Cloudflare developer platform Release notes from Cloudflare

Workers AI - Planned model deprecations on Workers AI

Cloudflare is deprecating several AI models on Workers AI, including select DeepSeek, Llama, Gemma, and Qwen variants, with complete removal scheduled for November 15, 2026.

DeprecationNov 5

AI Gateway - Route across a pool of models with model aliases

Cloudflare AI Gateway introduced model aliases, enabling applications to direct requests to configurable model pools with fallback and smart routing.

GANov 4

Cloudflare One Client for Linux (version 2026.7.1385.0)

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.

GANov 3

8 releases →

AI Search billing postponed to December 1, 2026, and default sync interval is now 24 hours

Billing postponed to December 1, 2026 AI Search billing has been postponed by one month and now begins on December 1, 2026, instead of November 1, 2026. You will not be charged for AI Search usage before December 1, 2026. Pricing and included usage are unchanged. For rates and included usage, refer to Limits & pricing .

PricingNov 2

DNS - Cloudflare Services for Private Origins is generally available

Cloudflare Services for Private Origins is generally available. Proxy public hostnames to origins in your private network over Cloudflare WAN, Cloudflare Tunnel, or Cloudflare Mesh. Refer to Private origins and the announcement blog post ↗︎ .

GAOct 30

12 releases →

Data Localization Suite, SSL/TLS - View your data localization settings in one dashboard page

Cloudflare added a Data Localization Suite Overview page to consolidate Regional Services, Customer Metadata Boundary, and Geo Key Manager settings into one view.

UpdateOct 29

Access, Cloudflare One - Google Workspace SCIM user provisioning through generic SAML

Organizations can now use Google Workspace's custom SCIM profiles to synchronize user identities with Cloudflare One. This requires using a generic SAML identity provider and supports automated user deprovisioning.

GAOct 28

8 releases →

Analytics - SQL API introspection: `include_attributes` parameter

The SQL API introspection endpoint now supports an include_attributes parameter to discover keys and types within a dataset's attributes JSON column. This replaces the deprecated include_custom_attributes parameter.

UpdateOct 27

Agents, Workers - Cloudflare Computer now helps agents recover from interruptions and wait for approval

Cloudflare Computer now supports resuming agent code execution after deployments or crashes, and pausing for external actions.

UpdateOct 26

WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset

Cloudflare released an emergency update to its Managed Ruleset, adding two rules to log requests related to the Brotli vulnerability CVE-2026-111497.

UpdateOct 25

Flagship - Target Flagship feature flags with structured evaluation context

Flagship now supports nested objects and arrays in evaluation context, allowing developers to target feature flags based on complex user profiles and tags.

GAOct 23

Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel - Granular Tunnel Read And Monitor role is generally available

The Granular Connector cloudflared Read And Monitor role is now generally available, allowing users to view tunnel details and stream logs without requiring full write access.

GAOct 22

9 releases →

Cloudflare One Client for Windows (version 2026.7.1384.0)

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.

GAOct 21

Workers, Cloudflare CLI - Wrangler and cf now upload source maps by default

From Wrangler 4.150.0, wrangler deploy , wrangler versions upload , and wrangler preview generate and upload source maps by default. You no longer need to set upload_source_maps to get stack traces with your original file names and line numbers. cf deploy also uploads source maps by default.

PreviewOct 20

Workers AI - Introducing Clairic: an extraction model for typed values, now on Workers AI

@cf/cloudflare/clairic is now available on Workers AI as a preview. Clairic is the first extraction model : a System One model that answers with values instead of text. We intend to release the model with open weights soon. Decision models such as Clef choose among options you define up front.

PreviewOct 19

Workers, Cloudflare CLI - Test Cron Triggers with Local Explorer

Local Explorer can now send one-off Cron Trigger invocations to a Worker's scheduled() handler during local development. This removes the need to construct request URLs when testing handler behavior. Start your local development server with cf dev , wrangler dev , or the Cloudflare Vite plugin .

UpdateOct 17

Workers, Cloudflare CLI - Search Cloudflare documentation with the Cloudflare CLI

Cloudflare CLI 1.0.0-beta.16 includes cf docs search , so you and your coding agent can find Cloudflare documentation without leaving the terminal. Search for guides, tutorials, and examples across Cloudflare products.

BetaOct 16

Stream - Ultra-low latency live with WebRTC is now Generally Available in Stream

Stream WebRTC support ↗︎ lets you deliver high quality live video to thousands of concurrent viewers in milliseconds. WebRTC is compatible with native Web APIs and standard protocols, so creators can go live from a browser ↗︎ without needing a separate broadcast application.

GAOct 15

DNS - Configure Advanced Custom Nameservers with nameserver sets (beta)

Nameserver sets are now available in beta to Enterprise accounts. A nameserver set groups two to five custom nameserver names with Cloudflare-assigned IP addresses. You can assign the set to zones in the same account. Enterprise customers using Cloudflare DNS can create Advanced Custom Nameserver sets.

BetaOct 14

Audit Logs v2 now captures view actions

Audit Logs v2 now records view actions for supported endpoints, providing visibility into read activity across Cloudflare products. These actions correspond to GET requests and provide additional context for security investigations and forensic analysis. The Audit Logs v2 dashboard excludes view actions by default to reduce noise.

UpdateOct 13

Workers Builds now posts preview URLs in seconds

Workers Builds now consistently posts preview URLs to GitHub pull requests and GitLab merge requests within a few seconds of a build completing, so you can start testing and reviewing your changes sooner. Previously, posting preview URLs could often take minutes. For details, refer to Workers Builds GitHub integration and Workers Builds GitLab integration .

PreviewOct 12

12 releases →

Agents - Cloudflare API MCP server serves Cloudflare skills

The Cloudflare API MCP server now serves Cloudflare skills ↗︎ through the Skills over MCP extension ↗︎ . MCP clients that support the extension discover the skills with skills/list and read their files at skill://<name>/<path> . To use them, add https://mcp.cloudflare.com/mcp to an MCP client that supports the extension ↗︎ .

UpdateOct 10

Cloudflare Fundamentals - Improved HTTP/3 client cancellation reporting

Cloudflare has improved how it handles and reports client-cancelled HTTP/3 requests across Free, Pro, Business, and Enterprise plans. Customers now get a clearer view of client behavior in Cloudflare analytics and, where available, logs. Previously, Cloudflare did not always stop an HTTP/3 request when the client cancelled its request stream.

UpdateOct 9

Workflows, Workers - Create Workflow instance batches by count or list

createBatch() now accepts an options object that creates up to 100 Workflow instances in one call. The result lists the created instances and explains why any others were not created. To use this form in local development and get its types from wrangler types , use Wrangler 4.148.0 or later. To create instances that share the same options, pass count .

UpdateOct 8

Cloudflare Fundamentals, Cloudflare One, Gateway, Organizations - Cloudflare Organizations is generally available

Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies.

GAOct 7

WAF Release - 2026-10-06

This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule. Key Findings CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP.

BetaOct 6

Cloudflare WAN, Magic Transit, Cloudflare One - BGP over IPsec and GRE tunnels generally available

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes.

GAOct 5

Agents, Workers - Run the Pi Durable harness on Cloudflare with the Agents SDK

The Agents SDK now provides first-class support for building agents using the Pi harness. You can build long-running agents using the combination of Pi 1.0 ↗︎ , Pi Durable ↗︎ , and the new PiHarness class that the Cloudflare Agents SDK provides, ensuring your agent's work is durably persisted, even if interrupted mid-turn.

BetaOct 2

10 releases →

Basin, Basin Pipelines, Basin Catalog, Basin SQL - Cloudflare Basin is now generally available

Basin , formerly the Cloudflare Data Platform, is now generally available. Basin brings an end-to-end analytics platform to the Developer Platform, enabling you to collect data from a variety of sources, such as apps, infrastructure, devices, and other Cloudflare services, then query it to answer analytical questions.

GAOct 1

13 releases →

Sandboxes - Sandbox SDK 1.0: control every sandbox from your own Durable Object

Sandbox SDK 1.0 is available. Your own Durable Object class now controls each sandbox container directly, through the Durable Object container API on this.ctx.container . With 1.0, your class can: Choose the image and instance size each time it starts a sandbox.

BetaSep 30

11 releases →

Cloudflare One Client for Windows (version 2026.8.2028.1)

A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting.

BetaSep 29

Workers, Cloudflare CLI - Cloudflare CLI is now in beta

The Cloudflare CLI , cf , is now in beta. cf is one command-line interface for the public Cloudflare API and for Workers projects. Use it to manage zones, DNS, storage, and security settings, and to create, develop, and deploy Workers, without switching between tools.

BetaSep 28

Workflows, Workers - Call Workflows declared in `exports` through `ctx.exports`

A Worker can now call the Workflows it declares in the exports field of its Wrangler configuration through ctx.exports . You no longer need a workflows binding to call a Workflow from the Worker that defines it.

UpdateSep 27

Browser Run, Queues - Subscribe to Browser Run crawl events

Browser Run crawl jobs can publish lifecycle events to Cloudflare Queues . Subscribe to started, updated, and finished events to track progress or trigger downstream processing without polling.

UpdateSep 25

Access, Cloudflare One - MCP server portals are now generally available

MCP server portals are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity.

GASep 24

Cloudflare Images - View transformation analytics in Images

You can now view account-level analytics for your Images transformation usage. Go to Images & Stream > Transformations > Analytics to view sampled estimates of image transformation request traffic, including: Requests by source, split between URL-based transformations and Images binding transformations Top zones, transformation configurations, and origin...

UpdateSep 23

WAF Release - Scheduled changes for 2026-09-29

Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-09-22 2026-09-29 Log N/A ...cb14ded8 Broken Access Control - Directory Traversal This is a new detection.

BetaSep 22

Cloudflare One Client for Windows (version 2026.8.1755.1)

BetaSep 21

Cloudflare Tunnel, Cloudflare Tunnel for SASE - cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027

Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared . After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025.

DeprecationSep 18

Cloudflare Fundamentals - Create additional Free accounts through the dashboard and API

We're expanding how customers create accounts across Cloudflare, making it easier to self-serve account creation in the dashboard, automate standalone account creation with user-owned API tokens or OAuth access tokens, and create Free accounts directly within Enterprise Organizations.

UpdateSep 17

R2, R2 Data Catalog - R2 Data Catalog adds table maintenance visibility and manual queueing

R2 Data Catalog now provides table-level maintenance visibility and manual compaction queueing in the Cloudflare dashboard. These updates make it easier to understand when maintenance is eligible to run, inspect completed operations, and request maintenance without leaving the table view.

UpdateSep 16

WAF Release - 2026-09-15

This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.

BetaSep 15

Data Loss Prevention - Discover where sensitive data goes before you create a Data Loss Prevention policy

Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs.

GASep 14

AI Search supports extensionless R2 objects with Content-Type metadata

AI Search can index R2 objects without filename extensions when they include supported Content-Type metadata. This supports object keys that do not include file extensions while preserving file-type validation during indexing. For supported file types and Content-Type requirements, refer to R2 data sources .

UpdateSep 11

Containers - Use Cloudflare Containers with Codex via the OpenAI Agents API

The OpenAI Agents API gives your application access to Codex through an OpenAI-managed API. OpenAI manages sessions, orchestration, context compaction, and recovery while your application provides tools and uses Cloudflare Containers as the execution environment.

UpdateSep 10

Cloudflare One Client for Windows (version 2026.8.1290.1)

A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.

BetaSep 9

WAF Release - 2026-09-08

This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.

BetaSep 8

WAF - Enforce positive security with Application Profiles

Application Profiles add a positive-security layer to Cloudflare WAF. Instead of looking only for requests that resemble known attacks, Application Profiles learn what valid requests to your application look like and identify traffic that deviates from the expected structure.

BetaSep 7

R2 - R2 Data Access Logs

R2 Data Access Logs are now generally available. Turn on logging for a bucket to record object read, write, list, multipart upload, and delete operations with response status codes below 400 .

GASep 4

Cloudflare Images - New in Images: text rasterization and updates to the binding

We've added more ways to manage and manipulate images with the Images binding . Here's what's new: Render text into an image. Output a string of text into its own image or draw it over another image. Use the .text() method to rasterize text with the Images binding. Style content using the font , size , and color options.

UpdateSep 2

D1 - D1 enforces free tier daily query limits

Beginning September 1, 2026, D1 queries on the Workers Free plan will fail when an account exceeds the daily row read or row write limits . Queries via the Workers Binding API and the REST API will return errors until the limit resets at midnight UTC. Stored data is not affected. You will receive email alerts when the daily limit is reached.

PricingSep 1

Browser Run - Crawl endpoint now respects the Content Signals `use` directive

The /crawl endpoint now respects the use directive of the Content Signals ↗ standard, letting site owners express the maximum level at which their content may be used. You can declare your intended level with the new contentUse parameter. Allowed values, from least to most permissive, are reference and full , and the default is full .

UpdateAug 31

AI Search now supports GLM-5.3 Flash

AI Search now supports @cf/zai-org/glm-5.3-flash for text generation. The model has a 1,048,576-token context window and runs on Workers AI. To configure the model for an AI Search instance, refer to Supported models .

UpdateAug 30

Cloudflare One Client for Linux (version 2026.7.1377.0)

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.

GAAug 28

Automatic Platform Optimization - APO caches more crawler and bot traffic again

We fixed a regression where Automatic Platform Optimization (APO) stopped caching some HTML requests that did not send an explicit Accept: text/html header , commonly crawlers, bots, and uptime monitors. These requests were being served from your origin ( cf-cache-status: DYNAMIC ) instead of the cache. APO now caches these requests again.

UpdateAug 27

Logpush Connectors, Logs - Azure Functions-based Microsoft Sentinel connector deprecation

Cloudflare Enterprise customers using the Azure Functions-based Microsoft Sentinel connector ↗ must migrate to the Cloudflare for Microsoft Sentinel Codeless Connector Framework (CCF) connector ↗ by 2026-09-14. Microsoft is deprecating the Azure Monitor HTTP Data Collector API. Support for the API ends on 2026-09-14.

DeprecationAug 26

8 releases →

WAF Release - 2026-08-25

This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.

BetaAug 25

Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard

When you register a Cloudflare One Virtual Appliance , you can now select your hypervisor and download the appliance directly from the dashboard , no need to look up asset URLs. On the Connectors page, select Add an appliance , choose Virtual appliance , then select your hypervisor: VMware ESXi , Proxmox , or libvirt/KVM .

UpdateAug 24

Agents, Workers - Choose OAuth scopes for Wrangler and the Cloudflare API MCP server

Wrangler and the Cloudflare API MCP server now use optional OAuth scopes. During authorization, you can choose which optional scopes to grant instead of approving every scope requested by each client.

UpdateAug 22