• Insecure Deserialization (INSECURE-DESER): Insecure Deserialization is the attempt to exploit unsafe deserialization of data.

Note that this signal will be converted to an attack signal at a future date.

ENHANCEMENTS:

• feat(docs): add intro content to the provider landing page (#151)

Dependencies:

• build(deps): github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.0 (#153)

ENHANCEMENTS:

• feat(routing_config): add fastly_routing_config and fastly_routing_config_domain_link resources for managing Domain Management routing configs (automatic versioning) and linking them to domains (#1445)

BUG FIXES:

• fix(acl-entries): clear unmanaged ACL entries from Terraform state (#1440)
• fix(dictionary-items): clear unmanaged dictionary items from Terraform state (#1448)
• fix(compute-acl-entries): skip refresh and clear unmanaged Compute ACL entries from state (#1447)
• fix(configstore-entries): skip refresh and clear unmanaged Config Store entries from state (#1446)

Dependencies

• build(deps): github.com/fastly/go-fastly/v17 from 17.3.2 to 17.4.0 (#1439)
• build(deps): golang.org/x/net from 0.58.0 to 0.59.0 (#1439)
• build(deps): github.com/fastly/go-fastly/v17 from 17.5.0 to 17.6.0 (#1443)
• build(deps): github.com/fastly/go-fastly/v17 from 17.6.0 to 17.7.0 (#1444)

BREAKING:

• resource/fastly_service_vcl, resource/fastly_service_cdn_auto: renamed fastly_service_vcl to fastly_service_custom_vcl, and its corresponding nested vcl block on fastly_service_cdn_auto to custom_vcl (#127)

ENHANCEMENTS:

• feat(docs): add a beta testing guide, and provider overview content explaining the resource families (#148)
• feat(logging_grafanacloudlogs): add support for Grafana Cloud Logs, including the explicit fastly_service_logging_grafanacloudlogs resource (#92)
• feat(ngwaf_workspace_templated_signal_rules): moved Templated Signal Rules to the dedicated fastly_ngwaf_workspace_templated_signal_rules data source (#90)
• feat(logging_digitalocean): add support for Digital Ocean Logging, including the explicit fastly_service_logging_digitalocean resource (#95)
• feat(api_security_discovered_operations): add fastly_api_security_discovered_operations data source (#96)
• feat(datacenters): add fastly_datacenters data source (#98)
• feat(staging_ips): add fastly_staging_ips data source (#99)
• feat(tls_domain): add fastly_tls_domain data source (#100)
• feat(api_security_operations): add fastly_api_security_operations and fastly_api_security_operation_tags data sources (#101)
• feat(package_hash): add fastly_package_hash data source (#103)
• feat(services): add fastly_services data source (#102)
• feat(ip_ranges): add fastly_ip_ranges data source (#104)
• feat(logging_elasticsearch): add support for Elasticsearch Logging, including the explicit fastly_service_logging_elasticsearch resource (#105)
• feat(logging_ftp): add support for FTP Logging, including the explicit fastly_service_logging_ftp resource (#107)
• feat(logging_googlepubsub): add support for Google Cloud Pub/Sub Logging, including the explicit fastly_service_logging_googlepubsub resource (#106)
• feat(service_product_ddos_protection): Add support for 'client_challenge' mode. (#110)
• feat(logging_heroku): add support for Heroku Logging, including the explicit fastly_service_logging_heroku resource (#108)
• feat(logging_kafka): add support for Kafka Logging, including the explicit fastly_service_logging_kafka resource (#111)
• feat(logging_honeycomb): add support for Honeycomb Logging, including the explicit fastly_service_logging_honeycomb resource (#112)
• feat(logging_logshuttle): add support for Log Shuttle Logging, including the explicit fastly_service_logging_logshuttle resource (#117)
• feat(logging_loggly): add support for Loggly Logging, including the explicit fastly_service_logging_loggly resource (#113)
• feat(logging_kinesis): add support for Kinesis Logging, including the explicit fastly_service_logging_kinesis resource (#116)
• feat(logging_scalyr): add support for Scalyr Logging, including the explicit fastly_service_logging_scalyr resource (#119)
• feat(logging_openstack): add support for OpenStack Logging, including the explicit fastly_service_logging_openstack resource (#120)
• feat(logging_sftp): add support for SFTP Logging, including the explicit fastly_service_logging_sftp resource (#124)
• feat(logging_papertrail): add support for Papertrail Logging, including the explicit fastly_service_logging_papertrail resource (#123)
• feat(tls_configuration): add staging_ip attribute to the fastly_tls_configuration data source (#126)
• feat(service_settings): add fastly_service_settings resource for explicit service version management of general settings; CDN services only (#128)
• feat(rate_limiter): add explicit family support for Rate Limiting (#134)
• feat(dictionary): add fastly_service_dictionary resource for explicit service version management of Edge Dictionaries; CDN and Compute services (#136)
• feat(cache_settings): add explicit family support for Cache Settings (#138)
• feat(gzip): add fastly_service_gzip resource for explicit service version management of Gzip configurations; CDN services only (#142)
• feat(dictionaries): add fastly_dictionaries data source, ported from the legacy provider (#146)
• feat(logging_bigquery): add support for BigQuery Logging, including the explicit fastly_service_logging_bigquery resource
• feat(logging_blobstorage): add support for Blob Storage Logging, including the explicit fastly_service_logging_blobstorage resource
• feat(logging_datadog): add support for Datadog Logging, including the explicit fastly_service_logging_datadog resource
• feat(logging_gcs): add support for GCS Logging, including the explicit fastly_service_logging_gcs resource
• feat(logging_https): add support for HTTPS Logging, including the explicit fastly_service_logging_https resource
• feat(logging_newrelic): add support for New Relic Logging, including the explicit fastly_service_logging_newrelic resource
• feat(logging_newrelicotlp): add support for New Relic OTLP Logging, including the explicit fastly_service_logging_newrelicotlp resource
• feat(logging_s3): add support for S3 Logging, including the explicit fastly_service_logging_s3 resource
• feat(logging_splunk): add support for Splunk Logging, including the explicit fastly_service_logging_splunk resource
• feat(logging_sumologic): add support for Sumo Logic Logging, including the explicit fastly_service_logging_sumologic resource
• feat(logging_syslog): add support for Syslog Logging, including the explicit fastly_service_logging_syslog resource

BUG FIXES:

• fix(cloudfiles_logging): ensure that the format attribute can't be set to null (#93)
• fix(docs): use versionless domains in examples, show the nested domain block as an alternative on the TLS pages, and note that classic domains are only available on accounts created before September 16, 2025 (#121)
• fix(docs): correct the README list of explicit resources, and map each one to its automatic-family equivalent (#122)
• fix(docs): add fastly_service_settings to the README table of explicit resources (#132)
• fix(docs): fill gaps and correct errors in the HCL syntax changes guide (#131)
• test(service_cdn_acl): add acceptance test coverage verifying the explicit fastly_service_cdn_acl resource rejects Compute services (#135)
• fix(compute): ensure that the Compute package hash is refreshed on import (#140)
• fix(gzip, condition, cache_settings): add RequiresReplace to name and service_id on the explicit fastly_service_gzip, fastly_service_condition, and fastly_service_cache_setting resources; changing either previously called Update against a name-keyed path that no longer matched the API's actual object, rather than the destroy/recreate their docs already described

• 2025 electricity emission factors are now used to calculate all Greenhouse Gas (GHG) emission metrics from January 1, 2025, onwards.
• The latest available Power Usage Effectiveness (PUE) data from colocation operators is now used to calculate non-IT equipment electricity consumption metrics from January 1, 2025, onwards.
• Minor errors related to the inclusion of Embedded CDN facilities and the calculation of Scope 3 GHG emissions (fuel and energy-related activities) have been corrected.
• Minor modifications have been made to 2025 Fastly-operated IT equipment electricity consumption data and the corresponding carbon data following an internal review of power distribution unit (PDU) data.
• 2025 Fastly market-based IT equipment electricity consumption data and market-based Scope 2 GHG emissions have been updated for South Korea and Ghana to comply with GHG Protocol guidance on the use of Energy Attribute Certificates (EACs) purchased in neighboring countries.
• An independent validation of the Sustainability dashboard methodology and calculations has been completed. Refer to the dashboard validation statement included in Appendix 4 of Fastly's 2025 Sustainability Report for more information.

• Getters no longer throw. They will return null instead.

Changed

• Merge in 3.x branch

• Set an action for a category of bots, such as AI crawlers, search engines, or headless browsers. Any bot Fastly later adds to that category picks up the same action automatically.
• Override the action for an individual bot when you want to treat one differently from the rest of its category. You can set the action back to inherit to return it to the category default.
• Update a workspace to switch between the off, log, and block protection modes.
• List all bots in a workspace across every category in a single request. Each bot reports its category_id, so you can build a complete bot-to-category map in one pass.

Settings and policy live in a workspace. Use the service_id filter on list workspaces to find the workspace serving a given service.

ENHANCEMENTS:

• feat(ai_runtime_control): add resources and data sources for managing AI Runtime Control (#1428)
• feat(product_enablement/ddos_protection): Add support for 'client_challenge' mode. (#1431)

Dependencies

• build(deps): github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1419)
• build(deps): golang.org/x/net from 0.57.0 to 0.58.0 (#1419)
• build(deps): github.com/fastly/go-fastly/v17 from 17.2.0 to 17.3.0 (#1421)
• build(deps): github.com/stretchr/testify from 1.12.0 to 1.12.1 (#1421)
• build(deps): google.golang.org/grpc from 1.82.1 to 1.83.1 (#1422)
• build(deps): google.golang.org/grpc from 1.83.1 to 1.83.2 (#1425)
• build(deps): github.com/fastly/go-fastly/v17 from 17.3.0 to 17.3.1 (#1427)
• build(deps): golang.org/x/net from 0.59.0 to 0.58.0 (#1435)

DOCUMENTATION:

• docs(fastly_object_storage): updated examples to use modern region (#1430)

Enhancements:

• feat(service/logging): add Log Explorer and Insights commands (#1887)
• feat(ai-runtime-control): add support for AI Runtime Control (#1901)

Dependencies:

• build(deps): golang.org/x/crypto from 0.54.0 to 0.55.0 (#1888)
• build(deps): golang.org/x/mod from 0.38.0 to 0.39.0 (#1888)
• build(deps): github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1888)
• build(deps): golang.org/x/text from 0.40.0 to 0.41.0 (#1888)
• build(deps): github.com/fastly/go-fastly from 17.2.0 to 17.3.0 (#1893)
• build(deps): golang.org/x/mod from 0.39.0 to 0.40.0 (#1894)
• build(deps): github.com/stretchr/testify from 1.12.0 to 1.12.1 (#1894)
• build(deps): github.com/mattn/go-runewidth from 0.0.27 to 0.0.28 (#1894)
• build(deps): github.com/pierrec/lz4/v4 from 4.1.28 to 4.1.29 (#1894)
• build(deps): golang.org/x/net from 0.57.0 to 0.58.0 (#1894)
• build(deps): github.com/nwaples/rardecode/v2 from 2.3.0 to 2.4.1 (#1898)
• build(deps): github.com/fastly/go-fastly from 17.3.0 to 17.3.1 (#1902)
• build(deps): golang.org/x/sys from 0.47.0 to 0.48.0 (#1904)
• build(deps): golang.org/x/mod from 0.40.0 to 0.41.0 (#1904)
• build(deps): github.com/andybalholm/brotli from 1.2.2 to 1.2.3 (#1904)
• build(deps): github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 (#1904)
• build(deps): github.com/klauspost/compress from 1.19.2 to 1.20.0 (#1904)
• build(deps): github.com/mattn/go-runewidth from 0.0.28 to 0.0.29 (#1904)
• build(deps): golang.org/x/oauth2 from 0.36.0 to 0.37.0 (#1904)
• build(deps): golang.org/x/sync from 0.22.0 to 0.23.0 (#1904)
• build(deps): github.com/fastly/go-fastly from 17.3.0 to 17.3.1 (#1902)

• CoreCache.transactionLookupAsync (#1591) (8aeb1ac)

Fixed

• Use the correct headers for the beforeSend HTTP cache hook (775c727)
• Use the correct headers for the beforeSend HTTP cache hook (#1590) (a4d6559)

Next-Gen WAF control panel

3. From the Rules menu, select Templated Rules.
4. In the search bar, enter CVE-2026-75650 and then click View for the CVE-2026-75650 templated rule.
5. Click Configure and then Add trigger.
6. Select the Block requests from an IP immediately if the CVE-2026-75650 signal is observed checkbox.
7. Click Update rule.

3. Click the Signals tab.
4. In the search bar, enter CVE-2026-75650 and then click View for the CVE-2026-75650 tag.
5. Click the Detections tab and then Add detection.
6. Verify the switch is set to Enabled.
7. Click Create detection.
8. Click the Alerts tab and then Add alert.
9. In the Status area, set the switch to Enabled.
10. Click Save alert.

Fastly control panel

3. Click Virtual Patches.
4. In the search bar, enter CVE-2026-75650 and then click the pencil to the right of the CVE-2026-75650 virtual patch.
5. From the Status menu, select Enabled.
6. (Optional) If your workspace is in blocking mode, choose whether to Block requests or Log requests if the CVE-2026-75650 signal is observed.
7. Click Update virtual patch.

Initial beta release. Introduces the rewrite of the Fastly Terraform provider on the Plugin Framework, including:

• Automatic (_auto) service resources: nested config blocks with provider-managed version lifecycle (auto-clone, validate, activate on every CRUD).
• Service building blocks: domain, backend, ACL + ACL entries, config store + items, secret store, dictionary items, cache settings, response object, request setting, custom dashboard, syslog logging, DNS zone.
• TLS: certificates, private keys, mutual authentication, activation, subscriptions, and Platform TLS.
• Next-Gen WAF (NGWAF): account rules, workspaces, workspace rules/thresholds/lists/signals/redactions/alert integrations, virtual patching.

BUG FIXES:

• fix(docs): add a note to the provider index page clarifying that the -beta suffix applies only to the Registry distribution, not to resource or data source type names (#76)

BUG FIXES:

• resource/fastly_service_cdn_auto, resource/fastly_service_dynamic_vcl_snippet: add an optional content attribute to dynamic VCL snippet metadata (the dynamic_snippet block, and the standalone resource), seeded into the snippet on creation so a service whose main VCL includes a dynamic snippet can be created in one apply (#78).