Releasesby GlyphGemini 3.5 Flash now available in Agent Runners
Google's Gemini 3.5 Flash model is now available through Netlify's Agent Runners with zero configuration required. Learn more in the Agent Runners documentation.
Also shipped May 20, 2026Netlify in May 2026 →
WAF Release - 2026-05-20
Key Findings Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. Continuous Rule Improvements We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns.
Request-based autoscaling for App Platform is now in general availability
Request-based autoscaling for App Platform is now in general availability. Service components can scale automatically based on HTTP traffic metrics, including requests per second and P95 request duration, in addition to or instead of CPU …
Feature preview: Customer account improvements
Customer accounts are getting a visual refresh, featuring improved navigation, layout, and consistency across devices. You can preview these changes now and test your Shopify Extensions within the updated layout. What's changing: Single-column native pages : These are now consistent across both desktop and mobile, with simplified navigation.
Removing deprecated PRIVATE and PUBLIC_READ enums on metaobject definitions
We are updating the MetaobjectAdminAccess enum by deprecating the PRIVATE and PUBLIC_READ values. These values are now obsolete and are never returned by the API. This change removes ambiguity, as the deprecated access values do not accurately reflect the actual access behaviors.
DuckDB v1.5.3 Bugfix Release
This is a bugfix release for various issues discovered after we released v1.5.2. Please also refer to the announcement blog post: https://duckdb.org/2026/05/20/announcing-duckdb-153 Use DB serialization compatibility for json_serialize_sql DuckLake Bump fix: resolve current catalog in ADBC Ingest to avoid temp table shadowing Fix TIMESTAMPFORMAT being...
More from NetlifyEvery Netlify release →
Build Plugins: End of support for Node.js 18 + Node.js 20
The following versions of Node.js have reached their official end of life: Node.js v18 on April 30, 2025 Node.js v20 on April 30, 2026 Now it’s time to say goodbye to Node.js versions 18 and 20 in our build plugins. This change will allow us to use...
Security update: multiple vulnerabilities in Nuxt
The Nuxt team has disclosed four security vulnerabilities. Here’s what Netlify customers need to know. Vulnerabilities CVE-2026-47200 : Route middleware bypass via island page endpoints (nuxt 3.11.0–3.21.5, 4.0.0-alpha.1–4.4.5) CVE-2026-46342 : Island response not validated against request props (nuxt 3.1.0–3.21.5, 4.0.0-alpha.1–4.4.5) CVE-2026-45670 : Dev...
Gemini 3.5 Flash now available in AI Gateway
Google's Gemini 3.5 Flash model is now available through Netlify’s AI Gateway with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
Agent Runners workflow improvements
We're making it easier to use Agent Runners in the existing workflows you have. Now you can do the following in a more seamless way: Prompt new changes using Agent Runners more quickly from a GitHub pull request link Copy output from Agent Runners faster so you can get back to what you're doing Track pull request ownership so you can understand who is doing...
Claude Opus 4.8 now available in AI Gateway and Agent Runners
Anthropic’s Claude Opus 4.8 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
Block project transfers out of your team
Team Owners can now guarantee that projects stay within the team to meet compliance or ownership requirements by blocking every project from being transferred to another team.
Security Update: Multiple vulnerabilities in Next.js and React
The Next.js and React teams have disclosed twelve security vulnerabilities: one in React Server Components and eleven in Next.js, all patched on May 6, 2026, plus a follow-up advisory on May 7. The issues span middleware/proxy bypass, cross-site scripting (XSS), server-side request forgery (SSRF), cache poisoning, and denial of service (DoS).
Security update: multiple vulnerabilities in React Router
The React Router team has disclosed seven security vulnerabilities. Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: GHSA-8x6r-g9mw-2r78 , DoS via __manifest endpoint Package: react-router Affected versions: 7.0.0–7.14.x Fixed in: 7.15.0 Vulnerability: GHSA-rxv8-25v2-qmq8 , DoS via single-fetch request body Package: react-router...