Skip to content
Cloudflare Docs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds
All products
hero image

  1. Cloudflare Queues now available on Workers Free plan

    Queues

    Cloudflare Queues is now part of the Workers free plan, offering guaranteed message delivery across up to 10,000 queues to either Cloudflare Workers or HTTP pull consumers. Every Cloudflare account now includes 10,000 operations per day across reads, writes, and deletes. For more details on how each operation is defined, refer to Queues pricing ↗.

    All features of the existing Queues functionality are available on the free plan, including unlimited event subscriptions. Note that the maximum retention period on the free tier, however, is 24 hours rather than 14 days.

    If you are new to Cloudflare Queues, follow this guide ↗ or try one of our tutorials to get started.

  1. Visualize your Workflows in the Cloudflare dashboard

    Workflows Workers

    Cloudflare Workflows now automatically generates visual diagrams from your code

    Your Workflow is parsed to provide a visual map of the Workflow structure, allowing you to:

    • Understand how steps connect and execute
    • Visualize loops and nested logic
    • Follow branching paths for conditional logic
    Example diagram

    You can collapse loops and nested logic to see the high-level flow, or expand them to see every step.

    Workflow diagrams are available in beta for all JavaScript and TypeScript Workflows. Find your Workflows in the Cloudflare dashboard ↗ to see their diagrams.

  1. Agents SDK v0.3.7: Workflows integration, synchronous state, and scheduleEvery()

    Agents Workflows

    The latest release of the Agents SDK ↗ brings first-class support for Cloudflare Workflows, synchronous state management, and new scheduling capabilities.

    Cloudflare Workflows integration

    Agents excel at real-time communication and state management. Workflows excel at durable execution. Together, they enable powerful patterns where Agents handle WebSocket connections while Workflows handle long-running tasks, retries, and human-in-the-loop flows.

    Use the new AgentWorkflow class to define workflows with typed access to your Agent:

    JavaScript
    import { AgentWorkflow } from "agents/workflows";
    export class ProcessingWorkflow extends AgentWorkflow {
      async run(event, step) {
        // Call Agent methods via RPC
        await this.agent.updateStatus(event.payload.taskId, "processing");
    

        // Non-durable: progress reporting to clients
        await this.reportProgress({ step: "process", percent: 0.5 });
        this.broadcastToClients({ type: "update", taskId: event.payload.taskId });
    

        // Durable via step: idempotent, won't repeat on retry
        await step.mergeAgentState({ taskProgress: 0.5 });
    

        const result = await step.do("process", async () => {
          return processData(event.payload.data);
        });
    

        await step.reportComplete(result);
        return result;
      }
    }

    Start workflows from your Agent with runWorkflow() and handle lifecycle events:

    JavaScript
    export class MyAgent extends Agent {
      async startTask(taskId, data) {
        const instanceId = await this.runWorkflow("PROCESSING_WORKFLOW", {
          taskId,
          data,
        });
        return { instanceId };
      }
    

      async onWorkflowProgress(workflowName, instanceId, progress) {
        this.broadcast(JSON.stringify({ type: "progress", progress }));
      }
    

      async onWorkflowComplete(workflowName, instanceId, result) {
        console.log(`Workflow ${instanceId} completed`);
      }
    

      async onWorkflowError(workflowName, instanceId, error) {
        console.error(`Workflow ${instanceId} failed:`, error);
      }
    }

    Key workflow methods on your Agent:

    • runWorkflow(workflowName, params, options?) — Start a workflow with optional metadata
    • getWorkflow(workflowId) / getWorkflows(criteria?) — Query workflows with cursor-based pagination
    • approveWorkflow(workflowId) / rejectWorkflow(workflowId) — Human-in-the-loop approval flows
    • pauseWorkflow(), resumeWorkflow(), terminateWorkflow() — Workflow control

    Synchronous setState()

    State updates are now synchronous with a new validateStateChange() validation hook:

    JavaScript
    export class MyAgent extends Agent {
      validateStateChange(oldState, newState) {
        // Return false to reject the change
        if (newState.count < 0) return false;
        // Return modified state to transform
        return { ...newState, lastUpdated: Date.now() };
      }
    }

    scheduleEvery() for recurring tasks

    The new scheduleEvery() method enables fixed-interval recurring tasks with built-in overlap prevention:

    JavaScript
    // Run every 5 minutes
    await this.scheduleEvery("syncData", 5 * 60 * 1000, { source: "api" });

    Callable system improvements

    • Client-side RPC timeout — Set timeouts on callable method invocations
    • StreamingResponse.error(message) — Graceful stream error signaling
    • getCallableMethods() — Introspection API for discovering callable methods
    • Connection close handling — Pending calls are automatically rejected on disconnect
    JavaScript
    await agent.call("method", [args], {
      timeout: 5000,
      stream: { onChunk, onDone, onError },
    });

    Email and routing enhancements

    Secure email reply routing — Email replies are now secured with HMAC-SHA256 signed headers, preventing unauthorized routing of emails to agent instances.

    Routing improvements:

    • basePath option to bypass default URL construction for custom routing
    • Server-sent identity — Agents send name and agent type on connect
    • New onIdentity and onIdentityChange callbacks on the client
    JavaScript
    const agent = useAgent({
      basePath: "user",
      onIdentity: (name, agentType) => console.log(`Connected to ${name}`),
    });

    Upgrade

    To update to the latest version:

    Terminal window
    npm i agents@latest

    For the complete Workflows API reference and patterns, see Run Workflows.

  1. Improve Global Upload Performance with R2 Local Uploads - Now in Open Beta

    R2

    Local Uploads is now available in open beta. Enable it on your R2 bucket to improve upload performance when clients upload data from a different region than your bucket. With Local Uploads enabled, object data is written to storage infrastructure near the client, then asynchronously replicated to your bucket. The object is immediately accessible and remains strongly consistent throughout. Refer to How R2 works for details on how data is written to your bucket.

    In our tests, we observed up to 75% reduction in Time to Last Byte (TTLB) for upload requests when Local Uploads is enabled.

    Local Uploads latency comparison showing p50 TTLB dropping from around 2 seconds to 500ms after enabling Local Uploads

    This feature is ideal when:

    • Your users are globally distributed
    • Upload performance and reliability is critical to your application
    • You want to optimize write performance without changing your bucket's primary location

    To enable Local Uploads on your bucket, find Local Uploads in your bucket settings in the Cloudflare Dashboard ↗, or run:

    Terminal window
    npx wrangler r2 bucket local-uploads enable <BUCKET_NAME>

    Enabling Local Uploads on a bucket is seamless: existing uploads will complete as expected and there’s no interruption to traffic. There is no additional cost to enable Local Uploads. Upload requests incur the standard Class A operation costs same as upload requests made without Local Uploads.

    For more information, refer to Local Uploads.

  1. Threat actor identification with "also known as" aliases

    Security Center

    Identifying threat actors can be challenging, because naming conventions often vary across the security industry. To simplify your research, Cloudflare Threat Events now include an Also known as field, providing a list of common aliases and industry-standard names for the groups we track.

    This new field is available in both the Cloudflare dashboard and via the API. In the dashboard, you can view these aliases by expanding the event details side panel (under the Attacker field) or by adding it as a column in your configurable table view.

    Key benefits

    • Easily map Cloudflare-tracked actors to the naming conventions used by other vendors without manual cross-referencing.
    • Quickly identify if a detected threat actor matches a group your team is already monitoring via other intelligence feeds.

    For more information on how to access this data, refer to the Threat Events API documentation ↗.

  1. Improved Accessibility and Search for Monitoring

    Email security

    We have updated the Monitoring page to provide a more streamlined and insightful experience for administrators, improving both data visualization and dashboard accessibility.

    • Enhanced Visual Layout: Optimized contrast and the introduction of stacked bar charts for clearer data visualization and trend analysis. visual-example
    • Improved Accessibility & Usability:
      • Widget Search: Added search functionality to multiple widgets, including Policies, Submitters, and Impersonation.
      • Actionable UI: All available actions are now accessible via dedicated buttons.
      • State Indicators: Improved UI states to clearly communicate loading, empty datasets, and error conditions. buttons-example
    • Granular Data Breakdowns: New views for dispositions by month, malicious email details, link actions, and impersonations. monthly-example

    This applies to all Email Security packages:

    • Advantage
    • Enterprise
    • Enterprise + PhishGuard

  1. WAF Release - 2026-02-02

    WAF

    This week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.

    Key Findings

    • CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the Q() class.
    • CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.
    RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
    Cloudflare Managed Ruleset N/AXWiki - Remote Code Execution - CVE:CVE-2025-24893 2LogBlockThis is a new detection.
    Cloudflare Managed Ruleset N/ADjango SQLI - CVE:CVE-2025-64459LogBlockThis is a new detection.
    Cloudflare Managed Ruleset N/ANoSQL, MongoDB - SQLi - Comparison - 2BlockBlockRule metadata description refined. Detection unchanged.

  1. Reduced minimum cache TTL for Workers KV to 30 seconds

    KV

    The minimum cacheTtl parameter for Workers KV has been reduced from 60 seconds to 30 seconds. This change applies to both get() and getWithMetadata() methods.

    This reduction allows you to maintain more up-to-date cached data and have finer-grained control over cache behavior. Applications requiring faster data refresh rates can now configure cache durations as low as 30 seconds instead of the previous 60-second minimum.

    The cacheTtl parameter defines how long a KV result is cached at the global network location it is accessed from:

    JavaScript
    // Read with custom cache TTL
    const value = await env.NAMESPACE.get("my-key", {
      cacheTtl: 30, // Cache for minimum 30 seconds (previously 60)
    });
    

    // getWithMetadata also supports the reduced cache TTL
    const valueWithMetadata = await env.NAMESPACE.getWithMetadata("my-key", {
      cacheTtl: 30, // Cache for minimum 30 seconds
    });

    The default cache TTL remains unchanged at 60 seconds. Upgrade to the latest version of Wrangler to be able to use 30 seconds cacheTtl.

    This change affects all KV read operations using the binding API. For more information, consult the Workers KV cache TTL documentation.

  1. BGP over GRE and IPsec tunnels

    Cloudflare WAN Magic Transit Cloudflare One

    Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using IPsec and GRE tunnel on-ramps (beta).

    Using BGP peering allows customers to:

    • Automate the process of adding or removing networks and subnets.
    • Take advantage of failure detection and session recovery features.

    With this functionality, customers can:

    • Establish an eBGP session between their devices and the Magic WAN / Magic Transit service when connected via IPsec and GRE tunnel on-ramps.
    • Secure the session by MD5 authentication to prevent misconfigurations.
    • Exchange routes dynamically between their devices and their Magic routing table.

    For configuration details, refer to:

  1. Launching FLUX.2 [klein] 9B on Workers AI

    Workers AI

    We have partnered with Black Forest Labs (BFL) again to bring their optimized FLUX.2 [klein] 9B model to Workers AI. This distilled model offers enhanced quality compared to the 4B variant, while maintaining cost-effective pricing. With a fixed 4-step inference process, Klein 9B is ideal for rapid prototyping and real-time applications where both speed and quality matter.

    Read the BFL blog ↗ to learn more about the model itself, or try it out yourself on our multi modal playground ↗.

    Pricing documentation is available on the model page or pricing page.

    Workers AI platform specifics

    The model hosted on Workers AI is optimized for speed with a fixed 4-step inference process and supports up to 4 image inputs. Since this is a distilled model, the steps parameter is fixed at 4 and cannot be adjusted. Like FLUX.2 [dev] and FLUX.2 [klein] 4B, this image model uses multipart form data inputs, even if you just have a prompt.

    With the REST API, the multipart form data input looks like this:

    Terminal window
    curl --request POST \
      --url 'https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/black-forest-labs/flux-2-klein-9b' \
      --header 'Authorization: Bearer {TOKEN}' \
      --header 'Content-Type: multipart/form-data' \
      --form 'prompt=a sunset at the alps' \
      --form width=1024 \
      --form height=1024

    With the Workers AI binding, you can use it as such:

    JavaScript
    const form = new FormData();
    form.append("prompt", "a sunset with a dog");
    form.append("width", "1024");
    form.append("height", "1024");
    

    // FormData doesn't expose its serialized body or boundary. Passing it to a
    // Request (or Response) constructor serializes it and generates the Content-Type
    // header with the boundary, which is required for the server to parse the multipart fields.
    const formResponse = new Response(form);
    const formStream = formResponse.body;
    const formContentType = formResponse.headers.get('content-type');
    

    const resp = await env.AI.run("@cf/black-forest-labs/flux-2-klein-9b", {
      multipart: {
        body: formStream,
        contentType: formContentType,
      },
    });

    The parameters you can send to the model are detailed here:

    JSON Schema for Model Required Parameters

    • prompt (string) - Text description of the image to generate

    Optional Parameters

    • input_image_0 (string) - Binary image
    • input_image_1 (string) - Binary image
    • input_image_2 (string) - Binary image
    • input_image_3 (string) - Binary image
    • guidance (float) - Guidance scale for generation. Higher values follow the prompt more closely
    • width (integer) - Width of the image, default 1024 Range: 256-1920
    • height (integer) - Height of the image, default 768 Range: 256-1920
    • seed (integer) - Seed for reproducibility

    Note: Since this is a distilled model, the steps parameter is fixed at 4 and cannot be adjusted.

    Multi-reference images

    The FLUX.2 klein-9b model supports generating images based on reference images, just like FLUX.2 [dev] and FLUX.2 [klein] 4B. You can use this feature to apply the style of one image to another, add a new character to an image, or iterate on past generated images. You would use it with the same multipart form data structure, with the input images in binary. The model supports up to 4 input images.

    For the prompt, you can reference the images based on the index, like take the subject of image 1 and style it like image 0 or even use natural language like place the dog beside the woman.

    You must name the input parameter as input_image_0, input_image_1, input_image_2, input_image_3 for it to work correctly. All input images must be smaller than 512x512.

    Terminal window
    curl --request POST \
      --url 'https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/ai/run/@cf/black-forest-labs/flux-2-klein-9b' \
      --header 'Authorization: Bearer {TOKEN}' \
      --header 'Content-Type: multipart/form-data' \
      --form 'prompt=take the subject of image 1 and style it like image 0' \
      --form input_image_0=@/Users/johndoe/Desktop/icedoutkeanu.png \
      --form input_image_1=@/Users/johndoe/Desktop/me.png \
      --form width=1024 \
      --form height=1024

    Through Workers AI Binding:

    JavaScript
    //helper function to convert ReadableStream to Blob
    async function streamToBlob(stream: ReadableStream, contentType: string): Promise<Blob> {
      const reader = stream.getReader();
      const chunks = [];
    

      while (true) {
        const { done, value } = await reader.read();
        if (done) break;
        chunks.push(value);
      }
    

      return new Blob(chunks, { type: contentType });
    }
    

    const image0 = await fetch("http://image-url");
    const image1 = await fetch("http://image-url");
    const form = new FormData();
    

    const image_blob0 = await streamToBlob(image0.body, "image/png");
    const image_blob1 = await streamToBlob(image1.body, "image/png");
    form.append('input_image_0', image_blob0)
    form.append('input_image_1', image_blob1)
    form.append('prompt', 'take the subject of image 1 and style it like image 0')
    

    // FormData doesn't expose its serialized body or boundary. Passing it to a
    // Request (or Response) constructor serializes it and generates the Content-Type
    // header with the boundary, which is required for the server to parse the multipart fields.
    const formResponse = new Response(form);
    const formStream = formResponse.body;
    const formContentType = formResponse.headers.get('content-type');
    

    const resp = await env.AI.run("@cf/black-forest-labs/flux-2-klein-9b", {
        multipart: {
            body: formStream,
            contentType: formContentType
        }
    })

  1. WARP client for Windows (version 2026.1.89.1)

    Zero Trust WARP Client

    A new Beta release for the Windows WARP client is now available on the beta releases downloads page.

    This release contains minor fixes, improvements, and new features.

    Changes and improvements

    • Improvements to multi-user mode. Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost.
    • Added a new feature to manage NetBIOS over TCP/IP functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in device profile settings.
    • Fixed an issue causing failure of the local network exclusion feature when configured with a timeout of 0.
    • Improvement for the Windows client certificate posture check to ensure logged results are from checks that run once users log in.
    • Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard.

    Known issues

    • For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum Windows 11 24H2 KB5062553 or higher for resolution.

    • Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to version 1.429.19.0 or later.

    • DNS resolution may be broken when the following conditions are all true:

      • WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
      • A custom DNS server address is configured on the primary network adapter.
      • The custom DNS server address on the primary network adapter is changed while WARP is connected.

      To work around this issue, reconnect the WARP client by toggling off and back on.

  1. WARP client for macOS (version 2026.1.89.1)

    Zero Trust WARP Client

    A new Beta release for the macOS WARP client is now available on the beta releases downloads page.

    This release contains minor fixes and improvements.

    Changes and improvements

    • Fixed an issue causing failure of the local network exclusion feature when configured with a timeout of 0.
    • Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard.

  1. Configure Cloudflare source IPs (beta)

    Cloudflare One Cloudflare WAN

    Cloudflare source IPs are the IP addresses used by Cloudflare services (such as Load Balancing, Gateway, and Browser Isolation) when sending traffic to your private networks.

    For customers using legacy mode routing, traffic to private networks is sourced from public Cloudflare IPs, which may cause IP conflicts. For customers using Unified Routing mode (beta), traffic to private networks is sourced from dedicated, non-Internet-routable private IPv4 range to ensure:

    • Symmetric routing over private network connections
    • Proper firewall state preservation
    • Private traffic stays on secure paths

    Key details:

    • IPv4: Sourced from 100.64.0.0/12 by default, configurable to any /12 CIDR
    • IPv6: Sourced from 2606:4700:cf1:5000::/64 (not configurable)
    • Affected connectors: GRE, IPsec, CNI, WARP Connector, and WARP Client (Cloudflare Tunnel is not affected)

    Configuring Cloudflare source IPs requires Unified Routing (beta) and the Cloudflare One Networks Write permission.

    For configuration details, refer to Configure Cloudflare source IPs.

  1. Added Timezone preferences settings

    Cloudflare Fundamentals

    You can now set the timezone in the Cloudflare dashboard as Coordinated Universal Time (UTC) or your browser or system's timezone.

    What's New

    Unless otherwise specified in the user interface, all dates and times in the Cloudflare dashboard are now displayed in the selected timezone.

    You can change the timezone setting from the user profile dropdown.

    Timezone preference dropdown

    The page will reload to apply the new timezone setting.

  1. Control request and response body buffering in Configuration Rules

    Rules

    You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules.

    Request body buffering

    Controls how Cloudflare buffers HTTP request bodies before forwarding them to your origin server:

    ModeBehavior
    Standard (default)Cloudflare can inspect a prefix of the request body for enabled functionality such as WAF and Bot Management.
    FullBuffers the entire request body before sending to origin.
    NoneNo buffering — the request body streams directly to origin without inspection.

    Response body buffering

    Controls how Cloudflare buffers HTTP response bodies before forwarding them to the client:

    ModeBehavior
    Standard (default)Cloudflare can inspect a prefix of the response body for enabled functionality.
    NoneNo buffering — the response body streams directly to the client without inspection.

    API example

    {
      "action": "set_config",
      "action_parameters": {
        "request_body_buffering": "standard",
        "response_body_buffering": "none"
      }
    }

    For more information, refer to Configuration Rules.

  1. WAF Release - 2026-01-26

    WAF

    This week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗).

    Key Findings

    • CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗) affects react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages.
    • Attackers can send crafted HTTP requests to Server Function endpoints, causing server crashes, out-of-memory exceptions, or excessive CPU usage.
    RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
    Cloudflare Managed Ruleset N/AReact Server - DOS - CVE:CVE-2026-23864 - 1N/ABlockThis is a new detection.
    Cloudflare Managed Ruleset N/AReact Server - DOS - CVE:CVE-2026-23864 - 2N/ABlockThis is a new detection.
    Cloudflare Managed Ruleset N/AReact Server - DOS - CVE:CVE-2026-23864 - 3N/ABlockThis is a new detection.

  1. New 2FA Experience for Login

    Cloudflare Fundamentals
    Screenshot of new 2FA enrollment experience

    In an effort to improve overall user security, users without 2FA will be prompted upon login to enroll in email 2FA. This will improve user security posture while minimizing friction. Users without email 2FA enabled will see a prompt to secure their account with additional factors upon logging in. Enrolling in 2FA remains optional, but strongly encouraged as it is the best way to prevent account takeovers.

    We also made changes to existing 2FA screens to improve the user experience. Now we have distinct experiences for each 2FA factor type, reflective of the way that factor works.

    For more information

  1. Increased Pages file limit to 100,000 for paid plans

    Pages

    Paid plans can now have up to 100,000 files per Pages site, increased from the previous limit of 20,000 files.

    To enable this increased limit, set the environment variable PAGES_WRANGLER_MAJOR_VERSION=4 in your Pages project settings.

    The Free plan remains at 20,000 files per site.

    For more details, refer to the Pages limits documentation.

  1. Vectorize indexes now support up to 10 million vectors

    Vectorize

    You can now store up to 10 million vectors in a single Vectorize index, doubling the previous limit of 5 million vectors. This enables larger-scale semantic search, recommendation systems, and retrieval-augmented generation (RAG) applications without splitting data across multiple indexes.

    Vectorize continues to support indexes with up to 1,536 dimensions per vector at 32-bit precision. Refer to the Vectorize limits documentation for complete details.

  1. New cryptographic functions — encode_base64() and sha256()

    Rules

    Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions. These functions support common patterns like constructing a canonical string from request attributes, computing a SHA256 digest, and Base64-encoding the result.

    New functions

    FunctionDescriptionAvailability
    encode_base64(input, flags)Encodes a string to Base64 format. Optional flags parameter: u for URL-safe encoding, p for padding (adds = characters to make the output length a multiple of 4, as required by some systems). By default, output is standard Base64 without padding.All plans (in header transform rules)
    sha256(input)Computes a SHA256 hash of the input string.Requires enablement

    Examples

    Encode a string to Base64 format:

    encode_base64("hello world")

    Returns: aGVsbG8gd29ybGQ

    Encode a string to Base64 format with padding:

    encode_base64("hello world", "p")

    Returns: aGVsbG8gd29ybGQ=

    Perform a URL-safe Base64 encoding of a string:

    encode_base64("hello world", "u")

    Returns: aGVsbG8gd29ybGQ

    Compute the SHA256 hash of a secret token:

    sha256("my-token")

    Returns a hash that your origin can validate to authenticate requests.

    Compute the SHA256 hash of a string and encode the result to Base64 format:

    encode_base64(sha256("my-token"))

    Combines hashing and encoding for systems that expect Base64-encoded signatures.

    For more information, refer to the Functions reference.

  1. New Placement Hints for Workers

    Workers

    You can now configure Workers to run close to infrastructure in legacy cloud regions to minimize latency to existing services and databases. This is most useful when your Worker makes multiple round trips.

    To set a placement hint, set the placement.region property in your Wrangler configuration file:

    {
      "placement": {
        "region": "aws:us-east-1",
      },
    }

    Placement hints support Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure region identifiers. Workers run in the Cloudflare data center ↗ with the lowest latency to the specified cloud region.

    If your existing infrastructure is not in these cloud providers, expose it to placement probes with placement.host for layer 4 checks or placement.hostname for layer 7 checks. These probes are designed to locate single-homed infrastructure and are not suitable for anycasted or multicasted resources.

    {
      "placement": {
        "host": "my_database_host.com:5432",
      },
    }
     
    {
      "placement": {
        "hostname": "my_api_server.com",
      },
    }

    This is an extension of Smart Placement, which automatically places your Workers closer to back-end APIs based on measured latency. When you do not know the location of your back-end APIs or have multiple back-end APIs, set mode: "smart":

    {
      "placement": {
        "mode": "smart",
      },
    }

  1. AI Search path filtering for website and R2 data sources

    AI Search

    AI Search now includes path filtering for both website and R2 data sources. You can now control which content gets indexed by defining include and exclude rules for paths.

    By controlling what gets indexed, you can improve the relevance and quality of your search results. You can also use path filtering to split a single data source across multiple AI Search instances for specialized search experiences.

    Path filtering configuration in AI Search

    Path filtering uses micromatch ↗ patterns, so you can use * to match within a directory and ** to match across directories.

    Use caseIncludeExclude
    Index docs but skip drafts**/docs/****/docs/drafts/**
    Keep admin pages out of results—**/admin/**
    Index only English content**/en/**—

    Configure path filters when creating a new instance or update them anytime from Settings. Check out path filtering to learn more.

  1. Create AI Search instances programmatically via REST API

    AI Search

    You can now create AI Search instances programmatically using the API. For example, use the API to create instances for each customer in a multi-tenant application or manage AI Search alongside your other infrastructure.

    If you have created an AI Search instance via the dashboard before, you already have a service API token registered and can start creating instances programmatically right away. If not, follow the API guide to set up your first instance.

    For example, you can now create separate search instances for each language on your website:

    Terminal window
    for lang in en fr es de; do
      curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/ai-search/instances" \
        -H "Authorization: Bearer $API_TOKEN" \
        -H "Content-Type: application/json" \
        --data '{
          "id": "docs-'"$lang"'",
          "type": "web-crawler",
          "source": "example.com",
          "source_params": {
            "path_include": ["**/'"$lang"'/**"]
          }
        }'
    done

    Refer to the REST API reference for additional configuration options.

  1. New Workers KV Dashboard UI

    KV

    Workers KV has an updated dashboard UI with new dashboard styling that makes it easier to navigate and see analytics and settings for a KV namespace.

    The new dashboard features a streamlined homepage for easy access to your namespaces and key operations, with consistent design with the rest of the dashboard UI updates. It also provides an improved analytics view.

    New KV Dashboard Homepage

    The updated dashboard is now available for all Workers KV users. Log in to the Cloudflare Dashboard ↗ to start exploring the new interface.

  1. Cloudflare Typescript SDK v6.0.0-beta.1 now available

    Cloudflare Fundamentals SDK

    Disclaimer: Please note that v6.0.0-beta.1 is in Beta and we are still testing it for stability.

    Full Changelog: v5.2.0...v6.0.0-beta.1 ↗

    In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

    Some breaking changes were introduced due to bug fixes, also listed below.

    Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

    Breaking Changes

    Addressing - Parameter Requirements Changed

    • BGPPrefixCreateParams.cidr: optional → required
    • PrefixCreateParams.asn: number | null → number
    • PrefixCreateParams.loa_document_id: required → optional
    • ServiceBindingCreateParams.cidr: optional → required
    • ServiceBindingCreateParams.service_id: optional → required

    API Gateway

    • ConfigurationUpdateResponse removed
    • PublicSchema → OldPublicSchema
    • SchemaUpload → UserSchemaCreateResponse
    • ConfigurationUpdateParams.properties removed; use normalize

    CloudforceOne - Response Type Changes

    • ThreatEventBulkCreateResponse: number → complex object with counts and errors

    D1 Database - Query Parameters

    • DatabaseQueryParams: simple interface → union type (D1SingleQuery | MultipleQueries)
    • DatabaseRawParams: same change
    • Supports batch queries via batch array

    DNS Records - Type Renames (21 types)

    All record type interfaces renamed from *Record to short names:

    • RecordResponse.ARecord → RecordResponse.A
    • RecordResponse.AAAARecord → RecordResponse.AAAA
    • RecordResponse.CNAMERecord → RecordResponse.CNAME
    • RecordResponse.MXRecord → RecordResponse.MX
    • RecordResponse.NSRecord → RecordResponse.NS
    • RecordResponse.PTRRecord → RecordResponse.PTR
    • RecordResponse.TXTRecord → RecordResponse.TXT
    • RecordResponse.CAARecord → RecordResponse.CAA
    • RecordResponse.CERTRecord → RecordResponse.CERT
    • RecordResponse.DNSKEYRecord → RecordResponse.DNSKEY
    • RecordResponse.DSRecord → RecordResponse.DS
    • RecordResponse.HTTPSRecord → RecordResponse.HTTPS
    • RecordResponse.LOCRecord → RecordResponse.LOC
    • RecordResponse.NAPTRRecord → RecordResponse.NAPTR
    • RecordResponse.SMIMEARecord → RecordResponse.SMIMEA
    • RecordResponse.SRVRecord → RecordResponse.SRV
    • RecordResponse.SSHFPRecord → RecordResponse.SSHFP
    • RecordResponse.SVCBRecord → RecordResponse.SVCB
    • RecordResponse.TLSARecord → RecordResponse.TLSA
    • RecordResponse.URIRecord → RecordResponse.URI
    • RecordResponse.OpenpgpkeyRecord → RecordResponse.Openpgpkey

    IAM Resource Groups

    • ResourceGroupCreateResponse.scope: optional single → required array
    • ResourceGroupCreateResponse.id: optional → required

    Origin CA Certificates - Parameter Requirements Changed

    • OriginCACertificateCreateParams.csr: optional → required
    • OriginCACertificateCreateParams.hostnames: optional → required
    • OriginCACertificateCreateParams.request_type: optional → required

    Pages

    • Renamed: DeploymentsSinglePage → DeploymentListResponsesV4PagePaginationArray
    • Domain response fields: many optional → required

    Pipelines - v0 to v1 Migration

    • Entire v0 API deprecated; use v1 methods (createV1, listV1, etc.)
    • New sub-resources: Sinks, Streams

    R2

    • EventNotificationUpdateParams.rules: optional → required
    • Super Slurper: bucket, secret now required in source params

    Radar

    • dataSource: string → typed enum (23 values)
    • eventType: string → typed enum (6 values)
    • V2 methods require dimension parameter (breaking signature change)

    Resource Sharing

    • Removed: status_message field from all recipient response types

    Schema Validation

    • Consolidated SchemaCreateResponse, SchemaListResponse, SchemaEditResponse, SchemaGetResponse → PublicSchema
    • Renamed: SchemaListResponsesV4PagePaginationArray → PublicSchemasV4PagePaginationArray

    Spectrum

    • Renamed union members: AppListResponse.UnionMember0 → SpectrumConfigAppConfig
    • Renamed union members: AppListResponse.UnionMember1 → SpectrumConfigPaygoAppConfig

    Workers

    • Removed: WorkersBindingKindTailConsumer type (all occurrences)
    • Renamed: ScriptsSinglePage → ScriptListResponsesSinglePage
    • Removed: DeploymentsSinglePage

    Zero-Trust DLP

    • datasets.create(), update(), get() return types changed
    • PredefinedGetResponse union members renamed to UnionMember0-5

    Zero-Trust Tunnels

    • Removed: CloudflaredCreateResponse, CloudflaredListResponse, CloudflaredDeleteResponse, CloudflaredEditResponse, CloudflaredGetResponse
    • Removed: CloudflaredListResponsesV4PagePaginationArray

    Features

    Abuse Reports (client.abuseReports)

    • Reports: create, list, get
    • Mitigations: sub-resource for abuse mitigations

    AI Search (client.aisearch)

    • Instances: create, update, list, delete, read, stats
    • Items: list, get
    • Jobs: create, list, get, logs
    • Tokens: create, update, list, delete, read

    Connectivity (client.connectivity)

    • Directory Services: create, update, list, delete, get
    • Supports IPv4, IPv6, dual-stack, and hostname configurations

    Organizations (client.organizations)

    • Organizations: create, update, list, delete, get
    • OrganizationProfile: update, get
    • Hierarchical organization support with parent/child relationships

    R2 Data Catalog (client.r2DataCatalog)

    • Catalog: list, enable, disable, get
    • Credentials: create
    • MaintenanceConfigs: update, get
    • Namespaces: list
    • Tables: list, maintenance config management
    • Apache Iceberg integration

    Realtime Kit (client.realtimeKit)

    • Apps: get, post
    • Meetings: create, get, participant management
    • Livestreams: 10+ methods for streaming
    • Recordings: start, pause, stop, get
    • Sessions: transcripts, summaries, chat
    • Webhooks: full CRUD
    • ActiveSession: polls, kick participants
    • Analytics: organization analytics

    Token Validation (client.tokenValidation)

    • Configuration: create, list, delete, edit, get
    • Credentials: update
    • Rules: create, list, delete, bulkCreate, bulkEdit, edit, get
    • JWT validation with RS256/384/512, PS256/384/512, ES256, ES384

    Alerting Silences (client.alerting.silences)

    • create, update, list, delete, get

    IAM SSO (client.iam.sso)

    • create, update, list, delete, get, beginVerification

    Pipelines v1 (client.pipelines)

    • Sinks: create, list, delete, get
    • Streams: create, update, list, delete, get

    Zero-Trust AI Controls / MCP (client.zeroTrust.access.aiControls.mcp)

    • Portals: create, update, list, delete, read
    • Servers: create, update, list, delete, read, sync

    Accounts

    • managed_by field with parent_org_id, parent_org_name

    Addressing LOA Documents

    • auto_generated field on LOADocumentCreateResponse

    Addressing Prefixes

    • delegate_loa_creation, irr_validation_state, ownership_validation_state, ownership_validation_token, rpki_validation_state

    AI

    • Added toMarkdown.supported() method to get all supported conversion formats

    AI Gateway

    • zdr field added to all responses and params

    Alerting

    • New alert type: abuse_report_alert
    • type field added to PolicyFilter

    Browser Rendering

    • ContentCreateParams: refined to discriminated union (Variant0 | Variant1)
    • Split into URL-based and HTML-based parameter variants for better type safety

    Client Certificates

    • reactivate parameter in edit

    CloudforceOne

    • ThreatEventCreateParams.indicatorType: required → optional
    • hasChildren field added to all threat event response types
    • datasetIds query parameter on AttackerListParams, CategoryListParams, TargetIndustryListParams
    • categoryUuid field on TagCreateResponse
    • indicators array for multi-indicator support per event
    • uuid and preserveUuid fields for UUID preservation in bulk create
    • format query parameter ('json' | 'stix2') on ThreatEventListParams
    • createdAt, datasetId fields on ThreatEventEditParams

    Content Scanning

    • Added create(), update(), get() methods

    Custom Pages

    • New page types: basic_challenge, under_attack, waf_challenge

    D1

    • served_by_colo - colo that handled query
    • jurisdiction - 'eu' | 'fedramp'
    • Time Travel (client.d1.database.timeTravel): getBookmark(), restore() - point-in-time recovery

    Email Security

    • New fields on InvestigateListResponse/InvestigateGetResponse: envelope_from, envelope_to, postfix_id_outbound, replyto
    • New detection classification: 'outbound_ndr'
    • Enhanced Finding interface with attachment, detection, field, portion, reason, score
    • Added cursor query parameter to InvestigateListParams

    Gateway Lists

    • New list types: CATEGORY, LOCATION, DEVICE

    Intel

    • New issue type: 'configuration_suggestion'
    • payload field: unknown → typed Payload interface with detection_method, zone_tag

    Leaked Credential Checks

    • Added detections.get() method

    Logpush

    • New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

    Load Balancers

    • Monitor.port: number → number | null
    • Pool.load_shedding: LoadShedding → LoadShedding | null
    • Pool.origin_steering: OriginSteering → OriginSteering | null

    Magic Transit

    • license_key field on connectors
    • provision_license parameter for auto-provisioning
    • IPSec: custom_remote_identities with FQDN support
    • Snapshots: Bond interface, probed_mtu field

    Pages

    • New response types: ProjectCreateResponse, ProjectListResponse, ProjectEditResponse, ProjectGetResponse
    • Deployment methods return specific response types instead of generic Deployment

    Queues

    • Added subscriptions.get() method
    • Enhanced SubscriptionGetResponse with typed event source interfaces
    • New event source types: Images, KV, R2, Vectorize, Workers AI, Workers Builds, Workflows

    R2

    • Sippy: new provider s3 (S3-compatible endpoints)
    • Sippy: bucketUrl field for S3-compatible sources
    • Super Slurper: keys field on source response schemas (specify specific keys to migrate)
    • Super Slurper: pathPrefix field on source schemas
    • Super Slurper: region field on S3 source params

    Radar

    • Added geolocations.list(), geolocations.get() methods
    • Added V2 dimension-based methods (summaryV2, timeseriesGroupsV2) to radar sub-resources

    Resource Sharing

    • Added terminal boolean field to Resource Error interfaces

    Rules

    • Added id field to ItemDeleteParams.Item

    Rulesets

    • New buffering fields on SetConfigRule: request_body_buffering, response_body_buffering

    Secrets Store

    • New scopes: 'dex', 'access' (in addition to 'workers', 'ai_gateway')

    SSL Certificate Packs

    • Response types now proper interfaces (was unknown)
    • Fields now required: id, certificates, hosts, status, type

    Security Center

    • payload field: unknown → typed Payload interface with detection_method, zone_tag

    Shared Types

    • Added: CloudflareTunnelsV4PagePaginationArray pagination class

    Workers

    • Added subdomains.delete() method
    • Worker.references - track external dependencies (domains, Durable Objects, queues)
    • Worker.startup_time_ms - startup timing
    • Script.observability - observability settings with logging
    • Script.tag, Script.tags - immutable ID and tags
    • Placement: support for region, hostname, host-based placement
    • tags, tail_consumers now accept | null
    • Telemetry: traces field, $containers event info, durableObjectId, transactionName, abr_level fields

    Workers for Platforms

    • ScriptUpdateResponse: new fields entry_point, observability, tag, tags
    • placement field now union of 4 variants (smart mode, region, hostname, host)
    • tags, tail_consumers now nullable
    • TagUpdateParams.body now accepts null

    Workflows

    • instance_retention: unknown → typed InstanceRetention interface with error_retention, success_retention
    • New status option: 'restart' added to StatusEditParams.status

    Zero-Trust Devices

    • External emergency disconnect settings (4 new fields)
    • antivirus device posture check type
    • os_version_extra documentation improvements

    Zones

    • New response types: SubscriptionCreateResponse, SubscriptionUpdateResponse, SubscriptionGetResponse

    Zero-Trust Access Applications

    • New ApplicationType values: 'mcp', 'mcp_portal', 'proxy_endpoint'
    • New destination type: ViaMcpServerPortalDestination for MCP server access

    Zero-Trust Gateway

    • Added rules.listTenant() method

    Zero-Trust Gateway - Proxy Endpoints

    • ProxyEndpoint: interface → discriminated union (ZeroTrustGatewayProxyEndpointIP | ZeroTrustGatewayProxyEndpointIdentity)
    • ProxyEndpointCreateParams: interface → union type
    • Added kind field: 'ip' | 'identity'

    Zero-Trust Tunnels

    • WARPConnector*Response: union type → interface

    Deprecations

    • API Gateway: UserSchemas, Settings, SchemaValidation resources
    • Audit Logs: auditLogId.not (use id.not)
    • CloudforceOne: ThreatEvents.get(), IndicatorTypes.list()
    • Devices: public_ip field (use DEX API)
    • Email Security: item_count field in Move responses
    • Pipelines: v0 methods (use v1)
    • Radar: old summary() and timeseriesGroups() methods (use V2)
    • Rulesets: disable_apps, mirage fields
    • WARP Connector: connections field
    • Workers: environment parameter in Domains
    • Zones: ResponseBuffering page rule

    Bug Fixes

    • mcp: correct code tool API endpoint (599703c ↗)
    • mcp: return correct lines on typescript errors (5d6f999 ↗)
    • organization_profile: fix bad reference (d84ea77 ↗)
    • schema_validation: correctly reflect model to openapi mapping (bb86151 ↗)
    • workers: fix tests (2ee37f7 ↗)

    Documentation

    • Added deprecation notices with migration paths
    • api_gateway: deprecate API Shield Schema Validation resources (8a4b20f ↗)
    • Improved JSDoc examples across all resources
    • workers: expose subdomain delete documentation (4f7cc1f ↗)
Search all changelog entries