API Breaking Changes and Deprecations — May 2026

The `/cdn-cgi/rum` endpoint now explicitly returns a 405 (Method Not Allowed) status for any request that is not a POST request. This is a breaking change for clients that might have been using other HTTP methods with this endpoint, as they will now receive an error.

The `/cdn-cgi/rum` endpoint now explicitly returns a 405 (Method Not Allowed) status for any request that is not a POST request. This is a breaking change for clients that might have been using other HTTP methods with this endpoint, as those requests will now fail.

Cloudflare has planned model deprecations on Workers AI. Users should review their usage to prepare for these changes.

Cloudflare has planned model deprecations on Workers AI. Users should review their usage to prepare for these changes.

Cloudflare is planning model deprecations on Workers AI. Users should review their Workers AI implementations to identify and address any dependencies on models that will be deprecated.

The Gemini 3 Flash Preview model has been updated to Gemini 3.5 Flash, requiring a model name update and a review of new pricing. Additionally, parameters like temperature, topP, and topK are no longer recommended for Gemini 3.x and later models, and the default thinking level has changed from HIGH to MEDIUM, which may impact prompt quality and cost.

GitHub is planning to deprecate Python 3.9 support for Dependabot. Users relying on Python 3.9 for Dependabot should plan to upgrade to a newer version to avoid future disruptions.

The `code_scanning_upload` field has been removed from the `rate_limit` API endpoint. This is a breaking change that may affect applications relying on this field for rate limit information.

The 'Grok Code Fast 1' feature related to Copilot has been retired. Users should be aware that this specific functionality is no longer available.

The synchronous SBOM API has been deprecated. Users should migrate to an asynchronous alternative to avoid future disruptions.

GitHub is announcing the upcoming deprecation of 'Grok Code Fast 1'. This indicates that the feature will be removed or no longer supported in the future, requiring users to plan for its eventual removal.

GitHub Copilot is deprecating support for GPT-4.1 and Claude Sonnet 4 models. Additionally, Enterprise Live Migrations is now available in public preview, and Copilot CLI's Rubber Duck feature supports more models.

The `code_scanning_upload` field will be removed from the `rate_limit` API endpoint. Users relying on this field should update their integrations to avoid future breaking changes.

The GPT-5.2 and GPT-5.2-Codex models are being deprecated. Users should plan to migrate away from these models to avoid service interruption.

This update includes two breaking changes: Cloud Storage's Object Lifecycle Management will now delete empty folders in hierarchical namespaces, and Secure Source Manager has removed support for legacy SSH algorithms, requiring clients to use modern algorithms for Git-over-SSH connections.

The Gemini Enterprise Agent Platform Gemini 3.1 Flash Image Preview and Gemini 3 Pro Image Preview are deprecated. Users should update their model endpoints to the GA versions (gemini-3.1-flash-image and gemini-3-pro-image) before July 19, 2026, to avoid service disruption.

The Gemini Enterprise assist feature is deprecated and shut down. Additionally, the administrator control for Gemini 3.5 Flash will be removed on June 8, 2026, after which it will be enabled by default.

The Podcast API for NotebookLM Enterprise is deprecated, and Google is no longer allowlisting new customers for this feature. Existing users may continue to use it, but new integrations are not permitted.

Agent Search for healthcare is deprecated. Users should consider building custom search apps on Agent Search for a managed solution or use Agent Retrieval for more control.

This release includes several breaking changes: BigQuery Data Transfer Service will stop populating historical data for Google Ads, Search Ads 360, and Google Analytics 4 connectors for backfill runs older than 37 months. Cloud Composer 2 environments can no longer be created in Johannesburg. Google Distributed Cloud for VMware 1.35.0-gke.525 requires cgroupsv2, dropping support for cgroupsv1 and legacy OSImageType options, and changes the default Docker bridge IP for advanced clusters.

As of April 10, 2026, creating, running, and editing Gemini Cloud Assist investigations will be restricted to users with a Premium Support contract or those who have requested access through their account team. This is a breaking change for users without these prerequisites.

Starting May 7, 2026, new BigQuery Data Transfer Service configurations for Google Ads will require Multi-factor authentication (MFA) for individual user authentication. This is a breaking change that will impact how users set up new data transfers from Google Ads.

The `report_requested` field in the `/cra/check_report/verification/pdf/get` endpoint has been deprecated in favor of the new `reports_requested` array field. Developers should update their integrations to use the new array field to support multiple report types.

This release adds deprecation headers to legacy rule endpoints, indicating they will be removed in the future. Additionally, the legacy organization invite path has been removed, which may cause breaking changes for integrations relying on it.

Shopify CLI 4.0 introduces semantic versioning and automatic updates, but also removes deprecated commands and the --force flag. This is a breaking change as developers using these removed features will need to update their workflows.

Shopify is introducing two breaking changes: all public apps must use expiring offline access tokens for Admin API calls by January 1, 2027, and the deprecated PRIVATE and PUBLIC_READ enums on metaobject definitions will be removed in 2026-07. Developers need to migrate their authentication methods and update metaobject definitions to avoid authentication errors and ensure compatibility.

The Stripe API introduces several breaking changes, notably updates to card property requirements and 3D Secure authentication in Payment Records, and the removal of deprecated methods from Stripe.js. These changes will require developers to update their integrations to avoid failures.

This release introduces several breaking changes, including renaming attributes in Issuing Authorization and Transaction objects, removing undocumented fields, and deprecating `alphanumeric_id` for Issuing Authorization and `bank_transfer_payments` capability type. These changes require immediate attention to prevent API failures.

This release introduces several breaking changes, including renaming attributes in Issuing Authorization and Transaction objects, removing undocumented fields, and deprecating `alphanumeric_id` for Issuing Authorization and `bank_transfer_payments` capability type. These changes require immediate attention to avoid service disruptions.

New Supabase projects will no longer automatically expose public schema tables to the Data API (PostgREST/GraphQL). Explicit Postgres grants are now required, becoming the default for all new projects on May 30. Existing projects are unaffected.

Twilio will update its cipher suite list for all REST API endpoints on November 18, 2026. This change may require customers to update their client configurations to maintain connectivity.

Twilio is decommissioning T-Mobile A2P 10DLC Daily Limit Warning Error Codes 30025, 30026, and 30027. Users relying on these specific error codes for T-Mobile A2P 10DLC daily limit warnings will need to update their systems.

The Transit CallerID feature is being sunset and users must migrate to Verified CallerID or Immutable Call Forwarding before May 31, 2026. Failure to migrate will result in loss of functionality.

Twilio is sunsetting Transit CallerID. Users must migrate to Verified CallerID or Immutable Call Forwarding before May 31, 2026, to avoid service disruption.