The execution time for App Server requests has always been documented as limited to 20 seconds, but this limit wasn’t strictly enforced, and requests could previously run for up to 30 seconds. Managed Runtime now enforces the documented 20-second limit. After this time, Managed Runtime returns an HTTP 502. This protects your storefront from slow or hung backend calls that would otherwise tie up rendering capacity. If your backend integrations typically respond in under 20 seconds, this change requires no action.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.
Non-Production Environments Now Have Lower Capacity Limits
Non-production Managed Runtime environments now have lower capacity limits, reflecting their use for development and testing traffic rather than live storefront traffic. Environments marked as production continue to receive full capacity and additional internal monitoring by Salesforce. Previously, there was no difference in capacity between production and non-production environments.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.
Log Center Logs and Metrics No Longer Require the Production Flag
Log Center logs and Log Center metrics no longer require an environment to be marked as production. Enable either setting independently for any environment associated with a B2C Commerce instance, under Observability in Environment Settings.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.
Coming September 29, 2026: Production Flag Will Require a Staging or Production B2C Commerce Instance
Starting September 29, 2026, you can mark an environment as production only if it’s associated with a Staging or Production B2C Commerce instance. Environments associated with a development or sandbox instance, or with no instance association, can’t be marked as production after this date.
Associate your production environments with a Staging or Production B2C Commerce instance now, ahead of the deadline.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.
Access Control Headers Limit Raised to 4 for Storefront Next Environments
Storefront Next environments can now have up to 4 access control headers, up from 2. This gives you more headroom to support vanity domains, because each domain typically needs its own header. The limit for other Managed Runtime environments remains 2. The header Salesforce configures for your default domain can’t be deleted; add a separate header for each vanity domain instead.
Where: This change applies to Managed Runtime with Storefront Next.
Protected Storefront is now enabled by default for new Managed Runtime environments, so you no longer need to contact Salesforce Support to turn it on before restricting access to a storefront under development. Existing environments are unaffected.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.
On-Demand Sandbox Instances Now Get Default eCDN Security Rules for Storefront Next
When you create a Storefront Next storefront on an On-Demand Sandbox (ODS) instance, Business Manager now adds default security rules to the instance’s default eCDN zone: custom firewall rules that block known AI crawlers and common vulnerability-probe paths, plus a rate limiting rule that blocks IP addresses sending excessive requests. The default zone is shared across every storefront on the instance, so these rules apply to all storefronts hosted there, not only the one that triggered their creation. ODS instances have less capacity than production, and these rules keep them responsive during development by limiting automated bot and crawler traffic.
Where: This change applies to On-Demand Sandbox (ODS) instances with Storefront Next.
How: If a rule blocks traffic you expect to allow, adjust its exclusions or rate limit rather than disabling it — see Adjust or Disable a Rule.
7/28/2026
SSR Bundle Size Limit Lowered to 247 MB
The maximum combined size of ssr_only and ssr_shared files in an Server-Side Rendering (SSR) bundle is now 247 MB, down from 249 MB. This reserves headroom for the fixed overhead Managed Runtime adds to every bundle, so bundles near the previous limit don’t fail during publish after upload. Check your bundle size before pushing if you’re close to the limit.
Where: This change applies to Managed Runtime with Composable Storefront and Storefront Next.