Skip to main content

Netlify News

Security Update: Next.js and React vulnerabilities (October 2026)

October 14, 2026

The Next.js and React teams have disclosed three security vulnerabilities (two critical, one high), released on October 14, 2026: a remote code execution (RCE) in SVG image processing, an RCE in use cache (Cache Components), and a denial of service (DoS) in App Router Server Actions. Here's what Netlify customers need to know. Summary If you run Next.js on Netlify, we strongly recommend upgrading next to 15.5.28 or 16.4.1 and redeploying. Several of these have limited or no impact on Netlify; see Impact on Netlify. See What should I do? for steps. Vulnerabilities All issues are patched in 15.5.28 and 16.4.1. Vulnerability: GHSA-673q-mjm6-r5xr — Unauthenticated Remote Code Execution in use cache functions returning typed arrays Severity: Critical Affected: 16.x apps using Cache Components with a use cache function returning typed arrays Vulnerability: GHSA-2464-fhr4-w9xw — Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (CVE-2026-96889 ) Severity: Critical Affected: Processing untrusted SVGs via sharp (Node.js runtime, glibc Linux); on Netlify, reachable through next/og ImageResponse Vulnerability: GHSA-p3m5-59mp-jv5r — Denial of Service in Ap

Mistral Large 4 now available in Agent Runners

October 13, 2026

Mistral AI's Mistral Large 4 model is now available in Netlify Agent Runners. With a 524K-token context window, it’s built for agentic coding and long-context work, making it a good fit for multi-step tasks across larger codebases. Select it from the model picker to try it today. Learn more in docs.

TanStack Start 1.0 deploys on Netlify

October 13, 2026

TanStack Start is now 1.0, and Start apps deploy on Netlify. SSR, server routes, server functions, and middleware run on Netlify Functions. It's also what new Agent Runners projects default start with. Start a new app Deploy the official template, or generate your own: npx create-tsrouter-app@latest --template file-router --add-ons tanchat,netlify Deploy an existing app Install the Netlify plugin: npm install -D @netlify/vite-plugin-tanstack-start Then add it to vite.config.ts after tanstackStart(): import { defineConfig } from 'vite' import { tanstackStart } from '@tanstack/react-start/plugin/vite' import netlify from '@netlify/vite-plugin-tanstack-start' export default defineConfig({ plugins: [tanstackStart(), netlify()], }) Add a netlify.toml with your build settings: [build] command = "vite build" publish = "dist/client" Develop locally against the real platform The plugin emulates Netlify in your dev server, so you can build against the same primitives you'll use in production, without the Netlify CLI: Serverless functions and edge functions Blobs and Netlify Database Cache API and Image CDN Redirects, rewrites, and headers Environment variables AI Gateway Start with Agent Run

Google Gemini 4 Argon now available in AI Gateway and Agent Runners

October 13, 2026

Google’s Gemini 4 Argon model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 4 Argon model: import { GoogleGenAI } from '@google/genai'; export default async () => { const ai = new GoogleGenAI({}); const response = await ai.models.generateContent({ model: 'gemini-4-argon', contents: 'How can AI improve my coding?' }); return Response.json(response); }; Gemini 4 Argon is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Meta Models Now Available in AI Gateway

October 12, 2026

Meta’s Muse Spark and Muse Wonder models are now available through Netlify’s AI Gateway with zero configuration required. Choose muse-spark-1.1 for coding, computer use, and multimodal perception; muse-spark-1.2 for coding-optimized agentic workflows; muse-spark-1.3 for long-horizon coding and agentic work with cleaner code and fewer tokens; or muse-wonder-1.0 for complex coding tasks, long-running agents, and advanced computer use. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway takes care of the setup automatically. Here’s an example using Muse Wonder with the Responses API: import OpenAI from 'openai'; export default async () => { const meta = new OpenAI(); const response = await meta.responses.create({ model: 'muse-wonder-1.0', input: 'How can AI improve my coding?' }); return Response.json(response); }; These Meta models also work in Scheduled Functions, Background Functions, and Edge Functions, with Netlify’s caching, rate limiting, and authentication infrastructure available automatically. Learn more in the AI Gateway documentation and explore the models on Meta’s developer site.

Know who is visiting your protected site, right from your functions

October 7, 2026

On private projects and sites protected with Netlify team login, your Netlify Functions and Edge Functions can now see who is making the request. The signed-in Netlify user is available as context.user, with their user ID, email address, and when their access expires. This function returns the signed-in user's ID, email address, and access expiry as JSON at /whoami, and responds with a 401 when context.user isn't set: // netlify/functions/whoami.ts import type { Config, Context } from '@netlify/functions' export default async (req: Request, context: Context) => { if (!context.user) { return new Response('Unauthorized', { status: 401 }) } return Response.json({ id: context.user.id, email: context.user.email, expiresAt: context.user.expiresAt.toISOString(), }) } export const config: Config = { path: '/whoami' } Previously, protecting a site meant Netlify checked who could visit, but your code couldn't tell who they were. Knowing who's on the other end meant adding a second login of your own on top. Now Netlify verifies the visitor at the edge and passes their identity to your code. Because context.user comes from Netlify and not from the request, a visitor can't impersonate someone e

Subscribe to Netlify events from ChatGPT

October 7, 2026

You can now subscribe to Netlify events from ChatGPT and set up automations that respond to what’s happening on your sites. Instead of checking the Netlify dashboard or waiting on an email, you can have ChatGPT act as soon as something happens. Events you can subscribe to include: A deploy succeeded A build failed A form submission came in For more events to subscribe to, check out our deploy events. Combine events with Netlify plugin and MCP server Events get more useful when you pair them with everything else you can already do through the Netlify ChatGPT plugin and Netlify MCP server. For example, you could set up an automation that: Reviews new form submissions and flags the ones that need a follow-up Summarizes what changed when a production deploy succeeds Because these automations live in ChatGPT, you can describe what you want in plain language and adjust it as your workflow changes. Get started Connect Netlify in ChatGPT, then ask it to subscribe to the events you care about for your project. Learn more in our guide to using Netlify with ChatGPT.

Claude Haiku 5.5 now available in AI Gateway and Agent Runners

October 7, 2026

Anthropic’s Claude Haiku 5.5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using Claude Haiku 5.5 with the Messages API: import Anthropic from '@anthropic-ai/sdk'; export default async () => { const anthropic = new Anthropic(); const response = await anthropic.messages.create({ model: 'claude-haiku-5-5', max_tokens: 1024, messages: [ { role: 'user', content: 'Give a concise explanation of how AI works.' } ], }); return Response.json(response); }; Claude Haiku 5.5 is also available across Scheduled Functions, Background Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

OpenAI Decisions API now available in AI Gateway

October 7, 2026

OpenAI’s Decisions API is now available through Netlify’s AI Gateway with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions to classify, route, and score inputs without managing API keys. Instead of generating prose, the Decisions API answers questions you define about an input, and choice answers are always one of the options you declared. That means there’s no output to parse and nothing unexpected to handle before you branch on the result. The Decisions API is in beta and currently runs on gpt-6-luna. Here’s a Function for an online store that sorts incoming return requests by reason: import type { Config } from "@netlify/functions"; import OpenAI from "openai"; export default async (req: Request) => { const openai = new OpenAI(); const { answers } = await openai.decisions.create({ model: "gpt-6-luna", input: await req.text(), questions: [ { type: "choice", name: "reason", instructions: "Why is the customer returning this item?", choices: [ { value: "wrong_size" }, { value: "defective" }, { value: "not_as_described" }, { value: "changed_mind" }, ], }, ], }); return Response.json(answers[0]); }; export const config: Config = { path: "/api/returns"

Comment on specific lines of code in Agent Runners

October 6, 2026

You can now add comments to individual lines in the diff on the Code tab of Agent Runners, so you can give your agent precise feedback on the code it generated. Previously, asking for a fix meant describing where the problem was in your prompt, such as naming the file, quoting the code, or explaining which function you meant. Now you can pinpoint exactly where you want changes. Open the Code tab for an agent run, select the + next to a line in the diff, and leave a comment about what you want changed. Your comments are sent along with your next prompt, so the agent knows exactly which code lines you’re referring to. Agent Runners Code tab showing a diff of index.html with a comment box open on line 278 that reads “use class name subdued instead” and an Add comment button This makes follow-up prompts more useful when you want to: Correct a specific bug or edge case without rewriting the whole request Ask for a different approach in one part of a change while keeping the rest Flag naming, styling, or structure issues right where they appear Leave feedback on several spots across multiple files in a single follow-up run Try it on your next agent run, or learn more about making changes

Google’s Gemini Nano Banana 2.1 now available in AI Gateway

October 6, 2026

Google’s Gemini Nano Banana 2.1 is now available through Netlify AI Gateway. You can call this image generation model from Netlify Functions without configuring API keys; AI Gateway provides the connection to Google for you. Use the Google Gen AI SDK with the model ID gemini-nano-banana-2.1. Here’s an example that generates an image from a prompt and returns it directly from a Function: import { GoogleGenAI } from '@google/genai'; // Netlify Function: Generate an image with Gemini Nano Banana 2.1 and return it directly. // Usage (GET): /.netlify/functions/nano-banana-2-1?prompt=Your+prompt+here // Returns: binary image (PNG/JPEG/etc) with proper content-type. If no image, JSON error. export default async (request: Request) => { const url = new URL(request.url); const prompt = url.searchParams.get('prompt') || 'two happy bananas holding flashlights'; const ai = new GoogleGenAI({}); try { const response = await ai.models.generateContent({ model: 'gemini-nano-banana-2.1', contents: prompt, config: { imageConfig: { aspectRatio: '16:9', imageSize: '1K' } } }); let imagePart = null; for (const part of response.candidates[0].content.parts) { if (part.inlineData) { imagePart = part.inlineD

SvelteKit 3 just works on Netlify

October 2, 2026

SvelteKit 3 is out today, and it just works on Netlify on day one. To upgrade, run: npx sv migrate sveltekit-3 The migration tool handles most of the mechanical changes for you, including moving your config and updating imports. You can also check out the official migration guide. What’s new Some highlights include: Vite 8 — SvelteKit 3 requires Vite 8, bringing faster builds powered by Rolldown. Config lives in vite.config.ts — SvelteKit configuration moves out of svelte.config.js and into your Vite config, so Vite plugins can read it right away. Explicit environment variables are stable — Declare the environment variables your app depends on in src/env.ts, and specify whether each one is public and whether it’s resolved at build time or when the app boots. You get validation and type safety out of the box. $lib is now #lib — The $lib alias is replaced by #lib, using Node’s subpath imports. Imports need to be unambiguous, so write #lib/foo.ts or #lib/foo/index.ts. Shallow routing is built into goto — Use goto() with shallow: true instead of pushState and replaceState. Consistent error handling — All errors, including ones you throw with error(...), now go through your handleError

Security Update: Cross-site scripting in TanStack Start

September 30, 2026

The TanStack team has disclosed a critical cross-site scripting (XSS) vulnerability in TanStack Start. A crafted URL can cause an affected app to return attacker-controlled HTML from its own origin, which may run attacker-supplied JavaScript in a visitor's browser. Here's what Netlify customers need to know. Vulnerabilities GHSA-qx66-fv34-fjm8 (CVE-2026-102989): Unauthenticated reflected XSS in server-function responses. Package: @tanstack/react-start Affected versions: >= 1.143.12, = 1.143.12, = 1.143.12, = 1.143.12, @tanstack/react-start 1.168.60 or later @tanstack/solid-start 1.168.57 or later @tanstack/vue-start 1.168.56 or later @tanstack/start-server-core 1.169.39 or later Not sure if you're affected? Open your project in Agent Runners in ask mode and try this prompt: Does this project use TanStack Start? If so, which versions of `@tanstack/react-start`, `@tanstack/solid-start`, `@tanstack/vue-start`, and `@tanstack/start-server-core` are resolved in the lockfile? Is the resolved `@tanstack/start-server-core` version 1.169.39 or later? If not, what do I need to change to upgrade? (Advisory: GHSA-qx66-fv34-fjm8) Ask mode answers without changing your code. If an upgrade is nee

Security Update: Multiple vulnerabilities in Next.js

September 30, 2026

The Next.js team has disclosed seven security vulnerabilities in Next.js (one high, five medium, one low), patched on September 30, 2026 in 15.5.27 and 16.3.8. The issues span server-side request forgery (SSRF), cache poisoning, and information disclosure. Several of them do not affect apps hosted on Netlify. Here's what Netlify customers need to know. Summary Some of these vulnerabilities affect Next.js sites hosted on Netlify (details in Impact on Netlify), so if you run Next.js on Netlify, we strongly recommend upgrading next to 15.5.27 or 16.3.8 and redeploying. The OpenNext Netlify Next.js adapter must also be updated to @netlify/plugin-nextjs 5.16.1; it's auto-installed by default, so a redeploy picks it up (a manual upgrade is only needed if you pin the version). See What should I do? for full steps. Vulnerabilities All issues are patched in 15.5.27 and 16.3.8. Vulnerability: GHSA-cjq9-62q9-8jv4 / CVE-2026-94483 — Image optimizer SSRF Severity: High Affected: 16.x with an attacker-controlled remote host in images.remotePatterns Vulnerability: GHSA-4jqv-mc3x-m676 / CVE-2026-94543 — Cache poisoning of SSG/ISR pages (cross-route) Severity: Medium Affected: 15.x/16.x Pages Route

Trust Center is now in the Netlify Dashboard

September 30, 2026

Netlify's security and compliance document library has moved into the Netlify Dashboard. To request access and learn more about the certifications and documents available, go to https://www.netlify.com/trust-center/. Any signed-in user, on any plan, can view our certifications, subprocessor list, and available compliance documents from their user settings. More sensitive documents, such as our SOC 2 report, require an access request through the Trust Center in the Netlify dashboard. Once approved, the documents are available for download. Learn more about how to access the Netlify Trust Center in our Security docs.

GPT-6.1 Sol now available in AI Gateway and Agent Runners

September 29, 2026

OpenAI’s GPT-6.1 Sol model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using GPT-6.1 Sol with the Responses API: import OpenAI from 'openai'; export default async () => { const openai = new OpenAI(); const response = await openai.responses.create({ model: 'gpt-6.1-sol', input: 'Give a concise explanation of how AI works.', }); return Response.json(response); }; GPT-6.1 Sol is also available across Scheduled Functions, Background Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Prompt and preview in one view with Agent Runners

September 28, 2026

Agent Runners now shows you a preview right next to your prompt. Previously, you’d get a link to the Deploy Preview and have to open it in a separate tab to see what the agent changed. Now the preview appears inline, so you can review the result and write your next prompt without switching back and forth. Plus, you can still access the Deploy Preview link if you need it. This makes iterating with an agent feel more like a conversation. See what changed, spot what’s off, and follow up with the next instruction, all in one view. Example flow For example, say you’re building a strategic task organizer and prompt your agent to add a button that generates a quarterly impact report. Now you can watch your agent’s updates in the side preview next to your prompt. Agent Runners side-by-side view showing a chat prompt to add a quarterly report button next to the live Deploy Preview of the resulting task organizer app In this example, your agent on Netlify will also let you know if your project cannot save your tasks across browser sessions yet, and you can approve adding a database in the same view. This is just one example of how Netlify gives you professional-grade capabilities, such as a

Claude Sonnet 5.5 now available in AI Gateway and Agent Runners

September 28, 2026

Anthropic’s Claude Sonnet 5.5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using Claude Sonnet 5.5: import Anthropic from '@anthropic-ai/sdk'; export default async () => { const anthropic = new Anthropic(); const response = await anthropic.messages.create({ model: 'claude-sonnet-5-5', max_tokens: 4096, messages: [ { role: 'user', content: 'How can AI improve my coding?' } ] }); return Response.json(response); }; Claude Sonnet 5.5 is also available across Background Functions, Scheduled Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

New project activity feed

September 24, 2026

As part of our ongoing work to simplify the Netlify dashboard, we’ve added an activity feed to the project overview page. It’s available on all plans and adapts to how your project is set up. Now when you open a project, the activity feed gives you a snapshot of your project's latest updates, with quick access to: Production versions of your project, including the version last published Preview versions of your project Agent runs, so you can see what agents are working on and what you and your teammates have prompted Project activity feed in the Netlify dashboard listing recent activity newest first, with filters for All, Production, Previews, and Agent runs. Entries include an in-progress agent run, a published production deploy, and two branch deploys with Preview links. This means that instead of tracking down Production deploy links, Deploy Preview links, branch deploy links, and your agent runs list separately, you can now see where your project stands at a glance in one single spot. The feed also suggests next steps to help you get started. It's one of several dashboard improvements we're gradually rolling out to simplify the Netlify experience, so you may have spotted a few

GPT-6 Sol and GPT-6 Luna now available in AI Gateway and Agent Runners

September 22, 2026

OpenAI’s GPT-6 Sol and GPT-6 Luna models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using GPT-6 Sol with the Responses API: import OpenAI from 'openai'; export default async () => { const openai = new OpenAI(); const response = await openai.responses.create({ model: 'gpt-6-sol', input: 'Give a concise explanation of how AI works.', }); return Response.json(response); }; GPT-6 Sol and GPT-6 Luna are also available across Scheduled Functions, Background Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Claude Opus 5.5 now available in AI Gateway and Agent Runners

September 22, 2026

Anthropic’s Claude Opus 5.5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using Claude Opus 5.5: import Anthropic from '@anthropic-ai/sdk'; export default async () => { const anthropic = new Anthropic(); const response = await anthropic.messages.create({ model: 'claude-opus-5-5', max_tokens: 4096, output_config: { effort: 'medium' }, messages: [ { role: 'user', content: 'How can AI improve my coding?', }, ], }); return new Response(JSON.stringify(response), { headers: { 'Content-Type': 'application/json' }, }); }; Claude Opus 5.5 is also available across Background Functions, Scheduled Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Security Update: Critical Next.js vulnerability in ImageResponse

September 22, 2026

The Next.js team has disclosed a critical severity vulnerability in an upstream dependency that can lead to remote code execution when ImageResponse renders untrusted input. It is patched in 15.5.26 and 16.3.6. Applications that do not pass untrusted input into ImageResponse are not expected to be affected. Here’s what Netlify customers need to know. Vulnerabilities GHSA-vcvr-r3jv-pc5j / CVE-2026-94545 — Remote Code Execution in next/og ImageResponse. Critical. Patched in 15.5.26 and 16.3.6. Impact on Netlify Netlify sites are affected only if they use ImageResponse and the image it generates includes untrusted input — text, or an image loaded from the request. Sites that don’t use ImageResponse, or that only render trusted content through it, are not affected. For sites that do, the impact is limited to a crashed function invocation, not code execution. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed function does not affect other requests. However, active exploitation could increase your function costs. What should I do? We strongly recommend upgrading as soon as possible to patched releases: next

TypeSafe Jev now available in AI Gateway

September 17, 2026

TypeSafe’s Jev model is now available through Netlify’s AI Gateway with zero configuration required. Install @typesafe-ai/sdk and use it directly in your Netlify Functions — no API keys to create, no provider config, no base URLs to wire up. AI Gateway handles credentials automatically, and usage is billed to your Netlify credits like every other model in the gateway. Jev is TypeSafe’s first “System One” model, and it works differently from the chat models you’re used to. Instead of generating prose, you send it your program state along with a set of typed questions, and it returns typed answers with calibrated probabilities. There are three question primitives: choice picks one option from a set, score rates against ordered levels, and noul returns a yes/no probability between 0 and 1. Answers are constrained to the options you declare, so there’s no JSON parsing or schema coercion on your end. Every question in a request is evaluated in parallel against the same state, which means batching a dozen questions into one call costs little more than asking one. State and questions share a budget of roughly 32,000 tokens — about 150,000 characters of English text — and TypeSafe reports

DeepSeek V4.1 Flash now available in AI Gateway

September 15, 2026

DeepSeek V4.1 Flash is now available through OpenRouter on Netlify’s AI Gateway with zero configuration required. Use the OpenRouter SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using DeepSeek V4.1 Flash: import { OpenRouter } from '@openrouter/sdk'; export default async () => { const client = new OpenRouter(); const response = await client.chat.send({ chatRequest: { model: 'deepseek/deepseek-v4.1-flash', messages: [{ role: 'user', content: 'How can AI improve my coding?' }], maxTokens: 400, }, }); return Response.json(response); }; DeepSeek V4.1 Flash is available across Background Functions, Scheduled Functions, and Edge Functions. You get automatic access to Netlify’s rate limiting and authentication infrastructure. Learn more in the AI Gateway documentation and OpenRouter documentation.

Agent Runners: Get a working result when low on credits

September 14, 2026

Agent Runners are now better at completing their work when a run has less credits remaining than the task requires. If you are close to running our of credits during a run, the agent will start focusing on delivering the most useful result it can with the credits it has left. It finishes work already in progress, leaves the project in a working state, and provides a clear summary of what it completed. Previously, an ambitious task could end abruptly before the agent wrapped up, leaving partial changes and little explanation. Now, you’re more likely to get a working result you can use right away, or a solid, clearly documented starting point for your next run. This improvement applies automatically to every agent and model available in Agent Runners. There’s nothing to enable or configure. Learn more in Make changes with Agent Runners and how credits work.

Get a working result even when a run runs low on credits

September 14, 2026

Agent Runners are now better at completing their work when a run has less credits remaining than the task requires. If you are close to running our of credits during a run, the agent will start focusing on delivering the most useful result it can with the credits it has left. It finishes work already in progress, leaves the project in a working state, and provides a clear summary of what it completed. Previously, an ambitious task could end abruptly before the agent wrapped up, leaving partial changes and little explanation. Now, you’re more likely to get a working result you can use right away, or a solid, clearly documented starting point for your next run. This improvement applies automatically to every agent and model available in Agent Runners. There’s nothing to enable or configure. Learn more in Make changes with Agent Runners and how credits work.

Social media share buttons

September 11, 2026

Sharing your Netlify projects is now faster with built-in social media share buttons. When you’re ready to show off what you’ve built, you can share your project directly to X, LinkedIn, Reddit, Facebook, or Bluesky. Choose your preferred platform and Netlify opens a ready-to-publish post with your project link, so you can reach your community with fewer steps.

Cursor Origin now supported as a Git provider

September 10, 2026

You can now connect repositories hosted on Cursor Origin to Netlify, so every Git push deploys an updated version of your project at a preview URL or a production URL. Netlify supports Cursor Origin with continuous deployment, meaning that once your codebase’s repo is connected, Netlify will automatically: Build and deploy your project with every git push Build Deploy Previews for your pull requests Send deploy notifications to your pull request comments on Cursor Origin so you can check preview URLs there Requirements Cursor Origin uses OAuth authentication, so connecting a repo works much like our existing Azure DevOps support: the Cursor user who authenticates needs access to the Cursor Origin codebase that owns the repository. To use Cursor Origin with Netlify, you do not need a specific pricing plan with Netlify. Support scope Note that features outside of continuous deployment, such as Agent Runners and the Netlify Drawer, are not supported at this time. Get started To learn more, check out these docs: Get started Cursor Origin Link your repo to your Netlify project Deploy a new project to Netlify from your Cursor Origin repo

ChatGPT Images 2.5 now available in AI Gateway and Agent Runners

September 9, 2026

OpenAI’s ChatGPT Images 2.5 models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use gpt-image-2.5-flare or gpt-image-2.5-sunburst to generate images for your applications. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using the gpt-image-2.5-flare model: import OpenAI from 'openai'; const ai = new OpenAI(); export default async (req, context) => { const response = await ai.images.generate({ model: 'gpt-image-2.5-flare', prompt: 'A golden retriever working at a laptop in a sunny startup office', size: '1024x1024', quality: 'low', output_format: 'jpeg', output_compression: 80 }); const imageBuffer = Buffer.from(response.data[0].b64_json, 'base64'); return new Response(imageBuffer, { status: 200, headers: { 'content-type': 'image/jpeg', 'cache-control': 'no-store' } }); }; Both ChatGPT Images 2.5 models are available across standard Functions, Background Functions, Scheduled Functions, Edge Functions, and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Le

GPT-6 Astra now available in AI Gateway and Agent Runners

September 4, 2026

OpenAI’s GPT-6 Astra model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. AI Gateway handles everything automatically. Here’s an example using GPT-6 Astra with the Responses API: import OpenAI from 'openai'; export default async () => { const openai = new OpenAI(); const response = await openai.responses.create({ model: 'gpt-6-astra', input: 'Give a concise explanation of how AI works.', }); return Response.json(response); }; GPT-6 Astra is also available across Background Functions, Scheduled Functions, and Edge Functions. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Agent Runners now use smarter scoping for new projects

September 4, 2026

Agent Runners can now scope ambitious prompts for new projects to create a partial working project and provide next steps within the available credit budget. Previously, a brand new project could use up its credit budget before the agent finished for ambitious prompts, leaving the run marked Cancelled partway through. Now, your agent scopes the work more intelligently. It builds out part of the project and shares a plan for next steps, so you can preview a working version within your new project credit budget instead of the run stalling out. Learn more in Make changes with Agent Runners.

Google Gemini 3.8 Flash now available in AI Gateway and Agent Runners

September 2, 2026

Google’s Gemini 3.8 Flash model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 3.8 Flash model: import { GoogleGenAI } from '@google/genai'; export default async () => { const ai = new GoogleGenAI({}); const response = await ai.models.generateContent({ model: 'gemini-3.8-flash', contents: 'How can AI improve my coding?' }); return Response.json(response); }; Gemini 3.8 Flash is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Claude Fable 5.1 now available in AI Gateway and Agent Runners

September 1, 2026

Anthropic’s Claude Fable 5.1 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Claude Fable 5.1 model: import Anthropic from '@anthropic-ai/sdk'; export default async () => { const anthropic = new Anthropic(); const response = await anthropic.messages.create({ model: 'claude-fable-5-1', max_tokens: 4096, messages: [ { role: 'user', content: 'How can AI improve my coding?' } ] }); return new Response(JSON.stringify(response), { headers: { 'Content-Type': 'application/json' } }); }; Claude Fable 5.1 is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

GitHub stacked pull requests now create Deploy Previews

August 27, 2026

Netlify now creates a Deploy Preview for every pull request in a GitHub stack when the stack ultimately targets your project’s production branch (usually main). You can review and share each layer of a larger change before it merges. A GitHub stacked pull request showing a successful Netlify Deploy Preview check GitHub Stacked Pull Requests help teams split a larger update into smaller, connected pull requests. Each pull request can focus on one step of the work, making changes easier to review and merge in sequence. Previously, Netlify only created a Deploy Preview for the first pull request in your stack while additional pull requests in the stack didn't get their own Deploy Previews. Now, every pull request in the stack gets its own Deploy Preview. There’s nothing new to configure. Create and update your stack in GitHub as usual, and Netlify automatically adds a Deploy Preview to each eligible pull request. Learn More Get an overview of GitHub Stacked Pull Requests Follow GitHub’s quick start for creating a stack

Security Update: Two critical Next.js vulnerabilities

August 25, 2026

The Next.js team has disclosed two critical severity vulnerabilities, both of which can lead to unauthenticated remote code execution. Both are patched in 15.5.24 and 16.3.3. Netlify-hosted sites are not affected by the Windows issue, and do not run the Next.js code path affected by the image issue. We still recommend upgrading. Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: CVE-2026-75604 / GHSA-p293-qw3h-jr36 — Unauthenticated remote code execution on Windows-hosted servers Severity: Critical Affected versions: ≥13.4.0 next 15.5.24 or later, or 16.3.3 or later, then redeploy. Resources Next.js August 2026 security release Next.js security advisories

Pre-launch toolbar and the Powered by Netlify badge

August 19, 2026

Private projects on Netlify will now show a pre-launch toolbar so you can share your project for review and run audits using AI checks before you make your project public. Private projects and agent runs require a Credit pricing plan. If you're on a Legacy pricing plan, you will not have access to the pre-launch toolbar. Audits consume credits like any other agent run. For public projects, new projects created on a Free plan on or after August 19, 2026 show a Powered by Netlify badge to all visitors. The badge is configurable for each project through your project configuration settings. To turn the Netlify badge on or off for all visitors of your site: Go to Project configuration > General > Powered by Netlify badge and turn it on or off. Additionally, any visitor can hide the badge for themselves, and that choice is stored locally on their browser and never reaches Netlify. All projects created before August 19, 2026 have the badge off by default. Users on a Credit-based Personal and Pro plans can also turn the badge on or off per-project. For these plans, the badge is always off by default. Release timeline We’re rolling both overlays out gradually over the next few weeks, so a p

Agent Runners can now ask clarifying questions

August 19, 2026

Agent Runners can now ask you clarifying questions before they start building. When a few details could significantly improve the result, the agent pauses and asks instead of guessing. The clarifying questions UI in an Agent Runners session, asking: What should the tracker dashboard keep track of? How clarifying questions work Say you start with something broad, like “Build a tracker dashboard.” Previously the agent had to make every call for you: what the dashboard should track, whether entries should be editable and saved to a database or live in the code as a read-only placeholder, whether the look should be dark and high-contrast or light, clean, and editorial. Now it can ask, and you can answer directly where the agent run works. Answer, skip, or add your own context Answering questions is always optional so you can answer the ones you have opinions about and skip the rest. Or you can skip all questions and let the agent decide. Finally, you can always add context in your own words alongside your answers. In our testing, even a few quick answers make the first build noticeably sharper and saves credits you’d otherwise spend on course corrections. Once you answer, the run conti

Google Gemini 3.7 Flash now available in AI Gateway and Agent Runners

August 13, 2026

Google’s Gemini 3.7 Flash model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 3.7 Flash model: import { GoogleGenAI } from '@google/genai'; export default async () => { const ai = new GoogleGenAI({}); const response = await ai.models.generateContent({ model: 'gemini-3.7-flash', contents: 'How can AI improve my coding?' }); return Response.json(response); }; Gemini 3.7 Flash is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

Pay for Netlify with Apple Pay and Google Pay

August 12, 2026

You can now pay for Netlify with Apple Pay or Google Pay, in addition to paying by credit card. Both options show up as you’d expect at checkout, so you can confirm a payment with the device you already have in hand instead of tracking down a card. It’s a small change, but it removes a genuine bit of friction—especially when you’re upgrading in the middle of shipping something and don’t want to break flow to go find your wallet. Credit cards continue to work exactly as they always have. If that’s what your team uses, there’s nothing to change and nothing to migrate. Apple Pay and Google Pay are simply two more ways to pay. Learn more in the Netlify billing documentation.

Simplified single sign-on (SSO) process

August 12, 2026

If your team uses SSO (single sign-on) with an identity provider, you can now sign in with just your email address without using your team ID. Netlify recognizes your domain and sends you straight to your identity provider. Previously, SSO required you to know your Team ID. That meant every new hire had to know and enter a Team ID, and anyone who forgot or didn’t know it was stuck at the login screen. It was a small detail that quietly created support work for the people administering the team. Now the flow is simplified: enter your email, get redirected to whichever identity provider your team has configured, authenticate there, and land back in Netlify. This is live for every team using SSO with an identity provider that lets you use your email address to authenticate. This means your existing SAML setup already carries everything Netlify needs to route people to the right place. Learn more about configuring SAML SSO in the Netlify documentation.

Manage your team invitations from your Netlify dashboard

August 12, 2026

Invitations to join an existing team now show up within your Netlify dashboard, where you can accept or decline them directly without checking your email inbox. Previously, the invitation email was the only way in. If it got buried, filtered, or sent to an address you no longer check, then getting collaboration started with your teammate took a lot longer than it needed to. Now, when you sign in to Netlify with an email address that has a pending invitation, you’ll see it waiting for you. Accept it and you’re on the team immediately. Decline it and it’s cleared out. Either way, you never have to go digging through your inbox. Nothing changes about how invitations are sent. Invitees still receive the same email they always have, and accepting from that link works exactly as before. This is simply a second, more reliable path to the same place. Learn more about inviting and managing teammates in Manage team members in the Netlify documentation.

SolidStart 2 just works on Netlify

August 6, 2026

SolidStart 2 is out, and it deploys to Netlify with no framework-specific adapter to install, a first for full-stack frameworks on Netlify. While SolidStart 1 deployed to Netlify through Nitro under the hood, SolidStart 2 no longer includes Nitro, building directly on Vite’s Environment API instead. The Netlify Vite plugin can now take the server build Vite produces and prepare it for deployment on its own, with no SolidStart-specific Netlify adapter needed in between. How to deploy Install the Netlify Vite plugin: npm install -D @netlify/vite-plugin Then add it to your Vite config with its build support turned on: // vite.config.ts import netlify from '@netlify/vite-plugin'; import { solidStart } from '@solidjs/start/config'; import { defineConfig } from 'vite'; export default defineConfig({ plugins: [solidStart(), netlify({ build: { enabled: true } })], }); That’s the whole setup for a new project. Netlify detects SolidStart and fills in your build settings, and your SSR pages, API routes, server functions, and middleware deploy to Netlify Functions. Prefer to build with Nitro? It became a Vite plugin in Nitro 3 and auto-detects Netlify, so adding nitro() works too. Just remove b

AI Gateway adds OpenRouter support for more AI model choice

August 6, 2026

The AI Gateway now supports OpenRouter, giving you access to models from providers beyond Netlify's direct integrations (OpenAI, Anthropic, Google Gemini). This partnership opens up models from providers like DeepSeek, Meta, Mistral, Qwen, and xAI, all billed through your existing Netlify credits. Learn more about our OpenRouter partnership through the Netlify blog on open models. Supported models For a full list of models available on OpenRouter, visit OpenRouter's models page. Note that Netlify only allows requests through OpenRouter for model providers that support a Zero Data Retention (ZDR) policy, meaning your prompts and outputs are never stored nor trained on. Models on OpenRouter that do not have any available provider guaranteeing this policy (at the time of your request) are not available via Netlify. Set up OpenRouter for AI Gateway As with the other providers, Netlify automatically injects OPENROUTER_API_KEY and OPENROUTER_BASE_URL into your Netlify Functions, Edge Functions, and Preview Server (unless you've already set your own values for either). You can call an OpenRouter-served model using whichever client you prefer: OpenRouter SDK (@openrouter/sdk): pass OPENROU

Agent Runners adds OpenCode and AI model controls

August 6, 2026

Through a new partnership with OpenRouter, you can now choose OpenCode as an AI agent with Agent Runners. OpenCode allows you to choose many different AI models, including Kimi, DeepSeek, and GLM. Learn more about our OpenRouter partnership through the Netlify blog on open models. Previously, you could only choose Claude, Gemini, or Codex as your AI agent, but now you can choose the OpenCode agent, which offers even more models from different AI providers. Requests made through OpenCode are only routed to model providers with a Zero Data Retention (ZDR) policy, so your prompts and outputs are never stored. AI model selection As part of this release, you can now also specify which model any agent uses with Agent Runners. Previously, Claude, Gemini, and Codex agents all automatically chose a model for the task you prompted with Agent Runners. Agents can still auto-select a model for you, but now you can also choose different models for your agents, with these preferences saved just for you on your device. This means you can experiment with which AI models best fit your needs. To open your AI model options for Agent Runners, select agent near your prompt box. Choosing the best AI mode

One-Click Publishing to Netlify

May 21, 2026

via Stitch

Stitch now publishes to Netlify in one click. Click deploy and instantly get a live preview URL — claim it to save it to your Netlify account, then add a custom domain, manage hosting, and scale your site. Perfect for resume sites, event pages, restaurant menus, and portfolios. Currently single-screen export; more options coming.

View Netlify on Creators Toolbox