You can now assign granular, resource-scoped roles for Cloudflare Gateway firewall policies and Zero Trust lists . Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This release introduces multiple features from our previous beta release into stable release, including: The client now applies DNS search suffixes configured in your device profile / network policy .
Workers fetch() requests now support the cf.vary request option. Use cf.vary to control how Cloudflare caches origin responses with a Vary header for a single subrequest.
The latest release of the Agents SDK ↗ makes it easier to run long work in the background, drive turns through one entry point, and keep chat agents working through deploys, evictions, and reconnects.
You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating. What's new Dashboard search : Both account API tokens ↗ and user API tokens ↗ pages now include a search bar. Type a name to filter results.
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page . This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation.
Cloudflare Accelerated Mobile Pages (AMP) and Signed Exchanges (SXG) support has reached end of life. The features have been disabled since October 2025, so customers who had them configured should see no change to their traffic. Customers will no longer be able to configure AMP/SXG through API or rulesets. The Zone API will start throwing errors.
R2 SQL now supports window functions, SELECT DISTINCT , set operations, and additional aggregates, making it easier to write analytical queries without preprocessing your data elsewhere. R2 SQL is Cloudflare's serverless, distributed SQL engine for querying Apache Iceberg ↗ tables stored in R2 Data Catalog .
AI agents can now deploy Workers to Cloudflare without first requiring a user to sign up, open a browser-based OAuth flow, click through the dashboard, or create an API token. When an agent tries to deploy without Cloudflare credentials, Wrangler can tell it to rerun with --temporary , then deploy the Worker to a temporary preview account.
When you create a new Zero Trust organization, Cloudflare now adds the Cloudflare identity provider as your default login method. Previously, new organizations started with one-time PIN (OTP) .
You can now configure Artifacts namespaces, repos, and tokens directly from the Cloudflare dashboard. Artifacts is Git-compatible storage that lets you store repos on Cloudflare and interact with them using standard Git workflows.
We are excited to announce GLM-5.2 on Workers AI, Z.ai's flagship agentic coding model. @cf/zai-org/glm-5.2 is a text generation model built for agentic coding workflows. With function calling and reasoning support, it can handle long codebases, multi-step planning, and tool-augmented agents.
You can now match incoming requests against Cloudforce One threat intelligence in your WAF rules. A new detection looks up the client IP address of each request against the threat intelligence database.
Cloudflare's Terraform v5 Provider makes it easy for developers to manage their Cloudflare infrastructure using a configuration as code approach. It releases every 2-3 weeks ↗ to ensure that you can always manage the latest features in the platform.
Browser Run 's /snapshot endpoint now supports a formats parameter that lets you return multiple page formats in a single API call. Previously, /snapshot returned only HTML content and a screenshot. You can now also include Markdown and the accessibility tree in the same response.
AI Search now supports namespace-level Wrangler commands, making it easier to manage namespaces from your terminal, scripts, and agent workflows. The following commands are available: Command Description wrangler ai-search namespace list List AI Search namespaces wrangler ai-search namespace create Create a new AI Search namespace wrangler ai-search...
Sandbox SDK 1.0 preview A preview of Sandbox SDK 1.0 is available on @cloudflare/sandbox@next . For new projects, or to move past these deprecations in one migration, refer to the Sandbox SDK 1.0 preview and Migrate . Today we are announcing the deprecation of several features from the Sandbox SDK.
You can now send emails through Cloudflare Email Service using authenticated SMTP submission on smtp.mx.cloudflare.net:465 . SMTP joins the REST API and the Workers binding as a third way to send transactional email , useful for existing applications that already speak SMTP and language-native SMTP libraries (Nodemailer, smtplib , PHPMailer, JavaMail).
AI Gateway now supports spend limits , cost-based budgets that track cumulative dollar spend and block requests when the budget is exceeded. Unlike rate limiting, which caps the number of requests, spend limits track actual cost based on token usage and model pricing. You can scope limits by model, provider, or custom metadata dimensions.
Cloudflare Access now supports IdP federation , which allows organizations to share a single identity provider across multiple Cloudflare accounts. Instead of configuring the same IdP (for example, Okta or Entra ID) separately in every account, you configure it once in a source account and share it with the other accounts in your organization.
Cloudflare Access now supports SAML assertion encryption for identity provider integrations. When turned on, your identity provider encrypts SAML assertions using a Cloudflare-managed certificate before sending them through the user's browser. Only Access can decrypt these assertions, protecting sensitive identity data even after TLS termination.
The latest release of the Agents SDK ↗ adds four new ways to build with @cloudflare/think : on-demand Agent Skills, chat messengers (starting with Telegram), declarative scheduled tasks, and durable reasoning steps inside Workflows.
Cloudflare has updated Logpush datasets : New datasets Turnstile Events : A new dataset with fields including ASN , Action , BrowserMajor , BrowserName , ClientIP , CountryCode , EventType , Hostname , OSMajor , OSName , Sitekey , Timestamp , and UserAgent . For the complete field definitions for each dataset, refer to Logpush datasets .
Releasesby Glyph