Releasesby GlyphWorkers AI - Planned model deprecations on Workers AI
We are refreshing the Workers AI model catalog to make room for newer releases. Please update your apps to remove references to the models listed below before the deprecation date. Recommended replacements @cf/zai-org/glm-4.7-flash , fast multilingual model with multi-turn tool calling and coding capabilities.
Also shipped May 8, 2026Cloudflare in May 2026 →
Supabase Is Now an Official ChatGPT App
Supabase is now available as an official ChatGPT app, allowing users to connect their projects to ChatGPT to manage database infrastructure through natural language commands.
Human-in-the-Loop Tools for the Agent SDK
The OpenRouter Agent SDK now includes tools that allow agents to auto-resolve routine decisions while pausing for human input on high-stakes tasks. This implementation requires no loop-management code.
Faster writes with full-page writes disabled, snapshot pricing in effect, organization-wide two-factor authentication release - May 08, 2026
Faster writes on Neon. Neon now delivers significantly faster writes across all projects. For write heavy workloads, this optimization delivers up to a 5x perfo...
Target discounts to specific markets
We've introduced markets as a new option in DiscountContextInput , enabling you to target discounts to specific regional markets, retail locations, or B2B company locations. This option can be used alongside existing eligibility options such as all , customerSegments , and customers .
Zed 1.1.7
- Fixed local zeta2 edit predictions using the wrong prompt format. ( #56192 ) Fixed an issue where broken symlinks, permission errors, or other fs errors in watched directories could cause excessive CPU usage ( #56175 ) Fixed a rare panic when invoking helix motions on an editor that had not yet been laid out.
Support for Node.js 20 dropped in client libraries
Supabase client libraries will drop support for Node.js 20 on June 30, 2026. Users must upgrade to Node.js 22 or later before that date.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Workers, WAF - WAF and framework adapter mitigations for React and Next.js vulnerabilities
Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Custom DHCP options on Cloudflare One Appliance
When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Source-based breakout and prioritization on Cloudflare One Appliance
Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by source in addition to destination application. You can pin breakout or priority behavior to: A source LAN interface , VLANs attached to that LAN are included automatically. A source IP address, range, or CIDR block.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve provisioning of Cloudflare One Virtual Appliance via API
You can now create, rotate, and delete Cloudflare One Virtual Appliance instances and their license keys directly via the API and Terraform. Create a virtual appliance and receive a license key: POST /accounts/{account_id}/magic/connectors with device.provision_license: true .
Security Center - CSV export and adjustable page density for RFIs
You can now export your Requests for Information (RFI) history to a CSV document and customize your dashboard view by choosing how many RFI records to load per page.
Stream - Introducing Stream Bindings for Workers
You can now interact with your Stream video library using new bindings for Workers! This allows customers to upload content to Stream, provision direct uploads, manage videos, and generate signed URLs from a Worker without making authenticated API calls.
WAF Release - 2026-05-07 - Emergency
This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575). Key Findings CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes Successful exploitation allows unauthenticated attackers to bypass middleware or...
Workers - Automatic tracing across Durable Object and Worker subrequests
You can now get a single unified trace across Worker-to-Worker subrequests, with trace context propagating automatically. Previously, automatic tracing produced disconnected traces when a Worker called another Worker through a service binding or Durable Object .