Releasesby GlyphCloudflare Fundamentals - Account Role API deprecated
The Account Roles API is deprecated and is being replaced by the Permission Groups API . An end of life date has not yet been established. What you need to do Review the Permission Groups API documentation; the response schema differs from the legacy Roles response.
Also shipped Jul 21, 2026Cloudflare in July 2026 →
CoCo Desktop - General availability
CoCo Desktop is now generally available. CoCo Desktop is a native Mac and Windows desktop application that brings CoCo’s full agentic capabilities into an IDE-like surface, with a file editor, integrated terminal, agentic AI loop, agentic browser, agentic notebook, and deep Snowflake awareness.
Consuming Delta Shares in Horizon Catalog (General availability)
Snowflake builds for interoperability. Horizon Catalog is the metadata hub for your entire data estate, giving every team a single, unified window into every data asset regardless of where it lives or what format it uses. Today we expand that commitment. Consuming Delta Shares as a Catalog Linked Database in Horizon Catalog is now generally available.
Tag-based data protection policies (Public Preview)
Tag-based policy support is now available in public preview for aggregation policies, row access policies, projection policies, and join policies. This feature allows you to assign data protection policies to tags, automatically protecting any objects that have the tag assigned to them.
Warehouse-level statement timeouts (Beta)
You can now set a statement timeout on a single SQL warehouse so that different warehouses can apply different timeouts to their queries. Set the timeout with the statement_timeout field in the Create or Update warehouse APIs. This feature is in Beta and is API-only. See Warehouse-level timeout .
Reddit Ads connector is now available in Beta
The managed Reddit Ads connector in Lakeflow Connect is now available in Beta. You can use the connector to ingest advertising campaign data and performance metrics from Reddit Ads into Databricks. See Reddit Ads connector .
Context-based ingress control for workspaces public access is now generally available
Context-based ingress control for workspaces public access is now generally available. Control who can reach your workspace endpoints using allow and deny rules that allow you to combine identities, network sources, and request types. See Context-based ingress control .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Cloudflare One Client for Windows (version 2026.6.880.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Cloudflare One Client for macOS (version 2026.6.880.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Cloudflare One Client for Linux (version 2026.6.880.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers.
Sandbox SDK - Run Devin on Cloudflare using Devin Outposts
Devin Outposts ↗ lets you run Devin agents on Cloudflare. Each Devin session runs in its own isolated sandbox backed by Cloudflare Containers , so agents can execute code and use development tooling in an isolated environment.
SSL/TLS - Faster and more secure TLS handshakes to your origins, automatically
Cloudflare now takes the guesswork out of TLS 1.3 key agreement with your origins. Automatic key exchange predicts the preferred algorithm and sends its key share in the first ClientHello , helping avoid a HelloRetryRequest and one extra network round trip. Automatic key exchange is on for all existing zones and on by default for new zones.
WAF Release - 2026-07-21
This release introduces new rules for vulnerabilities in Adobe ColdFusion, Next.js, WordPress alongside updates to existing rules thereby providing enhanced generic protections against Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS).
Agents, Workers - Agents SDK reduces MCP schema conversion, adds exposure controls for MCP in Think and Code Mode SDK adds direct host APIs
This release reduces repeated MCP schema conversion and adds an opt-out for Think's automatic MCP tool exposure. It also lets non-AI-SDK hosts invoke the durable Code Mode runtime directly. Control direct MCP tool exposure in Think Agents SDK MCP clients now reuse converted input and output schemas while a live connection keeps the same tool catalog.
Access - Browser-based login for plaintext HTTP private applications
Cloudflare Access now uses the standard browser-based login flow for private applications served over plaintext HTTP on port 80 . Previously, plaintext HTTP private apps fell back to the same session flow used for SSH, RDP, and other non-HTTP protocols: users got an Authentication required pop-up from the Cloudflare One Client, then had to select the...