{"collection":{"slug":"application-platforms","name":"Application Platforms"},"digest":{"id":"cwd_nTB5UhSfK5tIGZYK9Q6Dg","weekStart":"2026-07-20","title":"Security patches and local observability reshape the platform week","intro":"Next.js patches four high-severity vulnerabilities, Cloudflare Workers gains local-dev tracing, and Vercel CLI adds AI Gateway budgets and Python rewrite visibility.","body":"### Security patches across the framework\n\nThe story of the week begins with a coordinated security release from Vercel. [Next.js v16.2.11](/release/rel_o9NeJTd9V-4U4e5yZt-Mq-next-js-v16-2-11-patches-high-severity-ssrf-dos-and-middleware-bypass) and the corresponding [v15.5.21](/release/rel_x3urtEfPxuCbjFmkvHM85-next-js-v15-5-21-patches-high-severity-ssrf-dos-and-middleware-bypass) patch four high-severity advisories covering denial of service via Server Actions, a middleware/proxy bypass in Turbopack single-locale apps, and two Server-Side Request Forgery vectors — one in rewrites and another in Server Actions on custom servers. Five moderate-severity fixes accompany them, addressing cache confusion, image optimization DoS, and unauthenticated endpoint disclosure. Any team running Next.js in production should prioritize this upgrade. A follow-up [v15.5.22](/release/rel_STFHkKgYWdm2Qx2dwmgH4-next-js-v15-5-22-rejects-typescript-7-0-with-actionable-error) rejects TypeScript 7.0 with an actionable error, a small but welcome guardrail.\n\n### Local observability lands in Workers\n\nCloudflare shipped a major improvement to the local development experience. [Wrangler v4.114.0](/release/rel_sLBHvKoHq2yYEz_ebczQ4-wrangler-v4-114-0-adds-local-dev-observability-with-traces-and-sql-endpoint) and the [Workers Vite Plugin v1.47.0](/release/rel_s13dc-W9dpBCeWCYKQDq6-workers-vite-plugin-v1-47-0-adds-local-dev-observability-and-crash-recovery) now capture full traces for every local Worker invocation — spans, logs, and `console.*` output — explorable through a new Observability tab or a read-only SQL endpoint. The [Miniflare](/release/rel_88aoLnOXfZ1YBiYuB3Ogc-workers-sdk-miniflare-adds-local-observability-traces-and-recovers-from-runtime) runtime also recovers from crashes instead of going silent, automatically restarting workerd and Vite. For teams debugging cross-worker or Durable Object interactions, this fills a real gap in the local feedback loop.\n\n### TLS optimization and WAF expansion\n\nCloudflare rolled out automatic TLS 1.3 key exchange for all origins, predicting the preferred key agreement algorithm and sending its key share in the first ClientHello to avoid a round trip. The feature, described in [Application Performance](/release/rel_AgN4MpH8tSMKqWKNpr_1Z-cloudflare-application-performance-automatically-optimizes-tls-1-3-origin-key), is on by default for new zones and prefers the post-quantum X25519MLKEM768 hybrid when supported. On the security side, [Cloudflare WAF](/release/rel_RWSs6FH3HENLHC7_6RdU2-cloudflare-waf-blocks-adobe-coldfusion-and-wordpress-cves-expands-ssrf-and-lfi) added rules blocking Adobe ColdFusion path traversal, WordPress SQL injection and RCE, and expanded SSRF and LFI detections to default Block.\n\n### Vercel Connect expands and AI Gateway gains new models\n\n[Vercel Connect](/release/rel_B42FR9qJxZIEIfzN669wn-vercel-connect-adds-90-preset-connectors) now ships with 90+ preset connectors, significantly reducing integration setup friction. The [AI Gateway](/release/rel__6yZYPCeR7iBUNatM5DrO-vercel-ai-gateway-adds-gemini-3-6-flash-and-3-5-flash-lite-models) added Gemini 3.6 Flash and 3.5 Flash-Lite, and [service tiers](/release/rel_J5Lo5S1hYoibbf8O-ZYwa-vercel-ai-gateway-adds-service-tiers-for-flexible-usage-management) for flexible usage management. The [AI SDK Anthropic provider](/release/rel_B0duOxiAeXjmVwDIHfWYN-ai-sdk-anthropic-provider-v4-0-20-adds-claude-opus-5-safety-fallback-and-mid) now supports Claude Opus 5, mid-conversation tool changes, and a safety classifier fallback mode — additions mirrored across the v3 and v4 provider lines. The [OpenAI provider](/release/rel_OrJTX4djShuSyTVOqzo6O-ai-sdk-openai-v4-0-20-adds-responses-programmatic-tool-calling) added Responses programmatic tool calling with hosted program tools and structured output schemas.\n\n### Vercel CLI and Python improvements\n\n[Vercel CLI 57.0.0](/release/rel_jUPVXN4cuuiqfZ0VGQy0P-vercel-cli-57-0-0-exposes-rewrite-destinations-to-python-improves-alerts-and) exposes resolved rewrite destinations to Python framework applications, alerting affected projects about the behavior change. The Python builder [@vercel/python@6.52.0](/release/rel_Pj9zRq5nNeSMTn6vHRgSg-vercel-cli-vercel-python-6-52-0-reduces-python-compilation-work-and-collects) reduces bytecode compilation work and collects FastAPI static files for CDN serving. The CLI also added [AI Gateway budgets commands](/release/rel_l8RbY56QEFO_nTk7k8F00-vercel-cli-56-5-0-adds-vercel-ai-gateway-budgets-commands-and-comments) and a `vercel flags evaluations` command for per-variant evaluation charts. A new native binary trampoline [gates behind explicit opt-in](/release/rel_TYWZWCrCnkGIiyuZB7S6G-vercel-cli-v0-2-1-gates-native-binary-behind-opt-in), preserving stability for teams that don't need it.\n\n### Cloudflare agents and config evolution\n\nThe [Cloudflare Agents SDK](/release/rel_HhV4MclbM-mXyKcuB_2nI-cloudflare-agents-sdk-packages-now-support-ai-sdk-v6-and-v7) now supports AI SDK v6 and v7 across its agent, chat, codemode, and think packages, letting teams upgrade independently. The SDK also [reduces MCP schema conversion](/release/rel_gLezE8rTPLQns-cEaEpjj-cloudflare-agents-sdk-reduces-mcp-schema-conversion-adds-exposure-control-for) overhead and adds `includeMcpTools` for opt-out. [Workers config v0.3.0](/release/rel_isRsBVQ2maJgkv_nPuBVQ-workers-config-v0-3-0-moves-account-level-settings-to-dedicated-settings-export) moves account-level settings to a dedicated `settings` export, and [Wrangler 4.113.0](/release/rel_6Tt7jAcA0-G8JWWj670Yk-wrangler-4-113-0-applies-email-routing-addresses-on-deploy-and-expands-auto) reconciles Email Routing rules on deploy with automatic resource provisioning now GA for Queue, Dispatch Namespace, and Flagship bindings.\n\n### Housekeeping across the ecosystem\n\nThe [Cloudflare One Client](/release/rel_QYXVS-MSWjqZXDWqf2Ief-cloudflare-one-client-for-windows-2026-6-880-0-fixes-dns-over-tcp-query) for Windows and macOS fixed a DNS-over-TCP query regression, and the [Account Roles API](/release/rel_5Qf0v1r_gUkrRXv8Y0nXc-cloudflare-fundamentals-deprecates-account-roles-api-in-favor-of-permission) is deprecated in favor of Permission Groups. On the AI SDK side, the [Amazon Bedrock provider](/release/rel_ANG0fa6GTjWMMS0RM_pif-ai-sdk-amazon-bedrock-provider-v3-0-109-passes-s3-image-urls-directly-to) now passes S3 image URLs directly to Converse, uses native structured output for Claude models, and [omits rejected fields](/release/rel_v8jMyKobKVQ5Vu1ThMx-k-ai-sdk-amazon-bedrock-provider-v5-0-32-fixes-tool-strict-and-output-config) for Bedrock compatibility. The [tool approval HMAC](/release/rel_ROIRMbiIYe6B_e8oo431P-ai-sdk-7-0-36-fixes-tool-approval-hmac-collision-for-newline-containing-fields) fix uses injective JSON serialization, and a [media-type sniffing regression](/release/rel_oNynYWidDpIizHOuylJZ0-ai-sdk-5-0-219-fixes-o-n-media-type-sniffing-regression-for-id3-prefixed-input) in the AI SDK core is now bounded to O(1).","releaseIds":["rel_o9NeJTd9V-4U4e5yZt-Mq","rel_x3urtEfPxuCbjFmkvHM85","rel_STFHkKgYWdm2Qx2dwmgH4","rel_sLBHvKoHq2yYEz_ebczQ4","rel_s13dc-W9dpBCeWCYKQDq6","rel_88aoLnOXfZ1YBiYuB3Ogc","rel_AgN4MpH8tSMKqWKNpr_1Z","rel_RWSs6FH3HENLHC7_6RdU2","rel_B42FR9qJxZIEIfzN669wn","rel__6yZYPCeR7iBUNatM5DrO","rel_J5Lo5S1hYoibbf8O-ZYwa","rel_B0duOxiAeXjmVwDIHfWYN","rel_OrJTX4djShuSyTVOqzo6O","rel_jUPVXN4cuuiqfZ0VGQy0P","rel_Pj9zRq5nNeSMTn6vHRgSg","rel_l8RbY56QEFO_nTk7k8F00","rel_TYWZWCrCnkGIiyuZB7S6G","rel_HhV4MclbM-mXyKcuB_2nI","rel_gLezE8rTPLQns-cEaEpjj","rel_isRsBVQ2maJgkv_nPuBVQ","rel_6Tt7jAcA0-G8JWWj670Yk","rel_QYXVS-MSWjqZXDWqf2Ief","rel_5Qf0v1r_gUkrRXv8Y0nXc","rel_ANG0fa6GTjWMMS0RM_pif","rel_v8jMyKobKVQ5Vu1ThMx-k","rel_ROIRMbiIYe6B_e8oo431P","rel_oNynYWidDpIizHOuylJZ0"],"releaseCount":170,"generatedAt":"2026-07-27T06:16:16.904Z","releases":[{"id":"rel_o9NeJTd9V-4U4e5yZt-Mq","title":"Next.js v16.2.11 patches high-severity SSRF, DoS, and middleware bypass","path":"/release/rel_o9NeJTd9V-4U4e5yZt-Mq-four-high-severity-cves-patched-all-deployments-should-upgrade","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_x3urtEfPxuCbjFmkvHM85","title":"Next.js v15.5.21 patches high-severity SSRF, DoS, and middleware bypass vulnerabilities","path":"/release/rel_x3urtEfPxuCbjFmkvHM85-four-high-severity-security-flaws-patched","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_STFHkKgYWdm2Qx2dwmgH4","title":"Next.js v15.5.22 rejects TypeScript 7.0 with actionable error","path":"/release/rel_STFHkKgYWdm2Qx2dwmgH4-typescript-7-0-now-rejected-with-actionable-error","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_sLBHvKoHq2yYEz_ebczQ4","title":"Wrangler v4.114.0 adds local-dev observability with traces and SQL endpoint","path":"/release/rel_sLBHvKoHq2yYEz_ebczQ4-local-dev-observability-traces-logs-sql-query-endpoint","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_s13dc-W9dpBCeWCYKQDq6","title":"Workers Vite Plugin v1.47.0 adds local-dev observability and crash recovery","path":"/release/rel_s13dc-W9dpBCeWCYKQDq6-local-dev-tracing-and-crash-recovery-in-vite-plugin","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_88aoLnOXfZ1YBiYuB3Ogc","title":"Workers SDK Miniflare adds local observability traces and recovers from runtime crashes","path":"/release/rel_88aoLnOXfZ1YBiYuB3Ogc-local-dev-gets-observability-traces-workerd-crashes-now-auto-recover","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_AgN4MpH8tSMKqWKNpr_1Z","title":"Cloudflare Application Performance automatically optimizes TLS 1.3 origin key exchange","path":"/release/rel_AgN4MpH8tSMKqWKNpr_1Z-automatic-origin-key-exchange-cuts-tls-1-3-round-trips","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_RWSs6FH3HENLHC7_6RdU2","title":"Cloudflare WAF blocks Adobe ColdFusion and WordPress CVEs, expands SSRF and LFI rules","path":"/release/rel_RWSs6FH3HENLHC7_6RdU2-adobe-coldfusion-and-wordpress-cves-blocked-ssrf-lfi-rules-upgraded","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":4},{"id":"rel_B42FR9qJxZIEIfzN669wn","title":"Vercel Connect adds 90+ preset connectors","path":"/release/rel_B42FR9qJxZIEIfzN669wn-90-preset-connectors-for-vercel-connect","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel__6yZYPCeR7iBUNatM5DrO","title":"Vercel AI Gateway adds Gemini 3.6 Flash and 3.5 Flash-Lite models","path":"/release/rel__6yZYPCeR7iBUNatM5DrO-gemini-3-6-flash-and-3-5-flash-lite-join-ai-gateway","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_J5Lo5S1hYoibbf8O-ZYwa","title":"Vercel AI Gateway adds service tiers for flexible usage management","path":"/release/rel_J5Lo5S1hYoibbf8O-ZYwa-service-tiers-for-ai-gateway-usage-management","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_B0duOxiAeXjmVwDIHfWYN","title":"AI SDK Anthropic provider v4.0.20 adds Claude Opus 5, safety fallback, and mid-conversation tool changes","path":"/release/rel_B0duOxiAeXjmVwDIHfWYN-claude-opus-5-safety-fallback-and-mid-conversation-tool-changes","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_OrJTX4djShuSyTVOqzo6O","title":"AI SDK OpenAI v4.0.20 adds Responses programmatic tool calling","path":"/release/rel_OrJTX4djShuSyTVOqzo6O-responses-api-programmatic-tool-calling-with-hosted-tools","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_jUPVXN4cuuiqfZ0VGQy0P","title":"Vercel CLI 57.0.0 exposes rewrite destinations to Python, improves alerts and logs","path":"/release/rel_jUPVXN4cuuiqfZ0VGQy0P-rewrite-destinations-exposed-to-python-alerts-and-logs-improved","org":{"slug":"vercel","name":"Vercel"},"importance":4},{"id":"rel_Pj9zRq5nNeSMTn6vHRgSg","title":"Vercel CLI @vercel/python@6.52.0 reduces Python compilation work and collects FastAPI static files for CDN","path":"/release/rel_Pj9zRq5nNeSMTn6vHRgSg-python-bytecode-compiled-in-one-subprocess-fastapi-static-files-served-via-cdn","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_l8RbY56QEFO_nTk7k8F00","title":"Vercel CLI 56.5.0 adds vercel ai-gateway budgets commands and comments","path":"/release/rel_l8RbY56QEFO_nTk7k8F00-ai-gateway-budgets-commands-vercel-comments-ship","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_TYWZWCrCnkGIiyuZB7S6G","title":"Vercel CLI v0.2.1 gates native binary behind opt-in","path":"/release/rel_TYWZWCrCnkGIiyuZB7S6G-native-binary-now-opt-in-zod-free-config-path-added","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_HhV4MclbM-mXyKcuB_2nI","title":"Cloudflare Agents SDK packages now support AI SDK v6 and v7","path":"/release/rel_HhV4MclbM-mXyKcuB_2nI-ai-sdk-v7-compatible-with-agents-packages","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_gLezE8rTPLQns-cEaEpjj","title":"Cloudflare Agents SDK reduces MCP schema conversion, adds exposure control for Think","path":"/release/rel_gLezE8rTPLQns-cEaEpjj-mcp-schema-conversion-cached-think-gets-includemcptools-opt-out","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_isRsBVQ2maJgkv_nPuBVQ","title":"Workers config v0.3.0 moves account-level settings to dedicated `settings` export","path":"/release/rel_isRsBVQ2maJgkv_nPuBVQ-account-level-settings-split-into-dedicated-settings-export","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_6Tt7jAcA0-G8JWWj670Yk","title":"Wrangler 4.113.0 applies Email Routing addresses on deploy and expands auto-provisioning","path":"/release/rel_6Tt7jAcA0-G8JWWj670Yk-email-routing-addresses-reconciled-on-deploy-auto-provisioning-ga","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_QYXVS-MSWjqZXDWqf2Ief","title":"Cloudflare One Client for Windows 2026.6.880.0 fixes DNS-over-TCP query regression","path":"/release/rel_QYXVS-MSWjqZXDWqf2Ief-fallback-dns-now-uses-udp-first-then-tcp","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_5Qf0v1r_gUkrRXv8Y0nXc","title":"Cloudflare Fundamentals deprecates Account Roles API in favor of Permission Groups API","path":"/release/rel_5Qf0v1r_gUkrRXv8Y0nXc-account-roles-api-deprecated-permissions-groups-api-replaces-it","org":{"slug":"cloudflare","name":"Cloudflare"},"importance":3},{"id":"rel_ANG0fa6GTjWMMS0RM_pif","title":"AI SDK Amazon Bedrock provider v3.0.109 passes S3 image URLs directly to Converse","path":"/release/rel_ANG0fa6GTjWMMS0RM_pif-s3-image-urls-passed-directly-to-bedrock-converse-native-thinking-with","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_v8jMyKobKVQ5Vu1ThMx-k","title":"AI SDK Amazon Bedrock provider v5.0.32 fixes tool strict and output_config format for Claude models","path":"/release/rel_v8jMyKobKVQ5Vu1ThMx-k-tool-strict-and-output-config-format-omitted-for-bedrock-claude-models","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_ROIRMbiIYe6B_e8oo431P","title":"AI SDK 7.0.36 fixes tool approval HMAC collision for newline-containing fields","path":"/release/rel_ROIRMbiIYe6B_e8oo431P-tool-approval-hmac-payload-now-uses-json-stringify-to-prevent-collision","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_oNynYWidDpIizHOuylJZ0","title":"AI SDK 5.0.219 fixes O(N) media-type sniffing regression for ID3-prefixed input","path":"/release/rel_oNynYWidDpIizHOuylJZ0-media-type-sniffing-now-o-1-for-id3-prefixed-attachments","org":{"slug":"vercel","name":"Vercel"},"importance":3}]}}