Releasesby GlyphWAF - WAF Release - 2026-07-29
This release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.
Also shipped Jul 29, 2026Cloudflare in July 2026 →
BigQuery Data Transfer Service adds incremental Klaviyo transfers in preview
Klaviyo transfers to BigQuery can now load data incrementally instead of in full.
Data quality monitoring dashboard (Public preview)
The data quality monitoring dashboard is now available in public preview for Enterprise Edition accounts. The dashboard provides an account-wide view of data quality health in Snowsight.
Upcoming general availability of Unity Gateway
Unity Gateway, the Databricks governance solution for enterprise AI, is scheduled for general availability soon. Built on Unity Catalog, Unity Gateway extends governance to the runtime interactions between models, agents, MCP servers, and tools.
Gemini Enterprise: New data stores and support for new actions (Preview)
The following data stores are available in Public Preview: Compute Engine Egnyte Sourcegraph Tavily Additionally, support for new actions is available in Public Preview for the following data stores: AirOps : Suggest Brand Kit edits and write grid. Egnyte : Create comments, create folders, create links, and upload files. Google Stitch : Edit screens.
[In preview] Public Preview: Azure Monitor Logs mirroring into Microsoft Fabric
This capability shares telemetry from Azure Monitor Log Analytics workspaces into Microsoft Fabric, making observability data available in OneLake as Delta Parquet, the open format, without duplication and with near real-time availability. All Azure Monit
Copilot code review: Agent skills and MCP now generally available
Copilot code review support for agent skills and MCP servers is now generally available for all Copilot Pro, Pro+, Business, and Enterprise users. Previously announced in public preview , these capabilities let you bring your team’s tools, standards, and external context directly into every code review.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Access - Admins can turn on Code Mode by default for MCP portal users
MCP server portals now support four Code Mode policies: Off , Opt-in , On by default , and Enforced . Admins can choose whether Code Mode is unavailable, optional, enabled by default, or required for every session. Existing portals retain their current behavior.
AI Search - Use AI Search with the Agents SDK, AI SDK, and LangChain
You can now use AI Search directly from popular agent frameworks, adding grounded retrieval to an existing app instead of calling the REST API by hand. The new Agents section has guides for the Vercel AI SDK , LangChain , and the Cloudflare Agents SDK .
Workers - Node.js 24 is now the default for Workers Builds
Workers Builds now uses Node.js 24.18.0 by default. The build image preinstalls Node.js 22.23.2 and 24.18.0. You can continue to override the default with the NODE_VERSION environment variable, an .nvmrc file, or a .node-version file. For more information, refer to Override default versions .
1.1.1.1 - Improved DoH JSON formatting for additional record types
Cloudflare is rolling out updated formatting for the data field in the 1.1.1.1 DoH JSON API ( application/dns-json ). During the roll out responses may use either the old or new format. Note These are breaking changes. The DoH JSON format has no formal RFC and its schema is not guaranteed to be stable.
Agents, Workers - Cloudflare MCP servers support the new MCP 2026-07-28 Specification
Cloudflare's product-specific MCP servers now support the new MCP 2026-07-28 Specification. Each request runs on a fresh stateless server without an MCP protocol session or protocol-specific Durable Object. The /mcp endpoint also accepts stateless requests from 2025 Streamable HTTP clients. Most clients can reconnect without configuration changes.
Browser Run adds structured handoff for Human in the Loop
Browser Run now supports structured handoff for Human in the Loop workflows. Using Cloudflare-specific CDP commands , your agent can signal that it needs help, a human steps in through Live View to handle the task, and the agent resumes once the work is done.
Cloudflare One, Gateway - Control Cloudflare Gateway DNS caching with a maximum TTL setting
You can now set a maximum time-to-live (TTL) for DNS responses returned by Gateway. When an upstream DNS record has a TTL that exceeds the configured maximum, Gateway caps it to your specified value. This ensures that DNS policy changes - such as blocking a newly identified malicious domain - take effect faster across all clients.
Workers AI - Select models now require the Workers Paid plan
We are limiting Workers Free plan access to a few resource-intensive models so we can prioritize capacity for the broader Workers AI user base. This helps everyone get a more reliable inference experience, with fewer 429 and 3040 (Out of Capacity) errors.