Pantheon release notes

Version 0.9.7 of the Push to Pantheon GitHub Action is now available. This release adds inputs that control what a new Multidev clones from its source environment, and makes the target_env input more forgiving about capitalization.

What's new

• Control what new Multidevs clone: Two new optional inputs, clone_files and clone_database, control what the action copies from source_env when it creates a Multidev. Both default to true, so existing workflows behave as before. Set either to false to skip that content (the action passes --no-files or --no-db to terminus multidev:create). This is useful when a Multidev only needs code, or when cloning a large database or files directory slows down every pull request. The inputs only apply when the action creates the Multidev. They have no effect on a Multidev that already exists. They also don't apply when the action deploys with Terminus Build Tools, which creates the Multidev itself. In that case the action logs a warning if either input is set to false. (#199)
• Uppercase target_env values are lowercased: Pantheon environment names must be lowercase. In 0.9.4 through 0.9.6, a target_env with uppercase letters failed the deployment with a message that the name was not a valid Pantheon environment. The action now lowercases the value and logs a message noting the change. Other naming problems, such as underscores, and reserved names like master, are still rejected. Branch names longer than 11 characters are still truncated to a maximum of 11 characters. (#200)

Example

This workflow step creates new Multidevs with code only, without copying the database or files from the source environment:

How to upgrade to 0.9.7

Update your workflow file to use 0.9.7:

For more information about this release, see the GitHub release page. To learn more about deploying to Pantheon from GitHub, see GitHub Actions.

If you have questions or concerns about the action, ask in Pantheon Community Slack or use the Push to Pantheon issue queue.

Pantheon now provides a Drupal 12 upstream for testing. New sites created from it start on the latest Drupal 12 release, currently 12.0.0-beta2, with PHP 8.5 and MySQL 8.4.

Drupal 12 is still in beta, so use it for testing, not for production sites. Drupal 12 compatibility for Pantheon's modules is in progress. The Drupal core release schedule plans the release candidate (12.0.0-rc1) for the week of November 9, 2026, and the stable release (12.0.0) for the week of December 7, 2026.

Create a Drupal 12 site

Create a site with Terminus:

Drupal 12 does not appear in the dashboard's site creation flow yet, so use Terminus.

Known issue: error after installing

After you install Drupal 12, you may see this error from Drupal core:

If you see it, clear the cache:

The latest security release for WordPress, 7.1.4, is available on Pantheon.

Action required

Because this is a security update, we recommend all users upgrade to WordPress 7.1.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Pantheon has deployed platform-wide mitigations against external abuse of some of the vulnerabilities fixed in this release, and is actively monitoring those rules. However, customers need to update their sites as soon as possible.

Highlights

This release resolves 13 security issues:

• A remote code execution weakness in the upgrade process.
• Stored XSS via specially crafted block markup.
• Stored XSS in privacy data removal requests.
• Multiple stored XSS issues in the Interactivity API.
• A stored denial of service in the Interactivity API.
• Stored XSS in Customizer selective refresh.
• Stored XSS in the Categories block.
• Stored XSS in user login fields.
• Unauthenticated disclosure of unpublished Customizer changesets.
• Stored XSS in the Playlist and Image blocks.
• Stored XSS in the Comments pagination blocks.
• Notes readable by unauthorized privileged users, allowing privilege escalation.

This release also updates the bundled certificates to account for the revocation of an eMudhra root certificate.

For full details, see the WordPress 7.1.4 release announcement.

Pantheon has updated the default PHP version for the Drupal 7 upstream to PHP 8.3, replacing the previous default of PHP 8.2.

New Drupal 7 sites created from Pantheon's upstream use PHP 8.3. Existing Drupal 7 sites that do not set php_version in their own pantheon.yml move to PHP 8.3 when they apply this upstream update.

Action required

Test the update before you deploy it to the Live environment. Apply it in Dev or a Multidev environment, confirm your modules and theme work on PHP 8.3, then promote it.

If your Drupal 7 site needs to stay on PHP 8.2, pin the version by setting php_version: 8.2 in your site's pantheon.yml before you apply the update. For steps, see Manage PHP Versions.

If you maintain a custom upstream, this change is not reflected in your pantheon.upstream.yml unless you update your fork from Pantheon's upstream.

Pantheon will move all sites to the next-generation Global CDN, powered by Cloudflare. Upgrade your sites by March 31, 2027. Pantheon will migrate sites that you haven't self-upgraded by then, beginning in April 2027. Pantheon shares this early to give you time for this migration alongside other platform updates.

What you get

The next-generation Global CDN includes bot protection, on by default at no additional cost. Bot protection scores incoming traffic, challenges suspicious requests, and lets verified bots, such as search engine crawlers, through. The next-generation Global CDN also supports Multizone Failover, custom certificates, and platform vanity domains. Also new with the upgrade are Edge Traffic Visibility and Workspace Performance Insights.

Action required

Upgrade each site by March 31, 2027. Find the GCDN banner on the Site Dashboard and follow the migration instructions.

If your site uses a custom SSL certificate or a vanity domain, contact Support for assistance:

• For custom SSL certificates, Pantheon re-uploads your certificate to the new CDN before your domains move over.
• For vanity domains, Pantheon works with you to update your vanity domain's DNS during the migration.

Exceptions

This applies to every Pantheon site, with two exceptions:

1. Sites already on the next-generation Global CDN, including all sites created on or after September 10, 2026. Sites that still need to migrate show a GCDN banner on the Site Dashboard.
2. Sites that use Advanced Global CDN (AGCDN). Don't upgrade these yourself. Pantheon will contact you by December 15, 2026 to coordinate the migration. Wait for Pantheon's guidance before you take action. See the latest AGCDN migration release note for details.

If you don't take action

Pantheon will automatically migrate sandbox sites to the next-generation Global CDN by the end of 2026.

After the March 31, 2027 deadline, Pantheon will migrate any remaining sites. Pantheon will notify you at least 60 days before the scheduled migration. Upgrading yourself lets you choose when the change happens.

Need help?

• Review the next-generation Global CDN setup guide.
• Contact your Pantheon Customer Success Manager or account team.
• Open a support ticket from the Site Dashboard.

Editor's note (October 29, 2026): This release note was updated to add Edge Traffic Visibility and Workspace Performance Insights to the "What you get" section.

Moving forward, all Pantheon sites must be owned by a Professional Workspace. My Dashboard is not going away, but sites currently owned by an individual account must be moved. You can move your sites yourself now, before Pantheon begins migrating remaining sites in January 2027.

What you need to do

1. From My Dashboard, go to Sites and select the sites you want to transfer.
2. Select Move to workspace.
3. Choose the destination Professional Workspace and confirm the move.

The migration starts immediately, and you can move multiple sites at once. The migration will not affect your site's uptime or other site functionality; the primary change is where it appears in the Pantheon Dashboard.

Important

Self-service migration supports only unpaid Professional Workspaces. To move a site to a paid Professional Workspace, contact Pantheon Support.

Unpaid sites moved into an unpaid Professional Workspace will be subject to Pantheon's 30-day trial beginning in January 2027. Existing customers with active paid workspaces are not affected. Learn more about the 30-day trial.

If you don't take action

Starting in January 2027, Pantheon will automatically migrate sites still in My Dashboard into a system-generated Professional Workspace. Pantheon will notify you at least 30 days before migrating any of your sites.

The migration will not affect your site's uptime or other site functionality, but Pantheon will choose the destination workspace and its organization for you.

The latest security update for Next.js addresses three vulnerabilities in upstream dependencies: two critical vulnerabilities and one high-severity vulnerability.

Action required

Because this is a security update, we recommend that customers update affected Next.js applications as soon as possible. Customers are responsible for updating their application dependencies and redeploying; Pantheon does not update Next.js sites on customers' behalf.

The published Next.js advisory lists 16.4.1 and 15.5.28 as patched versions.

If your application directly manages React Server Components packages, update them to the patched versions listed in the React advisories: 19.0.9, 19.1.10, 19.2.9, or 19.3.1, as applicable.

Highlights

This update addresses three upstream security vulnerabilities:

• Critical — Remote code execution in image processing: A vulnerability in the upstream image-processing stack can lead to remote code execution when Next.js processes SVG files on glibc-based Linux systems. The advisory identifies Next.js 15.5.28 and 16.4.1 as patched versions. As a workaround, use Sharp 0.35.5 or later. See GHSA-2464-fhr4-w9xw.
• Critical — React Flight remote code execution: Crafted React Server Component payloads can lead to remote code execution in rare cases involving multiple typed arrays and attacker-controlled values. See GHSA-xqc2-xf4c-x3h3.
• High — Denial of service through Server Functions: Crafted requests to Server Function endpoints can cause excessive CPU use or out-of-memory exceptions. Applications that do not use server-side React or a framework that supports React Server Components are not affected. See GHSA-h3gv-c5rc-p453.

For full technical details and affected package versions, review the linked security advisories.

Pantheon is continuing the phased migration of Advanced Global CDN (AGCDN) to our next-generation edge platform. Starting October 15, 2026, AGCDN customers who use rate limiting or geolocation, and whose current configuration is fully supported in Phase 2, are eligible to migrate. Pantheon will contact eligible customers directly.

What's included

Phase 2 adds two features that you configure yourself in a pantheon-edge.yml file at the root of your site's code repository. Each site environment uses its own settings, and changes go live when you push and deploy your code. Changes no longer require a request to Pantheon.

• Rate limiting: Limit how many requests a single client, identified by IP address or JA4 fingerprint, can make to a site environment, using one of four pre-defined tiers.
• Geolocation: Send the visitor's approximate location, such as country, region, and city, to your site in a single Pantheon-Geo request header.

Before you migrate

• If your site reads AGCDN geolocation headers, update your code to read the Pantheon-Geo header. The header name, format, and available fields are different from AGCDN.
• Rate limiting uses pre-defined tiers. Custom request thresholds and time windows, including 1-second windows, aren't available.
• At launch, pantheon-edge.yml is supported for sites that push code to their Pantheon Git repository. Support for sites that use GitHub, GitLab, or Bitbucket integration, and for Next.js sites, is coming later.

How migration works

This migration is not self-serve. Pantheon's Professional Services team will:

1. Review your current Legacy AGCDN configuration and confirm feature support with current capabilities on NextGen.
2. Migrate your supported rules and configuration.
3. Make the migrated configuration available for you to review.
4. Coordinate the DNS cutover with you during an agreed change window.
5. Validate the configuration after cutover.

Action required

If you are eligible for Phase 2, you will receive an email. Respond to the ticket to confirm your technical contact so we can schedule your migration.

AGCDN customers who are not contacted for Phase 1 or Phase 2 don't need to do anything at this time, and will be contacted at a later date.

Learn how to configure rate limiting and geolocation in the Advanced Edge documentation. Learn more about our switch to Next-generation GCDN with bot protection in this related blog post.