Pantheon release notes

As part of Pantheon's Long-Term Support (LTS) for Drupal 7, Drupal 7.108 is now available with two security fixes.

• Restored cache hardening: This release restores the DrupalCacheArray::__destruct() hardening from SA-CORE-2024-008 (CVE-2024-55638), which was lost in Drupal 7.103.
• External authentication access bypass: This release fixes an access bypass caused by case-insensitive matching of external authentication names. Drupal now accepts only an exact match for names stored in the authmap table, and refuses new external logins whose name differs from an existing account only by case or trailing spaces.

Action required

Apply the latest upstream update to your Drupal 7 site to receive these fixes. See related documentation for how to apply core updates.

After you apply the update, run database updates in each environment, either from update.php or with Terminus:

This release includes the user_update_7021() database update, which makes the authmap.authname column case-sensitive on MySQL. The update stops without making changes if your authmap table contains names that differ only by case or trailing spaces. If that happens, merge or remove the duplicate entries, then run database updates again.

If your site uses an external authentication module, such as SAML, LDAP, or OpenID, and your identity provider treats names as case-insensitive, confirm that the provider sends names with consistent casing. Otherwise, affected users might see "Unable to log in. Contact the site administrator."

About Drupal 7 long-term support

Pantheon has partnered with Tag1 Consulting to deliver security updates and maintenance for Drupal 7 sites. This extended support is included at no additional cost.

For configuration guidance and detailed information, visit our related documentation.

Version 1.4.3 of the Pantheon Content Publisher WordPress plugin is now available.

What's new?

• Smoother video previews — Embedded videos no longer reload or flicker in the real-time preview every time you make an edit.
• Fresher preview links — Preview links now always show your latest content instead of a cached, out-of-date version.
• More reliable Smart Components — All Smart Components on the page, not just videos, now stay visible in the real-time preview as you keep editing.
• Clearer preview errors — If the real-time preview can't load your latest edits, you'll see a clear error message instead of outdated content.

Update to 1.4.3 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

Terminus 4.3.4 is now available. This release keeps sensitive option values out of request headers and verbose output, fixes dashboard links for multidev environments, and removes a PHP deprecation warning from backup:automatic:info.

Key improvements in this release

• Sensitive values kept out of headers and verbose output: Terminus no longer includes sensitive option values such as --machine-token, or the arguments of remote commands, in the command header it sends to Pantheon or in very-verbose (-vvv) output. (#2929)
• Dashboard links for multidev environments: Dashboard URLs, such as those from dashboard:view, now use the site-redirect route, so links to multidev environments resolve correctly. (#2930)
• Fixed deprecation warning in backup:automatic:info: The command no longer prints a PHP deprecation warning when no automatic backup schedule is set. (#2913)

How to upgrade to Terminus 4.3.4

If you use Homebrew (macOS-only) to manage your Terminus installation, you should upgrade using:

If you installed Terminus directly from the .phar file, you should upgrade using the self:update command:

For more information about this release, visit the GitHub release page.

If you have questions or concerns around Terminus, please use the Terminus issue queue.

The latest security update for Next.js addresses seven vulnerabilities: one high-severity and six medium-severity. Most of them affect applications that use specific features, such as Cache Components, Edge runtime routes, or image optimization.

Action required

Because this is a security update, we recommend that customers update affected Next.js applications as soon as possible. Customers are responsible for updating their application dependencies and redeploying; Pantheon does not update Next.js sites on customers' behalf.

The published Next.js advisories list 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS) as patched versions.

Highlights

This update addresses the following upstream security vulnerabilities. Severity labels are from the Next.js security release announcement.

• High — Cross-tenant cache disclosure with unstable_cache and use cache: In applications with Cache Components enabled, a public use cache function that reads a root parameter, such as a tenant identifier, and is called both directly and from inside unstable_cache can return another request's result during a cold cache fill. See GHSA-mfr8-8qww-v76h.
• Medium — Cross-root-parameter disclosure in nested use cache functions: With Cache Components, an outer cache entry can be stored before an inner function's root-parameter dependencies are recorded, which can disclose tenant-, site-, or locale-specific content. See GHSA-vc7v-qv4w-wrv8.
• Medium — Shared shell cache poisoning in self-hosted applications: Self-hosted applications running next start with Cache Components enabled and Partial Prefetching disabled or unset can have request-specific values stored in a shared fallback shell through a crafted URL. See GHSA-vvgp-ww4w-46vf.
• Medium — Cross-user cache disclosure through binary use cache arguments: Distinct binary arguments can produce the same cache identity, so applications that pass security-significant binary arguments through use cache and share entries across callers are affected. See GHSA-rhh4-g77r-r9qj.
• Medium — Cross-client response injection in self-hosted applications: Applications that return an attacker-controlled fetched Response unchanged can mismatch compressed-response framing, which can be exploited behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection. See GHSA-pc58-hwjq-p385.
• Medium — Cookie exposure through an internal header on Edge routes: App Router Edge Route Handlers and Pages Router Edge API routes that set cookies with NextResponse.cookies.set() expose the serialized cookie, including HttpOnly cookies, in the internal x-middleware-set-cookie response header. Exploitation requires attacker-controlled JavaScript on the same origin. See GHSA-f3mh-rxg3-f5g2.
• Medium — SVG rejection bypass in image optimization: An attacker-controlled image from a permitted source can be misclassified as AVIF, bypassing images.dangerouslyAllowSVG: false when a native image backend that can decode SVG is in use. See GHSA-7qx7-33qx-rqx2.

Next.js 15.5.29 includes fixes for the cross-client response injection, Edge cookie exposure, and SVG rejection bypass issues. Next.js 16.4.5 includes fixes for all seven.

For full technical details and affected configurations, review the linked security advisories and the Next.js security release announcement.

Starting Monday, November 9, 2026, Pantheon is rolling out a change that blocks package installs while a Next.js application is running. Dependencies are still installed during the build as usual. If your application tries to install a package after it starts, the install now fails within seconds, rather than downloading packages inside the running container.

Why we're making this change

During the build, Pantheon installs all of your dependencies, runs your build script, and then removes devDependencies before creating the runtime image.

Next.js versions 15.4 through 16.1 load next.config.ts with the typescript package. If typescript is listed only in devDependencies, it isn't present at runtime, and Next.js tries to install it with your project's package manager each time the application starts. That install can take a minute or more and can exhaust the container's memory. Then the application exits and restarts, and the cycle repeats.

With this change, the runtime install fails immediately. Affected sites still need the fix below to start, but they no longer spend time and memory reinstalling packages on every restart.

Who is affected

Most sites are not affected and need no changes. Your site is affected only if either of these applies:

• It uses Next.js 15.4 through 16.1 and has a next.config.ts file, with typescript listed only in devDependencies.
• It installs packages at runtime in some other way, for example a start script that calls npx for a package that isn't in your dependencies.

Next.js 16.2 and later do not need typescript at runtime to load next.config.ts.

Action required for affected sites

If your application logs Installing TypeScript as it was not found while loading "next.config.ts" during startup, choose one of the following:

• Move typescript from devDependencies to dependencies, and regenerate your lock file by running your package manager's install command (for example, npm install). Commit both package.json and the lock file, because editing the lock file by hand can leave typescript marked as a development dependency.
• Rename next.config.ts to next.config.js (or next.config.mjs) and remove the TypeScript-specific syntax.
• Upgrade to Next.js 16.2 or later.

If your application installs other packages at runtime, add them to dependencies so they are installed during the build.

Rollout timeline

The change begins rolling out on Monday, November 9, 2026. Each environment picks up the change on its next deployment after the rollout reaches your site.

After the change is applied, Pantheon sets the following environment variables in your application container: npm_config_offline, pnpm_config_offline, YARN_ENABLE_NETWORK, and YARN_REGISTRY. These variables do not affect builds.

For more details about how Pantheon builds and runs Next.js sites, see our Next.js documentation and build and runtime architecture.

Should you have any questions or concerns, please reach out to our customer support team via chat or email us at the Pantheon Helpdesk.

Sites on the Next Generation GCDN can now exempt trusted tools from bot protection by their User-Agent, without contacting support.

Bot bypass tokens cover automation you can configure to send a request header. Some tools can't do that: hosted uptime monitors, SEO scanners, accessibility scanners, and partner integrations often let you see or set their User-Agent but not add a custom header.

You can now use Terminus to add up to 8 User-Agent strings to each of your site's domains. Requests whose User-Agent header exactly matches one of a domain's entries skip the standard challenge for automated traffic on that domain. Targeted protections, rate limiting, and the managed WAF still apply to every request.

Key details:

• Entries apply to a single domain. The domain must be a verified custom domain on the Next Generation GCDN, and you must have access to the site to manage its entries. If a tool requests both example.com and www.example.com, add the entry to each. Wildcard domains are not supported. To manage entries, use terminus gcdn:ua-bypass:add, gcdn:ua-bypass:remove and gcdn:ua-bypass:list.

• Matching is exact and case-sensitive against the full User-Agent string, including any version number. If a tool changes its User-Agent, for example after an upgrade, update the entry.

• A User-Agent is not a secret: any client that sends the same string also skips the challenge. Prefer a distinctive string that identifies your tool. Entries that look like a web browser's User-Agent are refused unless you confirm with --allow-browser-ua. If your automation can send a request header, use a bot bypass token instead.

• Changes take effect within a few minutes. Remove entries you no longer need.

Update the plugin with terminus gcdn:update, or install it with terminus self:plugin:install pantheon-systems/terminus-gcdn-plugin.

For setup instructions, see User-Agent Bypass in the Next Generation GCDN guide.

Version 0.9.7 of the Push to Pantheon GitHub Action is now available. This release adds inputs that control what a new Multidev clones from its source environment, and makes the target_env input more forgiving about capitalization.

What's new

• Control what new Multidevs clone: Two new optional inputs, clone_files and clone_database, control what the action copies from source_env when it creates a Multidev. Both default to true, so existing workflows behave as before. Set either to false to skip that content (the action passes --no-files or --no-db to terminus multidev:create). This is useful when a Multidev only needs code, or when cloning a large database or files directory slows down every pull request. The inputs only apply when the action creates the Multidev. They have no effect on a Multidev that already exists. They also don't apply when the action deploys with Terminus Build Tools, which creates the Multidev itself. In that case the action logs a warning if either input is set to false. (#199)
• Uppercase target_env values are lowercased: Pantheon environment names must be lowercase. In 0.9.4 through 0.9.6, a target_env with uppercase letters failed the deployment with a message that the name was not a valid Pantheon environment. The action now lowercases the value and logs a message noting the change. Other naming problems, such as underscores, and reserved names like master, are still rejected. Branch names longer than 11 characters are still truncated to a maximum of 11 characters. (#200)

Example

This workflow step creates new Multidevs with code only, without copying the database or files from the source environment:

How to upgrade to 0.9.7

Update your workflow file to use 0.9.7:

For more information about this release, see the GitHub release page. To learn more about deploying to Pantheon from GitHub, see GitHub Actions.

If you have questions or concerns about the action, ask in Pantheon Community Slack or use the Push to Pantheon issue queue.

Pantheon now provides a Drupal 12 upstream for testing. New sites created from it start on the latest Drupal 12 release, currently 12.0.0-beta2, with PHP 8.5 and MySQL 8.4.

Drupal 12 is still in beta, so use it for testing, not for production sites. Drupal 12 compatibility for Pantheon's modules is in progress. The Drupal core release schedule plans the release candidate (12.0.0-rc1) for the week of November 9, 2026, and the stable release (12.0.0) for the week of December 7, 2026.

Create a Drupal 12 site

Create a site with Terminus:

Drupal 12 does not appear in the dashboard's site creation flow yet, so use Terminus.

Known issue: error after installing

After you install Drupal 12, you may see this error from Drupal core:

If you see it, clear the cache: