43:I[20710,["/_next/static/immutable/chunks/2yaquzzu9_zf3.js","/_next/static/immutable/chunks/1td73il66ixpx.js","/_next/static/immutable/chunks/3vfts4_7jnyk8.js","/_next/static/immutable/chunks/2lrkouyqzusm-.js","/_next/static/immutable/chunks/3snx1ablqscfd.js","/_next/static/immutable/chunks/3faoi6891l6ax.js","/_next/static/immutable/chunks/2c7rilkmr9e8z.js"],"OrgReleaseList"] 44:T197a,# SolidStart 2 just works on Netlify - [framework](/changelog/tag/framework/) August 6, 2026 [SolidStart 2](https://github.com/solidjs/solid-start/discussions/2281) is out, and it deploys to Netlify with no framework-specific adapter to install, a first for full-stack frameworks on Netlify. While SolidStart 1 deployed to Netlify through Nitro under the hood, SolidStart 2 no longer includes Nitro, [building directly on Vite’s Environment API](https://github.com/solidjs/solid-start/discussions/2281) instead. The Netlify Vite plugin can now take the server build Vite produces and prepare it for deployment on its own, with no SolidStart-specific Netlify adapter needed in between. ## How to deploy Install the [Netlify Vite plugin](https://npmx.dev/package/@netlify/vite-plugin): ```

npm install -D @netlify/vite-plugin

``` Then add it to your Vite config with its build support turned on: vite.config.ts ```

import netlify from '@netlify/vite-plugin';

import { solidStart } from '@solidjs/start/config';

import { defineConfig } from 'vite';

export default defineConfig({

plugins: [solidStart(), netlify({ build: { enabled: true } })],

});

``` That’s the whole setup for a new project. Netlify detects SolidStart and fills in your build settings, and your SSR pages, API routes, server functions, and middleware deploy to [Netlify Functions](https://docs.netlify.com/build/functions/overview/). Prefer to build with [Nitro](https://nitro.build/)? It became a Vite plugin in Nitro 3 and auto-detects Netlify, so adding `nitro()` works too. Just remove `build.enabled` from the Netlify Vite plugin. Either way, `vite dev` gives you the full Netlify platform emulated right in your dev server without reaching for the Netlify CLI. ## Already on SolidStart 1? Nothing breaks, and your Nitro `netlify` preset keeps working. When you’re ready to upgrade, follow the framework [upgrade guide](https://docs.solidjs.com/solid-start/v2/migrating-from-v1). We recommend then moving to the Netlify Vite plugin with build support as described above and changing your publish directory from `dist` to `dist/client`. (If you keep building with Nitro, `dist` stays as it is.) ## Why there’s no SolidStart adapter Every framework used to need its own adapter for every platform, and every adapter needed someone to keep it current. Frameworks converging on Vite’s Environment API doesn’t change this on its own. What removes it is the build support in `@netlify/vite-plugin`: it takes the server bundle a Vite-powered framework emits and turns it into Netlify deployment configuration (we call this the [Frameworks API](https://docs.netlify.com/build/frameworks/frameworks-api/)), *without knowing or caring which framework produced it*. Supporting SolidStart 2 required no SolidStart-specific code and, in fact, no changes at all. This is the same code that’s been [powering TanStack Start on Netlify the past year](https://docs.netlify.com/build/frameworks/framework-setup-guides/tanstack-start/). It’s the direction we’re heading, in collaboration with the Vite team, framework authors, other platforms like Cloudflare, and the broader ecosystem: fewer adapters to maintain, more consistent feature sets across frameworks, and more niche frameworks supported out of the box, helping to support a healthy web ecosystem. ## Resources - [SolidStart 2 announcement](https://github.com/solidjs/solid-start/discussions/2281) - [SolidStart 2 upgrade guide](https://docs.solidjs.com/solid-start/v2/migrating-from-v1) - [SolidStart on Netlify docs](https://docs.netlify.com/build/frameworks/framework-setup-guides/solidstart/)45:T8d8,Through a new partnership with OpenRouter, you can now choose OpenCode as an AI agent with Agent Runners. OpenCode allows you to choose many different AI models, including Kimi, DeepSeek, and GLM. Learn more about our OpenRouter partnership through the Netlify blog on open models. Previously, you could only choose Claude, Gemini, or Codex as your AI agent, but now you can choose the OpenCode agent, which offers even more models from different AI providers. Requests made through OpenCode are only routed to model providers with a Zero Data Retention (ZDR) policy, so your prompts and outputs are never stored. AI model selection As part of this release, you can now also specify which model any agent uses with Agent Runners. Previously, Claude, Gemini, and Codex agents all automatically chose a model for the task you prompted with Agent Runners. Agents can still auto-select a model for you, but now you can also choose different models for your agents, with these preferences saved just for you on your device. This means you can experiment with which AI models best fit your needs. To open your AI model options for Agent Runners, select agent near your prompt box. Choosing the best AI model for your needs To help you choose the best AI model for your needs, within Agent Runners you can browse details about each model, including a link to learn more, a visual way to compare cost across all supported models with a 1-5 dot scale, and the option to set an effort level for that model. To get the most out of your credits, consider the following strategies: - Use a more expensive, capable model to help you plan your project updates and design a clear prompt with Agent Runners’ ask mode , then switch to a cheaper model to implement the changes. - Experiment with using different AI models for different tasks. - Be explicit about the functionality you want when using models that are cheaper or set to a lower effort level. These models may fill in placeholder functionality. For example, a model might render a contact page without fully setting up working Netlify Forms, so the page looks complete but doesn’t actually work as expected. Learn more To learn more, check out our docs: - Agent Runners overview - Make changes with Agent Runners46:T7c7,The AI Gateway now supports OpenRouter, giving you access to models from providers beyond Netlify's direct integrations (OpenAI, Anthropic, Google Gemini). This partnership opens up models from providers like DeepSeek, Meta, Mistral, Qwen, and xAI, all billed through your existing Netlify credits. Learn more about our OpenRouter partnership through the Netlify blog on open models. Supported models For a full list of models available on OpenRouter, visit OpenRouter's models page. Note that Netlify only allows requests through OpenRouter for model providers that support a Zero Data Retention (ZDR) policy, meaning your prompts and outputs are never stored nor trained on. Models on OpenRouter that do not have any available provider guaranteeing this policy (at the time of your request) are not available via Netlify. Set up OpenRouter for AI Gateway As with the other providers, Netlify automatically injects OPENROUTER\_API\_KEY and OPENROUTER\_BASE\_URL into your Netlify Functions, Edge Functions, and Preview Server (unless you've already set your own values for either). You can call an OpenRouter-served model using whichever client you prefer: - OpenRouter SDK (@openrouter/sdk): pass OPENROUTER\_BASE\_URL explicitly as serverURL when constructing the client, this is the one exception where the base URL isn't picked up automatically. - OpenAI SDK : works out of the box, no extra config. Just pass a model ID in OpenRouter notation (e.g. deepseek/deepseek-v4-flash-0731). - REST API : call ${OPENROUTER\_BASE\_URL}/chat/completions with a bearer token from OPENROUTER\_API\_KEY. Whichever client you use, you can find model IDs to pass in the OpenRouter models directory. Note that a model listed in OpenRouter's directory will not work through the AI Gateway if it does not support a Zero Data Retention (ZDR) policy since Netlify only routes to OpenRouter providers with this support. To learn more about using AI Gateway, check out our official AI Gateway Netlify docs.47:T4fe,Netlify Agent Runners now have a mode selector. Pick Ask and the agent reads, investigates, and answers questions about your project. Build is still the default and works exactly as before. Ask mode is strictly read-only. The agent can’t edit files, run commands, deploy, or change settings. With no build or Deploy Preview, Ask runs are often faster and use fewer credits. It answers with real context: your repository, your project context, and your project’s Netlify Database. Your data is often the fastest way to answer a question about your app, and Ask mode can query it with no risk of a write. A few prompts to steal: - “How many users are in the database?” - “Walk me through how authentication is implemented in this project. Which files handle it, and where is the token stored?” - “Our Largest Contentful Paint is bad on mobile. Read the code and tell me what's most likely responsible.” - “Plan out how we can migrate to the latest version of Astro.” Because it’s a mode on the same run, you can switch to Build the moment an answer turns into a task — same run, same context, no re-explaining. Ask mode is available on all agents, Claude Code, Google Gemini, and OpenAI Codex, in Agent Runners today. See the docs on Ask and Build modes.48:Te3b,# Keep projects private by default with project visibility - [workflow](/changelog/tag/workflow/) July 28, 2026 Teams on a [Free, Personal, or Pro plan](https://docs.netlify.com/manage/accounts-and-billing/billing/billing-for-credit-based-plans/credit-based-pricing-plans/) now have project visibility settings to ensure that all of your project stay private until you decide to make them public. More people are shipping prototypes, internal tools, early client work, and projects built with agents. A deploy is often a work in progress, not a publication. Netlify now reflects that distinction. Project visibility settings allow you to: - quickly ensure your project stays internal for your Netlify team until you’re ready to launch more publicly. - ensure that your project stays private for you and your Netlify team. - choose defaults that keep internal-only projects private, such as for internal apps and tools or sensitive releases. While project access affects who on your team can access a project from the Netlify dashboard, project visibility impacts who can view your project, both at the live URL and inside of Netlify, and requires Netlify login credentials if a project is set to private. ## Starting defaults Starting today, all new Netlify teams on a [Free, Personal, or Pro plan](https://docs.netlify.com/manage/accounts-and-billing/billing/billing-for-credit-based-plans/credit-based-pricing-plans/) will have their projects set to private by default. This means that new Netlify teams will need to adjust the project visibility of each new site or app to decide when to make them publicly available. If you have an existing [Free, Personal, or Pro plan](https://docs.netlify.com/manage/accounts-and-billing/billing/billing-for-credit-based-plans/credit-based-pricing-plans/) (all credit-based plans), then your starting project visibility settings are set differently to keep the previous default behavior before project visibility settings launched. This means all your project URLs stay publicly available unless you’ve set up other authentication with code or Netlify’s password protection options. ## Change your project visibility To change your project’s visibility, you can set a team default for all new and existing projects at: [Team settings > General > Visitor access > Default project visibility](https://app.netlify.com/teams/~/settings/general#default-project-visibility) To change only one project’s visibility settings: [Project configuration > General > Visitor access > Project visibility](https://app.netlify.com/projects/~/configuration/general/#project-visibility) ## Availability Project visibility settings are only available for Credit-based [Free, Personal, or Pro plans](https://docs.netlify.com/manage/accounts-and-billing/billing/billing-for-credit-based-plans/credit-based-pricing-plans/). If you have a Legacy pricing plan, an Enterprise plan, an Open Source plan, you will not find project visibility settings. In this case though, you can still use [password protection](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/), [Team login protection (for Enterprise only)](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/#protect-your-sites-with-netlify-team-login) or configure [authentication with code](https://docs.netlify.com/manage/security/secure-access-to-sites/overview/#require-password-or-login-credentials). ## Learn more Learn more about [setting up and managing project visibility](https://docs.netlify.com/manage/security/secure-access-to-sites/project-visibility/) in our docs.49:T714,Netlify Drop has a refreshed look, with even more support for your questions and guidance on what’s next after you drop your latest site or app. We first launched Netlify Drop 13 years ago when we introduced the web to a simpler way to deploy your web project and get a custom link for it. Since that time we’ve learned a lot about how people (and now agents) use Drop. You can learn more from our official blog post revisiting Netlify Drop and how it’s evolved over time. Same core functionality with more context The newly improved Drop page keeps the same core functionality, letting you drag and drop your project files or folder, while making it easier for you or an agent to find answers along the way. For example, did you know Netlify can detect your framework and run a build step for you? You don’t have to build your project first. If you drop a project folder that uses a framework requiring a build, we’ll direct you to log in first, then take care of the build step for you. Try it out Try it out at app.netlify.com/drop. After you drop After you drop a project, claim it to keep your project online and join millions of others, from solo builders to global brands, who manage their sites and apps on Netlify. After you claim your project, you can keep building in your preferred workflow. We’ve got you covered with more ways than ever to keep building and deploying: - Keep dropping to update the same production URL - Push your deployed project to a newly created GitHub repo - Keep deploying with dev tools, such as our CLI or API - Keep developing with popular AI agents directly from your Netlify dashboard using Agent Runners From there you can keep launching with confidence, undo mistakes (even without Git), build with a team, and grow to any size, all starting from a drop.4a:Tea4,The Nuxt team has disclosed several security vulnerabilities fixed in Nuxt 4.5.1 and 3.21.10, ranging from a high-severity server-side remote code execution (under specific conditions) to lower-severity and development-only issues. Here’s what Netlify customers need to know. Vulnerabilities - GHSA-9473-5f9j-94wq (High): remote code execution via server island props - GHSA-48hr-524c-v5w3 (Medium): unauthorized component instantiation via server island props - GHSA-hxvh-4h3w-prp9 (High): route rule authorization bypass when a route rule key contains an uppercase character - GHSA-hxcr-hm88-mpq6 and GHSA-9pgf-384g-p7mv (High): server component denial of service - GHSA-wm8w-6qjm-cv43 (High): cross-user disclosure of cached payloads (Nuxt 4.x only, 4.4.0 and later) - GHSA-7c4v-fwgw-9rf7 (Low): dev server path disclosure - GHSA-279x-mwfv-vcqv (Critical, development only): remote code execution in Nuxt DevTools, fixed in @nuxt/devtools@3.3.1 Impact on Netlify Remote code execution (GHSA-9473-5f9j-94wq) This issue only applies under uncommon conditions: it requires Vue’s runtime compiler (vue.runtimeCompiler: true, which is off by default) and a server island that forwards untrusted input into a component. Few applications meet both conditions, so real-world exposure is limited. We’ve proactively reached out to the very small number of Netlify customers whose projects could potentially be affected. Route rule authorization bypass (GHSA-hxvh-4h3w-prp9) This is a framework-level issue that affects Nuxt apps regardless of hosting provider. It is not specific to Netlify. You’re affected if you use routeRules with appMiddleware as an authorization gate and any rule key contains an uppercase character, such as a rule derived from a page like pages/Admin.vue or written explicitly as routeRules: { '/Admin': ... }. Because routing is case-insensitive by default, the page was served while its route rule (and the middleware guarding it) was silently skipped. This is a regression in the earlier fix for CVE-2026-53721, so upgrading only to 4.4.7 or 3.21.7 does not protect you. Upgrade to Nuxt 4.5.1 or 3.21.10, then audit any uppercase route rule keys used for access control. Denial of service (GHSA-hxcr-hm88-mpq6, GHSA-9pgf-384g-p7mv) These are server-side denial-of-service (DoS) vulnerabilities. On Netlify, these have minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs. Cross-user payload disclosure (GHSA-wm8w-6qjm-cv43) If you use the cache, swr, or isr route rules on authenticated pages that render user-specific data, a cached payload could be served to the wrong user. After upgrading, purge any upstream CDN cache (e.g. Akamai or Cloudflare) that may already be holding a leaked payload. Upgrading alone won’t evict it. Development-only issues (GHSA-279x-mwfv-vcqv, GHSA-7c4v-fwgw-9rf7) The Nuxt DevTools remote code execution and the dev server path disclosure only affect local development, not deployed Netlify sites. Still, refresh your lockfile so it picks up @nuxt/devtools@3.3.1. What should I do? We strongly recommend upgrading as soon as possible to a patched release: - nuxt 4.5.1 or later (for Nuxt 4) - nuxt 3.21.10 or later (for Nuxt 3) Running npx nuxt upgrade --dedupe also refreshes your lockfile so it pulls in @nuxt/devtools@3.3.1, which fixes the critical development-only issue above. Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources - Nuxt security post - Nuxt security advisories4b:T1b78,# Claude Opus 5 Now Available in AI Gateway and Agent Runners - [ai gateway](/changelog/tag/ai-gateway/) - [agent runners](/changelog/tag/agent-runners/) July 24, 2026 Anthropic’s Claude Opus 5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Claude Opus 5 model: ```

import Anthropic from '@anthropic-ai/sdk';

export default async () => {

const anthropic = new Anthropic();

const response = await anthropic.messages.create({

model: 'claude-opus-5',

max_tokens: 4096,

output_config: { effort: 'medium' },

messages: [

{

role: 'user',

content: 'How can AI improve my coding?'

}

]

});

return new Response(JSON.stringify(response), {

headers: { 'Content-Type': 'application/json' }

});

};

``` Claude Opus 5 is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the [AI Gateway documentation](https://docs.netlify.com/build/ai-gateway/overview/) and [Agent Runners documentation](https://docs.netlify.com/build/build-with-ai/agent-runners/overview/).4c:T1173,The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: Open redirect leading to XSS CVE: CVE-2026-53668 Severity: Medium Affected versions: ≥6.30.2 ≤6.30.4, ≥7.9.6 <7.13.0 Patched in: 7.13.0 Vulnerability: Unauthenticated Denial of Service in React Router \_\_manifest endpoint CVE: CVE-2026-55685 Severity: High Affected versions: ≥7.0.0 <7.18.0 Patched in: 7.18.0 Vulnerability: RSCErrorHandler Missing Protocol Validation (XSS) CVE: CVE-2026-53667 Severity: Medium Affected versions: ≥7.11.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Arbitrary client-side constructor injection via React Router SSR Hydration CVE: CVE-2026-53666 Severity: Medium Affected versions: ≥6.4.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Unexpected external redirect via untrusted paths CVE: CVE-2026-53669 Severity: Medium Affected versions: ≥6.0.0 <7.18 Patched in: 7.18.0 Impact on Netlify Open redirect leading to XSS Attacker-controlled redirect targets combined with path concatenation and useNavigate can escape the intended app path, resulting in open redirects or XSS via javascript: URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs. Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable. Unauthenticated Denial of Service in React Router \_\_manifest endpoint Deep, attacker-controlled paths can trigger expensive synchronous route matching, blocking the Node.js event loop with a single unauthenticated request to manifest endpoints (\_\_manifest, and \*.manifest in unstable RSC mode). This affects Framework mode with SSR only, including unstable RSC framework mode. This is a server-side denial-of-service (DoS) vulnerability. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs. RSCErrorHandler Missing Protocol Validation (XSS) One RSC redirect handling path was missing protocol validation. Apps that redirect to attacker-controlled values may execute dangerous schemes such as javascript:. This only affects apps using unstable RSC Data or RSC Framework mode. Regardless of hosting provider, all RSC apps redirecting to untrusted values may be vulnerable. Note that this affects an experimental feature only. Arbitrary client-side constructor injection via React Router SSR Hydration Serialized server errors can carry a subtype that’s resolved against window during hydration. Apps that set user-controlled input into error.name could have this instantiate browser constructors such as EventSource, WebSocket, Worker, or Image. This affects Data and Framework mode SSR hydration. Regardless of hosting provider, apps setting user-controlled values into error.name may be vulnerable. This requires an unusual application code path, so real-world impact is expected to be low. Unexpected external redirect via untrusted paths Backslash-based URL forms such as \\\\evil.com, /\\evil.com, or \\/evil.com can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for //. This affects , useNavigate, and redirects across Declarative, Data, Framework, and RSC modes. Regardless of hosting provider, all apps passing untrusted destinations to , useNavigate, or redirects may be vulnerable. What should I do? We strongly recommend upgrading as soon as possible to patched releases: - react-router 7.18.0 or later (all five issues) - react-router 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources - Open redirect leading to XSS (CVE-2026-53668) - Unauthenticated Denial of Service in React Router \_\_manifest endpoint (CVE-2026-55685) - RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667) - Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666) - Unexpected external redirect via untrusted paths (CVE-2026-53669)4d:T16e7,The Next.js team has disclosed nine security vulnerabilities, all patched in 15.5.21 and 16.2.11. The issues span server-side request forgery (SSRF), a middleware authorization bypass, denial of service (DoS), and cache/identifier disclosure. Here's what Netlify customers need to know. Summary If you run Next.js on Netlify, upgrade next to 15.5.21 or 16.2.11 and redeploy. Netlify-hosted sites are not affected by three of these (Server Action Host forwarding, the Image Optimizer DoS, and the Edge-runtime OOM). The rest affect only apps using a specific pattern or configuration, and are resolved by upgrading — see Impact on Netlify for the per-issue verdict. Vulnerabilities All issues are patched in 15.5.21 and 16.2.11. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor. Follow the GHSA links for full details. Vulnerability: CVE-2026-64645 / GHSA-p9j2-gv94-2wf4 — Server-Side Request Forgery in rewrites via attacker-controlled destination hostname Severity: High Affected versions: ≥12.0.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64649 / GHSA-89xv-2m56-2m9x — Server-Side Request Forgery in Server Actions on custom servers Severity: High Affected versions: ≥14.1.1 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64642 / GHSA-6gpp-xcg3-4w24 — Middleware / Proxy bypass in App Router applications using Turbopack and single locale Severity: High Affected versions: ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64641 / GHSA-m99w-x7hq-7vfj — Denial of Service in App Router using Server Actions Severity: High Affected versions: ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64644 / GHSA-q8wf-6r8g-63ch — Denial of Service in the Image Optimization API using SVGs Severity: Medium Affected versions: ≥15.5.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64646 / GHSA-4c39-4ccg-62r3 — Unbounded Server Action payload in Edge runtime Severity: Medium Affected versions: ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64648 / GHSA-68g3-v927-f742 — Cache confusion of response bodies for requests with bodies Severity: Medium Affected versions: ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64647 / GHSA-4633-3j49-mh5q — Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Severity: Medium Affected versions: ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11 Vulnerability: CVE-2026-64643 / GHSA-955p-x3mx-jcvp — Unauthenticated disclosure of internal Server Function endpoints Severity: Medium Affected versions: ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11 Impact on Netlify Server-side request forgery CVE-2026-64645 / GHSA-p9j2-gv94-2wf4 (Server-Side Request Forgery in rewrites via attacker-controlled destination hostname): Netlify sites are affected if a rewrites() or redirects() rule builds the destination hostname from request input (static destinations are not). Upgrading Next.js resolves it. CVE-2026-64649 / GHSA-89xv-2m56-2m9x (Server-Side Request Forgery in Server Actions on custom servers): Netlify sites are not affected — our edge overwrites inbound X-Forwarded-Host with the real host, so an attacker cannot redirect the Server Action's outbound request to a host they control. Middleware authorization bypass CVE-2026-64642 / GHSA-6gpp-xcg3-4w24 (Middleware / Proxy bypass in App Router applications using Turbopack and single locale): Netlify sites are affected if they build with Turbopack and use the legacy middleware.ts convention with single-locale i18n. Webpack builds and the newer proxy.ts convention are not affected. Upgrading Next.js resolves it. Denial of service CVE-2026-64641 / GHSA-m99w-x7hq-7vfj (Denial of Service in App Router using Server Actions) and CVE-2026-64646 / GHSA-4c39-4ccg-62r3 (Unbounded Server Action payload in Edge runtime) are server-side DoS. On Netlify these have minimal impact: our autoscaling architecture means a hung or crashed function does not affect other requests, though active exploitation could increase your function costs. The Edge-runtime OOM specifically cannot exhaust memory on Netlify — request bodies are capped and each request runs in an isolated invocation. Upgrading Next.js resolves both. CVE-2026-64644 / GHSA-q8wf-6r8g-63ch (Denial of Service in the Image Optimization API using SVGs): Netlify sites are not affected — /\_next/image is served by Netlify Image CDN, so the vulnerable Next.js code path is not used. Cache disclosure / confusion CVE-2026-64648 / GHSA-68g3-v927-f742 (Cache confusion of response bodies for requests with bodies) and CVE-2026-64647 / GHSA-4633-3j49-mh5q (Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences): Netlify sites are affected if they use the specific cached-fetch patterns — a cached fetch(new Request(url), init), or a cached binary-body POST fetch(). fetch(url, init) and cache: 'no-store' are not affected. Upgrading Next.js resolves both. Information disclosure CVE-2026-64643 / GHSA-955p-x3mx-jcvp (Unauthenticated disclosure of internal Server Function endpoints): Netlify sites are affected (low impact) if they use Cache Components with a reflective Server Action co-bundled alongside a use cache function. The leak is limited to opaque internal function identifiers — no credentials or PII. Upgrading Next.js resolves it. What should I do? We strongly recommend upgrading as soon as possible: - Upgrade next to 15.5.21 or 16.2.11, then redeploy. For Next.js 13.x and 14.x: patches target 15.x / 16.x — upgrade to a patched minor. Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources - Next.js July 2026 security release - Next.js security advisories4e:T453,You can now invite a Developer or Internal Builder to your team without assigning them to an existing project. Previously, the UI required every new Developer or Internal Builder to be given access to at least one existing project before you could add them. That got in the way of a common workflow: bringing someone on specifically to spin up new work, without handing them the keys to projects they don’t need to touch. Because both roles can create their own projects directly, this is often exactly what teams want. Invite a new teammate, let them start building right away, and keep your existing projects untouched. When they create a project, they’re automatically assigned the Developer role on it, so they own the work they start without gaining access to everything else. The result is cleaner, least-privilege onboarding: people get exactly the access they need to begin, and nothing more. To try it, head to your team’s Members page and invite a Developer or Internal Builder without selecting any existing projects. Learn more about managing project access in our project access docs.4f:T5e8,Team Owners on the credit-based Pro plan can now choose how many monthly credits come with their plan, instead of a single fixed amount. Pick the tier that fits your usage, and change it whenever your needs shift. The new credit tiers, with rollover on higher tiers, can be especially helpful for teams with seasonal surges and teams with consistently high-credit usage and come with some per-credit cost savings. What’s changing Previously, every Pro plan included a fixed 3,000 monthly credits for $20/month. New amounts for monthly credits Now you can choose from five tiers: Monthly credits: 3,000 Price: $20/mo Rollover: No Monthly credits: 5,000 Price: $33/mo Rollover: Yes Monthly credits: 10,000 Price: $63/mo Rollover: Yes Monthly credits: 15,000 Price: $95/mo Rollover: Yes Monthly credits: 20,000 Price: $126/mo Rollover: Yes All tiers include the same Pro plan features: unlimited seats, password protection, and everything else that comes with Pro. Rollover credits on higher tiers Choose 5,000 monthly credits or higher and unused credits rollover an additional billing cycle so you get an extra month to use them. The base 3,000-credit tier doesn’t roll over. Change your tier anytime Team Owners can switch tiers without limits to how many times they switch. Upgrades take effect immediately with a prorated refund; downgrades take effect next billing cycle. Learn more about switching between Pro tiers. Learn more - Pro plan - How credits work - Change your pricing plan - Buy credit packs50:T8b2,Google's Nano Banana 2 Lite (Gemini 3.1 Flash-Lite Image) is now available through AI Gateway. You can call this lightweight image generation model from Netlify Functions without configuring API keys; the AI Gateway provides the connection to Google for you. Example usage in a Function: import { GoogleGenAI } from '@google/genai'; // Netlify Function: Generate an image with Gemini 3.1 Flash Lite Image and return it directly. // Usage (GET): /.netlify/functions/gemini-31-flash-lite-image?prompt=Your+prompt+here // Returns: binary image (PNG/JPEG/etc) with proper content-type. If no image, JSON error. export default async (request: Request) => { const url = new URL(request.url); const prompt = url.searchParams.get('prompt') || 'two happy bananas holding flashlights'; const ai = new GoogleGenAI({}); try { const response = await ai.models.generateContent({ model: 'gemini-3.1-flash-lite-image', contents: prompt, config: { imageConfig: { aspectRatio: '16:9', imageSize: '1K' } } }); let imagePart = null; for (const part of response.candidates[0].content.parts) { if (part.inlineData) { imagePart = part.inlineData; break; } } const bytes = Buffer.from(imagePart.data, 'base64'); const mimeType = imagePart.mimeType || 'image/png'; return new Response(bytes, { status: 200, headers: { 'Content-Type': mimeType, 'Cache-Control': 'no-store' } }); } catch (err) { return new Response(JSON.stringify({ error: String(err), prompt }), { status: 500, headers: { 'Content-Type': 'application/json' } }); } }; Built for speed and lower cost, Gemini 3.1 Flash-Lite Image is a good fit for high-volume image generation. It works across any function type and is compatible with other Netlify primitives such as caching and rate limiting, giving you control over request behavior across your site. Learn more in the AI Gateway documentation.42:["$","$L43",null,{"orgSlug":"netlify","initialReleases":[{"id":"rel_yS4DhPcm9nGGZ_bWmf3KZ","version":null,"title":"SolidStart 2 just works on Netlify","summary":"SolidStart 2 deploys to Netlify using the Netlify Vite plugin with no framework-specific adapter required, enabled by SolidStart 2's shift from Nitro to Vite's Environment API and the Netlify Vite plugin's build support. Existing SolidStart 1 deployments continue working with Nitro.","content":"$44","publishedAt":"2026-08-06T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.145Z","url":"https://www.netlify.com/changelog/2026-08-06-solidstart-2-on-netlify/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify supports SolidStart 2 without a framework-specific adapter","titleShort":"SolidStart 2 deploys to Netlify with no adapter needed","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

SolidStart 2 deploys to Netlify using the Netlify Vite plugin with no framework-specific adapter required, enabled by SolidStart 2's shift from Nitro to Vite's Environment API and the Netlify Vite plugin's build support. Existing SolidStart 1 deployments continue working with Nitro.

"},{"id":"rel_4XUcDHSBkNcv6hJ5Q2bJw","version":null,"title":"Agent Runners adds OpenCode and AI model controls","summary":"Agent Runners now supports OpenCode as an AI agent through a new OpenRouter partnership, offering access to models including Kimi, DeepSeek, and GLM with Zero Data Retention guarantees. Users can also now select which model each agent uses instead of relying on automatic selection, with model details and cost comparison available within the interface.","content":"$45","publishedAt":"2026-08-06T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.145Z","url":"https://www.netlify.com/changelog/2026-08-06-opencode-agent-runners/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify Agent Runners adds OpenCode agent and per-model selection","titleShort":"OpenCode agent ships; AI models now user-selectable","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":1,"features":2},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Agent Runners now supports OpenCode as an AI agent through a new OpenRouter partnership, offering access to models including Kimi, DeepSeek, and GLM with Zero Data Retention guarantees. Users can also now select which model each agent uses instead of relying on automatic selection, with model details and cost comparison available within the interface.

"},{"id":"rel_-vpBzQ4_PBQl7k04sqfzq","version":null,"title":"AI Gateway adds OpenRouter support for more AI model choice","summary":"AI Gateway now supports OpenRouter, providing access to models from DeepSeek, Meta, Mistral, Qwen, and xAI through existing Netlify credits. Netlify automatically injects OPENROUTER_API_KEY and OPENROUTER_BASE_URL into Functions and Edge Functions, and supports the OpenAI SDK, OpenRouter SDK, and REST API for calling OpenRouter models, with a Zero Data Retention policy enforced for all routed requests.","content":"$46","publishedAt":"2026-08-06T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.145Z","url":"https://www.netlify.com/changelog/2026-08-06-ai-gateway-openrouter/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway adds OpenRouter support for DeepSeek, Meta, Mistral, and more","titleShort":"OpenRouter integration unlocks DeepSeek, Meta, Mistral models","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

AI Gateway now supports OpenRouter, providing access to models from DeepSeek, Meta, Mistral, Qwen, and xAI through existing Netlify credits. Netlify automatically injects OPENROUTER_API_KEY and OPENROUTER_BASE_URL into Functions and Edge Functions, and supports the OpenAI SDK, OpenRouter SDK, and REST API for calling OpenRouter models, with a Zero Data Retention policy enforced for all routed requests.

"},{"id":"rel_qM3OAVdBToct8g1Ehjh5o","version":"5.6","title":"GPT-5.6 Luna and Terra price reduction on AI Gateway","summary":"GPT-5.6 Luna now costs 80% less and GPT-5.6 Terra costs 20% less through Netlify AI Gateway, improving price-performance across the GPT-5.6 model family.","content":"# GPT-5.6 Luna and Terra price reduction on AI Gateway\n\n- [ai gateway](/changelog/tag/ai-gateway/)\n- [ai](/changelog/tag/ai/)\n\nJuly 30, 2026\n\nGPT-5.6 Luna now costs 80% less and GPT-5.6 Terra is 20% less through Netlify AI Gateway, making both models more cost-efficient for production AI workloads.\n\nThese reductions improve the price-performance tradeoff across the GPT-5.6 model family, giving teams more flexibility to choose the right balance of capability and cost for each workload.\n\nLearn more in OpenAI’s announcement, [Advancing the price-performance frontier with GPT-5.6](https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/).","publishedAt":"2026-07-30T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.145Z","url":"https://www.netlify.com/changelog/gpt-5-6-luna-terra-price-reduction-ai-gateway/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway cuts GPT-5.6 Luna 80% and Terra 20%","titleShort":"GPT-5.6 Luna 80% cheaper; Terra 20% cheaper","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":1,"features":0},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

GPT-5.6 Luna now costs 80% less and GPT-5.6 Terra costs 20% less through Netlify AI Gateway, improving price-performance across the GPT-5.6 model family.

"},{"id":"rel_WQlfFdn-lI07h2Q20tHmq","version":null,"title":"Ask mode for Agent Runners","summary":"Agent Runners now have an Ask mode that lets the agent read, investigate, and answer questions about your project in read-only fashion—the agent cannot edit files, run commands, deploy, or change settings. Ask runs are often faster and use fewer credits than Build runs, and can query your Netlify Database with no risk of writes. The mode is available on all agents: Claude Code, Google Gemini, and OpenAI Codex.","content":"$47","publishedAt":"2026-07-30T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.145Z","url":"https://www.netlify.com/changelog/2026-07-30-agent-runners-ask-mode/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify Agent Runners add Ask mode for read-only code analysis","titleShort":"Ask mode lets agents analyze code without building or deploying","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Agent Runners now have an Ask mode that lets the agent read, investigate, and answer questions about your project in read-only fashion—the agent cannot edit files, run commands, deploy, or change settings. Ask runs are often faster and use fewer credits than Build runs, and can query your Netlify Database with no risk of writes. The mode is available on all agents: Claude Code, Google Gemini, and OpenAI Codex.

"},{"id":"rel_xOI_5mmapbNq3nkqJwF9f","version":null,"title":"Keep projects private by default with project visibility","summary":"Teams on Free, Personal, or Pro plans can now control project visibility to keep deployments private until ready to launch. New Netlify teams default to private project URLs; existing teams retain public URLs unless changed manually.","content":"$48","publishedAt":"2026-07-28T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.275Z","url":"https://www.netlify.com/changelog/2026-07-28-start-with-private-project-urls/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify adds project visibility settings; new teams default to private","titleShort":"New teams' projects private by default","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Teams on Free, Personal, or Pro plans can now control project visibility to keep deployments private until ready to launch. New Netlify teams default to private project URLs; existing teams retain public URLs unless changed manually.

"},{"id":"rel_kIi3jtbi9c-2geZNLJ4sa","version":null,"title":"Netlify Drop updates","summary":"Netlify Drop has a refreshed interface with improved guidance for deploying sites and apps. The updated Drop page now detects frameworks requiring a build step and directs users to log in before automatically running the build, eliminating the need to build projects locally first.","content":"$49","publishedAt":"2026-07-27T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.275Z","url":"https://www.netlify.com/changelog/2026-07-27-netlify-drop-refresh/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify Drop gets refreshed UI with improved guidance and framework detection","titleShort":"Drop UI refresh; framework detection and build automation","breaking":"unknown","importance":2,"composition":{"bugs":0,"enhancements":1,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Netlify Drop has a refreshed interface with improved guidance for deploying sites and apps. The updated Drop page now detects frameworks requiring a build step and directs users to log in before automatically running the build, eliminating the need to build projects locally first.

"},{"id":"rel_HBFiCWi5160hq9eKL6CJe","version":null,"title":"Security Update: Multiple vulnerabilities in Nuxt","summary":"Nuxt 4.5.1 and 3.21.10 fix multiple high-severity vulnerabilities including remote code execution via server island props (limited exposure on Netlify due to uncommon conditions), route rule authorization bypass when keys contain uppercase characters, server component denial of service, and cross-user disclosure of cached payloads on authenticated pages. Upgrade immediately and audit uppercase route rule keys used for access control; also purge upstream CDN cache if using cache, swr, or isr route rules on authenticated pages.","content":"$4a","publishedAt":"2026-07-27T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.275Z","url":"https://www.netlify.com/changelog/2026-07-27-nuxt-security-vulnerabilities/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify: Multiple high-severity vulnerabilities in Nuxt 4.5.1 and 3.21.10","titleShort":"Nuxt RCE, route rule bypass, and cross-user cache disclosure fixed","breaking":"unknown","importance":4,"composition":{"bugs":7,"enhancements":0,"features":0},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Nuxt 4.5.1 and 3.21.10 fix multiple high-severity vulnerabilities including remote code execution via server island props (limited exposure on Netlify due to uncommon conditions), route rule authorization bypass when keys contain uppercase characters, server component denial of service, and cross-user disclosure of cached payloads on authenticated pages. Upgrade immediately and audit uppercase route rule keys used for access control; also purge upstream CDN cache if using cache, swr, or isr route rules on authenticated pages.

"},{"id":"rel_N39PtmVxl-FWsHA2ONFyQ","version":null,"title":"Claude Opus 5 Now Available in AI Gateway and Agent Runners","summary":"Claude Opus 5 is now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in Netlify Functions without managing API keys or authentication, with automatic access to caching, rate limiting, and authentication infrastructure.","content":"$4b","publishedAt":"2026-07-24T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.275Z","url":"https://www.netlify.com/changelog/claude-opus-5-ai-gateway-agent-runners/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway and Agent Runners now support Claude Opus 5","titleShort":"Claude Opus 5 available in AI Gateway and Agent Runners","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Claude Opus 5 is now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in Netlify Functions without managing API keys or authentication, with automatic access to caching, rate limiting, and authentication infrastructure.

"},{"id":"rel_RbQhuZVWYEawfyB7FmL4q","version":null,"title":"Security Update: Multiple vulnerabilities in React Router","summary":"React Router 7.18.0 patches five security vulnerabilities: an unauthenticated denial-of-service attack on the __manifest endpoint (high severity), open redirect leading to XSS, RSC error handler XSS, arbitrary constructor injection during SSR hydration, and unexpected external redirects via untrusted paths (all medium severity). Netlify's serverless architecture mitigates the DoS impact, but active exploitation could increase function costs; upgrading is strongly recommended.","content":"$4c","publishedAt":"2026-07-23T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.275Z","url":"https://www.netlify.com/changelog/2026-07-23-react-router-security-vulnerabilities/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify: Five security vulnerabilities in React Router require upgrade to 7.18.0","titleShort":"React Router 7.18.0 patches five vulnerabilities; DoS, XSS, open redirect","breaking":"unknown","importance":4,"composition":{"bugs":5,"enhancements":0,"features":0},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

React Router 7.18.0 patches five security vulnerabilities: an unauthenticated denial-of-service attack on the __manifest endpoint (high severity), open redirect leading to XSS, RSC error handler XSS, arbitrary constructor injection during SSR hydration, and unexpected external redirects via untrusted paths (all medium severity). Netlify's serverless architecture mitigates the DoS impact, but active exploitation could increase function costs; upgrading is strongly recommended.

"},{"id":"rel_ZKizQ_7PxsKSkoFkRQRTh","version":null,"title":"Security Update: Multiple vulnerabilities in Next.js","summary":"Next.js 15.5.21 and 16.2.11 patch nine security vulnerabilities including server-side request forgery, middleware authorization bypass, denial of service, and cache confusion issues. Netlify customers should upgrade immediately and redeploy; three of the nine vulnerabilities do not affect Netlify-hosted sites, but the remainder affect apps using specific patterns or configurations.","content":"$4d","publishedAt":"2026-07-21T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.297Z","url":"https://www.netlify.com/changelog/2026-07-21-nextjs-security-vulnerabilities/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Next.js 15.5.21 and 16.2.11 patch nine security vulnerabilities","titleShort":"Nine Next.js vulnerabilities patched; upgrade urgent","breaking":"unknown","importance":4,"composition":{"bugs":9,"enhancements":0,"features":0},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Next.js 15.5.21 and 16.2.11 patch nine security vulnerabilities including server-side request forgery, middleware authorization bypass, denial of service, and cache confusion issues. Netlify customers should upgrade immediately and redeploy; three of the nine vulnerabilities do not affect Netlify-hosted sites, but the remainder affect apps using specific patterns or configurations.

"},{"id":"rel_9ote02LNpcU92vrqHvrMY","version":"3.6","title":"Google Gemini 3.6 Flash and Gemini 3.5 Flash-Lite Now Available in AI Gateway and Agent Runners","summary":"Google's Gemini 3.6 Flash and Gemini 3.5 Flash-Lite models are now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in Netlify Functions without managing API keys or authentication; the AI Gateway handles caching, rate limiting, and authentication automatically.","content":"Google’s Gemini 3.6 Flash and Gemini 3.5 Flash-Lite models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required.\n\nUse the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 3.6 Flash model:\n\nimport { GoogleGenAI } from '@google/genai';\n\nexport default async () => {\n const ai = new GoogleGenAI({});\n\n const response = await ai.models.generateContent({\n model: 'gemini-3.6-flash',\n contents: 'How can AI improve my coding?',\n });\n\n return Response.json(response);\n};\n\nGemini 3.6 Flash and Gemini 3.5 Flash-Lite are available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.\n\nLearn more in the AI Gateway documentation and Agent Runners documentation.","publishedAt":"2026-07-21T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.297Z","url":"https://www.netlify.com/changelog/gemini-3-6-flash-3-5-flash-lite-ai-gateway-agent-runners/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway and Agent Runners add Google Gemini 3.6 Flash and 3.5 Flash-Lite","titleShort":"Gemini 3.6 Flash and 3.5 Flash-Lite available in AI Gateway","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":2},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Google's Gemini 3.6 Flash and Gemini 3.5 Flash-Lite models are now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in Netlify Functions without managing API keys or authentication; the AI Gateway handles caching, rate limiting, and authentication automatically.

"},{"id":"rel_iyMgvcexvvVyY_He85OsD","version":null,"title":"Invite Developers and Internal Builders without assigning a project","summary":"You can now invite a Developer or Internal Builder to your team without assigning them to an existing project. Previously the UI required assigning new developers to at least one existing project before adding them; teams can now invite teammates to spin up new work without giving them access to existing projects.","content":"$4e","publishedAt":"2026-07-20T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.297Z","url":"https://www.netlify.com/changelog/2026-07-20-invite-builders-without-project-access/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify removes project requirement for inviting developers and internal builders","titleShort":"Developers can be invited without assigning projects","breaking":"unknown","importance":2,"composition":{"bugs":0,"enhancements":1,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

You can now invite a Developer or Internal Builder to your team without assigning them to an existing project. Previously the UI required assigning new developers to at least one existing project before adding them; teams can now invite teammates to spin up new work without giving them access to existing projects.

"},{"id":"rel_cGJPsSbDJYKXmGG2vuQxS","version":null,"title":"Set AI usage limits for individual team members","summary":"Team Owners on Pro plans can now set individual AI credit limits for team members, with optional overrides for specific people. Per-member limits stack on top of existing team-wide limits, and AI inference credit usage is now easier to monitor in the dashboard.","content":"Team Owners on Pro plans can now limit Agent Runners spend for individual members in your team, giving you finer control over how AI credits are used across your team.\n\nSet a single credit limit that applies to every member, then customize it with overrides for specific people who need more (or less) room to work. This makes it easy to give power users a higher ceiling while keeping predictable, budget-friendly defaults for everyone else.\n\nYou’ll find these controls in Team Settings under General > AI Enablement.\n\nThis builds on our existing team-wide AI usage limits, so you can now manage AI spend both for an entire team and down to each individual member.\n\nWe’ve also updated how AI inference credit usage is displayed in your dashboard, making it easier to monitor AI usage and manage your AI spend.\n\nLearn more about AI inference usage and how credits work.","publishedAt":"2026-07-15T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.297Z","url":"https://www.netlify.com/changelog/2026-07-15-per-member-ai-usage-limits/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify adds per-member AI usage limits for Agent Runners","titleShort":"Per-member AI credit limits now available","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":1,"features":2},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Team Owners on Pro plans can now set individual AI credit limits for team members, with optional overrides for specific people. Per-member limits stack on top of existing team-wide limits, and AI inference credit usage is now easier to monitor in the dashboard.

"},{"id":"rel_9THMzzM9FdYU1kvJeP0F1","version":null,"title":"Introducing Pro plan monthly credit tiers with rollovers","summary":"Pro plan customers can now choose from five monthly credit tiers (3,000 to 20,000 credits) instead of a fixed 3,000-credit allocation. Higher tiers (5,000 and above) include unused-credit rollover to a second billing cycle, helping teams with seasonal surges and variable usage patterns.","content":"$4f","publishedAt":"2026-07-14T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.297Z","url":"https://www.netlify.com/changelog/2026-07-14-pro-plan-credit-tiers/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify Pro plan now offers five monthly credit tiers with rollover","titleShort":"Pro plan credit tiers from 3K–20K monthly with rollover on higher tiers","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":1,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Pro plan customers can now choose from five monthly credit tiers (3,000 to 20,000 credits) instead of a fixed 3,000-credit allocation. Higher tiers (5,000 and above) include unused-credit rollover to a second billing cycle, helping teams with seasonal surges and variable usage patterns.

"},{"id":"rel_koIzTHa-00ZR4DikPXqrX","version":"5.6","title":"OpenAI GPT-5.6 Sol, Luna, and Terra Now Available in AI Gateway and Agent Runners","summary":"OpenAI's GPT-5.6 Sol, Luna, and Terra models are now available through Netlify's AI Gateway and Agent Runners with zero configuration required. The OpenAI SDK can be used directly in Netlify Functions without managing API keys or authentication, with automatic access to caching, rate limiting, and authentication infrastructure.","content":"OpenAI’s GPT-5.6 Sol, Luna, and Terra models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required.\n\nUse the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the GPT-5.6 Sol model:\n\nimport OpenAI from 'openai';\n\nexport default async () => {\n const openai = new OpenAI();\n\n const response = await openai.responses.create({\n model: 'gpt-5.6-sol',\n input: 'Give a concise explanation of how AI works.',\n });\n\n return Response.json(response);\n};\n\nGPT-5.6 Sol, Luna, and Terra are available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.\n\nLearn more in the AI Gateway documentation and Agent Runners documentation.","publishedAt":"2026-07-09T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.318Z","url":"https://www.netlify.com/changelog/gpt-5-6-sol-luna-terra-ai-gateway-agent-runners/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway and Agent Runners now support OpenAI GPT-5.6 Sol, Luna, Terra","titleShort":"GPT-5.6 Sol, Luna, Terra available in AI Gateway; zero config","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":3},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

OpenAI's GPT-5.6 Sol, Luna, and Terra models are now available through Netlify's AI Gateway and Agent Runners with zero configuration required. The OpenAI SDK can be used directly in Netlify Functions without managing API keys or authentication, with automatic access to caching, rate limiting, and authentication infrastructure.

"},{"id":"rel_NMnxzEFFWEsHnhrohs-Hr","version":null,"title":"Node.js 24 is now the default for Builds and Functions on new sites","summary":"New sites created on Netlify now use Node.js 24 by default for both builds and Netlify Functions. Existing sites retain their current Node.js version and are not affected.","content":"New sites created on Netlify now use Node.js 24 by default for both builds and Netlify Functions.\n\nExisting sites aren’t affected — they keep using whatever Node.js version they’re currently pinned to, whether that’s set via a NODE_VERSION environment variable, an .nvmrc/.node-version file, or the engines.node field in package.json.\n\nIf you want to move an existing site to Node.js 24, follow the Node.js version configuration guide for builds, and the functions runtime version guide for Netlify Functions.","publishedAt":"2026-07-07T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.318Z","url":"https://www.netlify.com/changelog/2026-07-07-nodejs-24-default-new-sites/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify defaults to Node.js 24 for new sites","titleShort":"Node.js 24 now default for builds and functions","breaking":"unknown","importance":2,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

New sites created on Netlify now use Node.js 24 by default for both builds and Netlify Functions. Existing sites retain their current Node.js version and are not affected.

"},{"id":"rel_wb2f52E_mPoqYoIm4xX23","version":null,"title":"Claude Fable 5 reactivated in AI Gateway","summary":"Anthropic's Claude Fable 5 model is now available through Netlify's AI Gateway with zero configuration, allowing direct use of the Anthropic SDK in Netlify Functions with automatic key and authentication handling.","content":"Anthropic’s Claude Fable 5 model is once again available through Netlify’s AI Gateway with zero configuration required.\n\nUse the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Claude Fable 5 model:\n\nimport Anthropic from '@anthropic-ai/sdk';\n\nexport default async () => {\n const anthropic = new Anthropic();\n\n const response = await anthropic.messages.create({\n model: 'claude-fable-5',\n max_tokens: 4096,\n messages: [\n {\n role: 'user',\n content: 'How can AI improve my coding?'\n }\n ]\n });\n\n return new Response(JSON.stringify(response), {\n headers: { 'Content-Type': 'application/json' }\n });\n};\n\nClaude Fable 5 is available for all Function types. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.\n\nLearn more in the AI Gateway documentation.","publishedAt":"2026-07-01T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.318Z","url":"https://www.netlify.com/changelog/claude-fable-5-re-enabled/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway reactivates Claude Fable 5 model","titleShort":"Claude Fable 5 returns to AI Gateway","breaking":"unknown","importance":2,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Anthropic's Claude Fable 5 model is now available through Netlify's AI Gateway with zero configuration, allowing direct use of the Anthropic SDK in Netlify Functions with automatic key and authentication handling.

"},{"id":"rel_230DUrHwaB49N0nPvYFHI","version":null,"title":"Claude Sonnet 5 now available in AI Gateway and Agent Runners","summary":"Claude Sonnet 5 is now available through Netlify's AI Gateway and Agent Runners with zero configuration. Use the Anthropic SDK directly in Netlify Functions without managing API keys or authentication; the AI Gateway handles caching, rate limiting, and authentication automatically.","content":"Anthropic’s Claude Sonnet 5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required.\n\nUse the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Claude Sonnet 5 model:\n\nimport Anthropic from '@anthropic-ai/sdk';\n\nexport default async () => {\n const anthropic = new Anthropic();\n\n const response = await anthropic.messages.create({\n model: 'claude-sonnet-5',\n max_tokens: 4096,\n messages: [\n {\n role: 'user',\n content: 'How can AI improve my coding?'\n }\n ]\n });\n\n return Response.json(response);\n};\n\nClaude Sonnet 5 is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure.\n\nLearn more in the AI Gateway documentation and Agent Runners documentation.","publishedAt":"2026-06-30T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.318Z","url":"https://www.netlify.com/changelog/claude-sonnet-5-ai-gateway-agent-runners/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway and Agent Runners now support Claude Sonnet 5","titleShort":"Claude Sonnet 5 available in AI Gateway; no config needed","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Claude Sonnet 5 is now available through Netlify's AI Gateway and Agent Runners with zero configuration. Use the Anthropic SDK directly in Netlify Functions without managing API keys or authentication; the AI Gateway handles caching, rate limiting, and authentication automatically.

"},{"id":"rel_0e8Qrsgean9Nmnf2f1Ig3","version":"3.1","title":"Nano Banana 2 Lite (Gemini 3.1 Flash-Lite Image) is now available in AI Gateway.","summary":"Google's Nano Banana 2 Lite (Gemini 3.1 Flash-Lite Image) is now available through Netlify's AI Gateway for use in Netlify Functions without manual API key configuration. The lightweight model is built for high-volume, cost-efficient image generation and integrates with Netlify's caching and rate-limiting primitives.","content":"$50","publishedAt":"2026-06-30T00:00:00.000Z","fetchedAt":"2026-08-11T19:32:34.318Z","url":"https://www.netlify.com/changelog/gemini-3-1-flash-lite-image-ai-gateway/","media":[],"type":"feature","prerelease":false,"titleGenerated":"Netlify AI Gateway now supports Google's Gemini 3.1 Flash-Lite Image","titleShort":"Gemini 3.1 Flash-Lite Image available in AI Gateway","breaking":"unknown","importance":3,"composition":{"bugs":0,"enhancements":0,"features":1},"source":{"slug":"netlify-changelog","name":"Changelog","type":"feed","appStore":"$undefined","video":"$undefined"},"product":null,"bodyHtml":"

Google's Nano Banana 2 Lite (Gemini 3.1 Flash-Lite Image) is now available through Netlify's AI Gateway for use in Netlify Functions without manual API key configuration. The lightweight model is built for high-volume, cost-efficient image generation and integrates with Netlify's caching and rate-limiting primitives.

"}],"initialCursor":"2026-06-30T00:00:00.000Z|2026-08-11T19:32:34.318Z|rel_0e8Qrsgean9Nmnf2f1Ig3","multipleSourcesExist":false,"availableSourceTypes":["feed"],"orgAvatarUrl":"https://media.releases.sh/orgs/netlify.png","productLinks":"$L51"}]