Pantheon release notes

Starting September 10, 2026, new sites created on Pantheon are provisioned on the next-generation Global CDN, powered by Cloudflare, instead of the legacy Global CDN.

This change applies to newly created sites only. Existing sites are not affected and remain eligible for migration through the normal migration path.

No action is required: the next-generation GCDN is provisioned automatically at site creation.

Advanced Global CDN (AGCDN) customers are not affected by this change. If you have any questions, contact Pantheon Support.

Sites on the Next Generation GCDN can now exempt their own trusted automation from bot protection, without contacting support.

Bot protection on the Next Generation GCDN automatically challenges traffic that looks automated. That is the right default for scrapers and attack tools, but it can also challenge automation you rely on: uptime monitors, CI/CD pipelines, feed importers, and custom API clients that are not on the verified bot list.

You can now generate a bot bypass token for your site using Terminus and configure your automation to send it in the x-pantheon-bot-bypass request header. Requests carrying a valid token skip the standard challenge applied to automated traffic; targeted protections, rate limiting, and the managed WAF still apply to every request.

Key details:

• Tokens are scoped to a single site (all environments) and valid for 6 months. The command returns a current token and a next token that becomes valid 3 months later; both are accepted during the overlap. Send the current token now, switch to the next token on or after its start date, and re-run the command each quarter to pick up the following pair.
• Treat the token like a credential. Send it only from trusted servers and services, and never expose it in client-side code. If a token is leaked, contact Pantheon support to revoke it; a replacement token becomes available at the start of the following month.
• Requests without the header are evaluated by bot protection as usual. Requests with an incorrect token are rejected with a 403, so check the header value first if your automation starts failing.

See Bot Bypass Tokens in the Next Generation GCDN guide for setup instructions.

Version 0.9.5 of the 'Push to Pantheon' GitHub Action is now available. This release changes how the action handles a push that has no Pantheon environment to deploy to, and corrects the documentation for the target_env and target_env_strategy inputs.

What's new

A Multidev comes from a pull request. A push to any other branch has nothing to derive an environment name from.

In 0.9.4 the action treated that as an error and failed the job, so adding the action to a workflow that runs on every push would fail on a feature branch with no PR. In 0.9.5 the action skips the remaining steps and the job succeeds, and the step log records why the deployment was skipped.

A misconfiguration still fails the job: a target_env value Pantheon will not accept, an unrecognized target_env_strategy, or the branch strategy with no branch to read.

If you want pushes to other branches to deploy, set target_env_strategy: branch to deploy to a Multidev named after the branch, or set target_env explicitly. (#188)

How to upgrade to 0.9.5

Update your workflow file to use 0.9.5:

For more information about this release, see the GitHub release page. To learn more about deploying to Pantheon from GitHub, see GitHub Actions.

If you have questions or concerns about the action, please use the Push to Pantheon issue queue.

Pantheon's GitLab support for external repositories is now generally available to everyone directly from the Pantheon Dashboard, alongside GitHub and Pantheon-hosted Git.

What's new

• Dashboard support — When creating a new site, choose GitLab as your code host right alongside GitHub and Pantheon's integrated Git repository — no Terminus required.
• Self-hosted GitLab — Connect to GitLab.com or your own self-hosted GitLab instance.
• Token-based authentication — Authenticate using a personal access token or group access token with api and write_repository scopes.

Where to find it

During site creation, select GitLab on the Where will your code be hosted? screen to connect your repository.

For full setup instructions, see the related documentation.

Pantheon MU-Plugin 1.5.7 adds dismiss and hide controls for the Pantheon WordPress core update notice ("A new WordPress update is available!"). Apply upstream updates to get this version of the mu-plugin.

Dismiss the notice

Any user who sees the notice can dismiss it with the X in the corner. The dismissal is saved per user, so it persists across page loads and logins. The notice reappears only when a newer WordPress version becomes available.

Hide the notice

To hide the notice more permanently, or for everyone, you can:

• Target #pantheon-update-notice (or the .pantheon-update-notice class) with CSS.
• Return false from the pantheon_show_update_notice filter.
• Define the PANTHEON_SHOW_UPDATE_NOTICE constant as false in wp-config.php.

For details, see Suppress WordPress Admin Notice.

What's new

You can now choose how the Pantheon Dashboard looks. Alongside the classic Light appearance, the Dashboard supports a full Dark mode, plus a System option that automatically follows your device or browser's own light/dark setting.

Pick your preference from the Theme control in your User Menu:

• Light — the classic Dashboard appearance (default)
• Dark — a full dark color scheme across the Dashboard
• System — automatically matches your OS or browser's current preference, and updates live if that setting changes

Your choice is saved to your account, so it follows you across devices and browsers — no need to set it again each time you log in somewhere new. If you haven't set a preference, the Dashboard defaults to Light.

Why it matters

Dark mode reduces eye strain in low-light environments, can save battery on some devices, and matches how many people prefer to work. If that preference is already set at the OS level, System mode picks it up automatically — no extra effort required.

Where to find it

Look for the Theme option in your User Menu at the top of the Dashboard. For more details, see related documentation.

You can now update the credentials for a Custom Upstream directly from the Pantheon Dashboard — no support ticket or new upstream required. Previously, changing a private repository's access token meant either creating a new Custom Upstream and switching each site over to it, or contacting Pantheon Support.

What's new

• The upstream Settings page now has a Repository credentials section that shows whether credentials are set and lets you update them — a GitHub personal access token or a Bitbucket repository access token.
• The stored credential is masked and never displayed back in the Dashboard.

Changing the repository URL still requires creating a new Custom Upstream.

For steps, see Edit an Existing Custom Upstream.

As of today, an increasing percentage of newly created sites on Pantheon will use a filesystem backed by Cloud Storage FUSE for their uploaded files (wp-content/uploads for WordPress and sites/default/files for Drupal). This filesystem replaces the "Valhalla" system Pantheon pioneered for sharing files across horizontally scalable PHP containers.

Existing sites will migrate to this new filesystem over the remainder of 2026 starting on 09/01/26.

With this change, we can create and restore backups faster and more reliably.

Background

Both WordPress and Drupal were originally architected in the early 2000s for systems where developer-controlled application files (.php, .css, .js, etc.) and files uploaded by CMS users (images, PDFs, etc.) would live on the same server. By default, both CMSes will write uploaded files to the local file system. Those defaults break down when the application files are horizontally scaled across multiple servers or containers which need to share access to an ever-changing set of uploaded files. To solve this challenge at Pantheon's founding we created a scalable filesystem (Valhalla) that mounted across containers which allows sites to behave as though they are writing to a local disc while those files are actually shared across containers. Additionally, this approach allows for the wide variance in the amount of files uploaded to WordPress or Drupal, with some sites writing millions of files.

While Valhalla was an innovative solution at Pantheon's founding, it has since been surpassed in performance by solutions like Cloud Storage FUSE. Thanks to our partnership with Google Cloud, we can deprecate Valhalla in favor of a more robust filesystem.

Rollout Timeline

New Sites: New sites will begin to be provisioned using the new filesystem on 8/3, ramping up to 100% of new sites being provisioned using the new filesystem by 8/17. There is no additional action you need to take.

Existing Sites: Existing site migrations will begin 9/1/2026. Rollout timeline:

• Free sites: September 1, 2026
• Basic sites: October 5, 2026
• Performance sites: November 16, 2026
• Elite sites: November 30, 2026

How to determine which Filesystem your site is using

In Site details, there is a Filesystem Generation field. Sites that are on the new filesystem will have a “2” in this field.

For more information, see our documentation. Should you have any questions or concerns, please reach out to our customer support team via chat or email us at the Pantheon Helpdesk.