--- collection: application-platforms collection_name: Application Platforms week_start: 2026-06-01 title: Actionable threat intelligence and deeper platform control release_count: 153 generated: 2026-07-11 canonical: https://releases.sh/collections/application-platforms/digest/2026-06-01 --- # Actionable threat intelligence and deeper platform control Cloudflare turned threat indicators into instant WAF rules, Workflows gained saga-style rollbacks, and Workers traffic can now be filtered through Gateway policies. Vercel shipped experimental realtime voice support in the AI SDK and persistent drives for sandboxes. ### Threat intelligence you can act on immediately The week’s most significant development was Cloudflare’s Security Center upgrades. You can now [create WAF rules directly from Threat Events saved views](/release/rel_bg3hihp99MCdQpRiA4Nhi-security-center-create-waf-rules-directly-from-threat-events-saved-views), turning Cloudforce One indicators into active defense without manual extraction. Security teams can also [pivot from a blocked event to a full Threat Actor Profile](/release/rel_H3iXx0EG1FDe6anWqoo-n-security-center-introducing-threat-actor-profiles-in-threat-events), revealing the “who, why, and how” behind an attack. This closes the gap between detection and response — intelligence that isn’t immediately actionable is just noise. ### A platform for building more resilient applications Cloudflare Workflows now supports [saga-style rollbacks](/release/rel_dS7MXMtdbJydq-2wB1REa-workflows-rollback-support-now-available-in-workflows), letting you add compensating logic to each `step.do()` that executes in reverse order on failure — critical for multi-step operations touching inventory, payments, or external APIs. Separately, the [Workers VPC](/release/rel_eTCOPIAiZXz5st-jFLwn--gateway-cloudflare-mesh-workers-vpc-filter-workers-public-internet-traffic-using) binding now routes public Internet egress through Cloudflare Gateway, so Zero Trust policies that apply to WARP users also govern your Workers’ traffic. The [AI Gateway’s new spend limits](/release/rel_GYQZIuOktHxFyHE6OtyuS-ai-gateway-control-ai-costs-with-spend-limits) track cumulative dollar cost per model or user, blocking requests when budgets are exceeded — a practical alternative to rate limiting for cost control. Wrangler 4.98.0 introduced a [migrations_pattern field for D1 bindings](/release/rel_9FSlKQZbOhcWiEGfFTwUv-workers-wrangler-4-98-0-adds-d1-migrations-pattern-and-generalizes-deploy-paths), supporting ORM-generated migration folders, while the deploy command now accepts a generic path argument that auto-detects whether the target is a Worker file or static assets. The [Vite Plugin gained experimental `cloudflare.config.ts` support](/release/rel_iG8Tc0x67LtBHaTd_diu5-workers-vite-plugin-v1-40-0-adds-experimental-cloudflare-config-ts-support), and the [SMTP submission beta](/release/rel_slwQctpAzyp2qt6vRmQ3O-email-service-authenticated-smtp-submission-now-available-in-beta) adds a third way to send transactional email from Workers. R2 SQL now supports [UNION, INTERSECT, EXCEPT, and SELECT DISTINCT](/release/rel_Og1agnhh9Kqdf4i0MWMKs-r2-sql-r2-sql-now-supports-union-intersect-except-and-select-distinct) for analytical queries on Iceberg tables. ### Realtime voice, persistent sandboxes, and OIDC The [AI SDK’s experimental Realtime API support](/release/rel_xL2dIA-OYA-RyCnP4YPqb-ai-sdk-ai-sdk-react-4-0-0-canary-168-adds-experimental-realtime-api-support) adds a `useRealtime` hook for speech-to-speech conversations, with provider implementations for OpenAI, Google, and xAI including server-side ephemeral token creation. Vercel’s [Sandbox Drives (private beta)](/release/rel_tLHCJo-l4mnSPXsrOGCk1-drives-for-vercel-sandbox-in-private-beta) provide persistent, attachable storage independent of any sandbox lifecycle — useful for keeping agent workspaces across disposable environments. The [skills.sh API](/release/rel_ABuLSN0f514zSvRVLy9K--the-skills-sh-api-is-now-available) is now available, querying 600,000+ open-source skills via short-lived OIDC tokens. Render added [OIDC authentication with AWS](/release/rel_wRtRr7UzZ16vThryIy8jU-authenticate-render-services-with-aws-using-oidc) in beta, and [Turborepo’s latest canary](/release/rel_v2vu976I4i8d_lyk-VZDv-turborepo-v2-9-17-canary-4-ignores-peer-dependencies-in-package-graph) ignores peer dependencies in the package graph, reducing false positives in dependency resolution. On the smaller side, Railway shipped five CLI versions — durable streaming exec over WebSocket, agentic auth flows, and an interactive sandbox directory picker — and Next.js continued its canary cycle with Turbopack memory management improvements and App Shell staging. ## Releases covered ### Cloudflare - [Security Center - Create WAF rules directly from Threat Events saved views](https://releases.sh/release/rel_bg3hihp99MCdQpRiA4Nhi-security-center-create-waf-rules-directly-from-threat-events-saved-views) - [Security Center - Introducing Threat Actor Profiles in Threat Events](https://releases.sh/release/rel_H3iXx0EG1FDe6anWqoo-n-security-center-introducing-threat-actor-profiles-in-threat-events) - [Workflows - Rollback support now available in Workflows](https://releases.sh/release/rel_dS7MXMtdbJydq-2wB1REa-workflows-rollback-support-now-available-in-workflows) - [Gateway, Cloudflare Mesh, Workers VPC - Filter Workers' public Internet traffic using Gateway policies](https://releases.sh/release/rel_eTCOPIAiZXz5st-jFLwn--gateway-cloudflare-mesh-workers-vpc-filter-workers-public-internet-traffic-using) - [AI Gateway - Control AI costs with spend limits](https://releases.sh/release/rel_GYQZIuOktHxFyHE6OtyuS-ai-gateway-control-ai-costs-with-spend-limits) - [Workers wrangler@4.98.0 adds D1 migrations_pattern and generalizes deploy paths](https://releases.sh/release/rel_9FSlKQZbOhcWiEGfFTwUv-d1-migrations-pattern-supports-nested-layouts-deploy-accepts-directories) - [Workers Vite Plugin v1.40.0 adds experimental cloudflare.config.ts support](https://releases.sh/release/rel_iG8Tc0x67LtBHaTd_diu5-experimental-cloudflare-config-ts-configuration-now-available) - [Email Service - Authenticated SMTP submission now available in beta](https://releases.sh/release/rel_slwQctpAzyp2qt6vRmQ3O-email-service-authenticated-smtp-submission-now-available-in-beta) - [R2 SQL - R2 SQL now supports UNION, INTERSECT, EXCEPT, and SELECT DISTINCT](https://releases.sh/release/rel_Og1agnhh9Kqdf4i0MWMKs-r2-sql-r2-sql-now-supports-union-intersect-except-and-select-distinct) ### Render - [Authenticate Render services with AWS using OIDC](https://releases.sh/release/rel_wRtRr7UzZ16vThryIy8jU-authenticate-render-services-with-aws-using-oidc) ### Vercel - [AI SDK @ai-sdk/react@4.0.0-canary.168 adds experimental Realtime API support](https://releases.sh/release/rel_xL2dIA-OYA-RyCnP4YPqb-experimental-realtime-api-support-for-voice-conversations) - [Drives for Vercel Sandbox in Private Beta](https://releases.sh/release/rel_tLHCJo-l4mnSPXsrOGCk1-drives-for-vercel-sandbox-in-private-beta) - [The skills.sh API is now available](https://releases.sh/release/rel_ABuLSN0f514zSvRVLy9K--the-skills-sh-api-is-now-available) - [Turborepo v2.9.17-canary.4 ignores peer dependencies in package graph](https://releases.sh/release/rel_v2vu976I4i8d_lyk-VZDv-peer-dependencies-ignored-in-package-graph)