Minor Changes #14471 f03b108 Thanks @DiogoSantoss ! - Apply Email Routing addresses during Worker trigger deployment Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy , wrangler triggers deploy , and clients of @cloudflare/deploy-helpers . After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone ( + added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules. #14679 deae171 Thanks @dario-piotrowicz ! - Add exclude_packages option to dependencies_instrumentation configuration The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads. // wrangler.json { "dependencies_instrumentation" : { "exclude_packages" : [ " @internal/* " , " secret-tool " ] } } #14721 4e92e32 Thanks @dmmulroy ! - Support Artifacts sources when creating Queue event subscriptions wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API. #13352 d1d6945 Thanks @penalosa ! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled. #14688 a0c8bb1 Thanks @NuroDev ! - Print Local Explorer API details for headless agent-driven wrangler dev sessions When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI. #14724 a50f73a Thanks @jamesopstad ! - Add a settings export to the experimental cloudflare.config.ts config Account-level settings ( accountId , complianceRegion ) now live in a dedicated, named settings export authored via defineSettings , rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export. // cloudflare.config.ts import { defineSettings , defineWorker } from "wrangler/experimental-config" ; import * as entrypoint from "./src/index.ts" with { type : "cf-worker" } ; export const settings = defineSettings ( { accountId : "<your-account-id>" , } ) ; export default defineWorker ( { name : "my-worker" , entrypoint , compatibilityDate : "2026-05-18" , } ) ; This is only used behind the experimental new-config path ( wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option). #14595 2b390d7 Thanks @colinhacks ! - Recognise nub as a package manager wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock , alongside npm, pnpm, yarn, and bun. #14742 34430b3 Thanks @pombosilva ! - Add support for redacting sensitive Workflows step output in local dev. Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted. Patch Changes #14715 42af66d Thanks @dependabot ! - Update dependencies of "miniflare", "wrangler" The following dependency versions have been updated: Dependency From To @cloudflare/workers-types ^5.20260714.1 ^5.20260721.1 workerd 1.20260714.1 1.20260721.1 #14744 a0a091b Thanks @penalosa ! - Drop the "Experimental:" prefix from the resource provisioning header now that automatic provisioning is generally available. The deploy output now reads The following bindings need to be provisioned: . #14720 0df3d43 Thanks @penalosa ! - Fix remote binding previews for accounts without a workers.dev subdomain Wrangler now automatically registers a workers.dev subdomain when one is required to start a remote binding preview. #14773 d83a476 Thanks @chinesepowered ! - Fix stray characters in the Workers Sites asset-key-too-long error The error thrown when an asset path key exceeds the 512-character limit ended with a stray ", copy-paste artifact, so the message printed to users terminated with ...#kv-limits", and the trailing documentation URL was malformed. The message now ends cleanly at the URL. #14766 4815711 Thanks @gianghungtien ! - Report the Worker's error for HEAD requests instead of an internal JSON parse error A Worker that threw on a HEAD request (for example curl -I ) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it. The error is now also carried in a header, which survives HEAD , so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure. #14448 c82d96b Thanks @GregBrimble ! - Use the new PATCH APIs for versioned secret commands Wrangler now updates versioned Worker secrets by patching the latest Worker version instead of downloading the latest version contents and uploading a full replacement version. This avoids reconstructing Worker configuration in Wrangler, which should reduce bugs when Workers use less common features. For example, this avoids regressions like the previous placement preservation bug fixed in #13843 . #14617 f75ae5d Thanks @martijnwalraven ! - Derive nodejsCompatMode from the effective compatibility inputs in unstable_startWorker() The CLI computes the node-compat mode from the effective compatibility date and flags ( args.* ?? parsedConfig.* ), but the programmatic path used input.build.nodejsCompatMode raw — leaving it unset meant a worker's nodejs_compat flag (from its config file or from input-level compatibilityFlags ) was silently ignored, so bundling failed to resolve node builtins that wrangler dev handles. startWorker now derives the mode the same way when the caller does not provide one: input-level compatibilityDate / compatibilityFlags first, then the resolved config, with no-bundle taken from the resolved build.bundle semantics. Passing an explicit null still disables it. Updated dependencies [ 42af66d , 4815711 , 34430b3 ]: miniflare@4.20260721.0
A field experiment with 1,559 Pakistani judges found that the AI assistant JudgeGPT boosted case resolution by 6.3 percent. The catch: only judges who got hands-on training saw gains. Without it, the effect mostly disappeared. The researchers estimate a return of up to $38.50 per dollar invested. The article An AI system helped Pakistani judges clear massive backlogs at $38.50 return per dollar invested appeared first on The Decoder .
Haroon Meer is back! Haroon is the Founder of Thinkst, the ~50-person bootstrapped company behind Canary and Canarytokens — honeypots and tripwires you sprinkle inside your network and forget about until an attacker touches one. We talk about the AWS API key token attackers just can't resist trying, the real credit card token backed by an actual bank partnership, Breadcrumbs (their brand-new feature that leads intruders straight to your canaries), a live demo where a hardware Canary becomes a Synology NAS in one click, and how a company with zero outbound sales and no price increase in ten years quietly passed $22.5 million in ARR.
As Iranian attacks intensify, Jordan is emerging as the latest frontline state in the widening Middle East conflict. Why is the Hashemite Kingdom a target for Tehran?
Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a year, when it was disclosed to the company by Tyler Murphy, co-founder of EasyOptOuts. Hide My Email
Example Changes fix: error handling and loading states in with-apollo-and-redux example: #91457 Misc Changes Upgrade React from 172742b4-20260716 to 81e442ea-20260721 : #96016 Fix Turbopack middleware matcher with i18n single locale: #96014 Improve performance of validating MPA form submissions: #96013 Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime: #96012 Set correct origin for internal redirects in custom server: #96011 Ensure exotic rewrite param values are properly encoded: #96010 fix(fetch-cache): key fetch(Request, init) by the effective request: #96009 fix(incremental-cache): byte-exact fetch cache key for binary bodies: #96008 Validate server reference IDs during manifest lookup: #96007 fix(next/image): improve performance of detectContentType() : #96006 Preserve basePath in redirect destinations: #95608 [ci] Skip passed-tests cache steps for jobs that never run tests: #96001 docs: add upgrade section to installation and expand AI agents guide: #95861 docs: fix unstable_cache syntax error: #96002 Insights: use a single Learn more link in console errors: #95967 Refine development validation signal handling: #95998 Include examples of static export tools & GitHub Pages template: #95929 docs: note the :has() scaling limit in the Interactive apps guide: #95925 Prevent unhandled rejections when a "use cache" cache handler errors: #95985 [test] Add coverage for throwing custom "use cache" cache handler: #95984 docs: clarify layout.js nesting behavior in route groups: #95720 Fix instant validation blocking navigations: #95939 [ci] Share a single browser instance across all test suites in a single job: #95589 [turbopack] Rename turbopackTreeShaking to turbopackModuleFragments : #95978 cna: use LayoutProps helper in TS layout templates: #95675 [turbopack] Skip redundant top-level root updates: #95903 [turbopack] Drop unused exports from a CJS module: #95716 Turbopack: Simplify parent directory creation retry loop logic: #95835 Run Rust doctests in CI: #95911 docs: add 'Set up your editor' to the installation guide: #95928 fix(cms-contentful): await draftMode() and use Promise<> params type: #95631 Move outputHashSalt out of experimental: #95840 Move immutable static assets config option out of experimental: #95351 [instant] Let dev-server requests bypass the fetch lock: #95761 Upgrade React from 7023f501-20260714 to 172742b4-20260716 : #95901 Fix Rust doctest failures: #95909 [turbopack] Clean up server_chunking_context : #95908 [turbopack] Don't SSR on pages only navigated to through a soft nav: #95539 Package skills/ as a Claude Code plugin: #95907 [ci] Avoid apt-get in the next-stats-action Docker image: #95847 Back/forward set the Nav Inspector back to pending: #95865 fix(agent-rules): pad managed AGENTS.md block with blank lines: #95892 Revert "Run more test suites under cacheComponents flag": #95884 Fix repeated navigations while the Instant Navigation lock is held: #95864 Run more test suites under cacheComponents flag: #95878 Unify appShells flag with Partial Prefetching: #95415 Fix Request Insights span collection: #95818 Revert "Replay same-document traversals that happen before hydration": #95853 [ci] Allow running all deploy tests with builds from a private registry: #95784 [turbopack] Only ship pages-router routes in the client chunk-group bootstrap manifest: #94671 [turbopack] Inline the chunk group bootstrap in Next.js to drop the per-route runtime: #94666 [turbopack] Add chunk_group_bootstrap_params and the chunk-loading global to the build manifest: #94663 [turbopack] Add registerEntry() to handle inline bootstrapping: #94664 [turbopack] Add inline_chunk_group_bootstrap to BrowserChunkingContext and chunk_group_bootstrap_params to ChunkGroupResult : #94661 [turbopack] Create a chunk_group_bootstrap_params() function: #94631 [turbopack] Create a shared asset with browser runtime code: #94586 Turbopack: trace externals imported only by server actions: #95824 [turbopack] Generate component chunks for each merged group to increase cache hits: #95261 Exclude stale under 5 minutes from app shells: #95833 docs: remove experimental @next/routing note: #94903 [turbopack] Tell agents not to mention next.config.js options: #95825 chore: Remove stale build warning: #95813 Replay same-document traversals that happen before hydration: #95682 docs: cssChunking graph option: #95693 [Bench] Extend bench app to have realistic client chunk counts: #95814 Add more realistic bench fixtures: #95807 Fix Request Insights subscription initialization: #95794 Model async userland loading in app routes as a state machine: #95791 Preserve init errors from async route modules: #95799 Fix cache warming and static params for metadata images with top-level await: #95790 Only track pending imports for real promises: #95789 Support metadata routes in --debug-build-paths: #95788 Respect NEXT_HASH_SALT for server side assetsHashes: #95738 telemetry: add agentName to anonymous metadata: #95586 [turbopack] Optimize the implementation of AutoMap/AutoSet : #95694 Better support the CLI spinner when running the TSC CLI: #95753 Upgrade React from 5123b063-20260708 to 7023f501-20260714 : #95782 docs: add route-side URL data audit to the Partial Prefetching adoption guide: #95389 docs: revalidateTag with expire zero, for route handlers: #95760 request insights: add DevTools request panel (5/5): #93978 docs: Improve immutable static docs: #95752 Add React sync development skill: #95620 docs: useSearchParams example stray link: #95759 Improve the NFT error message and ignore comment handling: #95144 Upgrade to swc 73: #95731 [turbopack] Switch make_production_chunks to use floats: #95749 Fix termination handling: #95692 Restore canary version 16.3.0-canary.84 after v16.3.0-preview.6 preview release Credits Huge thanks to @vercel-release-bot , @eps1lon , @ZaforAbdullah , @gaojude , @aurorascharff , @icyJoseph , @timneutkens , @WildChargerTV , @ankurdotio , @bgw , @sampoder , @marcoshernanz , @manoraj , @mischnic , @acdlite , @gaearon , @gnoff , @andrewimm , @lukesandberg , and @feedthejim for helping!
New executive order calls for end-to-end visibility into defense supply chains, including software dependencies, foreign ownership and cyber-related supplier risks. The post Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains appeared first on SecurityWeek .
I am a very clumsy man. So clumsy, that I have AirTags hanging off practically every camera I own. Have I left my camera in an Uber? Yes. Have I left it on an airplane? Also yes. For me, finder tags are essential for my cameras. The problem is, strapping a finder tag to a […]
The row over the sacking of the popular defence minister, Mykhailo Fedorov, highlights questions about the country’s military and political direction Even as Ukraine’s civilians endure brutal strikes by Russia , thousands have taken to the streets to protest against Volodymyr Zelenskyy’s sacking of Mykhailo Fedorov , the popular young defence minister, last week after he clashed with the commander-in-chief, Oleksandr Syrskyi. On Tuesday night, demonstrators’ calls were answered as the Ukrainian president fired the general and offered Mr Fedorov a “prominent” role and promised an overhaul of the army command. Mr Fedorov, widely credited for significant improvements in the country’s military performance and reducing corruption, had made a scathing attack on Gen Syrskyi after his dismissal – accusing him of blocking reforms and refusing to cooperate. The general seems to have seen the minister as exceeding his remit and effectively taking control of units. The pair also butted heads over Mr Fedorov’s plans to improve recruitment and training to reduce the deep anger created by the conscription system . A Soviet-schooled military officer deeply embedded within institutions tussled with a young civilian disruptor taking a more agile, improvisational approach. Continue reading...
Germany's Criminal Police Office has reported over 17,000 cases of sexual violence against children in the past year. Organizations such as Zartbitter provide support to victims.
The open-weight Antares models are designed to pinpoint known vulnerabilities in codebases faster and at a fraction of the cost of larger AI models. The post Cisco Launches Low-Cost AI Models for Source Code Security appeared first on SecurityWeek .