Releasesby GlyphAccess, Cloudflare One - Sign in to Cloudflare Access with passkeys
Cloudflare Access now supports passkeys as a login method for protected applications. Users can authenticate using device-based security keys or password managers.
Cloudflare Release notes and new features
Public · San Francisco, US · 1,068 releases · 26 this month
Also onAcquisitions·Quarterly(NET earnings calendar)·Paydays(Pay schedule)·TechConf(1 conference)
Cloudflare releases
November 2026 digestWorkers AI - Planned model deprecations on Workers AI
Cloudflare is deprecating several AI models on Workers AI, including select DeepSeek, Llama, Gemma, and Qwen variants, with complete removal scheduled for November 15, 2026.
AI Gateway - Route across a pool of models with model aliases
Cloudflare AI Gateway introduced model aliases, enabling applications to direct requests to configurable model pools with fallback and smart routing.
Cloudflare One Client for Linux (version 2026.7.1385.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.
AI Search billing postponed to December 1, 2026, and default sync interval is now 24 hours
Billing postponed to December 1, 2026 AI Search billing has been postponed by one month and now begins on December 1, 2026, instead of November 1, 2026. You will not be charged for AI Search usage before December 1, 2026. Pricing and included usage are unchanged. For rates and included usage, refer to Limits & pricing .
DNS - Cloudflare Services for Private Origins is generally available
Cloudflare Services for Private Origins is generally available. Proxy public hostnames to origins in your private network over Cloudflare WAN, Cloudflare Tunnel, or Cloudflare Mesh. Refer to Private origins and the announcement blog post ↗︎ .
Data Localization Suite, SSL/TLS - View your data localization settings in one dashboard page
Cloudflare added a Data Localization Suite Overview page to consolidate Regional Services, Customer Metadata Boundary, and Geo Key Manager settings into one view.
Access, Cloudflare One - Google Workspace SCIM user provisioning through generic SAML
Organizations can now use Google Workspace's custom SCIM profiles to synchronize user identities with Cloudflare One. This requires using a generic SAML identity provider and supports automated user deprovisioning.
Analytics - SQL API introspection: `include_attributes` parameter
The SQL API introspection endpoint now supports an include_attributes parameter to discover keys and types within a dataset's attributes JSON column. This replaces the deprecated include_custom_attributes parameter.
Agents, Workers - Cloudflare Computer now helps agents recover from interruptions and wait for approval
Cloudflare Computer now supports resuming agent code execution after deployments or crashes, and pausing for external actions.
WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset
Cloudflare released an emergency update to its Managed Ruleset, adding two rules to log requests related to the Brotli vulnerability CVE-2026-111497.
Flagship - Target Flagship feature flags with structured evaluation context
Flagship now supports nested objects and arrays in evaluation context, allowing developers to target feature flags based on complex user profiles and tags.
Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel - Granular Tunnel Read And Monitor role is generally available
The Granular Connector cloudflared Read And Monitor role is now generally available, allowing users to view tunnel details and stream logs without requiring full write access.
Cloudflare One Client for Windows (version 2026.7.1384.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.
Workers, Cloudflare CLI - Wrangler and cf now upload source maps by default
From Wrangler 4.150.0, wrangler deploy , wrangler versions upload , and wrangler preview generate and upload source maps by default. You no longer need to set upload_source_maps to get stack traces with your original file names and line numbers. cf deploy also uploads source maps by default.
Workers AI - Introducing Clairic: an extraction model for typed values, now on Workers AI
@cf/cloudflare/clairic is now available on Workers AI as a preview. Clairic is the first extraction model : a System One model that answers with values instead of text. We intend to release the model with open weights soon. Decision models such as Clef choose among options you define up front.
Workers, Cloudflare CLI - Test Cron Triggers with Local Explorer
Local Explorer can now send one-off Cron Trigger invocations to a Worker's scheduled() handler during local development. This removes the need to construct request URLs when testing handler behavior. Start your local development server with cf dev , wrangler dev , or the Cloudflare Vite plugin .
Workers, Cloudflare CLI - Search Cloudflare documentation with the Cloudflare CLI
Cloudflare CLI 1.0.0-beta.16 includes cf docs search , so you and your coding agent can find Cloudflare documentation without leaving the terminal. Search for guides, tutorials, and examples across Cloudflare products.
Stream - Ultra-low latency live with WebRTC is now Generally Available in Stream
Stream WebRTC support ↗︎ lets you deliver high quality live video to thousands of concurrent viewers in milliseconds. WebRTC is compatible with native Web APIs and standard protocols, so creators can go live from a browser ↗︎ without needing a separate broadcast application.
DNS - Configure Advanced Custom Nameservers with nameserver sets (beta)
Nameserver sets are now available in beta to Enterprise accounts. A nameserver set groups two to five custom nameserver names with Cloudflare-assigned IP addresses. You can assign the set to zones in the same account. Enterprise customers using Cloudflare DNS can create Advanced Custom Nameserver sets.
Audit Logs v2 now captures view actions
Audit Logs v2 now records view actions for supported endpoints, providing visibility into read activity across Cloudflare products. These actions correspond to GET requests and provide additional context for security investigations and forensic analysis. The Audit Logs v2 dashboard excludes view actions by default to reduce noise.
Workers Builds now posts preview URLs in seconds
Workers Builds now consistently posts preview URLs to GitHub pull requests and GitLab merge requests within a few seconds of a build completing, so you can start testing and reviewing your changes sooner. Previously, posting preview URLs could often take minutes. For details, refer to Workers Builds GitHub integration and Workers Builds GitLab integration .
Agents - Cloudflare API MCP server serves Cloudflare skills
The Cloudflare API MCP server now serves Cloudflare skills ↗︎ through the Skills over MCP extension ↗︎ . MCP clients that support the extension discover the skills with skills/list and read their files at skill://<name>/<path> . To use them, add https://mcp.cloudflare.com/mcp to an MCP client that supports the extension ↗︎ .
Cloudflare Fundamentals - Improved HTTP/3 client cancellation reporting
Cloudflare has improved how it handles and reports client-cancelled HTTP/3 requests across Free, Pro, Business, and Enterprise plans. Customers now get a clearer view of client behavior in Cloudflare analytics and, where available, logs. Previously, Cloudflare did not always stop an HTTP/3 request when the client cancelled its request stream.
Workflows, Workers - Create Workflow instance batches by count or list
createBatch() now accepts an options object that creates up to 100 Workflow instances in one call. The result lists the created instances and explains why any others were not created. To use this form in local development and get its types from wrangler types , use Wrangler 4.148.0 or later. To create instances that share the same options, pass count .
Cloudflare Fundamentals, Cloudflare One, Gateway, Organizations - Cloudflare Organizations is generally available
Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies.
WAF Release - 2026-10-06
This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule. Key Findings CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP.
Cloudflare WAN, Magic Transit, Cloudflare One - BGP over IPsec and GRE tunnels generally available
BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes.
Agents, Workers - Run the Pi Durable harness on Cloudflare with the Agents SDK
The Agents SDK now provides first-class support for building agents using the Pi harness. You can build long-running agents using the combination of Pi 1.0 ↗︎ , Pi Durable ↗︎ , and the new PiHarness class that the Cloudflare Agents SDK provides, ensuring your agent's work is durably persisted, even if interrupted mid-turn.
Basin, Basin Pipelines, Basin Catalog, Basin SQL - Cloudflare Basin is now generally available
Basin , formerly the Cloudflare Data Platform, is now generally available. Basin brings an end-to-end analytics platform to the Developer Platform, enabling you to collect data from a variety of sources, such as apps, infrastructure, devices, and other Cloudflare services, then query it to answer analytical questions.
Sandboxes - Sandbox SDK 1.0: control every sandbox from your own Durable Object
Sandbox SDK 1.0 is available. Your own Durable Object class now controls each sandbox container directly, through the Durable Object container API on this.ctx.container . With 1.0, your class can: Choose the image and instance size each time it starts a sandbox.
Cloudflare One Client for Windows (version 2026.8.2028.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting.
Workers, Cloudflare CLI - Cloudflare CLI is now in beta
The Cloudflare CLI , cf , is now in beta. cf is one command-line interface for the public Cloudflare API and for Workers projects. Use it to manage zones, DNS, storage, and security settings, and to create, develop, and deploy Workers, without switching between tools.
Workflows, Workers - Call Workflows declared in `exports` through `ctx.exports`
A Worker can now call the Workflows it declares in the exports field of its Wrangler configuration through ctx.exports . You no longer need a workflows binding to call a Workflow from the Worker that defines it.
Browser Run, Queues - Subscribe to Browser Run crawl events
Browser Run crawl jobs can publish lifecycle events to Cloudflare Queues . Subscribe to started, updated, and finished events to track progress or trigger downstream processing without polling.
Access, Cloudflare One - MCP server portals are now generally available
MCP server portals are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity.
Cloudflare Images - View transformation analytics in Images
You can now view account-level analytics for your Images transformation usage. Go to Images & Stream > Transformations > Analytics to view sampled estimates of image transformation request traffic, including: Requests by source, split between URL-based transformations and Images binding transformations Top zones, transformation configurations, and origin...
WAF Release - Scheduled changes for 2026-09-29
Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-09-22 2026-09-29 Log N/A ...cb14ded8 Broken Access Control - Directory Traversal This is a new detection.
Cloudflare One Client for Windows (version 2026.8.1755.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting.
Cloudflare Tunnel, Cloudflare Tunnel for SASE - cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027
Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared . After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025.
Cloudflare Fundamentals - Create additional Free accounts through the dashboard and API
We're expanding how customers create accounts across Cloudflare, making it easier to self-serve account creation in the dashboard, automate standalone account creation with user-owned API tokens or OAuth access tokens, and create Free accounts directly within Enterprise Organizations.
R2, R2 Data Catalog - R2 Data Catalog adds table maintenance visibility and manual queueing
R2 Data Catalog now provides table-level maintenance visibility and manual compaction queueing in the Cloudflare dashboard. These updates make it easier to understand when maintenance is eligible to run, inspect completed operations, and request maintenance without leaving the table view.
WAF Release - 2026-09-15
This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.
Data Loss Prevention - Discover where sensitive data goes before you create a Data Loss Prevention policy
Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs.
AI Search supports extensionless R2 objects with Content-Type metadata
AI Search can index R2 objects without filename extensions when they include supported Content-Type metadata. This supports object keys that do not include file extensions while preserving file-type validation during indexing. For supported file types and Content-Type requirements, refer to R2 data sources .
Containers - Use Cloudflare Containers with Codex via the OpenAI Agents API
The OpenAI Agents API gives your application access to Codex through an OpenAI-managed API. OpenAI manages sessions, orchestration, context compaction, and recovery while your application provides tools and uses Cloudflare Containers as the execution environment.
Cloudflare One Client for Windows (version 2026.8.1290.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
WAF Release - 2026-09-08
This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.
WAF - Enforce positive security with Application Profiles
Application Profiles add a positive-security layer to Cloudflare WAF. Instead of looking only for requests that resemble known attacks, Application Profiles learn what valid requests to your application look like and identify traffic that deviates from the expected structure.
R2 - R2 Data Access Logs
R2 Data Access Logs are now generally available. Turn on logging for a bucket to record object read, write, list, multipart upload, and delete operations with response status codes below 400 .
Cloudflare Images - New in Images: text rasterization and updates to the binding
We've added more ways to manage and manipulate images with the Images binding . Here's what's new: Render text into an image. Output a string of text into its own image or draw it over another image. Use the .text() method to rasterize text with the Images binding. Style content using the font , size , and color options.
D1 - D1 enforces free tier daily query limits
Beginning September 1, 2026, D1 queries on the Workers Free plan will fail when an account exceeds the daily row read or row write limits . Queries via the Workers Binding API and the REST API will return errors until the limit resets at midnight UTC. Stored data is not affected. You will receive email alerts when the daily limit is reached.
Browser Run - Crawl endpoint now respects the Content Signals `use` directive
The /crawl endpoint now respects the use directive of the Content Signals ↗ standard, letting site owners express the maximum level at which their content may be used. You can declare your intended level with the new contentUse parameter. Allowed values, from least to most permissive, are reference and full , and the default is full .
AI Search now supports GLM-5.3 Flash
AI Search now supports @cf/zai-org/glm-5.3-flash for text generation. The model has a 1,048,576-token context window and runs on Workers AI. To configure the model for an AI Search instance, refer to Supported models .
Cloudflare One Client for Linux (version 2026.7.1377.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
Automatic Platform Optimization - APO caches more crawler and bot traffic again
We fixed a regression where Automatic Platform Optimization (APO) stopped caching some HTML requests that did not send an explicit Accept: text/html header , commonly crawlers, bots, and uptime monitors. These requests were being served from your origin ( cf-cache-status: DYNAMIC ) instead of the cache. APO now caches these requests again.
Logpush Connectors, Logs - Azure Functions-based Microsoft Sentinel connector deprecation
Cloudflare Enterprise customers using the Azure Functions-based Microsoft Sentinel connector ↗ must migrate to the Cloudflare for Microsoft Sentinel Codeless Connector Framework (CCF) connector ↗ by 2026-09-14. Microsoft is deprecating the Azure Monitor HTTP Data Collector API. Support for the API ends on 2026-09-14.
WAF Release - 2026-08-25
This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard
When you register a Cloudflare One Virtual Appliance , you can now select your hypervisor and download the appliance directly from the dashboard , no need to look up asset URLs. On the Connectors page, select Add an appliance , choose Virtual appliance , then select your hypervisor: VMware ESXi , Proxmox , or libvirt/KVM .
Agents, Workers - Choose OAuth scopes for Wrangler and the Cloudflare API MCP server
Wrangler and the Cloudflare API MCP server now use optional OAuth scopes. During authorization, you can choose which optional scopes to grant instead of approving every scope requested by each client.
About and activity
Cloudflare, Inc., is an American technology company headquartered in San Francisco, California, that provides a range of internet services, including content delivery network (CDN) services, cloud cybersecurity, DDoS mitigation, and ICANN-accredited domain registration.
Official release-notes pages 8
| Release-notes page | Site | Feed |
|---|---|---|
| AI Changelog developers.cloudflare.com | developers.cloudflare.com | None |
| Application security Changelog developers.cloudflare.com | developers.cloudflare.com | None |
| Changelog · Cloudflare DNS docs developers.cloudflare.com | developers.cloudflare.com | None |
| Changelog · Cloudflare Web Application Firewall (WAF) docs developers.cloudflare.com | developers.cloudflare.com | None |
| Changelogs developers.cloudflare.com | developers.cloudflare.com | None |
| Cloudflare Tunnel Changelog developers.cloudflare.com | developers.cloudflare.com | None |
| Overview of the WAF changelog developers.cloudflare.com | developers.cloudflare.com | None |
| Releases · cloudflare/workers developers.cloudflare.com | developers.cloudflare.com | None |