F
Add AI Runtime Control requests metric to Historical Stats and Real-Time Analytics APIs
The Historical Stats and Real-Time Analytics APIs now track requests received by AI Runtime Control via the new arc_requests metric.
F
JavaScript SDK 3.46.0
Added CoreCache.transactionLookupAsync (#1591) (8aeb1ac) Fixed Use the correct headers for the beforeSend HTTP cache hook (775c727) Use the correct headers for the beforeSend HTTP cache hook (#1590) (a4d6559)
F
CLI v16.1.0
View this release on GitHub. Enhancements: feat(service/logging): add Log Explorer and Insights commands (#1887) feat(ai-runtime-control): add support for AI Runtime Control (#1901) Dependencies: build(deps): golang.org/x/crypto from 0.54.0 to 0.55.0 (#1888) build(deps): golang.org/x/mod from 0.38.0 to 0.39.0 (#1888) build(deps): github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1888) build(deps…
F
Added virtual patch for CVE-2026-75650 Adobe Commerce and Magento Unauthenticated SSTI (StyleSmuggler)
An unauthenticated Server-Side Template Injection (SSTI) vulnerability leading to remote code execution has been found in Adobe Commerce and Magento and has been assigned CVE-2026-75650. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel Fr…
F
Fastly Terraform Provider (beta) 0.1.3
View this release on GitHub. ENHANCEMENTS: feat(logging_cloudfiles): add support for Cloudfiles Logging (#85) feat(rtsig_key): add fastly_tsig_key resource and fastly_tsig_keys data source (#83) feat(object_storage_access_keys): add resource for managing Fastly object storage access keys (#84) BUG FIXES: fix(logging): reject explicit empty string on defaulted format-like attributes (format, timest…
F
Fastly Terraform Provider (beta) 0.1.2
View this release on GitHub. BUG FIXES: resource/fastly_service_cdn_auto, resource/fastly_service_dynamic_vcl_snippet: add an optional content attribute to dynamic VCL snippet metadata (the dynamic_snippet block, and the standalone resource), seeded into the snippet on creation so a service whose main VCL includes a dynamic snippet can be created in one apply (#78).
F
Fastly Terraform Provider (beta) 0.1.1
View this release on GitHub. BUG FIXES: fix(docs): add a note to the provider index page clarifying that the -beta suffix applies only to the Registry distribution, not to resource or data source type names (#76)
F
Fastly Terraform Provider (beta) 0.1.0
View this release on GitHub. Initial beta release. Introduces the rewrite of the Fastly Terraform provider on the Plugin Framework, including: Automatic (_auto) service resources: nested config blocks with provider-managed version lifecycle (auto-clone, validate, activate on every CRUD). Service building blocks: domain, backend, ACL + ACL entries, config store + items, secret store, dictionary ite…
F
JavaScript SDK 3.45.1
Fixed Close cache transaction if getOrSet handler throws (#1586) (5e7fc87) Commit cache transaction in SimpleCache.getOrSet (#1581) (7789f23)
F
JavaScript SDK 3.45.0
Added Add clientSNI to FetchEvent.client (#1569) (9a85f2a) Fixed add test to verify includeBytes sandboxing (#1559) (8585d3a) Avoid arithmetic overflow in content_stream_read_then_handler (#1570) (b390de4) Avoid crashes if KV store list hostcall returns unexpected data (#1563) (e2e4c8b) Check for presence of environment variables before checking their values (#1555) (0e1779b) Cloning requests that…
F
Go SDK 1.10.0
fsthttp: add ComplianceRegion and RawHeaders to FastlyMeta fsthttp: fix reusing body and response handles with StatusEarlyHints internal: clean up abi type definitions fsthttp: export SendErrorDetailTag integration_tests: remove extra http requests from tests shielding: add first byte and between bytes timeouts fsthttp: add support for dynamic backend healthchecks Makefile,tools.mod: tooling upgra…
F
Added virtual patch for CVE-2026-82329 (Artifactory Authentication Bypass)
An authentication bypass vulnerability that can lead to administrative access has been found in Artifactory and has been assigned CVE-2026-82329. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel From the Rules menu, select Templated Rules…
F
Add Image Optimizer Input and Output metrics
Real-time analytics and historical stats responses now include the following new metrics: imgopto_input_image_bytes and imgopto_output_image_bytes.
F
Correct documented filter values for Next-Gen WAF account rules
The Account rules endpoints previously documented action and types list-filter values that account-level rules do not support. Account rules support only the request and signal rule types, with actions allow, block, and add_signal (request rules) or exclude_signal (signal rules). Challenge and deception actions and rate limit rules are available on workspace rules only.
F
Add status 499 metric to Historical Stats, Real-Time Analytics, and Domain Inspector APIs
The Historical Stats API, Real-Time Analytics API, Domain Inspector Historical API, and Domain Inspector Real-Time API now track client disconnects from Varnish services via the new status_499 metric.
F
Added virtual patch for CVE-2026-75604 (Next.js Windows Cache Traversal RCE)
A directory traversal vulnerability that can enable remote code execution (RCE) has been found in Next.js and has been assigned CVE-2026-75604. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel From the Rules menu, select Templated Rules.…
F
Rust SDK 0.13.1
Add a Request::as_handles method. Add cache lookup timeout Add from_handle functions for ConfigStore, SecretStore, and Log. Add ToBackend implementation for Arc<Backend>. Add BotCategory::Headless to list of known bot categories Fix clearing of override_cache_key before using it. Return descriptive error when Fanout is not enabled Respect cache lookup timeout for HTTP guest caching. Experimental s…
F
Add headless bot metric to Historical Stats and Real-Time Analytics APIs
The Historical Stats API and the Real-Time Analytics API now track edge requests from headless bots via the new bot_edge_requests_headless_count metric.
F
Next-Gen WAF agent 4.81.0
Upgraded to Golang 1.26.6 Updated base GeoIP data: August 2026
F
CLI v16.0.0
View this release on GitHub. Bug Fixes: fix(compute): Add bounds checking around starter kit selection to avoid a panic and provide a more useful error message (#1879) Enhancements: feat(compute/init): Offer all available starter kits for each language. (#1846) Dependencies: build(deps): github.com/klauspost/compress from 1.19.1 to 1.19.2 (#1881) build(deps): github.com/pierrec/lz4/v4 from 4.1.27…
F
Add Private Access Token (PAT) challenge metrics to Historical Stats and Real-Time Analytics APIs
The Historical Stats API and the Real-Time Analytics API now support two new metrics for troubleshooting Private Access Token (PAT) challenges. These track the number of issued and successful PAT challenges.
F
Fastly Terraform Provider 9.6.0
View this release on GitHub. ENHANCEMENTS: feat(fastly_audit_log_event_mapping): add resource and data source for managing Audit Log Event Mappings (#1394) BUG FIXES: fix(ngwaf/rules): corrects a bug where rules with a deception action had their deception_type and allow_interactive fields omitted from update operations, causing an error on subsequent applies (#1396) Dependencies build(deps): githu…
F
Go SDK 1.9.0
fsthttp: add Headless bot type fsthttp: make fsthttp.Transport (net/http adapter) goroutine-safe fsthttp: improve error messages when fanout is not enabled all: improve error handling in examples and tests
F
Fastly Terraform Provider 9.5.1
View this release on GitHub. BUG FIXES: fix(service_compute): process healthcheck blocks before backend blocks so backends referencing a healthcheck created in the same apply do not fail with No healthcheck named '<name>' (#1384) fix(service_vcl): process dictionary and response_object blocks before rate_limiter blocks so a rate limiter referencing a dictionary or response object created in the sa…
F
CLI v15.6.0
View this release on GitHub. Bug Fixes: fix(compute): add Python starter kit to the static config (#1877) Enhancements: feat(audit-log): add event-mapping command group (#1875) Dependencies: build(deps): github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 (#1871)
F
Next-Gen WAF: `created_by` field now included in rules and signals
The Next-Gen WAF Rules and Next-Gen WAF Signals APIs now include a created_by field in responses, identifying the email of the user who created the rule or signal.
F
Next-Gen WAF: Error responses now documented for all endpoints
Several Next-Gen WAF API endpoints were missing documentation for error response codes they can return. Endpoints across Agents, Agent Keys, Custom Dashboards, Events, Lists, Rate Limited Sources, Redactions, Reports, Requests, Rules, Signals, Simulate, Thresholds, Timeseries, Virtual Patches, Workspace Alerts, and Workspaces now document the full set of error responses they can return.
F
Fastly Terraform Provider 9.5.0
View this release on GitHub. ENHANCEMENTS: feat(fastly_integration): add support for datadog, jiraissue, jsm, opsgenie, and splunkoncall integration types (#1374) BUG FIXES: fix(service): update versionless name and comment attributes regardless of activate and stage settings (#1369) Dependencies build(deps): google.golang.org/grpc from 1.79.3 to 1.82.1 (#1360) build(deps): github.com/fastly/go-fa…
F
CLI v15.5.0
View this release on GitHub. Bug Fixes: fix(service-version): support autoclone when staging a service version. (#1850) fix(logging): the placement flag for all loggging commands can now be reset back to null by setting it's value to "" when it was previously set to another value (#1855) fix(profile): profiles can now be created and updated with service-limited tokens, which cannot access /current…
F
JavaScript SDK 3.44.3
Fixed Disallow accessing HTML rewriter elements outside of handlers (#1541) (bf4ac3d) dynamic backends disabled exception (#1535) (432d059) Make headers of cloned requests independent (#1539) (9b34c43) Memory leak in Backend::health_for_name (#1542) (43e03d2) Memory leak in Device::lookup (#1543) (2f02080) URLSearchParams premature free (#1538) (da5146c)