{"collection":{"slug":"application-platforms","name":"Application Platforms"},"digest":{"id":"cwd_sWPmJHwX_fAXJIqGTUigi","weekStart":"2026-09-28","title":"Cloudflare opens the agent stack while Next.js patches cache poisoning","intro":"Cloudflare shipped a broad expansion of its agent and data platform this week — a Web Search API, the first in-house Workers AI models, Git-backed Artifacts, and a Sandbox SDK that hands sandboxes to your own Durable Objects — while Next.js issued security patches for a high-severity SSRF bug and cache poisoning in SSG and ISR pages.","body":"### Cloudflare builds out the agent stack\n\nThe week's biggest theme was giving AI agents real infrastructure to stand on. Cloudflare launched a [Web Search API in beta](/release/rel_7Xi2b97vQqRBr0DGCeqeE-cloudflare-launches-web-search-api-in-beta-with-ceramic-ai-exa-and-linkup), letting agents query the live web through a choice of Ceramic.ai, Exa, or Linkup, with requests flowing through AI Gateway so they show up in your logs and bill at provider list price with no markup. Grounding models in real results is the point; you can also bring your own provider key.\n\nTwo more pieces landed squarely in agent territory. [Durable Objects now stay alive while I/O is pending](/release/rel_GN1sqzwI3GNsiamuqlFv9-cloudflare-durable-objects-stay-alive-for-pending-i-o-without-a-connected-client) — bindings, RPC calls to other Durable Objects, container monitoring, waitUntil promises, and timers — so a submitted job no longer dies when its client disconnects. And the [Artifacts versioned file system entered open beta](/release/rel_MNQ6wIbs5UtX0F_MDAele-cloudflare-artifacts-enters-open-beta-with-git-based-versioned-file-system), a Git-speaking store built so you can keep a repository per project, user, session, or task, deploy them to Workers through Workers Builds, and pick US or EU storage.\n\nThe [Sandbox SDK hit 1.0](/release/rel_RM0Xl0LylxnaM1PiYkjgG-cloudflare-sandbox-sdk-1-0-puts-each-sandbox-under-your-own-durable-object), letting your own Durable Object class drive each sandbox container through the container API — choosing image and instance size at start, snapshotting and restoring workspaces, streaming command I/O, and serving authenticated previews from sandbox ports. The [Agents SDK added a PiHarness beta](/release/rel_gZjm2zGcJKh9rGyx8yz4W-cloudflare-agents-sdk-adds-piharness-beta-for-durable-pi-agents) for durable long-running Pi agents. Cloudflare also [open-sourced its first Workers AI models](/release/rel_BNEN0r998n3QLr3ty1Qpb-cloudflare-launches-clef-decision-models-on-workers-ai), Clef and Clef-flash, which return probabilities over typed questions rather than free-form text, plus an RL fine-tuning service for adapting them.\n\n### Data residency and an analytics platform go GA\n\n[Basin reached general availability](/release/rel_If-u4SBF3KGYPQGTP6A-A-cloudflare-basin-analytics-platform-reaches-general-availability) as Cloudflare's end-to-end analytics platform — Pipelines for ingestion, Catalog for Iceberg tables, SQL for querying — and [each Pipelines stream now ingests up to 1 GB/s](/release/rel_9f4gqGf6XjCcuhIQ_bAuD-cloudflare-basin-pipelines-raises-per-stream-ingest-limit-to-1-gb-s-from-5-mb-s), a 200x jump over the old 5 MB/s ceiling. [AI Search went GA too](/release/rel_86nJfAUeb5JUzHOxgwPkc-cloudflare-ai-search-reaches-general-availability-with-usage-based-billing-from) with usage-based billing from November 1 and hybrid search on by default.\n\nData localization got concrete: [KV namespace jurisdictions are generally available](/release/rel_EZhRGp0c3OwXwBtWM-6fL-cloudflare-workers-kv-namespace-jurisdictions-are-now-generally-available) with `eu`, `us`, and `fedramp` options fixed at creation, and D1 added a US jurisdiction for databases that must run and persist in the United States. Wrangler and the config packages followed with the [Analytics SQL binding and graduated Basin commands](/release/rel_vncIA8FJe3yIO9vkDmdck-wrangler-4-145-0-adds-analytics-sql-binding-and-graduates-basin-commands-to), accompanied by matching support in the [typed configuration package](/release/rel_VItiJhuTxA28QaA3WFW4i-workers-cloudflare-config-0-22-0-adds-native-analytics-sql-binding), [codemods](/release/rel_OV_L5JRrqiGDQjeNevFUZ-cloudflare-workers-codemods-0-3-0-adds-analytics-sql-binding-and-k2-migration), and [deploy helpers](/release/rel_jtuHFAakID8IKTZQB_eVh-workers-deploy-helpers-0-19-0-adds-analytics-sql-and-k2-producer-bindings), plus a [US jurisdiction for Container apps](/release/rel_sNbEs1lZi8bAtQRLjpiOW-wrangler-4-147-0-adds-us-jurisdiction-for-container-apps) and a [local Workflows createBatch API](/release/rel_GrAURzToHnDEgjd-su1fr-wrangler-4-146-0-adds-local-workflows-createbatch-api-and-tunnel-email-filtering).\n\nElsewhere on the platform, the [Workers OAuth Provider reached v1](/release/rel_MFPLxdxUt7ekN7D94vahg-cloudflare-workers-oauth-provider-hits-v1-with-split-auth-server-resource-server) with authorization and resource servers split across Workers and validated over a Service Binding, [Monetization Gateway entered closed beta](/release/rel_AkgL984Zr0f03bA7xuXSS-cloudflare-monetization-gateway-enters-closed-beta-for-charging-ai-agents) for charging agents over x402, and [Logpush opened to all plans](/release/rel_8Pa3Vm38i2t5LLXsuc0X0-cloudflare-logpush-opens-to-all-plans-with-usage-based-pricing) with usage-based pricing. [Workers Web Crypto added ML-KEM and ML-DSA](/release/rel_SruN-OrkgpKdW9pqJJ8nt-cloudflare-workers-web-crypto-adds-ml-kem-and-ml-dsa-behind-compatibility-flag) behind a compatibility flag, while Core Platform pushed out [30 days of analytics on every plan](/release/rel_alwnXrv_cxHonTG0Pe_LB-cloudflare-core-platform-gives-all-plans-30-days-of-analytics-data), [Workers Observability data in Custom Dashboards](/release/rel_tNS-aE_RM5k-SI3WWkQ3c-cloudflare-core-platform-adds-workers-observability-data-to-custom-dashboards), and [self-serve Account API tokens](/release/rel__Roob3JCll0vQ2TUOhWPN-cloudflare-core-platform-lets-account-members-self-serve-create-account-api). The workerd runtime chipped in a [Cache API invalidation method](/release/rel_asxJwGXg8U5c4jKcYF-Hq-workers-v1-20261003-1-adds-ctx-cache-invalidate-to-cache-api) and [Durable Object snapshot APIs](/release/rel_P-V4X3BTycU4Tx3vJyHlU-cloudflare-workers-v1-20261004-1-exposes-durable-object-snapshot-apis).\n\n### Security patches: Next.js, AI SDK, and the WAF\n\nNext.js spent the week closing holes. Its current line [patched a high-severity SSRF in Image Optimization](/release/rel_DQMcmQahyywReveyI94ta-next-js-v16-3-8-patches-ssrf-in-image-optimization-and-cache-poisoning-flaws) alongside cache poisoning of SSG and ISR pages, cross-user content substitution, and Draft Mode content leaking into persisted pages; the 15.x line received the [SSG and ISR cache poisoning fixes](/release/rel_Ipw2wG7i156eA38xySQfX-next-js-v15-5-27-patches-ssg-and-isr-cache-poisoning-vulnerabilities) it was missing. The canary channel separately closed a Draft Mode leak through cross-request \"use cache\" deduplication and an MCP middleware DNS rebinding issue, and pinned DNS resolution when fetching external images.\n\nThe AI SDK shipped the same class of fix across two provider-utils lines: [SSRF in MCP OAuth metadata discovery](/release/rel_lsT6BNN7dpSpYaabZ_ZCF-ai-sdk-provider-utils-4-0-57-fixes-ssrf-in-mcp-oauth-metadata-discovery) is closed, and [DNS validation and connection pinning survive frameworks wrapping global fetch](/release/rel_g9r8fgU0o9FugfTsBU-ib-ai-sdk-provider-utils-3-0-41-fixes-mcp-oauth-ssrf-and-preserves-dns-validation). It also [gained a Topaz Labs provider](/release/rel_nhZPTE2fTmXBuuhsNAg4p-ai-sdk-adds-topaz-labs-provider-in-ai-sdk-topaz-2-0-0).\n\nOn the edge, Cloudflare's WAF [added an emergency block rule for CVE-2026-88771](/release/rel_LmZ-7FH8tIBq5FBb9KOXx-cloudflare-waf-adds-emergency-block-rule-for-citrix-netscaler-cve-2026-88771), an unauthenticated command execution flaw in Citrix NetScaler ADC and Gateway.\n\n### Smaller but useful\n\n[Turborepo added task tags](/release/rel_jMfZvnPaAcBhB_GRogCQU-turborepo-v2-11-6-adds-task-tags-with-configuration-inheritance-and-query) with configuration inheritance and tag filtering in `query`, [Cloudflare Tunnel Quick Tunnels gained email authentication](/release/rel_w_jBy4I8xrXa07aGBD_Ur-cloudflare-tunnel-adds-email-authentication-for-quick-tunnels-via-allowed-mail), and [Access learned strict service token authentication](/release/rel_7S4A-opiF_CfQBUACnbtL-cloudflare-one-adds-strict-service-token-authentication-for-access) that returns 401/403 instead of redirecting to a login page. On the model side, [Microsoft AI's audio models arrived on Vercel AI Gateway](/release/rel_pZm7pwxQZYS15591V4rBc-microsoft-ai-audio-models-for-speech-and-transcription-land-on-vercel-ai-gateway).","releaseIds":["rel_7Xi2b97vQqRBr0DGCeqeE","rel_GN1sqzwI3GNsiamuqlFv9","rel_MNQ6wIbs5UtX0F_MDAele","rel_RM0Xl0LylxnaM1PiYkjgG","rel_gZjm2zGcJKh9rGyx8yz4W","rel_BNEN0r998n3QLr3ty1Qpb","rel_If-u4SBF3KGYPQGTP6A-A","rel_9f4gqGf6XjCcuhIQ_bAuD","rel_86nJfAUeb5JUzHOxgwPkc","rel_EZhRGp0c3OwXwBtWM-6fL","rel_vncIA8FJe3yIO9vkDmdck","rel_VItiJhuTxA28QaA3WFW4i","rel_OV_L5JRrqiGDQjeNevFUZ","rel_jtuHFAakID8IKTZQB_eVh","rel_sNbEs1lZi8bAtQRLjpiOW","rel_GrAURzToHnDEgjd-su1fr","rel_MFPLxdxUt7ekN7D94vahg","rel_AkgL984Zr0f03bA7xuXSS","rel_8Pa3Vm38i2t5LLXsuc0X0","rel_SruN-OrkgpKdW9pqJJ8nt","rel_alwnXrv_cxHonTG0Pe_LB","rel_tNS-aE_RM5k-SI3WWkQ3c","rel__Roob3JCll0vQ2TUOhWPN","rel_asxJwGXg8U5c4jKcYF-Hq","rel_P-V4X3BTycU4Tx3vJyHlU","rel_DQMcmQahyywReveyI94ta","rel_Ipw2wG7i156eA38xySQfX","rel_lsT6BNN7dpSpYaabZ_ZCF","rel_g9r8fgU0o9FugfTsBU-ib","rel_nhZPTE2fTmXBuuhsNAg4p","rel_LmZ-7FH8tIBq5FBb9KOXx","rel_jMfZvnPaAcBhB_GRogCQU","rel_w_jBy4I8xrXa07aGBD_Ur","rel_7S4A-opiF_CfQBUACnbtL","rel_pZm7pwxQZYS15591V4rBc"],"releaseCount":209,"generatedAt":"2026-10-05T06:18:15.468Z","releases":[{"id":"rel_7Xi2b97vQqRBr0DGCeqeE","title":"Cloudflare launches Web Search API in beta with Ceramic.ai, Exa, and Linkup","path":"/release/rel_7Xi2b97vQqRBr0DGCeqeE-web-search-api-in-beta-with-three-providers","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-introducing-web-search-api/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_GN1sqzwI3GNsiamuqlFv9","title":"Cloudflare Durable Objects stay alive for pending I/O without a connected client","path":"/release/rel_GN1sqzwI3GNsiamuqlFv9-durable-objects-survive-client-disconnect-during-pending-i-o","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-pending-io-keep-alive/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_MNQ6wIbs5UtX0F_MDAele","title":"Cloudflare Artifacts enters open beta with Git-based versioned file system","path":"/release/rel_MNQ6wIbs5UtX0F_MDAele-artifacts-open-beta-git-speaking-repos-for-workers","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-artifacts-open-beta/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_RM0Xl0LylxnaM1PiYkjgG","title":"Cloudflare Sandbox SDK 1.0 puts each sandbox under your own Durable Object","path":"/release/rel_RM0Xl0LylxnaM1PiYkjgG-sandbox-sdk-1-0-control-sandboxes-from-your-durable-object","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-sandbox-sdk-1-0/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_gZjm2zGcJKh9rGyx8yz4W","title":"Cloudflare Agents SDK adds PiHarness beta for durable Pi agents","path":"/release/rel_gZjm2zGcJKh9rGyx8yz4W-pi-agents-run-durably-on-cloudflare-via-piharness","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-pi-harness/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_BNEN0r998n3QLr3ty1Qpb","title":"Cloudflare launches Clef decision models on Workers AI","path":"/release/rel_BNEN0r998n3QLr3ty1Qpb-clef-decision-models-land-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-clef-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_If-u4SBF3KGYPQGTP6A-A","title":"Cloudflare Basin analytics platform reaches general availability","path":"/release/rel_If-u4SBF3KGYPQGTP6A-A-cloudflare-basin-analytics-platform-now-ga","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-basin-ga/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_9f4gqGf6XjCcuhIQ_bAuD","title":"Cloudflare Basin Pipelines raises per-stream ingest limit to 1 GB/s from 5 MB/s","path":"/release/rel_9f4gqGf6XjCcuhIQ_bAuD-basin-pipelines-stream-ingest-limit-now-1-gb-s","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-stream-ingest-limit-increase/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_86nJfAUeb5JUzHOxgwPkc","title":"Cloudflare AI Search reaches general availability with usage-based billing from November 1","path":"/release/rel_86nJfAUeb5JUzHOxgwPkc-ai-search-ga-usage-based-billing-starts-nov-1","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-ai-search-generally-available/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_EZhRGp0c3OwXwBtWM-6fL","title":"Cloudflare Workers KV namespace jurisdictions are now generally available","path":"/release/rel_EZhRGp0c3OwXwBtWM-6fL-kv-namespace-jurisdictions-reach-ga","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-kv-jurisdictions-ga/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_vncIA8FJe3yIO9vkDmdck","title":"Wrangler 4.145.0 adds Analytics SQL binding and graduates Basin commands to stable","path":"/release/rel_vncIA8FJe3yIO9vkDmdck-analytics-sql-binding-basin-sql-catalog-pipelines-stable","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.145.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":4},{"id":"rel_VItiJhuTxA28QaA3WFW4i","title":"Workers @cloudflare/config 0.22.0 adds native Analytics SQL binding","path":"/release/rel_VItiJhuTxA28QaA3WFW4i-analytics-sql-binding-goes-native-k2-producer-bindings-in-beta","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.22.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_OV_L5JRrqiGDQjeNevFUZ","title":"Cloudflare Workers codemods 0.3.0 adds Analytics SQL binding and K2 migration","path":"/release/rel_OV_L5JRrqiGDQjeNevFUZ-analytics-sql-binding-support-k2-producer-bindings-migrated","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/codemods%400.3.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_jtuHFAakID8IKTZQB_eVh","title":"Workers deploy-helpers 0.19.0 adds Analytics SQL and K2 producer bindings","path":"/release/rel_jtuHFAakID8IKTZQB_eVh-analytics-sql-binding-k2-producer-beta-for-existing-streams","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/deploy-helpers%400.19.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_sNbEs1lZi8bAtQRLjpiOW","title":"Wrangler 4.147.0 adds \"us\" jurisdiction for Container apps","path":"/release/rel_sNbEs1lZi8bAtQRLjpiOW-us-jurisdiction-for-container-apps-live-instance-counts-fixed","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.147.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_GrAURzToHnDEgjd-su1fr","title":"Wrangler 4.146.0 adds local Workflows createBatch API and tunnel email filtering","path":"/release/rel_GrAURzToHnDEgjd-su1fr-local-workflows-createbatch-support-tunnel-allowed-mail-added","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.146.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_MFPLxdxUt7ekN7D94vahg","title":"Cloudflare Workers OAuth Provider hits v1 with split auth-server/resource-server API","path":"/release/rel_MFPLxdxUt7ekN7D94vahg-workers-oauth-provider-v1-split-auth-and-resource-servers","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-workers-oauth-provider-1x/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_AkgL984Zr0f03bA7xuXSS","title":"Cloudflare Monetization Gateway enters closed beta for charging AI agents","path":"/release/rel_AkgL984Zr0f03bA7xuXSS-monetization-gateway-enters-closed-beta","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-closed-beta/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":4},{"id":"rel_8Pa3Vm38i2t5LLXsuc0X0","title":"Cloudflare Logpush opens to all plans with usage-based pricing","path":"/release/rel_8Pa3Vm38i2t5LLXsuc0X0-logpush-available-on-all-plans-25-gb-free-monthly","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-logpush-usage-based-pricing/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":4},{"id":"rel_SruN-OrkgpKdW9pqJJ8nt","title":"Cloudflare Workers Web Crypto adds ML-KEM and ML-DSA behind compatibility flag","path":"/release/rel_SruN-OrkgpKdW9pqJJ8nt-workers-web-crypto-gains-ml-kem-and-ml-dsa","url":"https://developers.cloudflare.com/changelog/post/2026-09-28-webcrypto-modern-algorithms/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_alwnXrv_cxHonTG0Pe_LB","title":"Cloudflare Core Platform gives all plans 30 days of analytics data","path":"/release/rel_alwnXrv_cxHonTG0Pe_LB-30-days-analytics-history-on-every-plan","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-30-days-analytics-on-every-plan/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_tNS-aE_RM5k-SI3WWkQ3c","title":"Cloudflare Core Platform adds Workers Observability data to Custom Dashboards","path":"/release/rel_tNS-aE_RM5k-SI3WWkQ3c-workers-logs-and-traces-now-chartable-in-custom-dashboards","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-workers-observability-in-custom-dashboards/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel__Roob3JCll0vQ2TUOhWPN","title":"Cloudflare Core Platform lets account members self-serve create Account API tokens","path":"/release/rel__Roob3JCll0vQ2TUOhWPN-account-api-tokens-no-longer-super-admin-only-oauth-scope-added","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-account-api-token-provisioning/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_asxJwGXg8U5c4jKcYF-Hq","title":"Workers v1.20261003.1 adds ctx.cache.invalidate() to Cache API","path":"/release/rel_asxJwGXg8U5c4jKcYF-Hq-ctx-cache-invalidate-added-to-workers-cache-api","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20261003.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_P-V4X3BTycU4Tx3vJyHlU","title":"Cloudflare Workers v1.20261004.1 exposes Durable Object snapshot APIs","path":"/release/rel_P-V4X3BTycU4Tx3vJyHlU-durable-object-snapshot-apis-now-exposed","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20261004.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_DQMcmQahyywReveyI94ta","title":"Next.js v16.3.8 patches SSRF in Image Optimization and cache poisoning flaws","path":"/release/rel_DQMcmQahyywReveyI94ta-ssrf-in-image-optimization-fixed-cache-poisoning-patches-land","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Ipw2wG7i156eA38xySQfX","title":"Next.js v15.5.27 patches SSG and ISR cache poisoning vulnerabilities","path":"/release/rel_Ipw2wG7i156eA38xySQfX-ssg-isr-cache-poisoning-and-metadata-image-disclosure-fixed","url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_lsT6BNN7dpSpYaabZ_ZCF","title":"AI SDK provider-utils 4.0.57 fixes SSRF in MCP OAuth metadata discovery","path":"/release/rel_lsT6BNN7dpSpYaabZ_ZCF-mcp-oauth-metadata-discovery-no-longer-ssrf-vulnerable","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.57","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_g9r8fgU0o9FugfTsBU-ib","title":"AI SDK provider-utils 3.0.41 fixes MCP OAuth SSRF and preserves DNS validation when fetch is wrapped","path":"/release/rel_g9r8fgU0o9FugfTsBU-ib-mcp-oauth-ssrf-fixed-dns-validation-survives-fetch-wrapping","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.41","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_nhZPTE2fTmXBuuhsNAg4p","title":"AI SDK adds Topaz Labs provider in @ai-sdk/topaz 2.0.0","path":"/release/rel_nhZPTE2fTmXBuuhsNAg4p-topaz-labs-provider-added-to-ai-sdk","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/topaz%402.0.0","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_LmZ-7FH8tIBq5FBb9KOXx","title":"Cloudflare WAF adds emergency block rule for Citrix NetScaler CVE-2026-88771","path":"/release/rel_LmZ-7FH8tIBq5FBb9KOXx-emergency-waf-rule-blocks-citrix-netscaler-cve-2026-88771","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-emergency-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4},{"id":"rel_jMfZvnPaAcBhB_GRogCQU","title":"Turborepo v2.11.6 adds task tags with configuration inheritance and query filtering","path":"/release/rel_jMfZvnPaAcBhB_GRogCQU-task-tags-with-config-inheritance-query-filters-by-tag","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.6","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3},{"id":"rel_w_jBy4I8xrXa07aGBD_Ur","title":"Cloudflare Tunnel adds email authentication for Quick Tunnels via --allowed-mail","path":"/release/rel_w_jBy4I8xrXa07aGBD_Ur-quick-tunnels-get-email-gated-access","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-protected-quick-tunnels/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_7S4A-opiF_CfQBUACnbtL","title":"Cloudflare One adds strict service token authentication for Access","path":"/release/rel_7S4A-opiF_CfQBUACnbtL-strict-service-token-auth-401-403-over-302-redirects","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-strict-service-token-authentication/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"cloudflare-one","name":"Cloudflare One"},"importance":3},{"id":"rel_pZm7pwxQZYS15591V4rBc","title":"Microsoft AI audio models for speech and transcription land on Vercel AI Gateway","path":"/release/rel_pZm7pwxQZYS15591V4rBc-microsoft-ai-speech-and-transcription-models-on-ai-gateway","url":"https://vercel.com/changelog#microsoft-ai-models-are-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3}],"sections":[{"heading":"Cloudflare builds out the agent stack","anchor":"cloudflare-builds-out-the-agent-stack","lede":"The week's biggest theme was giving AI agents real infrastructure to stand on.","releaseIds":["rel_7Xi2b97vQqRBr0DGCeqeE","rel_GN1sqzwI3GNsiamuqlFv9","rel_MNQ6wIbs5UtX0F_MDAele","rel_RM0Xl0LylxnaM1PiYkjgG","rel_gZjm2zGcJKh9rGyx8yz4W","rel_BNEN0r998n3QLr3ty1Qpb"],"releases":[{"id":"rel_7Xi2b97vQqRBr0DGCeqeE","title":"Cloudflare launches Web Search API in beta with Ceramic.ai, Exa, and Linkup","path":"/release/rel_7Xi2b97vQqRBr0DGCeqeE-web-search-api-in-beta-with-three-providers","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-introducing-web-search-api/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_GN1sqzwI3GNsiamuqlFv9","title":"Cloudflare Durable Objects stay alive for pending I/O without a connected client","path":"/release/rel_GN1sqzwI3GNsiamuqlFv9-durable-objects-survive-client-disconnect-during-pending-i-o","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-pending-io-keep-alive/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_MNQ6wIbs5UtX0F_MDAele","title":"Cloudflare Artifacts enters open beta with Git-based versioned file system","path":"/release/rel_MNQ6wIbs5UtX0F_MDAele-artifacts-open-beta-git-speaking-repos-for-workers","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-artifacts-open-beta/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_RM0Xl0LylxnaM1PiYkjgG","title":"Cloudflare Sandbox SDK 1.0 puts each sandbox under your own Durable Object","path":"/release/rel_RM0Xl0LylxnaM1PiYkjgG-sandbox-sdk-1-0-control-sandboxes-from-your-durable-object","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-sandbox-sdk-1-0/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_gZjm2zGcJKh9rGyx8yz4W","title":"Cloudflare Agents SDK adds PiHarness beta for durable Pi agents","path":"/release/rel_gZjm2zGcJKh9rGyx8yz4W-pi-agents-run-durably-on-cloudflare-via-piharness","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-pi-harness/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_BNEN0r998n3QLr3ty1Qpb","title":"Cloudflare launches Clef decision models on Workers AI","path":"/release/rel_BNEN0r998n3QLr3ty1Qpb-clef-decision-models-land-on-workers-ai","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-clef-workers-ai/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4}]},{"heading":"Data residency and an analytics platform go GA","anchor":"data-residency-and-an-analytics-platform-go-ga","lede":"Basin reached general availability as Cloudflare's end-to-end analytics platform — Pipelines for ingestion, Catalog for Iceberg tables, SQL for querying — and each Pipelines stream now ingests up to 1 GB/s, a 200x jump over the old 5 MB/s ceiling.","releaseIds":["rel_If-u4SBF3KGYPQGTP6A-A","rel_9f4gqGf6XjCcuhIQ_bAuD","rel_86nJfAUeb5JUzHOxgwPkc","rel_EZhRGp0c3OwXwBtWM-6fL","rel_vncIA8FJe3yIO9vkDmdck","rel_VItiJhuTxA28QaA3WFW4i","rel_OV_L5JRrqiGDQjeNevFUZ","rel_jtuHFAakID8IKTZQB_eVh","rel_sNbEs1lZi8bAtQRLjpiOW","rel_GrAURzToHnDEgjd-su1fr","rel_MFPLxdxUt7ekN7D94vahg","rel_AkgL984Zr0f03bA7xuXSS","rel_8Pa3Vm38i2t5LLXsuc0X0","rel_SruN-OrkgpKdW9pqJJ8nt","rel_alwnXrv_cxHonTG0Pe_LB","rel_tNS-aE_RM5k-SI3WWkQ3c","rel__Roob3JCll0vQ2TUOhWPN","rel_asxJwGXg8U5c4jKcYF-Hq","rel_P-V4X3BTycU4Tx3vJyHlU"],"releases":[{"id":"rel_If-u4SBF3KGYPQGTP6A-A","title":"Cloudflare Basin analytics platform reaches general availability","path":"/release/rel_If-u4SBF3KGYPQGTP6A-A-cloudflare-basin-analytics-platform-now-ga","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-basin-ga/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_9f4gqGf6XjCcuhIQ_bAuD","title":"Cloudflare Basin Pipelines raises per-stream ingest limit to 1 GB/s from 5 MB/s","path":"/release/rel_9f4gqGf6XjCcuhIQ_bAuD-basin-pipelines-stream-ingest-limit-now-1-gb-s","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-stream-ingest-limit-increase/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_86nJfAUeb5JUzHOxgwPkc","title":"Cloudflare AI Search reaches general availability with usage-based billing from November 1","path":"/release/rel_86nJfAUeb5JUzHOxgwPkc-ai-search-ga-usage-based-billing-starts-nov-1","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-ai-search-generally-available/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_EZhRGp0c3OwXwBtWM-6fL","title":"Cloudflare Workers KV namespace jurisdictions are now generally available","path":"/release/rel_EZhRGp0c3OwXwBtWM-6fL-kv-namespace-jurisdictions-reach-ga","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-kv-jurisdictions-ga/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_vncIA8FJe3yIO9vkDmdck","title":"Wrangler 4.145.0 adds Analytics SQL binding and graduates Basin commands to stable","path":"/release/rel_vncIA8FJe3yIO9vkDmdck-analytics-sql-binding-basin-sql-catalog-pipelines-stable","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.145.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":4},{"id":"rel_VItiJhuTxA28QaA3WFW4i","title":"Workers @cloudflare/config 0.22.0 adds native Analytics SQL binding","path":"/release/rel_VItiJhuTxA28QaA3WFW4i-analytics-sql-binding-goes-native-k2-producer-bindings-in-beta","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/config%400.22.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_OV_L5JRrqiGDQjeNevFUZ","title":"Cloudflare Workers codemods 0.3.0 adds Analytics SQL binding and K2 migration","path":"/release/rel_OV_L5JRrqiGDQjeNevFUZ-analytics-sql-binding-support-k2-producer-bindings-migrated","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/codemods%400.3.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_jtuHFAakID8IKTZQB_eVh","title":"Workers deploy-helpers 0.19.0 adds Analytics SQL and K2 producer bindings","path":"/release/rel_jtuHFAakID8IKTZQB_eVh-analytics-sql-binding-k2-producer-beta-for-existing-streams","url":"https://github.com/cloudflare/workers-sdk/releases/tag/%40cloudflare/deploy-helpers%400.19.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_sNbEs1lZi8bAtQRLjpiOW","title":"Wrangler 4.147.0 adds \"us\" jurisdiction for Container apps","path":"/release/rel_sNbEs1lZi8bAtQRLjpiOW-us-jurisdiction-for-container-apps-live-instance-counts-fixed","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.147.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_GrAURzToHnDEgjd-su1fr","title":"Wrangler 4.146.0 adds local Workflows createBatch API and tunnel email filtering","path":"/release/rel_GrAURzToHnDEgjd-su1fr-local-workflows-createbatch-support-tunnel-allowed-mail-added","url":"https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.146.0","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_MFPLxdxUt7ekN7D94vahg","title":"Cloudflare Workers OAuth Provider hits v1 with split auth-server/resource-server API","path":"/release/rel_MFPLxdxUt7ekN7D94vahg-workers-oauth-provider-v1-split-auth-and-resource-servers","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-workers-oauth-provider-1x/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":4},{"id":"rel_AkgL984Zr0f03bA7xuXSS","title":"Cloudflare Monetization Gateway enters closed beta for charging AI agents","path":"/release/rel_AkgL984Zr0f03bA7xuXSS-monetization-gateway-enters-closed-beta","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-closed-beta/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":4},{"id":"rel_8Pa3Vm38i2t5LLXsuc0X0","title":"Cloudflare Logpush opens to all plans with usage-based pricing","path":"/release/rel_8Pa3Vm38i2t5LLXsuc0X0-logpush-available-on-all-plans-25-gb-free-monthly","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-logpush-usage-based-pricing/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":4},{"id":"rel_SruN-OrkgpKdW9pqJJ8nt","title":"Cloudflare Workers Web Crypto adds ML-KEM and ML-DSA behind compatibility flag","path":"/release/rel_SruN-OrkgpKdW9pqJJ8nt-workers-web-crypto-gains-ml-kem-and-ml-dsa","url":"https://developers.cloudflare.com/changelog/post/2026-09-28-webcrypto-modern-algorithms/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"developer-platform","name":"Developer Platform"},"importance":3},{"id":"rel_alwnXrv_cxHonTG0Pe_LB","title":"Cloudflare Core Platform gives all plans 30 days of analytics data","path":"/release/rel_alwnXrv_cxHonTG0Pe_LB-30-days-analytics-history-on-every-plan","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-30-days-analytics-on-every-plan/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_tNS-aE_RM5k-SI3WWkQ3c","title":"Cloudflare Core Platform adds Workers Observability data to Custom Dashboards","path":"/release/rel_tNS-aE_RM5k-SI3WWkQ3c-workers-logs-and-traces-now-chartable-in-custom-dashboards","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-workers-observability-in-custom-dashboards/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel__Roob3JCll0vQ2TUOhWPN","title":"Cloudflare Core Platform lets account members self-serve create Account API tokens","path":"/release/rel__Roob3JCll0vQ2TUOhWPN-account-api-tokens-no-longer-super-admin-only-oauth-scope-added","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-account-api-token-provisioning/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_asxJwGXg8U5c4jKcYF-Hq","title":"Workers v1.20261003.1 adds ctx.cache.invalidate() to Cache API","path":"/release/rel_asxJwGXg8U5c4jKcYF-Hq-ctx-cache-invalidate-added-to-workers-cache-api","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20261003.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3},{"id":"rel_P-V4X3BTycU4Tx3vJyHlU","title":"Cloudflare Workers v1.20261004.1 exposes Durable Object snapshot APIs","path":"/release/rel_P-V4X3BTycU4Tx3vJyHlU-durable-object-snapshot-apis-now-exposed","url":"https://github.com/cloudflare/workerd/releases/tag/v1.20261004.1","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"workers","name":"Workers"},"importance":3}]},{"heading":"Security patches: Next.js, AI SDK, and the WAF","anchor":"security-patches-next-js-ai-sdk-and-the-waf","lede":"Next.js spent the week closing holes.","releaseIds":["rel_DQMcmQahyywReveyI94ta","rel_Ipw2wG7i156eA38xySQfX","rel_lsT6BNN7dpSpYaabZ_ZCF","rel_g9r8fgU0o9FugfTsBU-ib","rel_nhZPTE2fTmXBuuhsNAg4p","rel_LmZ-7FH8tIBq5FBb9KOXx"],"releases":[{"id":"rel_DQMcmQahyywReveyI94ta","title":"Next.js v16.3.8 patches SSRF in Image Optimization and cache poisoning flaws","path":"/release/rel_DQMcmQahyywReveyI94ta-ssrf-in-image-optimization-fixed-cache-poisoning-patches-land","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Ipw2wG7i156eA38xySQfX","title":"Next.js v15.5.27 patches SSG and ISR cache poisoning vulnerabilities","path":"/release/rel_Ipw2wG7i156eA38xySQfX-ssg-isr-cache-poisoning-and-metadata-image-disclosure-fixed","url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_lsT6BNN7dpSpYaabZ_ZCF","title":"AI SDK provider-utils 4.0.57 fixes SSRF in MCP OAuth metadata discovery","path":"/release/rel_lsT6BNN7dpSpYaabZ_ZCF-mcp-oauth-metadata-discovery-no-longer-ssrf-vulnerable","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.57","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_g9r8fgU0o9FugfTsBU-ib","title":"AI SDK provider-utils 3.0.41 fixes MCP OAuth SSRF and preserves DNS validation when fetch is wrapped","path":"/release/rel_g9r8fgU0o9FugfTsBU-ib-mcp-oauth-ssrf-fixed-dns-validation-survives-fetch-wrapping","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.41","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_nhZPTE2fTmXBuuhsNAg4p","title":"AI SDK adds Topaz Labs provider in @ai-sdk/topaz 2.0.0","path":"/release/rel_nhZPTE2fTmXBuuhsNAg4p-topaz-labs-provider-added-to-ai-sdk","url":"https://github.com/vercel/ai/releases/tag/%40ai-sdk/topaz%402.0.0","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3},{"id":"rel_LmZ-7FH8tIBq5FBb9KOXx","title":"Cloudflare WAF adds emergency block rule for Citrix NetScaler CVE-2026-88771","path":"/release/rel_LmZ-7FH8tIBq5FBb9KOXx-emergency-waf-rule-blocks-citrix-netscaler-cve-2026-88771","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-emergency-waf-release/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"application-security","name":"Application Security"},"importance":4}]},{"heading":"Smaller but useful","anchor":"smaller-but-useful","lede":"Turborepo added task tags with configuration inheritance and tag filtering in query, Cloudflare Tunnel Quick Tunnels gained email authentication, and Access learned strict service token authentication that returns 401/403 instead of redirecting to a login page.","releaseIds":["rel_jMfZvnPaAcBhB_GRogCQU","rel_w_jBy4I8xrXa07aGBD_Ur","rel_7S4A-opiF_CfQBUACnbtL","rel_pZm7pwxQZYS15591V4rBc"],"releases":[{"id":"rel_jMfZvnPaAcBhB_GRogCQU","title":"Turborepo v2.11.6 adds task tags with configuration inheritance and query filtering","path":"/release/rel_jMfZvnPaAcBhB_GRogCQU-task-tags-with-config-inheritance-query-filters-by-tag","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.6","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3},{"id":"rel_w_jBy4I8xrXa07aGBD_Ur","title":"Cloudflare Tunnel adds email authentication for Quick Tunnels via --allowed-mail","path":"/release/rel_w_jBy4I8xrXa07aGBD_Ur-quick-tunnels-get-email-gated-access","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-protected-quick-tunnels/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"core-platform","name":"Core Platform"},"importance":3},{"id":"rel_7S4A-opiF_CfQBUACnbtL","title":"Cloudflare One adds strict service token authentication for Access","path":"/release/rel_7S4A-opiF_CfQBUACnbtL-strict-service-token-auth-401-403-over-302-redirects","url":"https://developers.cloudflare.com/changelog/post/2026-10-02-strict-service-token-authentication/","org":{"slug":"cloudflare","name":"Cloudflare","avatarUrl":"https://media.releases.sh/orgs/cloudflare.jpg","githubHandle":"cloudflare"},"product":{"slug":"cloudflare-one","name":"Cloudflare One"},"importance":3},{"id":"rel_pZm7pwxQZYS15591V4rBc","title":"Microsoft AI audio models for speech and transcription land on Vercel AI Gateway","path":"/release/rel_pZm7pwxQZYS15591V4rBc-microsoft-ai-speech-and-transcription-models-on-ai-gateway","url":"https://vercel.com/changelog#microsoft-ai-models-are-now-available-on-ai-gateway","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":null,"importance":3}]}]}}