Releasesby GlyphWorkers - Grant teammates and agents access to specific Workers
You can now grant access to specific Workers and choose from four roles to control the level of access you give teammates, agents, and CI/CD workflows. Choose from four roles to control the level of access: Metadata Read-Only : View settings, metrics, logs, and traces without access to Worker code or the ability to make changes.
Also shipped Sep 15, 2026Cloudflare in September 2026 →
Predict dynamic table refresh behavior with EXPLAIN CHANGES (General availability)
You can now use EXPLAIN CHANGES to predict a dynamic table's refresh behavior before it happens, either for a manual refresh or as part of a DDL change, without applying the change.
Horizon Catalog Explorer UI (Preview)
With this release, the Horizon Catalog Explorer is the default experience for browsing Snowflake objects in Snowsight, replacing Database Explorer. The Horizon Catalog Explorer provides consistent navigation and object detail pages while preserving the tabs and actions that you already use.
Embedding Streamlit in Snowflake apps in external pages (General availability)
Embedding Streamlit in Snowflake apps in external pages is now generally available. You can render a container-runtime app inside a page you host, such as a customer portal or an internal dashboard, using a single tag.
Elastic Channels for Snowpipe Streaming (General availability)
Elastic Channels for Snowpipe Streaming are now generally available. Elastic Channels provide one implicit, server-scaled ingestion path per pipe, so concurrent producers can stream directly to Snowflake tables and supported Snowflake-managed Iceberg tables without managing channel names, lifecycle, ordering, or offset tokens.
Webhook-triggered deployments for Databricks Apps will soon be generally available
Starting in October 2026, webhook-triggered deployments for Databricks Apps will be generally available. Automatically deploy your app when changes are pushed to a connected GitHub or Azure DevOps repository, so your deployed app stays in sync with your repository without manual redeployment. See Deploy a Databricks app .
Sharing foreign Delta tables with OpenSharing is now generally available
Sharing and reading foreign Delta tables with OpenSharing is now generally available. Providers can share Delta-format tables federated from OneLake, a Hive metastore, or AWS Glue, without copying data into Databricks. See Add foreign Delta tables to a share .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Workflows, Workers - Stream Workflow instance events in your Worker or via the API with .subscribe()
You can now stream Workflow instance events via WorkflowInstance.subscribe() and the GET /subscribe API endpoint. Workers and HTTP clients can react to workflow and step events, including attempts, sleeps, waits, and rollbacks, without polling for instance status. A subscription first streams the entire event history of the Workflow instance.
Cloudflare One, Access - Access for Infrastructure now supports tagged targets and tag-based target criteria
Access for Infrastructure now integrates with Resource Tagging . You can attach key-value tags to infrastructure targets and use them in access policies. You can manage tags on targets inline when you create or edit a target or through the central Resource Tagging API . Cloudflare keeps tags in sync across both methods.
WAF Release - 2026-09-15
This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.
Workers, Hyperdrive - Hyperdrive support for Python Workers
Python Workers can now connect to PostgreSQL and MySQL through Hyperdrive. For setup, code examples, and limitations, refer to Use Hyperdrive from Python Workers .
R2, R2 Data Catalog - R2 Data Catalog adds table maintenance visibility and manual queueing
R2 Data Catalog now provides table-level maintenance visibility and manual compaction queueing in the Cloudflare dashboard. These updates make it easier to understand when maintenance is eligible to run, inspect completed operations, and request maintenance without leaving the table view.
Access - Require fresh authentication for SAML identity providers
Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on Require reauthentication in the Cloudflare dashboard, or set force_authn to true through the API. Access will then set ForceAuthn to true in signed and unsigned SAML authentication requests.
AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers
AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials. Turn on Require provider credentials in your gateway settings.
Browser Run - Control which hostnames Browser Run sessions can access
Browser Run now supports guardrails , which limit a browser session's HTTP and HTTPS requests to permitted hostnames. Use guardrails when you need to: Keep a browser workflow limited to a specific website and its subdomains. Load only known third-party APIs, scripts, images, and fonts.