{"collection":{"slug":"application-platforms","name":"Application Platforms"},"digest":{"id":"cwd_3JYc2uEjSv6PfyeHiorno","weekStart":"2026-08-24","title":"Critical Next.js RCE patches land as Vercel opens its agent stack","intro":"Next.js shipped emergency patches for two critical unauthenticated remote code execution flaws, Cloudflare's WAF raced out matching detections, and Vercel took its agent connectivity layer and agent builder to general availability.","body":"### Next.js RCE patches, and the WAF rules that raced them\n\nThe week's most urgent story was a pair of critical unauthenticated remote code execution vulnerabilities in Next.js: one affecting Windows-hosted servers and one reachable through the Image Optimization API when crafted AVIF files are processed. Vercel patched both branches at once, with [the 16.x line](/release/rel_szezifiwmX4wDfGw-5u1Z-next-js-v16-3-3-patches-two-critical-unauthenticated-rce-vulnerabilities) and [the 15.x line](/release/rel_fKHCmzeMe6DmiS2IlwGee-next-js-v15-5-24-patches-two-critical-unauthenticated-rce-vulnerabilities) each receiving the same two advisory fixes — if you run either major version in production, upgrade now rather than waiting for a routine window.\n\nCloudflare's WAF moved in parallel. An [emergency rules update](/release/rel_mIow4KIc8bxfnfUsdAD8O-cloudflare-waf-blocks-next-js-rce-cve-2026-75604) extended an existing Next.js RCE rule to identify CVE-2026-75604 across Windows-hosted Pages Router and App Router apps, and added fresh detection for the AVIF Image Optimizer path. The same week brought [four detections promoted from Log to Block](/release/rel_wNSR-jQCGCW6KWNWHD0Xa-cloudflare-waf-moves-four-detections-to-block-and-adds-rce-rule), including HTTP/2 request smuggling and XSS JavaScript event handler coercion across headers, body, and URI, plus a new generic remote code execution rule in Block mode. Together that's a meaningful tightening of default protections for anyone behind the managed ruleset.\n\nNext.js also continued its v17 groundwork, with [Cache Components arriving in create-next-app](/release/rel_p8qh_KDJKXDTe5EViUCUc-next-js-v16-4-0-canary-10-launches-cache-components-and-deprecates-react-18) and Pages Router deprecating React 18, alongside Turbopack tweaks to CSS module class naming and request-context retention.\n\n### Vercel opens up agent infrastructure\n\nVercel's bigger product story was [Vercel Connect reaching general availability](/release/rel_s2jDYIU50TsxH5s3kXits-vercel-connect-ga-brings-secure-connectivity-for-ai-agents), giving agents and apps a supported secure connectivity layer instead of bespoke plumbing. It pairs naturally with [building eve agents straight from the dashboard](/release/rel_4PNelFw8pSF7eI6dXAU1_-vercel-dashboard-now-lets-you-build-and-deploy-eve-agents), which scaffolds agent code, pushes it to your repo, and creates a project wired up with AI Gateway models, web chat or Slack, and MCP connections — a notable shortcut from idea to running agent.\n\nThe AI Gateway itself got steadier in production terms: [per-user spending caps](/release/rel_YaQTPvqsPiuQT4KtzTU2v-vercel-ai-gateway-budgets-add-per-user-spending-caps) join the existing team, project, and API key budgets, while [Tencent's Hy4 Preview](/release/rel_jLfmLsX3KnlMg7hC1f-ZF-vercel-ai-gateway-adds-hy4-preview-with-one-key-access) and [Meta's Muse Image](/release/rel_BuW4OYH1vIQhE_QO0gzPP-vercel-ai-gateway-adds-muse-image-by-meta-support) both became callable with a single key, no provider account required. On the SDK side, the harness layer picked up [an fx adapter](/release/rel_47AIsGIuENNav-H2tkxMG-vercel-s-ai-sdk-harness-layer-now-supports-fx-via-ai-sdk-harness-fx) that runs through the existing HarnessAgent interface.\n\nPerformance monitoring got cheaper for everyone: [Speed Insights introduced a free tier](/release/rel_2n_bNKuTOrG2iofIfuAVq-vercel-speed-insights-now-has-a-free-tier) covering real-user data on every plan, with paid capabilities continuing as Speed Insights Plus.\n\nThe AI SDK shipped a run of provider work — a new [Z.AI provider for GLM chat completions](/release/rel__-l1EdTNBIiea-op7uzfz-ai-sdk-adds-z-ai-provider-with-glm-chat-completions) with streaming, reasoning, tools, and multimodal inputs; [Moonshot's predicted output and partial mode support](/release/rel_INiLKknQEOp0xkR4QYOpb-moonshot-ai-provider-adds-predicted-output-and-partial-mode-support); [Google safety-block metadata surfaced as content-filter results](/release/rel_-MXUq9iqe2CWFILX28xl3-ai-sdk-google-provider-4-0-55-surfaces-safety-block-metadata); and [stricter tool-choice enforcement in generateText](/release/rel_9IYKeri0yFMeoLSbKiOVq-ai-sdk-6-0-272-rejects-invalid-tool-choice-responses-in-generatetext), which now rejects responses that violate a required tool selection and exposes the content for recovery.\n\n### GLM-5.3 lands across Workers AI\n\nCloudflare's model catalog absorbed Z.ai's latest in a hurry. [GLM-5.3, the flagship agentic coding model](/release/rel_CdC46YGADnKlyJYRgsh2v-workers-ai-adds-glm-5-3-z-ai-s-flagship-agentic-coding-model), arrived at GLM-5.2 pricing while roughly doubling long-horizon benchmark scores, and [GLM-5.3 Flash](/release/rel_6nPYa2k-RUxssXS3FFCDX-workers-ai-adds-z-ai-glm-5-3-flash-first-natively-multimodal-glm-5-model) followed as the first natively multimodal entry in the GLM-5 series, beating its predecessor at a lower price. Both are reachable by binding, REST API, OpenAI-compatible endpoint, or AI Gateway.\n\nAI Search wasted no time adopting them, adding [GLM-5.3 Flash for text generation](/release/rel_UCjhWFkMjMrQzMXRNPD0M-cloudflare-developer-platform-ai-search-adds-glm-5-3-flash-support) with its million-token context window and [six more Workers AI models](/release/rel_JCuF35ZziAW0wN9pGw0aY-cloudflare-ai-search-adds-six-workers-ai-text-generation-models) including DeepSeek V4 Flash and Pro, GPT-OSS 120b and 20b, Qwen3.8-27b, and Kimi K2.7 Code — all without a separate provider key.\n\n### Load balancing, local dev, and platform housekeeping\n\nCloudflare Load Balancing gained [pool sets](/release/rel_x3s0X4qNnCl8fIVzg8d4y-cloudflare-load-balancing-adds-pool-sets-for-location-specific-traffic-steering), letting a single load balancer apply different candidate pools, steering policies, weights, and fallbacks per data center, country, or region — geographic matching that previously took multiple load balancers. Elsewhere on the edge, [Durable Objects raised their concurrent Dynamic Worker ceiling to ten](/release/rel_qlKDs-DnxIItmZWONIEU_-cloudflare-durable-objects-now-support-up-to-ten-concurrent-dynamic-workers), and APO [resumed caching crawler and bot HTML requests](/release/rel_Kce0-3VOXSzXdyv5GbHPE-cloudflare-apo-caches-crawler-and-bot-traffic-again-after-accept-header) after an Accept-header regression, so any Transform Rule workaround you added can go.\n\nThe Workers toolchain had a busy, mostly structural week: [shared local storage across Miniflare instances](/release/rel_z87jmUUVtgi5AGJoGaf_x-workers-miniflare-alpha-adds-shared-local-storage-across-dev-instances), [email inspection and local Images binding support](/release/rel_3dVXAryUsUY0-JRJGX3Ti-workers-sdk-miniflare-alpha-adds-email-inspection-local-images-binding-support), [PR metadata attached to preview deployments](/release/rel_fJZJ9_08XuouennTjguAh-workers-deploy-helpers-0-9-0-adds-pull-request-metadata-to-preview-deployments), [per-workflow default retention in wrangler](/release/rel_-VBfuvYkyqnyUTjdl8Tx9-workers-wrangler-4-126-0-adds-per-workflow-default-retention), and [Vitest support for Workerd's new module registry](/release/rel_r9wiCIJjYEx1V-VYaVGhh-workers-vitest-plugin-v1-1-0-supports-new-module-registry-and-typescript-config). Several config packages converged on a `worker` field name and input/output schema conventions ([config v0.9.0](/release/rel_pgKELSWvukDUw4dBlMoMy-workers-config-v0-9-0-renames-worker-target-fields-to-worker), [Config 0.8.0](/release/rel_jye67e-Ej5beiIS2C8XcS-workers-config-0-8-0-renames-schema-exports-and-consolidates-dev-binding-config), [build-output-utils](/release/rel_MkAP8BhYzQxaudaaqRCAp-workers-sdk-build-output-utils-0-2-0-records-build-mode-and-renames-config)), and the runtime [fixed node:fs cp symlink handling](/release/rel_SsdLfvrcZZxOsaoPe_ub2-cloudflare-workers-v1-20260826-1-fixes-node-fs-cp-symlink-handling-and-adds).\n\nSmaller but worth noting: [app-scoped API tokens for Flagship](/release/rel_KwD1RJHruMI_eqJq6OKtU-cloudflare-flagship-adds-app-scoped-api-tokens-for-per-app-access) and [scannable cfast_ service token secrets](/release/rel_Mg5ZGZ9ypz4oimwa1os5S-cloudflare-access-service-tokens-adopt-scannable-cfast-secret-format) tighten credential hygiene, [Log Explorer gained permanent dataset deletion](/release/rel_AO0mltJK6fUW-bRXkHwc6-cloudflare-log-explorer-now-supports-permanent-dataset-deletion) with protection on by default, and the [Azure Functions Sentinel connector's retirement date](/release/rel__z38mS_XtPs3PhJF8Ha3i-cloudflare-deprecates-azure-functions-based-microsoft-sentinel-connector) is now firm — enterprise users should migrate before September 14. Railway's CLI [reworked its MCP proxy command](/release/rel_Vai0HKbawRoSmlv2DGkYI-railway-cli-v5-44-0-reworks-mcp-proxy-command) and [added a threads TUI](/release/rel_uyX8iW6qy6Wl3XT0tA4uB-railway-cli-v5-45-0-adds-threads-tui-and-project-mcp-import), Railpack [moved pnpm provisioning to Mise](/release/rel_Z6otjOurvo6A56a1f_hov-railpack-v0-38-0-switches-pnpm-to-mise-devengines-now-beat-engines) with devEngines taking precedence, and Turborepo [streamed dry-run JSON output](/release/rel_woOW0E-9U-rAPpt1bHza9-turborepo-v2-10-13-canary-1-streams-dry-run-json-and-merges-globs) while merging same-prefix globs into single directory walks.","releaseIds":["rel_szezifiwmX4wDfGw-5u1Z","rel_fKHCmzeMe6DmiS2IlwGee","rel_mIow4KIc8bxfnfUsdAD8O","rel_wNSR-jQCGCW6KWNWHD0Xa","rel_p8qh_KDJKXDTe5EViUCUc","rel_s2jDYIU50TsxH5s3kXits","rel_4PNelFw8pSF7eI6dXAU1_","rel_YaQTPvqsPiuQT4KtzTU2v","rel_jLfmLsX3KnlMg7hC1f-ZF","rel_BuW4OYH1vIQhE_QO0gzPP","rel_47AIsGIuENNav-H2tkxMG","rel_2n_bNKuTOrG2iofIfuAVq","rel__-l1EdTNBIiea-op7uzfz","rel_INiLKknQEOp0xkR4QYOpb","rel_-MXUq9iqe2CWFILX28xl3","rel_9IYKeri0yFMeoLSbKiOVq","rel_CdC46YGADnKlyJYRgsh2v","rel_6nPYa2k-RUxssXS3FFCDX","rel_UCjhWFkMjMrQzMXRNPD0M","rel_JCuF35ZziAW0wN9pGw0aY","rel_x3s0X4qNnCl8fIVzg8d4y","rel_qlKDs-DnxIItmZWONIEU_","rel_Kce0-3VOXSzXdyv5GbHPE","rel_z87jmUUVtgi5AGJoGaf_x","rel_3dVXAryUsUY0-JRJGX3Ti","rel_fJZJ9_08XuouennTjguAh","rel_-VBfuvYkyqnyUTjdl8Tx9","rel_r9wiCIJjYEx1V-VYaVGhh","rel_pgKELSWvukDUw4dBlMoMy","rel_jye67e-Ej5beiIS2C8XcS","rel_MkAP8BhYzQxaudaaqRCAp","rel_SsdLfvrcZZxOsaoPe_ub2","rel_KwD1RJHruMI_eqJq6OKtU","rel_Mg5ZGZ9ypz4oimwa1os5S","rel_AO0mltJK6fUW-bRXkHwc6","rel__z38mS_XtPs3PhJF8Ha3i","rel_Vai0HKbawRoSmlv2DGkYI","rel_uyX8iW6qy6Wl3XT0tA4uB","rel_Z6otjOurvo6A56a1f_hov","rel_woOW0E-9U-rAPpt1bHza9"],"releaseCount":226,"generatedAt":"2026-09-23T12:43:46.240Z","releases":[{"id":"rel_szezifiwmX4wDfGw-5u1Z","title":"Next.js v16.3.3 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_szezifiwmX4wDfGw-5u1Z-critical-rce-vulnerabilities-patched-upgrade-advised","url":"https://github.com/vercel/next.js/releases/tag/v16.3.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_fKHCmzeMe6DmiS2IlwGee","title":"Next.js v15.5.24 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_fKHCmzeMe6DmiS2IlwGee-two-critical-unauthenticated-rce-flaws-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.24","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_mIow4KIc8bxfnfUsdAD8O","title":"Cloudflare WAF blocks Next.js RCE CVE-2026-75604","path":"/release/rel_mIow4KIc8bxfnfUsdAD8O-new-waf-rule-blocks-next-js-rce","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-emergency-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4},{"id":"rel_wNSR-jQCGCW6KWNWHD0Xa","title":"Cloudflare WAF moves four detections to Block and adds RCE rule","path":"/release/rel_wNSR-jQCGCW6KWNWHD0Xa-four-detections-now-block-rce-rule-added","url":"https://developers.cloudflare.com/changelog/post/2026-08-25-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4},{"id":"rel_p8qh_KDJKXDTe5EViUCUc","title":"Next.js v16.4.0-canary.10 launches Cache Components and deprecates React 18","path":"/release/rel_p8qh_KDJKXDTe5EViUCUc-cache-components-added-react-18-deprecated-on-pages-router","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.10","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3},{"id":"rel_s2jDYIU50TsxH5s3kXits","title":"Vercel Connect GA brings secure connectivity for AI agents","path":"/release/rel_s2jDYIU50TsxH5s3kXits-vercel-connect-now-generally-available","url":"https://vercel.com/changelog#vercel-connect-is-now-generally-available","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":5},{"id":"rel_4PNelFw8pSF7eI6dXAU1_","title":"Vercel dashboard now lets you build and deploy eve agents","path":"/release/rel_4PNelFw8pSF7eI6dXAU1_-eve-agents-built-and-deployed-from-vercel-dashboard","url":"https://vercel.com/changelog#build-and-deploy-eve-agents-from-the-vercel-dashboard","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":4},{"id":"rel_YaQTPvqsPiuQT4KtzTU2v","title":"Vercel AI Gateway budgets add per-user spending caps","path":"/release/rel_YaQTPvqsPiuQT4KtzTU2v-ai-gateway-per-user-spending-caps","url":"https://vercel.com/changelog#set-per-user-budgets-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_jLfmLsX3KnlMg7hC1f-ZF","title":"Vercel AI Gateway adds Hy4 Preview with one-key access","path":"/release/rel_jLfmLsX3KnlMg7hC1f-ZF-hy4-preview-now-on-ai-gateway","url":"https://vercel.com/changelog#hy4-preview-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_BuW4OYH1vIQhE_QO0gzPP","title":"Vercel AI Gateway adds Muse Image by Meta support","path":"/release/rel_BuW4OYH1vIQhE_QO0gzPP-muse-image-via-ai-gateway-no-provider-account","url":"https://vercel.com/changelog#muse-image-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_47AIsGIuENNav-H2tkxMG","title":"Vercel's AI SDK harness layer now supports fx via @ai-sdk/harness-fx","path":"/release/rel_47AIsGIuENNav-H2tkxMG-fx-joins-ai-sdk-harness-layer","url":"https://vercel.com/changelog#fx-is-now-available-in-the-ai-sdk-harness-layer","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_2n_bNKuTOrG2iofIfuAVq","title":"Vercel Speed Insights now has a free tier","path":"/release/rel_2n_bNKuTOrG2iofIfuAVq-speed-insights-free-tier-for-all-plans","url":"https://vercel.com/changelog#speed-insights-now-has-a-free-tier","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":4},{"id":"rel__-l1EdTNBIiea-op7uzfz","title":"AI SDK adds Z.AI provider with GLM chat completions","path":"/release/rel__-l1EdTNBIiea-op7uzfz-z-ai-provider-lands-with-glm-chat-streaming-tools","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/zai%402.0.0","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_INiLKknQEOp0xkR4QYOpb","title":"Moonshot AI provider adds predicted output and partial mode support","path":"/release/rel_INiLKknQEOp0xkR4QYOpb-predicted-output-and-partial-mode-added-for-moonshot-ai","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/moonshotai%402.0.53","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_-MXUq9iqe2CWFILX28xl3","title":"AI SDK Google provider 4.0.55 surfaces safety block metadata","path":"/release/rel_-MXUq9iqe2CWFILX28xl3-google-safety-blocks-surface-with-prompt-feedback","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/google%404.0.55","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_9IYKeri0yFMeoLSbKiOVq","title":"AI SDK 6.0.272 rejects invalid tool-choice responses in generateText","path":"/release/rel_9IYKeri0yFMeoLSbKiOVq-generatetext-rejects-tool-choice-violations-at-runtime","url":"https://github.com/vercel/ai/releases/tag/ai%406.0.272","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_CdC46YGADnKlyJYRgsh2v","title":"Workers AI adds GLM-5.3, Z.ai's flagship agentic coding model","path":"/release/rel_CdC46YGADnKlyJYRgsh2v-glm-5-3-now-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-08-28-glm-5.3-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_6nPYa2k-RUxssXS3FFCDX","title":"Workers AI adds Z.ai GLM-5.3 Flash, first natively multimodal GLM-5 model","path":"/release/rel_6nPYa2k-RUxssXS3FFCDX-glm-5-3-flash-lands-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-glm-5.3-flash-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_UCjhWFkMjMrQzMXRNPD0M","title":"Cloudflare Developer Platform AI Search adds GLM-5.3 Flash support","path":"/release/rel_UCjhWFkMjMrQzMXRNPD0M-ai-search-gains-glm-5-3-flash-with-1m-token-context","url":"https://developers.cloudflare.com/changelog/post/2026-08-30-glm-5.3-flash/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_JCuF35ZziAW0wN9pGw0aY","title":"Cloudflare AI Search adds six Workers AI text generation models","path":"/release/rel_JCuF35ZziAW0wN9pGw0aY-ai-search-adds-six-workers-ai-text-models","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-new-workers-ai-models/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_x3s0X4qNnCl8fIVzg8d4y","title":"Cloudflare Load Balancing adds pool sets for location-specific traffic steering","path":"/release/rel_x3s0X4qNnCl8fIVzg8d4y-load-balancing-pool-sets-enable-location-specific-steering","url":"https://developers.cloudflare.com/changelog/post/2026-08-31-pool-sets/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-performance","name":"Application Performance"},"importance":4},{"id":"rel_qlKDs-DnxIItmZWONIEU_","title":"Cloudflare Durable Objects now support up to ten concurrent Dynamic Workers","path":"/release/rel_qlKDs-DnxIItmZWONIEU_-durable-objects-expand-to-ten-concurrent-dynamic-workers","url":"https://developers.cloudflare.com/changelog/post/2026-08-28-durable-objects-dynamic-workers-limit/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_Kce0-3VOXSzXdyv5GbHPE","title":"Cloudflare APO caches crawler and bot traffic again after Accept-header regression","path":"/release/rel_Kce0-3VOXSzXdyv5GbHPE-apo-caches-crawler-and-bot-traffic-again","url":"https://developers.cloudflare.com/changelog/post/2026-08-27-accept-header-caching/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-performance","name":"Application Performance"},"importance":3},{"id":"rel_z87jmUUVtgi5AGJoGaf_x","title":"Workers Miniflare alpha adds shared local storage across dev instances","path":"/release/rel_z87jmUUVtgi5AGJoGaf_x-dev-instances-share-local-kv-d1-data-email-test-harness-extended","url":"https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20260825.0-alpha","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_3dVXAryUsUY0-JRJGX3Ti","title":"Workers SDK miniflare alpha adds email inspection, local Images binding support","path":"/release/rel_3dVXAryUsUY0-JRJGX3Ti-email-inspection-and-images-binding-come-to-local-dev","url":"https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20260828.0-alpha","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_fJZJ9_08XuouennTjguAh","title":"Workers deploy-helpers 0.9.0 adds pull request metadata to preview deployments","path":"/release/rel_fJZJ9_08XuouennTjguAh-pr-metadata-now-attached-to-preview-deployments","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/deploy-helpers%400.9.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_-VBfuvYkyqnyUTjdl8Tx9","title":"Workers wrangler 4.126.0 adds per-workflow default retention","path":"/release/rel_-VBfuvYkyqnyUTjdl8Tx9-workers-wrangler-4-126-0-adds-per-workflow-default-retention","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.126.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_r9wiCIJjYEx1V-VYaVGhh","title":"Workers Vitest plugin v1.1.0 supports new module registry and TypeScript config","path":"/release/rel_r9wiCIJjYEx1V-VYaVGhh-vitest-pool-follows-module-registry-v2-adds-newconfig-option","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/vitest-plugin%401.1.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_pgKELSWvukDUw4dBlMoMy","title":"Workers config v0.9.0 renames Worker target fields to `worker`","path":"/release/rel_pgKELSWvukDUw4dBlMoMy-worker-target-fields-now-use-worker","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.9.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_jye67e-Ej5beiIS2C8XcS","title":"Workers Config 0.8.0 renames schema exports and consolidates dev binding config","path":"/release/rel_jye67e-Ej5beiIS2C8XcS-settings-schema-exports-renamed-dev-bindings-consolidated-under-dev","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.8.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_MkAP8BhYzQxaudaaqRCAp","title":"Workers SDK build-output-utils 0.2.0 records build mode and renames config accessors","path":"/release/rel_MkAP8BhYzQxaudaaqRCAp-build-mode-now-written-to-config-json-config-accessors-renamed","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/build-output-utils%400.2.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_SsdLfvrcZZxOsaoPe_ub2","title":"Cloudflare Workers v1.20260826.1 fixes node:fs cp symlink handling and adds ioContext.createObject","path":"/release/rel_SsdLfvrcZZxOsaoPe_ub2-node-fs-cp-symlink-fix-iocontext-createobject-added","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20260826.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_KwD1RJHruMI_eqJq6OKtU","title":"Cloudflare Flagship adds app-scoped API tokens for per-app access","path":"/release/rel_KwD1RJHruMI_eqJq6OKtU-app-scoped-api-tokens-for-flagship","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-app-scoped-tokens/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_Mg5ZGZ9ypz4oimwa1os5S","title":"Cloudflare Access service tokens adopt scannable cfast_ secret format","path":"/release/rel_Mg5ZGZ9ypz4oimwa1os5S-service-token-secrets-now-scannable-cfast-format","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-service-token-secret-format/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"cloudflare-one","name":"Cloudflare One"},"importance":3},{"id":"rel_AO0mltJK6fUW-bRXkHwc6","title":"Cloudflare Log Explorer now supports permanent dataset deletion","path":"/release/rel_AO0mltJK6fUW-bRXkHwc6-log-explorer-datasets-now-deletable","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-dataset-deletion/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel__z38mS_XtPs3PhJF8Ha3i","title":"Cloudflare deprecates Azure Functions-based Microsoft Sentinel connector","path":"/release/rel__z38mS_XtPs3PhJF8Ha3i-sentinel-functions-connector-deprecated-migrate-to-ccf","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-sentinel-functions-connector-deprecation/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_Vai0HKbawRoSmlv2DGkYI","title":"Railway CLI v5.44.0 reworks MCP proxy command","path":"/release/rel_Vai0HKbawRoSmlv2DGkYI-railway-mcp-now-runs-proxy-local-for-in-process","url":"https://github.com/railwayapp/cli/releases/tag/v5.44.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_uyX8iW6qy6Wl3XT0tA4uB","title":"Railway CLI v5.45.0 adds threads TUI and project MCP import","path":"/release/rel_uyX8iW6qy6Wl3XT0tA4uB-threads-tui-startup-auto-connect-project-mcp-import","url":"https://github.com/railwayapp/cli/releases/tag/v5.45.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_Z6otjOurvo6A56a1f_hov","title":"Railpack v0.38.0 switches pnpm to Mise, devEngines now beat engines","path":"/release/rel_Z6otjOurvo6A56a1f_hov-pnpm-via-mise-devengines-override-engines","url":"https://github.com/railwayapp/railpack/releases/tag/v0.38.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_woOW0E-9U-rAPpt1bHza9","title":"Turborepo v2.10.13-canary.1 streams dry-run JSON and merges globs","path":"/release/rel_woOW0E-9U-rAPpt1bHza9-dry-run-json-streamed-perf-wins-across-globs-berry","url":"https://github.com/vercel/turborepo/releases/tag/v2.10.13-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3}],"sections":[{"heading":"Next.js RCE patches, and the WAF rules that raced them","anchor":"next-js-rce-patches-and-the-waf-rules-that-raced-them","lede":"The week's most urgent story was a pair of critical unauthenticated remote code execution vulnerabilities in Next.js: one affecting Windows-hosted servers and one reachable through the Image Optimization API when crafted AVIF files are processed.","releaseIds":["rel_szezifiwmX4wDfGw-5u1Z","rel_fKHCmzeMe6DmiS2IlwGee","rel_mIow4KIc8bxfnfUsdAD8O","rel_wNSR-jQCGCW6KWNWHD0Xa","rel_p8qh_KDJKXDTe5EViUCUc"],"releases":[{"id":"rel_szezifiwmX4wDfGw-5u1Z","title":"Next.js v16.3.3 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_szezifiwmX4wDfGw-5u1Z-critical-rce-vulnerabilities-patched-upgrade-advised","url":"https://github.com/vercel/next.js/releases/tag/v16.3.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_fKHCmzeMe6DmiS2IlwGee","title":"Next.js v15.5.24 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_fKHCmzeMe6DmiS2IlwGee-two-critical-unauthenticated-rce-flaws-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.24","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_mIow4KIc8bxfnfUsdAD8O","title":"Cloudflare WAF blocks Next.js RCE CVE-2026-75604","path":"/release/rel_mIow4KIc8bxfnfUsdAD8O-new-waf-rule-blocks-next-js-rce","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-emergency-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4},{"id":"rel_wNSR-jQCGCW6KWNWHD0Xa","title":"Cloudflare WAF moves four detections to Block and adds RCE rule","path":"/release/rel_wNSR-jQCGCW6KWNWHD0Xa-four-detections-now-block-rce-rule-added","url":"https://developers.cloudflare.com/changelog/post/2026-08-25-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4},{"id":"rel_p8qh_KDJKXDTe5EViUCUc","title":"Next.js v16.4.0-canary.10 launches Cache Components and deprecates React 18","path":"/release/rel_p8qh_KDJKXDTe5EViUCUc-cache-components-added-react-18-deprecated-on-pages-router","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.10","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3}]},{"heading":"Vercel opens up agent infrastructure","anchor":"vercel-opens-up-agent-infrastructure","lede":"Vercel's bigger product story was Vercel Connect reaching general availability, giving agents and apps a supported secure connectivity layer instead of bespoke plumbing.","releaseIds":["rel_s2jDYIU50TsxH5s3kXits","rel_4PNelFw8pSF7eI6dXAU1_","rel_YaQTPvqsPiuQT4KtzTU2v","rel_jLfmLsX3KnlMg7hC1f-ZF","rel_BuW4OYH1vIQhE_QO0gzPP","rel_47AIsGIuENNav-H2tkxMG","rel_2n_bNKuTOrG2iofIfuAVq","rel__-l1EdTNBIiea-op7uzfz","rel_INiLKknQEOp0xkR4QYOpb","rel_-MXUq9iqe2CWFILX28xl3","rel_9IYKeri0yFMeoLSbKiOVq"],"releases":[{"id":"rel_s2jDYIU50TsxH5s3kXits","title":"Vercel Connect GA brings secure connectivity for AI agents","path":"/release/rel_s2jDYIU50TsxH5s3kXits-vercel-connect-now-generally-available","url":"https://vercel.com/changelog#vercel-connect-is-now-generally-available","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":5},{"id":"rel_4PNelFw8pSF7eI6dXAU1_","title":"Vercel dashboard now lets you build and deploy eve agents","path":"/release/rel_4PNelFw8pSF7eI6dXAU1_-eve-agents-built-and-deployed-from-vercel-dashboard","url":"https://vercel.com/changelog#build-and-deploy-eve-agents-from-the-vercel-dashboard","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":4},{"id":"rel_YaQTPvqsPiuQT4KtzTU2v","title":"Vercel AI Gateway budgets add per-user spending caps","path":"/release/rel_YaQTPvqsPiuQT4KtzTU2v-ai-gateway-per-user-spending-caps","url":"https://vercel.com/changelog#set-per-user-budgets-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_jLfmLsX3KnlMg7hC1f-ZF","title":"Vercel AI Gateway adds Hy4 Preview with one-key access","path":"/release/rel_jLfmLsX3KnlMg7hC1f-ZF-hy4-preview-now-on-ai-gateway","url":"https://vercel.com/changelog#hy4-preview-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_BuW4OYH1vIQhE_QO0gzPP","title":"Vercel AI Gateway adds Muse Image by Meta support","path":"/release/rel_BuW4OYH1vIQhE_QO0gzPP-muse-image-via-ai-gateway-no-provider-account","url":"https://vercel.com/changelog#muse-image-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_47AIsGIuENNav-H2tkxMG","title":"Vercel's AI SDK harness layer now supports fx via @ai-sdk/harness-fx","path":"/release/rel_47AIsGIuENNav-H2tkxMG-fx-joins-ai-sdk-harness-layer","url":"https://vercel.com/changelog#fx-is-now-available-in-the-ai-sdk-harness-layer","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_2n_bNKuTOrG2iofIfuAVq","title":"Vercel Speed Insights now has a free tier","path":"/release/rel_2n_bNKuTOrG2iofIfuAVq-speed-insights-free-tier-for-all-plans","url":"https://vercel.com/changelog#speed-insights-now-has-a-free-tier","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":4},{"id":"rel__-l1EdTNBIiea-op7uzfz","title":"AI SDK adds Z.AI provider with GLM chat completions","path":"/release/rel__-l1EdTNBIiea-op7uzfz-z-ai-provider-lands-with-glm-chat-streaming-tools","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/zai%402.0.0","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_INiLKknQEOp0xkR4QYOpb","title":"Moonshot AI provider adds predicted output and partial mode support","path":"/release/rel_INiLKknQEOp0xkR4QYOpb-predicted-output-and-partial-mode-added-for-moonshot-ai","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/moonshotai%402.0.53","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_-MXUq9iqe2CWFILX28xl3","title":"AI SDK Google provider 4.0.55 surfaces safety block metadata","path":"/release/rel_-MXUq9iqe2CWFILX28xl3-google-safety-blocks-surface-with-prompt-feedback","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/google%404.0.55","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_9IYKeri0yFMeoLSbKiOVq","title":"AI SDK 6.0.272 rejects invalid tool-choice responses in generateText","path":"/release/rel_9IYKeri0yFMeoLSbKiOVq-generatetext-rejects-tool-choice-violations-at-runtime","url":"https://github.com/vercel/ai/releases/tag/ai%406.0.272","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3}]},{"heading":"GLM-5.3 lands across Workers AI","anchor":"glm-5-3-lands-across-workers-ai","lede":"Cloudflare's model catalog absorbed Z.ai's latest in a hurry.","releaseIds":["rel_CdC46YGADnKlyJYRgsh2v","rel_6nPYa2k-RUxssXS3FFCDX","rel_UCjhWFkMjMrQzMXRNPD0M","rel_JCuF35ZziAW0wN9pGw0aY"],"releases":[{"id":"rel_CdC46YGADnKlyJYRgsh2v","title":"Workers AI adds GLM-5.3, Z.ai's flagship agentic coding model","path":"/release/rel_CdC46YGADnKlyJYRgsh2v-glm-5-3-now-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-08-28-glm-5.3-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_6nPYa2k-RUxssXS3FFCDX","title":"Workers AI adds Z.ai GLM-5.3 Flash, first natively multimodal GLM-5 model","path":"/release/rel_6nPYa2k-RUxssXS3FFCDX-glm-5-3-flash-lands-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-glm-5.3-flash-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_UCjhWFkMjMrQzMXRNPD0M","title":"Cloudflare Developer Platform AI Search adds GLM-5.3 Flash support","path":"/release/rel_UCjhWFkMjMrQzMXRNPD0M-ai-search-gains-glm-5-3-flash-with-1m-token-context","url":"https://developers.cloudflare.com/changelog/post/2026-08-30-glm-5.3-flash/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_JCuF35ZziAW0wN9pGw0aY","title":"Cloudflare AI Search adds six Workers AI text generation models","path":"/release/rel_JCuF35ZziAW0wN9pGw0aY-ai-search-adds-six-workers-ai-text-models","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-new-workers-ai-models/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3}]},{"heading":"Load balancing, local dev, and platform housekeeping","anchor":"load-balancing-local-dev-and-platform-housekeeping","lede":"Cloudflare Load Balancing gained pool sets, letting a single load balancer apply different candidate pools, steering policies, weights, and fallbacks per data center, country, or region — geographic matching that previously took multiple load balancers.","releaseIds":["rel_x3s0X4qNnCl8fIVzg8d4y","rel_qlKDs-DnxIItmZWONIEU_","rel_Kce0-3VOXSzXdyv5GbHPE","rel_z87jmUUVtgi5AGJoGaf_x","rel_3dVXAryUsUY0-JRJGX3Ti","rel_fJZJ9_08XuouennTjguAh","rel_-VBfuvYkyqnyUTjdl8Tx9","rel_r9wiCIJjYEx1V-VYaVGhh","rel_pgKELSWvukDUw4dBlMoMy","rel_jye67e-Ej5beiIS2C8XcS","rel_MkAP8BhYzQxaudaaqRCAp","rel_SsdLfvrcZZxOsaoPe_ub2","rel_KwD1RJHruMI_eqJq6OKtU","rel_Mg5ZGZ9ypz4oimwa1os5S","rel_AO0mltJK6fUW-bRXkHwc6","rel__z38mS_XtPs3PhJF8Ha3i","rel_Vai0HKbawRoSmlv2DGkYI","rel_uyX8iW6qy6Wl3XT0tA4uB","rel_Z6otjOurvo6A56a1f_hov","rel_woOW0E-9U-rAPpt1bHza9"],"releases":[{"id":"rel_x3s0X4qNnCl8fIVzg8d4y","title":"Cloudflare Load Balancing adds pool sets for location-specific traffic steering","path":"/release/rel_x3s0X4qNnCl8fIVzg8d4y-load-balancing-pool-sets-enable-location-specific-steering","url":"https://developers.cloudflare.com/changelog/post/2026-08-31-pool-sets/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-performance","name":"Application Performance"},"importance":4},{"id":"rel_qlKDs-DnxIItmZWONIEU_","title":"Cloudflare Durable Objects now support up to ten concurrent Dynamic Workers","path":"/release/rel_qlKDs-DnxIItmZWONIEU_-durable-objects-expand-to-ten-concurrent-dynamic-workers","url":"https://developers.cloudflare.com/changelog/post/2026-08-28-durable-objects-dynamic-workers-limit/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_Kce0-3VOXSzXdyv5GbHPE","title":"Cloudflare APO caches crawler and bot traffic again after Accept-header regression","path":"/release/rel_Kce0-3VOXSzXdyv5GbHPE-apo-caches-crawler-and-bot-traffic-again","url":"https://developers.cloudflare.com/changelog/post/2026-08-27-accept-header-caching/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-performance","name":"Application Performance"},"importance":3},{"id":"rel_z87jmUUVtgi5AGJoGaf_x","title":"Workers Miniflare alpha adds shared local storage across dev instances","path":"/release/rel_z87jmUUVtgi5AGJoGaf_x-dev-instances-share-local-kv-d1-data-email-test-harness-extended","url":"https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20260825.0-alpha","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_3dVXAryUsUY0-JRJGX3Ti","title":"Workers SDK miniflare alpha adds email inspection, local Images binding support","path":"/release/rel_3dVXAryUsUY0-JRJGX3Ti-email-inspection-and-images-binding-come-to-local-dev","url":"https://github.com/cloudflare/workers-sdk/releases/tag/miniflare%405.20260828.0-alpha","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_fJZJ9_08XuouennTjguAh","title":"Workers deploy-helpers 0.9.0 adds pull request metadata to preview deployments","path":"/release/rel_fJZJ9_08XuouennTjguAh-pr-metadata-now-attached-to-preview-deployments","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/deploy-helpers%400.9.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_-VBfuvYkyqnyUTjdl8Tx9","title":"Workers wrangler 4.126.0 adds per-workflow default retention","path":"/release/rel_-VBfuvYkyqnyUTjdl8Tx9-workers-wrangler-4-126-0-adds-per-workflow-default-retention","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.126.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_r9wiCIJjYEx1V-VYaVGhh","title":"Workers Vitest plugin v1.1.0 supports new module registry and TypeScript config","path":"/release/rel_r9wiCIJjYEx1V-VYaVGhh-vitest-pool-follows-module-registry-v2-adds-newconfig-option","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/vitest-plugin%401.1.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_pgKELSWvukDUw4dBlMoMy","title":"Workers config v0.9.0 renames Worker target fields to `worker`","path":"/release/rel_pgKELSWvukDUw4dBlMoMy-worker-target-fields-now-use-worker","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.9.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_jye67e-Ej5beiIS2C8XcS","title":"Workers Config 0.8.0 renames schema exports and consolidates dev binding config","path":"/release/rel_jye67e-Ej5beiIS2C8XcS-settings-schema-exports-renamed-dev-bindings-consolidated-under-dev","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.8.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_MkAP8BhYzQxaudaaqRCAp","title":"Workers SDK build-output-utils 0.2.0 records build mode and renames config accessors","path":"/release/rel_MkAP8BhYzQxaudaaqRCAp-build-mode-now-written-to-config-json-config-accessors-renamed","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/build-output-utils%400.2.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_SsdLfvrcZZxOsaoPe_ub2","title":"Cloudflare Workers v1.20260826.1 fixes node:fs cp symlink handling and adds ioContext.createObject","path":"/release/rel_SsdLfvrcZZxOsaoPe_ub2-node-fs-cp-symlink-fix-iocontext-createobject-added","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20260826.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_KwD1RJHruMI_eqJq6OKtU","title":"Cloudflare Flagship adds app-scoped API tokens for per-app access","path":"/release/rel_KwD1RJHruMI_eqJq6OKtU-app-scoped-api-tokens-for-flagship","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-app-scoped-tokens/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_Mg5ZGZ9ypz4oimwa1os5S","title":"Cloudflare Access service tokens adopt scannable cfast_ secret format","path":"/release/rel_Mg5ZGZ9ypz4oimwa1os5S-service-token-secrets-now-scannable-cfast-format","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-service-token-secret-format/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"cloudflare-one","name":"Cloudflare One"},"importance":3},{"id":"rel_AO0mltJK6fUW-bRXkHwc6","title":"Cloudflare Log Explorer now supports permanent dataset deletion","path":"/release/rel_AO0mltJK6fUW-bRXkHwc6-log-explorer-datasets-now-deletable","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-dataset-deletion/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel__z38mS_XtPs3PhJF8Ha3i","title":"Cloudflare deprecates Azure Functions-based Microsoft Sentinel connector","path":"/release/rel__z38mS_XtPs3PhJF8Ha3i-sentinel-functions-connector-deprecated-migrate-to-ccf","url":"https://developers.cloudflare.com/changelog/post/2026-08-26-sentinel-functions-connector-deprecation/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_Vai0HKbawRoSmlv2DGkYI","title":"Railway CLI v5.44.0 reworks MCP proxy command","path":"/release/rel_Vai0HKbawRoSmlv2DGkYI-railway-mcp-now-runs-proxy-local-for-in-process","url":"https://github.com/railwayapp/cli/releases/tag/v5.44.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_uyX8iW6qy6Wl3XT0tA4uB","title":"Railway CLI v5.45.0 adds threads TUI and project MCP import","path":"/release/rel_uyX8iW6qy6Wl3XT0tA4uB-threads-tui-startup-auto-connect-project-mcp-import","url":"https://github.com/railwayapp/cli/releases/tag/v5.45.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_Z6otjOurvo6A56a1f_hov","title":"Railpack v0.38.0 switches pnpm to Mise, devEngines now beat engines","path":"/release/rel_Z6otjOurvo6A56a1f_hov-pnpm-via-mise-devengines-override-engines","url":"https://github.com/railwayapp/railpack/releases/tag/v0.38.0","org":{"slug":"railway","name":"Railway","avatarUrl":"https://media.releases.sh/orgs/railway.png","githubHandle":"railwayapp"},"product":null,"importance":3},{"id":"rel_woOW0E-9U-rAPpt1bHza9","title":"Turborepo v2.10.13-canary.1 streams dry-run JSON and merges globs","path":"/release/rel_woOW0E-9U-rAPpt1bHza9-dry-run-json-streamed-perf-wins-across-globs-berry","url":"https://github.com/vercel/turborepo/releases/tag/v2.10.13-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3}]}]}}