agnhh9Kqdf4i0MWMKs","title":"R2 SQL - R2 SQL now supports UNION, INTERSECT, EXCEPT, and SELECT DISTINCT","path":"/release/rel_Og1agnhh9Kqdf4i0MWMKs-r2-sql-r2-sql-now-supports-union-intersect-except-and-select-distinct","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":null},{"id":"rel_xL2dIA-OYA-RyCnP4YPqb","title":"AI SDK @ai-sdk/react@4.0.0-canary.168 adds experimental Realtime API support","path":"/release/rel_xL2dIA-OYA-RyCnP4YPqb-experimental-realtime-api-support-for-voice-conversations","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_tLHCJo-l4mnSPXsrOGCk1","title":"Drives for Vercel Sandbox in Private Beta","path":"/release/rel_tLHCJo-l4mnSPXsrOGCk1-drives-for-vercel-sandbox-in-private-beta","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_ABuLSN0f514zSvRVLy9K-","title":"The skills.sh API is now available","path":"/release/rel_ABuLSN0f514zSvRVLy9K--the-skills-sh-api-is-now-available","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_wRtRr7UzZ16vThryIy8jU","title":"Authenticate Render services with AWS using OIDC","path":"/release/rel_wRtRr7UzZ16vThryIy8jU-authenticate-render-services-with-aws-using-oidc","org":{"slug":"render","name":"Render"},"importance":null},{"id":"rel_v2vu976I4i8d_lyk-VZDv","title":"Turborepo v2.9.17-canary.4 ignores peer dependencies in package graph","path":"/release/rel_v2vu976I4i8d_lyk-VZDv-peer-dependencies-ignored-in-package-graph","org":{"slug":"vercel","name":"Vercel"},"importance":null}]}}