Releasesby GlyphBilling, Workers - Budget alerts now on by default for Pay-as-you-go accounts
We are turning on budget alerts by default for eligible Pay-as-you-go accounts. If your account does not already have a budget alert, Cloudflare will create one for you with a $10 account-level threshold. Your default alert will enable at the turn of your next billing cycle, so it will not fire based on usage you have already incurred.
Also shipped Jul 20, 2026Cloudflare in July 2026 →
Lakehouse : Cross-cloud Lakehouse now supports integration with SAP Business Data Cloud (BDC) in Preview
Lakehouse : Cross-cloud Lakehouse now supports integration with SAP Business Data Cloud (BDC) in Preview. This update includes the following features: Federation from SAP BDC: Create Delta Sharing catalogs in Lakehouse to automatically synchronize shares, schemas, and tables from SAP BDC.
OIDC federated authentication (Public Preview)
OpenID Connect (OIDC) security integrations for federated single sign-on (SSO) are available in Public Preview. Multiple OIDC integrations, or OIDC alongside an existing SAML2 integration, require identifier-first login . Without identifier-first login, only one SSO integration (SAML2 or OIDC) can be ENABLED=TRUE at a time.
DML into frozen regions of dynamic tables (General availability)
You can now use DML statements (INSERT, UPDATE, MERGE, DELETE) to modify rows directly in the frozen region of a dynamic table. This enables use cases such as GDPR-required row deletions or correcting specific records without triggering a full refresh of the active region. For more information, see DML into a frozen region .
Pass-through policies for dynamic tables with incremental refresh (General availability)
Dynamic tables that have base tables with arbitrary masking or row access policies can now maintain incremental refresh when the policy is pass-through for the role used during refresh (that is, when the refresh role has unrestricted access to all rows and columns regardless of the policy condition).
[In preview] Public Preview: Protect sensitive generative AI telemetry in Application Insights and Microsoft Foundry
Azure Monitor Application Insights now stores generative AI content in a dedicated GenAIContent table (AppGenAIContent in Log Analytics), making it possible to apply newly available access controls to sensitive AI telemetry. Because Application Insights p
AI credit pools for cost centers in the billing UI
You can now manage a cost center’s AI credit pool directly in the billing UI where you create and edit cost centers. Previously, you could only manage this through the GitHub REST API. This feature is available for Copilot Business and Copilot Enterprise on GitHub Enterprise Cloud. Toggle the AI credit pool on when you create or edit a cost center.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Access - Browser-based login for plaintext HTTP private applications
Cloudflare Access now uses the standard browser-based login flow for private applications served over plaintext HTTP on port 80 . Previously, plaintext HTTP private apps fell back to the same session flow used for SSH, RDP, and other non-HTTP protocols: users got an Authentication required pop-up from the Cloudflare One Client, then had to select the...
Durable Objects, Workers - View total SQLite storage for Durable Object namespaces
You can now monitor the total SQLite storage used by a Durable Object namespace over time in the Cloudflare dashboard. The new Total storage chart shows the maximum storage reported during each hour. This helps you identify storage growth, validate data cleanup, and investigate unexpected usage.
Cloudflare One Client for Windows (version 2026.6.880.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Cloudflare One Client for macOS (version 2026.6.880.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Cloudflare One Client for Linux (version 2026.6.880.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Cloudflare Fundamentals - Account Role API deprecated
The Account Roles API is deprecated and is being replaced by the Permission Groups API . An end of life date has not yet been established. What you need to do Review the Permission Groups API documentation; the response schema differs from the legacy Roles response.
Sandbox SDK - Run Devin on Cloudflare using Devin Outposts
Devin Outposts ↗ lets you run Devin agents on Cloudflare. Each Devin session runs in its own isolated sandbox backed by Cloudflare Containers , so agents can execute code and use development tooling in an isolated environment.
SSL/TLS - Faster and more secure TLS handshakes to your origins, automatically
Cloudflare now takes the guesswork out of TLS 1.3 key agreement with your origins. Automatic key exchange predicts the preferred algorithm and sends its key share in the first ClientHello , helping avoid a HelloRetryRequest and one extra network round trip. Automatic key exchange is on for all existing zones and on by default for new zones.