Netlify Release Notes

Teams on a Free, Personal, or Pro plan now have project visibility settings to ensure that all of your project stay private until you decide to make them public. More people are shipping prototypes, internal tools, early client work, and projects built with agents. A deploy is often a work in progress, not a publication. Netlify now reflects that distinction. Project visibility settings allow you to:

• quickly ensure your project stays internal for your Netlify team until you’re ready to launch more publicly.
• ensure that your project stays private for you and your Netlify team.
• choose defaults that keep internal-only projects private, such as for internal apps and tools or sensitive releases.

While project access affects who on your team can access a project from the Netlify dashboard, project visibility impacts who can view your project, both at the live URL and inside of Netlify, and requires Netlify login credentials if a project is set to private. Starting defaults Starting today, all new Netlify teams on a Free, Personal, or Pro plan will have their projects set to private by default. This means that new Netlify teams will need to adjust the project visibility of each new site or app to decide when to make them publicly available. If you have an existing Free, Personal, or Pro plan (all credit-based plans), then your starting project visibility settings are set differently to keep the previous default behavior before project visibility settings launched. This…

Netlify Drop has a refreshed look, with even more support for your questions and guidance on what’s next after you drop your latest site or app. We first launched Netlify Drop 13 years ago when we introduced the web to a simpler way to deploy your web project and get a custom link for it. Since that time we’ve learned a lot about how people (and now agents) use Drop. You can learn more from our official blog post revisiting Netlify Drop and how it’s evolved over time. Same core functionality with more context The newly improved Drop page keeps the same core functionality, letting you drag and drop your project files or folder, while making it easier for you or an agent to find answers along the way. For example, did you know Netlify can detect your framework and run a build step for you? You don’t have to build your project first. If you drop a project folder that uses a framework requiring a build, we’ll direct you to log in first, then take care of the build step for you. Try it out Try it out at app.netlify.com/drop. After you drop After you drop a project, claim it to keep your project online and join millions of others, from solo builders to global brands, who manage their sites and apps on Netlify. After you claim your project, you can keep building in your preferred workflow. We’ve got you covered with more ways than ever to keep building and deploying:

• Keep dropping to update the same production URL
• Push your deployed project to a newly created GitHub repo …

Anthropic’s Claude Opus 5 model is now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Anthropic SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Claude Opus 5 model: import Anthropic from '@anthropic-ai/sdk'; export default async () => { const anthropic = new Anthropic(); const response = await anthropic.messages.create({ model: 'claude-opus-5', max_tokens: 4096, output_config: { effort: 'medium' }, messages: [ { role: 'user', content: 'How can AI improve my coding?' } ] }); return new Response(JSON.stringify(response), { headers: { 'Content-Type': 'application/json' } }); }; Claude Opus 5 is available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: Open redirect leading to XSS CVE: CVE-2026-53668 Severity: Medium Affected versions: ≥6.30.2 ≤6.30.4, ≥7.9.6 <7.13.0 Patched in: 7.13.0 Vulnerability: Unauthenticated Denial of Service in React Router __manifest endpoint CVE: CVE-2026-55685 Severity: High Affected versions: ≥7.0.0 <7.18.0 Patched in: 7.18.0 Vulnerability: RSCErrorHandler Missing Protocol Validation (XSS) CVE: CVE-2026-53667 Severity: Medium Affected versions: ≥7.11.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Arbitrary client-side constructor injection via React Router SSR Hydration CVE: CVE-2026-53666 Severity: Medium Affected versions: ≥6.4.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Unexpected external redirect via untrusted paths CVE: CVE-2026-53669 Severity: Medium Affected versions: ≥6.0.0 <7.18 Patched in: 7.18.0 Impact on Netlify Open redirect leading to XSS Attacker-controlled redirect targets combined with path concatenation and useNavigate can escape the intended app path, resulting in open redirects or XSS via javascript: URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs. Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable. Unaut…

Google’s Gemini 3.6 Flash and Gemini 3.5 Flash-Lite models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the Gemini 3.6 Flash model: import { GoogleGenAI } from '@google/genai'; export default async () => { const ai = new GoogleGenAI({}); const response = await ai.models.generateContent({ model: 'gemini-3.6-flash', contents: 'How can AI improve my coding?', }); return Response.json(response); }; Gemini 3.6 Flash and Gemini 3.5 Flash-Lite are available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

You can now invite a Developer or Internal Builder to your team without assigning them to an existing project. Previously, the UI required every new Developer or Internal Builder to be given access to at least one existing project before you could add them. That got in the way of a common workflow: bringing someone on specifically to spin up new work, without handing them the keys to projects they don’t need to touch. Because both roles can create their own projects directly, this is often exactly what teams want. Invite a new teammate, let them start building right away, and keep your existing projects untouched. When they create a project, they’re automatically assigned the Developer role on it, so they own the work they start without gaining access to everything else. The result is cleaner, least-privilege onboarding: people get exactly the access they need to begin, and nothing more. To try it, head to your team’s Members page and invite a Developer or Internal Builder without selecting any existing projects. Learn more about managing project access in our project access docs.

Team Owners on Pro plans can now limit Agent Runners spend for individual members in your team, giving you finer control over how AI credits are used across your team. Set a single credit limit that applies to every member, then customize it with overrides for specific people who need more (or less) room to work. This makes it easy to give power users a higher ceiling while keeping predictable, budget-friendly defaults for everyone else. You’ll find these controls in Team Settings under General > AI Enablement. This builds on our existing team-wide AI usage limits, so you can now manage AI spend both for an entire team and down to each individual member. We’ve also updated how AI inference credit usage is displayed in your dashboard, making it easier to monitor AI usage and manage your AI spend. Learn more about AI inference usage and how credits work.

Team Owners on the credit-based Pro plan can now choose how many monthly credits come with their plan, instead of a single fixed amount. Pick the tier that fits your usage, and change it whenever your needs shift. The new credit tiers, with rollover on higher tiers, can be especially helpful for teams with seasonal surges and teams with consistently high-credit usage and come with some per-credit cost savings. What’s changing Previously, every Pro plan included a fixed 3,000 monthly credits for $20/month. New amounts for monthly credits Now you can choose from five tiers: Monthly credits: 3,000 Price: $20/mo Rollover: No Monthly credits: 5,000 Price: $33/mo Rollover: Yes Monthly credits: 10,000 Price: $63/mo Rollover: Yes Monthly credits: 15,000 Price: $95/mo Rollover: Yes Monthly credits: 20,000 Price: $126/mo Rollover: Yes All tiers include the same Pro plan features: unlimited seats, password protection, and everything else that comes with Pro. Rollover credits on higher tiers Choose 5,000 monthly credits or higher and unused credits rollover an additional billing cycle so you get an extra month to use them. The base 3,000-credit tier doesn’t roll over. Change your tier anytime Team Owners can switch tiers without limits to how many times they switch. Upgrades take effect immediately with a prorated refund; downgrades take effect next billing cycle. Learn more about switching between Pro tiers. Learn more

• Pro plan
• How credits work
• Change your pricing plan …

OpenAI’s GPT-5.6 Sol, Luna, and Terra models are now available through Netlify’s AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically. Here’s an example using the GPT-5.6 Sol model: import OpenAI from 'openai'; export default async () => { const openai = new OpenAI(); const response = await openai.responses.create({ model: 'gpt-5.6-sol', input: 'Give a concise explanation of how AI works.', }); return Response.json(response); }; GPT-5.6 Sol, Luna, and Terra are available for all Function types and Agent Runners. You get automatic access to Netlify’s caching, rate limiting, and authentication infrastructure. Learn more in the AI Gateway documentation and Agent Runners documentation.

@netlify/identity 1.1.0 introduces a new verifyRequestOrigin helper to make it easier for developers and AI agents to add CSRF (Cross-Site Request Forgery) protection when running authentication on the server. You can call login(), signup(), or logout() from a Netlify Function or Edge Function to handle authentication entirely on the server. The library reads and writes the nf_jwt and nf_refresh cookies through the Netlify runtime, so the user’s browser receives the session via the response. // netlify/functions/login.ts import { login, verifyRequestOrigin } from '@netlify/identity' import type { Context } from '@netlify/functions' export default async (req: Request, context: Context) => { verifyRequestOrigin(req) const { email, password } = await req.json() await login(email, password) return new Response(null, { status: 302, headers: { Location: '/dashboard' } }) } When login(), signup(), or logout() runs inside an HTTP endpoint that you expose, that endpoint needs Cross-Site Request Forgery (CSRF) protection. Without it, an attacker can trick a victim’s browser into logging into the attacker’s account, then collect anything the victim does inside that session. Call verifyRequestOrigin(request) at the start of the handler. It compares the request’s Origin header against the request’s own origin and throws a 403 on mismatch. If your framework already checks Origin on state-changing requests by default, the call is redundant but harmless. Refer to the @netlify/identity CSRF…

The Netlify CLI now includes a netlify logs command, giving you a powerful and flexible way to access logs for your projects whether you're a developer debugging locally or an AI agent processing structured output. Filter by source Use --source to pull logs from functions, edge functions, deploys, or any combination of them together. Color-coded output makes it easy to tell sources apart at a glance when you're tailing multiple at once. netlify logs CLI showing colour-coded output from functions and edge functions Need to narrow it down further? The --function and --edge-function flags let you filter to a specific function by name, and --url lets you target the exact deploy you want logs from. Historical and real-time views The --since and --until flags let you query logs over any specific time window — useful for tracking down what happened during a past deploy or incident. When you want to watch logs as they come in, --follow streams them in real time. JSON Lines support Pass --json to get structured output in JSON Lines format. This works in both historical and real-time modes, making netlify logs easy to pipe into your own tooling or integrate into automated workflows. netlify logs CLI with --json flag showing JSON Lines output Update to the latest Netlify CLI to start using it: npm install -g netlify-cli@latest Then run netlify logs --help to see all available options.