Changelog

The D1 undelete API now only accepts requests for databases that were deleted within the last 7 days. Requests to undelete a database that was deleted more than 7 days ago will fail and return an error.

If you delete a D1 database by mistake, send the undelete request as soon as possible, and no later than 7 days after deletion.

For more information, refer to the undelete D1 database API reference.

Flagship supports nested objects, arrays, and null in evaluation context. Pass user profiles and tag lists directly, then target nested attributes without flattening your application data.

For example, pass a profile and tags when evaluating a flag through the Workers binding:

const enabled = await env.FLAGS.getBooleanValue("new-checkout", false, {
	targetingKey: "user-42",
	profile: { plan: "enterprise" },
	tags: ["beta", "early-access"],
});

const enabled = await env.FLAGS.getBooleanValue("new-checkout", false, {
	targetingKey: "user-42",
	profile: { plan: "enterprise" },
	tags: ["beta", "early-access"],
});

A targeting rule can combine profile.plan equals "enterprise" with tags has "beta" to serve the feature to enterprise users in the beta group. Use dot-separated paths for nested attributes and the has and not_has operators for array membership. Percentage rollouts can also use a nested identifier, such as profile.id, for consistent user assignment.

Structured context works through the Workers binding, the evaluation REST API with a JSON POST body, and the TypeScript, Python, and Go OpenFeature SDKs from version 0.6.0. The SDKs automatically use POST when HTTP evaluation requires structured context.

Refer to targeting rules, the evaluation API, and SDK context support for usage and supported values.

The Cloudflare Radar homepage has been redesigned to make global Internet data easier to explore for broader audiences, including journalists, policymakers, and everyday users, while preserving the depth that technical users rely on.

• Interactive map: Shows Internet traffic and outages around the world, and acts as a starting point for exploring specific countries and trends.
• Curated insights section: Tabbed navigation that highlights summary statistics across Radar data, with a call to action to explore each area in depth.
• Updated interface: Built with Kumo ↗︎ components, the same ones used across Cloudflare products.

As we continue the redesign, all Radar pages will see improvements. Share feedback at radar@cloudflare.com.

For more details, read the blog post ↗︎ or visit Cloudflare Radar ↗︎.

A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page.

This release includes the following highlights:

• Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.
• Added protection against unauthorized modification or uninstallation of the Cloudflare One Client. When enabled, the user will be asked to provide an administrator-generated code when trying to uninstall the client, which will otherwise be blocked.
• The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.

Additional Changes and improvements

• The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.
• When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.
• Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.
• For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.
• warp-diag now includes redacted copies of the deployed MDM files and the names, but not the values, of stored registration secrets. It reports a QUIC path MTU only when one was measured.
• Added the MDM parameters mdm_file_debounce_secs (1–60) and mdm_file_unavailable_debounce_secs (0–300), which set how long the client waits before applying a changed MDM file and before acting on a missing or unreadable one.
• The consumer client home screen now shows when the connection is post-quantum encrypted.
• The client UI no longer starts WMIC or PowerShell processes to collect memory information for crash reports.
• Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.
• Fixed the client window appearing blank or white after an upgrade, at sign-in, after waking from sleep, or after a display change.
• Fixed the client service restarting when a firewall update for captive portal detection stalled while the device was asleep.
• Fixed the client getting stuck in a disconnected state on Windows on Arm devices because leftover tunnel adapters were not removed.
• Fixed the client being unable to connect after an upgrade, downgrade, and upgrade that switched between consumer and Zero Trust registrations. The client now clears the mismatched registration so the user can register again.
• Fixed the client UI looking for one of its libraries in a directory that standard users can create before looking in the installation directory.
• Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.
• Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.
• Added the MDM parameters managed_network_probe_interval_secs (30–300, default 30) and managed_network_probe_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.
• In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution instead of resolving them on the device.
• When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of "IPC error".
• Fixed Windows resetting the Wi-Fi adapter after sign-in or a Wi-Fi restart when the client's firewall rules in Exclude split tunnel mode blocked Windows network connectivity checks. The client now allows those checks.
• Fixed the installer asking the user to close running applications during an upgrade, downgrade or uninstall because other programs loaded the client's Visual C++ runtime libraries through the system PATH. The client now loads these libraries from a private folder so that closing other applications is unnecessary.

Known issues

A Windows DNS client regression may cause connectivity check failures on systems containing large hosts files. While our client includes a mitigation for this issue, users may still experience reduced DNS performance and connectivity check failures.

For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page.

This release includes the following highlights:

• macOS 15.0 is now the minimum supported version. This release does not run on macOS 14.
• Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user.. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.
• The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.

Additional Changes and improvements

• The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.
• When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.
• Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.
• For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.
• warp-diag now includes redacted copies of the deployed MDM files and reports a QUIC path MTU only when one was measured.
• The consumer client home screen now shows when the connection is post-quantum encrypted.
• Fixed a managed registration being removed when the MDM configuration file was briefly missing or unreadable. The client now keeps the last applied policy for 20 seconds after the file becomes unavailable. The new MDM parameters mdm_file_debounce_secs (1–60) and mdm_file_unavailable_debounce_secs (0–300) change how long the client waits before applying a changed file and before acting on a missing one.
• Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.
• Fixed split tunnel updates for hostname-based entries failing when the client tried to remove a route that macOS had not installed.
• Fixed the client UI not showing onboarding on first launch while a notification permission request was pending.
• Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.
• Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.
• Fixed an upgrade sometimes leaving the client without a running service when the previous service was slow to stop. The installer now waits up to 10 seconds for the old service to be removed before starting the new one.
• Fixed the OS version detail stored for a device keeping an outdated value, including the text "Usage: sw_vers…" reported by client versions 2023.5.587.1 through 2024.12.760.0. The client now clears the value the next time it connects.
• Added the MDM parameters managed_network_probe_interval_secs (30–300, default 30) and managed_network_probe_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.
• In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution, instead of resolving them on the device.
• When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of "IPC error".

Known issues

None.

For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Cloudflare's product-specific MCP servers now serve only /mcp. A request to /sse returns 410 Gone with the server's /mcp URL, which most MCP clients show in their connection error.

If your MCP client is configured with an /sse URL, change it to /mcp, for example https://docs.mcp.cloudflare.com/mcp. If you signed in through /sse, your client asks you to sign in again. Connections that already use /mcp are not affected.

Agents SDK v0.30.0 runs PiHarness on Pi 1.4 ↗︎, and makes it recover more reliably from evictions, crashes, and storage errors.

• Hibernation while Pi's tasks sleep. PiHarness passes Pi's new onWake callback to your harness factory. While a task sleeps, such as during a model retry backoff, the Durable Object can hibernate until the task is due instead of staying in memory.
• Parked tasks. Pi 1.4 parks a task that keeps crashing the object instead of restarting it forever. Parked operations show as parked in pending(), and session.retry() runs them again.
• Recovery from storage errors. PiHarness reopens Pi after a storage error instead of failing every call until the object restarts. Its wake-up job retries failed steps with a backoff instead of being dropped.
• Retried model streams. agents/models/pi-ai reports a cut-off or idle model stream as a transient error, so Pi retries the turn instead of failing it.

The Agents SDK v0.30.0 changelog ↗︎ has step-by-step upgrade instructions. Point your coding agent at them and upgrade today:

Copy promptPrompt copied!

Pi 1.4 migrates the session storage in the object's SQLite database to a schema that Pi 1.3 cannot open, so a deployment cannot roll back past this upgrade. Refer to the Pi Durable 1.4.0 changelog ↗︎ for Pi's own breaking changes.

The private keys of eight eMudhra intermediate certificate authorities ↗︎ can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images before 0.12.14 trust these certificates. An HTTPS connection that leaves the container directly, such as one from mountBucket(), backups, gitCheckout(), tunnels, or code that runs in the sandbox, can be intercepted with a forged certificate.

Update immediately. Install @cloudflare/sandbox@0.12.14, change the FROM line in your Dockerfile to the matching image, and redeploy. Keep any -python, -opencode, or -musl suffix on the image tag. The deployment's rollout replaces running sandboxes with ones that use the new image.

FROM docker.io/cloudflare/sandbox:0.12.14

If you use the next prerelease, update to 0.13.0-next.825.1 or later.

If you cannot update yet and use 0.8.7 or later, send all HTTPS through your Worker, so that Cloudflare checks every certificate on port 443 whatever your image trusts:

import { Sandbox, ContainerProxy } from "@cloudflare/sandbox";
export { ContainerProxy };

export class MySandbox extends Sandbox {
	interceptHttps = true;
}

MySandbox.outbound = (request: Request) => fetch(request);

Deploy, then stop running sandboxes so that they restart with the interception certificate. This does not cover TLS on other ports, such as cloudflared tunnels, and clients that ignore the injected certificate fail to connect. For more information, refer to HTTPS traffic.

You do not need to update the SDK, because it makes no TLS connections of its own. Your image decides which certificates your sandboxes trust, so rebuild it and replace the sandboxes that run the old one:

1. Run docker pull for each base image in your Dockerfile, then clear the Docker build cache with docker builder prune --all. wrangler deploy builds with your local images and build cache, so without these steps it can ship the old CA certificates and runtimes. If your Wrangler configuration references an image by digest, build and push a new image and update the digest instead.
2. Deploy your Worker.
3. Stop sandboxes that are still running, for example with this.ctx.container.destroy(). A running sandbox keeps the image it started with until it stops. To restart only the sandboxes whose image is out of date, refer to Roll out a named image update.
4. If you use snapshots, create new ones from sandboxes that run the updated image. A snapshot restores the image it was created from, so an older snapshot brings back the old certificates.

From inside a sandbox, connect to one of the test hosts listed at emudhra.we-have-a-problem.com ↗︎ with each TLS client your code uses, such as curl, node, or bun. Every request should fail:

curl -f https://dv-g3b-emudhra.we-have-a-problem.com/

In the 0.12.13 images, the system CA bundle, Node.js, cloudflared, and pip reject certificates from the compromised intermediates. The images ship updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, cloudflared 2026.10.2, and pip 26.2.2 in the -python image.

0.12.14 updates Bun to 1.4.4, so the bun command and createBackup() uploads of archives of 10 MiB or more reject these certificates too. The -opencode image ships OpenCode 1.19.4 or later, which also runs on Bun 1.4.4.

Starting from version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same.

In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default. Test your path-based routing before that date, as this change may affect which ingress rule matches a request. Configurations without rules requiring Access validation are unaffected.

This setting is currently off by default. To turn it on, run:

cloudflared tunnel --disable-path-normalization=false run <TUNNEL_NAME_OR_UUID>

Alternatively, set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each cloudflared replica and restart it.

For more information, refer to ingress matching and Access validation at the origin.

The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account.

This role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read: viewing selected Tunnels, their IP and hostname routes, and connector host details. It also grants remote log streaming, so support operators can troubleshoot a Tunnel without changing its configuration. The existing Read role does not grant log streaming access.

To assign the role, follow Grant a granular permission. For the available roles, refer to the resource-scoped roles reference.

This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.

For more information, refer to WAF Managed Rules.

This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.

For more information, refer to WAF Managed Rules.

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses an issue building trusted certificate chains.

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses an issue building trusted certificate chains.

The Agents SDK has a new createAI function for the AI SDK and Pi AI. It unifies what workers-ai-provider and ai-gateway-provider did: Workers AI models, AI Gateway catalog models, dynamic routes, and vendor models, through the AI binding or an account id and API token.

workers-ai-provider and ai-gateway-provider are now feature frozen and marked as deprecated. Please migrate at your convenience.

npm i agents

import { createAI } from "agents/models/ai-sdk";
import { streamText } from "ai";

export default {
	async fetch(request, env) {
		const ai = createAI({ binding: env.AI, id: "my-gateway" });

		const result = streamText({
			model: ai("anthropic/claude-opus-5.5", {
				fallback: ["@cf/zai-org/glm-4.7-flash"],
			}),
			prompt: "Write a haiku about Durable Objects",
		});

		return result.toTextStreamResponse();
	},
};

import { createAI } from "agents/models/ai-sdk";
import { streamText } from "ai";

export default {
	async fetch(request: Request, env: Env) {
		const ai = createAI({ binding: env.AI, id: "my-gateway" });

		const result = streamText({
			model: ai("anthropic/claude-opus-5.5", {
				fallback: ["@cf/zai-org/glm-4.7-flash"],
			}),
			prompt: "Write a haiku about Durable Objects",
		});

		return result.toTextStreamResponse();
	},
};

With createAI you get:

• Every model by id. Workers AI @cf/ ids, any model in the AI Gateway catalog, and dynamic routes as dynamic/<route>.
• Vendor model objects. Pass a model from the vendor's own package, such as ai(anthropic("claude-opus-5-5")). It goes unchanged to AI Gateway's provider-native endpoint.
• The binding, or an account id and API token. Use a gateway in another account, or call from outside a Worker.
• Gateway options, fallback, and BYOK. Caching, logging, metadata, retries, byokAlias, zdr, and vendorKey.
• Stream resume. Through the binding, a catalog or dynamic route stream that drops mid-answer resumes.
• Other model types. Embeddings, images, speech, transcription, and reranking in the AI SDK provider, and images in Pi AI.

For AI Search, use ai-search-provider. For more information, refer to Models.

Basin SQL is a serverless, distributed SQL engine for querying Apache Iceberg tables in Basin Catalog. It now supports OFFSET, which lets you skip a specified number of rows when retrieving query results.

Use LIMIT to set the page size and OFFSET to skip earlier rows. With a page size of 100, use OFFSET 0 for the first page, OFFSET 100 for the second, and increase the offset by 100 for each later page. Add ORDER BY on a unique column to keep the row order consistent.

For example, this query returns the second page of 100 rows:

SELECT sale_id, total_amount
FROM my_namespace.sales_data
ORDER BY sale_id
LIMIT 100 OFFSET 100

For syntax and examples, refer to the OFFSET clause in the Basin SQL reference.

This emergency release adds seven rules to the Cloudflare Managed Ruleset to detect anomalous request patterns.

For more information, refer to WAF Managed Rules.

This emergency release adds seven rules to the Cloudflare Free Ruleset to block anomalous request patterns.

For more information, refer to WAF Managed Rules.

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses an issue building trusted certificate chains.

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses an issue building trusted certificate chains.

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses an issue building trusted certificate chains.

Think and Agent Skills now use the workspace from @cloudflare/computer ↗︎ as well as the filesystem tools. A JavaScript execution environment can be configured by adding the WorkerJavaScriptBackend.

@cloudflare/shell is deprecated, and so is Think's createExecuteTool. These will no longer be developed nor supported from today onwards.

import { Think } from "@cloudflare/think";
import { Workspace } from "@cloudflare/computer";
import { WorkerJavaScriptBackend } from "@cloudflare/computer/backends/worker-javascript";

export class MyAgent extends Think {
	workspace = new Workspace({
		storage: this.ctx.storage,
		backends: [
			new WorkerJavaScriptBackend({ id: "js", loader: this.env.LOADER }),
		],
	});
}

import { Think } from "@cloudflare/think";
import { Workspace } from "@cloudflare/computer";
import { WorkerJavaScriptBackend } from "@cloudflare/computer/backends/worker-javascript";

export class MyAgent extends Think<Env> {
	override workspace = new Workspace({
		storage: this.ctx.storage,
		backends: [
			new WorkerJavaScriptBackend({ id: "js", loader: this.env.LOADER }),
		],
	});
}

This is a breaking change. @cloudflare/computer stores files in different tables from @cloudflare/shell, and there is no automatic data migration between workspace formats. To keep an existing workspace, copy its files with the script in Migrating from @cloudflare/shell to @cloudflare/computer ↗︎. Otherwise your agent will start with an empty workspace, though the original data will still be present in the existing tables.

For more information, refer to Think tools.

From Wrangler 4.150.0, wrangler deploy, wrangler versions upload, and wrangler preview generate and upload source maps by default. You no longer need to set upload_source_maps to get stack traces with your original file names and line numbers.

cf deploy also uploads source maps by default. With the Cloudflare Vite plugin 1.64.0 or later, Worker builds generate source maps by default, and cf deploy uploads every source map in the build output.

Remapped stack traces show up in Workers Logs, real-time logs, Tail Workers, and Workers Issues. Source maps are applied after your Worker runs, so they don't affect CPU time, bundle size, or cold starts.

If your Worker uses a custom build, Wrangler uploads any external source maps it finds. Maps it can't resolve, such as inline data: source maps, are skipped instead of failing the upload. Set upload_source_maps to true if you'd prefer the upload to fail.

To opt out with Wrangler, set upload_source_maps to false:

{
	"upload_source_maps": false
}

upload_source_maps = false

To opt out with cf or the Cloudflare Vite plugin, set build.sourcemap to false for your Worker's Vite environment. Refer to Disable source maps.

The Cloudflare API MCP server now supports step-up authorization ↗︎.

Grant only the required scopes when you connect, then authorize more on demand as your agent performs a task. When a tool call needs a scope you have not granted, the server returns an insufficient_scope challenge ↗︎ naming it, and your MCP client asks you to approve it. Scopes you already granted are kept.

To start with the least access, choose Minimal on the consent page when you connect https://mcp.cloudflare.com/mcp. Refer to authorization in MCP.

Available now in all MCP clients that support step-up authorization.

We released Monitor mode at customers' request so they can test Precursor and the Precursor Interstitial without updating bot score.

In Security > Settings, the Precursor Status dropdown now offers Off, Monitor, and Arm. Selecting Arm means Precursor detections can affect bot score and Challenge clearance. Selecting Monitor means Precursor detections do not affect bot score or Challenge clearance.

We also separated the Precursor Interstitial from the mode. Set the sitewide default with Show Interstitial, then add Interstitial Rules to customize it for specific requests. For example, leave Show Interstitial off across most of your site, but require an interstitial Challenge on /checkout to enforce a valid session before purchase.

For more information, refer to the Precursor documentation.