--- title: Changelogs image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) All products ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Apr 28, 2026 1. ### [Account-level enforce DNS-only](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-enforce-dns-only/) [ DNS ](https://edgetunnel-b2h.pages.dev/dns/) You can now disable Cloudflare's reverse proxy across all zones in your account simultaneously using the new `enforce_dns_only` setting. When enabled, Cloudflare responds to DNS queries for all proxied records with your origin IP addresses instead of Cloudflare's anycast IPs. This account-level kill switch is designed for incident response scenarios where you need to quickly route traffic directly to your origin servers. Warning Enabling this setting exposes your origin IP addresses and removes all Cloudflare protections — including DDoS mitigation, WAF, caching, and all other proxy-based features — for every zone in your account. Use with extreme caution and only after proper [preparations](https://edgetunnel-b2h.pages.dev/dns/proxy-status/enforce-dns-only/#preparation). #### Key characteristics * **Account-level** — Affects all zones in the account simultaneously with a single API call. * **Non-destructive** — Does not modify your DNS records. Disabling the setting restores normal proxy behavior. * **API-only** — Available through the API only, not in the Cloudflare dashboard. #### What's affected **Included:** Standard proxied A, AAAA, and CNAME records, Load Balancing records, and records matching Worker routes. **Excluded:** Spectrum applications, Cloudflare Tunnel CNAMEs, R2 custom domains, Web3 gateways, and Workers custom domains continue to operate normally. #### Before you enable * Verify your origin servers can handle direct traffic without Cloudflare's caching and filtering. * Review which origin IPs will become publicly visible through DNS queries. * Test the API in a staging account before relying on it for incident response. #### Availability Available via API to all Cloudflare customers. For information on how to use it, refer to [Enforce DNS-only developer documentation](https://edgetunnel-b2h.pages.dev/dns/proxy-status/enforce-dns-only/) . Apr 28, 2026 1. ### [Realtime backlog metrics now available for Queues](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-improved-queues-metrics/) [ Queues ](https://edgetunnel-b2h.pages.dev/queues/) [Queues](https://edgetunnel-b2h.pages.dev/queues/), Cloudflare's managed message queue, now exposes realtime backlog metrics via the dashboard, REST API, and JavaScript API. Three new fields are available: * **`backlog_count`** — the number of unacknowledged messages in the queue * **`backlog_bytes`** — the total size of those messages in bytes * **`oldest_message_timestamp_ms`** — the timestamp of the oldest unacknowledged message The following endpoints also now include a `metadata.metrics` object on the result field after successful message consumption: * `/accounts/{account_id}/queues/{queue_id}/messages/pull` * `/accounts/{account_id}/queues/{queue_id}/messages` * `/accounts/{account_id}/queues/{queue_id}/messages/batch` #### Javascript APIs Call `env.QUEUE.metrics()` to get realtime backlog metrics: **TypeScript** ```ts const { backlogCount, // number backlogBytes, // number oldestMessageTimestamp, // Date | undefined } = await env.QUEUE.metrics(); ``` `env.QUEUE.send()` and `env.QUEUE.sendBatch()` also now return a metrics object on the response. You can also query these fields via the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/) or view realtime backlog on the [dashboard ↗](https://dash.cloudflare.com/?to=/:account/workers/queues). ![Queues realtime backlog](https://edgetunnel-b2h.pages.dev/_astro/2026-04-28-queues-metrics.BYi0hgrD_149xlT.webp) For more information, refer to [Queues metrics](https://edgetunnel-b2h.pages.dev/queues/observability/metrics/). Apr 28, 2026 1. ### [Direct access to Support from the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-direct-support-navigation/) [ Support ](https://edgetunnel-b2h.pages.dev/support/) #### Direct access to Support from the dashboard The **Support** button in the dashboard global navigation header now takes you directly to the [Cloudflare Support Portal ↗](https://support.cloudflare.com), eliminating the previous dropdown menu. This change ensures that when you need help, you spend less time navigating the UI and more time getting the answers you need. #### What changed? * **Previous behavior**: Selecting **? Support** opened a dropdown menu with various links (Help Center, Cloudflare Community, etc.). * **New behavior**: Selecting **Support** immediately redirects your current tab to the Support Portal. To learn more about the resources available to you, refer to the [Cloudflare Support documentation ↗](https://edgetunnel-b2h.pages.dev/support/contacting-cloudflare-support/). Apr 27, 2026 1. ### [Cache Response Rules now support zone versioning](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-cache-response-rules-zone-versioning/) [ Cache / CDN ](https://edgetunnel-b2h.pages.dev/cache/) Cache Response Rules now work with [Version Management](https://edgetunnel-b2h.pages.dev/version-management/). You can version response-phase cache settings and promote them through environments, just like Cache Rules and other supported configurations. #### What changed Previously, Cache Response Rules were excluded from zone versioning. Any response-phase rule you created applied globally across all environments with no way to test changes in staging first. Cache Rules already supported versioning, but the response phase, where you modify `Cache-Control` directives, manage cache tags, and strip headers, did not. Cache Response Rules are now fully integrated with Version Management. You can create or modify response-phase rules within a version, and those changes stay scoped to that version until promoted. #### Benefits * **Safe rollout of cache behavior changes**: Test response-phase rules in a staging environment before promoting to production. Catch unintended caching side effects early. * **Parity with Cache Rules**: Cache Response Rules now follow the same versioning workflow as Cache Rules, so you can manage all cache configuration through a single promotion pipeline. * **Independent environment control**: Run different response-phase cache settings per environment. For example, strip `Set-Cookie` headers in staging to validate cacheability without affecting production traffic. #### Get started Configure Cache Response Rules in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/:zone/caching/cache-rules) under **Caching** \> **Cache Rules**, or via the [Rulesets API](https://edgetunnel-b2h.pages.dev/ruleset-engine/rulesets-api/). For more details, refer to the [Cache Response Rules documentation](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-response-rules/) and the [Version Management documentation](https://edgetunnel-b2h.pages.dev/version-management/). Apr 27, 2026 1. ### [Structured error responses for Cloudflare 5xx errors](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-structured-responses-for-5xx-errors/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow [RFC 9457 (Problem Details for HTTP APIs) ↗](https://www.rfc-editor.org/rfc/rfc9457) and include a `Retry-After` HTTP header on retryable codes. #### Changes **5xx coverage.** Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. These are errors Cloudflare itself generates when it cannot reach or understand the origin server. Origin-generated 5xx responses that Cloudflare passes through are not affected. **Fault attribution.** The `error_category` field tells agents where the fault lies: * `origin` (502, 504, 520-524) — the origin server is responsible. Transient; retry with the backoff in `retry_after`. * `cloudflare` (500) — Cloudflare's fault, not the website or the request. Short retry. * `ssl` (525, 526) — the origin's TLS configuration is broken. Do not retry. **Retry-After header.** Retryable codes (500, 502, 504, 520-524) include a `Retry-After` HTTP header matching the `retry_after` body field. Non-retryable codes (525, 526) do not include the header. #### Negotiation behavior | Request header sent | Response format | | --------------------------------------------- | -------------------------------------------- | | Accept: application/json | JSON (application/json content type) | | Accept: application/problem+json | JSON (application/problem+json content type) | | Accept: application/json, text/markdown;q=0.9 | JSON | | Accept: text/markdown | Markdown | | Accept: text/markdown, application/json | Markdown (equal q, first-listed wins) | | Accept: \*/\* | HTML (default) | #### Availability Available now for all zones on all plans. #### Get started Get JSON response for error 522: ```bash curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "/cdn-cgi/error/522" | jq . ``` Check presence of the `Retry-After` HTTP header associated with the JSON response for error 521: ```bash curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "/cdn-cgi/error/521" | grep -i retry-after ``` References: * [RFC 9457 — Problem Details for HTTP APIs ↗](https://www.rfc-editor.org/rfc/rfc9457) * [Cloudflare 5xx error documentation](https://edgetunnel-b2h.pages.dev/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/) Apr 27, 2026 1. ### [Resource Tagging enters public beta](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-resource-tagging-public-beta/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Resource Tagging ](https://edgetunnel-b2h.pages.dev/resource-tagging/) Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need. #### What's included * **Broad resource type support** — Tag zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, Durable Object namespaces, Queues, Stream videos, Images, Access applications, Gateway rules, AI Gateways, and more. Refer to the [full list of supported resource types](https://edgetunnel-b2h.pages.dev/resource-tagging/reference/resource-types/). * **Powerful filtering** — Query tagged resources using AND/OR logic, negation, and key-only matching. Combine up to 20 filters per query to build precise resource views. * **Account and zone-level endpoints** — Full CRUD operations across both scopes. * **Token-based authentication** — Tagging supports [Account Owned Tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) that persist independently of individual users, so your automation keeps running through credential rotations and team changes. * **Flexible role support** — Super Administrators, Workers Admins, and Tag Admins can all manage tags. #### API-first by design The API is the primary interface for Resource Tagging and the recommended path for all workflows — scripting tag assignments, building CI/CD pipelines, or integrating with your infrastructure-as-code toolchain. #### Dashboard UI You can also view and manage tagged resources directly in the Cloudflare dashboard. Navigate to **Manage Account** \> **Resource Tagging** to see all tagged resources across your account, filter by resource name or tag, and add or edit tags inline. ![Tagged Resources dashboard](https://edgetunnel-b2h.pages.dev/_astro/tagged-resources-dashboard.Dg5WvwiN_24xl6P.webp) #### What's coming next In future releases, expect support for additional resource types across the Cloudflare platform, tag-based access control policies for scoping user permissions to tagged resources, billing and usage attribution by tag for breaking down costs by team, project, or environment, and Terraform provider support for managing tags declaratively. #### Current limitations * `PUT` replaces all tags on a resource (no partial update). Use the [GET, merge, PUT workflow](https://edgetunnel-b2h.pages.dev/resource-tagging/how-to/manage-tags/#add-a-single-tag) to modify individual tags safely. * `DELETE` removes all tags from a resource. To remove a single tag, PUT the remaining tags back. * Querying tags for a resource that has never been tagged returns `500` instead of `404`. This is a known beta limitation. To get started, refer to the [Resource Tagging documentation](https://edgetunnel-b2h.pages.dev/resource-tagging/). Apr 27, 2026 1. ### [Unified workspace for Brand Protection](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-unified-workspace-brand-protection/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) We have introduced a unified investigation workspace within Brand Protection to help analysts manage complex brand portfolios. Instead of jumping between individual queries, you can now consolidate your workflow into a single, cohesive view. #### What's new * You can now elect multiple saved queries from your dashboard to generate a consolidated "Combined Matches" view. This allows you to triage results from different brand queries in one unified table * You can open query extended views in distinct tabs within the Brand Protection dashboard. This enables you to maintain multiple investigation contexts simultaneously and switch between them without losing your place. * You can reset your workspace using the new "Clear Selection" action, making it easier to pivot between different investigation sets. #### Key benefits * Eliminate fragmented workflows by viewing all matches across different query buckets in a single table, reducing the need to click through dozens of individual query pages * Correlate related campaigns by seeing similar domains or infrastructure patterns that appear across multiple saved queries Learn more in our [Brand Protection documentation](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/). Apr 27, 2026 1. ### [WAF Release - 2026-04-27](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release focuses on new improvements to enhance coverage. **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------- | --------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...80cec1dd | N/A | PostgreSQL - SQLi - COPY - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "PostgreSQL - SQLi - COPY - Body (ID: ...e7265a4e ). The rule previously known as "PostgreSQL - SQLi - COPY" is now renamed to "PostgreSQL - SQLi - COPY - Body". | | Cloudflare Managed Ruleset | ...2903de89 | N/A | PostgreSQL - SQLi - COPY - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1036cfa6 | N/A | PostgreSQL - SQLi - COPY - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...55ff389e | N/A | SQLi - AND/OR MAKE\_SET/ELT - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - AND/OR MAKE\_SET/ELT - Body" (ID: ...252d3934 ). The rule previously known as "SQLi - AND/OR MAKE\_SET/ELT" is now renamed to "SQLi - AND/OR MAKE\_SET/ELT - Body". | | Cloudflare Managed Ruleset | ...346487f9 | N/A | SQLi - AND/OR MAKE\_SET/ELT - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1ac6ceca | N/A | SQLi - AND/OR MAKE\_SET/ELT - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dd471337 | N/A | SQLi - Common Patterns - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Common Patterns - Body" (ID: ...cb5d0b9b ). The rule previously known as "SQLi - Common Patterns" is now renamed to "SQLi - Common Patterns - Body". | | Cloudflare Managed Ruleset | ...975c07b7 | N/A | SQLi - Common Patterns - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...05b1b06b | N/A | SQLi - Common Patterns - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dd0ba3c7 | N/A | SQLi - Equation - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Equation - Body" (ID: ...c2eb3e7f ). The rule previously known as "SQLi - Equation" is now renamed to "SQLi - Equation - Body". | | Cloudflare Managed Ruleset | ...3d1c2384 | N/A | SQLi - Equation - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...e1149ea6 | N/A | SQLi - Equation - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...205adbb0 | N/A | SQLi - AND/OR Digit Operator Digit - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit - Body" (ID: ...3893c564 ). The rule previously known as "SQLi - AND/OR Digit Operator Digit" is now renamed to "SQLi - AND/OR Digit Operator Digit - Body". | | Cloudflare Managed Ruleset | ...ad2abbaa | N/A | SQLi - AND/OR Digit Operator Digit - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...53acbc0d | N/A | SQLi - AND/OR Digit Operator Digit - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...2b45a97d | N/A | SQLi - Benchmark Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Benchmark Function - Body" (ID: ...2ebc44ad ). The rule previously known as "SQLi - Benchmark Function" is now renamed to "SQLi - Benchmark Function - Body". | | Cloudflare Managed Ruleset | ...9889aadc | N/A | SQLi - Benchmark Function - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...491b28e9 | N/A | SQLi - Benchmark Function - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...2aa649de | N/A | SQLi - Comparison - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Comparison - Body" (ID: ...e7907480 ). The rule previously known as "SQLi - Comparison" is now renamed to "SQLi - Comparison - Body". | | Cloudflare Managed Ruleset | ...39e3e013 | N/A | SQLi - Comparison - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...f4bdb492 | N/A | SQLi - Comparison - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a1ff3b34 | N/A | SQLi - String Concatenation - Body - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - String Concatenation - Headers" (ID: ...2116d2fe ).The rule previously known as "SQLi - String Concatenation - Headers" is now renamed to "SQLi - String Concatenation - Body". | | Cloudflare Managed Ruleset | ...0d0e6c3b | N/A | SQLi - String Concatenation - Headers | Log | Block | This is a new detection.(Former Id was ...846d1940 ) | | Cloudflare Managed Ruleset | ...26cc211f | N/A | SQLi - String Concatenation - URI | Log | Block | This is a new detection. (Former Id was ...8fae8c84 ) | | Cloudflare Managed Ruleset | ...eacc78ab | N/A | SQLi - SELECT Expression - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - SELECT Expression - Body" (ID: ...d0023a36 ). The rule previously known as "SQLi - SELECT Expression" is now renamed to "SQLi - SELECT Expression - Body". | | Cloudflare Managed Ruleset | ...630bb223 | N/A | SQLi - SELECT Expression - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dcd6efb5 | N/A | SQLi - SELECT Expression - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...18c47cea | N/A | SQLi - ORD and ASCII - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - ORD and ASCII- Body" (ID: ...d0d207f9 ). The rule previously known as "SQLi - ORD and ASCII" is now renamed to "SQLi - ORD and ASCII- Body". | | Cloudflare Managed Ruleset | ...bdb1618f | N/A | SQLi - ORD and ASCII - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1d0906b6 | N/A | SQLi - ORD and ASCII - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...9fe4eff5 | N/A | SQLi - Destructive Operations | Log | Block | This is a new detection. | Apr 24, 2026 1. ### [Network Session Logs now available for all on-ramps](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-24-nsl-all-onramps/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) [Zero Trust Network Session Logs](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/zero%5Ftrust%5Fnetwork%5Fsessions/) are now generated for all traffic proxied through Cloudflare Gateway, regardless of on-ramp type. This includes traffic from [proxy endpoints (PAC files)](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/) and [Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/) egress — on-ramps that previously did not generate session logs. Customers who already consume the `zero_trust_network_sessions` dataset via [Logpush](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/) or [Log Explorer](https://edgetunnel-b2h.pages.dev/log-explorer/) may see increased log volume if they use these on-ramps. For field definitions, refer to [Zero Trust Network Session Logs](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/zero%5Ftrust%5Fnetwork%5Fsessions/). For traffic analysis, refer to [Network session analytics](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/network-sessions/). Apr 24, 2026 1. ### [Terraform v5.19.0 now available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-24-terraform-v5190-provider/) [ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/) Terraform Provider v5.19.0 introduces 14 new resources spanning AI Gateway, Pipelines, R2 Data Catalog, User Groups, Vulnerability Scanner, Workers Observability, and Zero Trust capabilities. This release significantly improves the v4 to v5 migration experience with automatic state upgraders for 26 resources, working seamlessly with the new [tf-migrate CLI tool ↗](https://github.com/cloudflare/tf-migrate) to automate resource renames, attribute updates, and `moved` block generation. Together, these enhancements reduce manual migration effort and minimize risk when upgrading from v4 to v5. **Note:** `cmd/migrate` is deprecated in favor of `tf-migrate` and will be removed in a future release ([#7062 ↗](https://github.com/cloudflare/terraform-provider-cloudflare/pull/7062)) #### New Resources * **cloudflare\_ai\_gateway**: Manage AI Gateway instances * **cloudflare\_certificate\_authorities\_hostname\_associations**: Manage mTLS certificate hostname associations * **cloudflare\_custom\_page\_asset**: Manage custom page assets * **cloudflare\_pipeline**: Manage Cloudflare Pipelines * **cloudflare\_r2\_data\_catalog**: Manage R2 Data Catalog * **cloudflare\_user\_group**: Manage user groups * **cloudflare\_user\_group\_members**: Manage user group memberships * **cloudflare\_vulnerability\_scanner\_credential**: Manage vulnerability scanner credentials * **cloudflare\_vulnerability\_scanner\_credential\_set**: Manage vulnerability scanner credential sets * **cloudflare\_vulnerability\_scanner\_target\_environment**: Manage vulnerability scanner target environments * **cloudflare\_workers\_observability\_destination**: Manage Workers Observability destinations * **cloudflare\_zero\_trust\_device\_ip\_profile**: Manage Zero Trust device IP profiles * **cloudflare\_zero\_trust\_device\_subnet**: Manage Zero Trust device subnets * **cloudflare\_zero\_trust\_dlp\_settings**: Manage Zero Trust DLP settings #### Features #### V4 to V5 Migration State Upgraders State upgraders added for seamless migration from v4 to v5 for the following resources: * account * account\_member * account\_token * authenticated\_origin\_pulls * authenticated\_origin\_pulls\_hostname\_certificate * byo\_ip\_prefix * custom\_hostname * custom\_ssl * leaked\_credential\_check * leaked\_credential\_check\_rule * logpush\_ownership\_challenge * mtls\_certificate * observatory\_scheduled\_test * pages\_domain * regional\_tiered\_cache * turnstile\_widget * workers\_custom\_domain * zero\_trust\_device\_custom\_profile * zero\_trust\_device\_default\_profile * zero\_trust\_device\_posture\_integration * zero\_trust\_gateway\_certificate * zero\_trust\_gateway\_settings * zero\_trust\_organization * zero\_trust\_tunnel\_cloudflared\_virtual\_network * zone\_setting #### Other Features * **ruleset**: Add `content_converter` and `redirects_for_ai_training` support to configuration rules * **zero\_trust\_gateway\_logging**: Make importable #### Bug Fixes #### Migration & State Management * **account\_member**: Add UseStateForUnknown to status field to prevent drift * **authenticated\_origin\_pulls\_settings**: Fix no prior schema and no-op upgrade * **certificate\_pack**: Initialize empty lists instead of null in state upgrader to prevent drift * **migrations**: Handle ambiguous schema\_version state for v4/v5 coexistence * **zero\_trust\_access\_policy**: Fix nil pointer panic in state upgrader; set PriorSchema nil for v4 state upgrade #### Resource-Specific Fixes * **ai\_search\_instance**: Restore original defaults for cache and cache\_threshold; conflict resolution * **apijson**: Return empty object from MarshalForPatch when no fields are serializable * **dlp\_predefined\_profile**: Eliminate perpetual entries and enabled\_entries drift * **dns\_record**: Avoid unnecessary drift for ipv4\_only and ipv6\_only attributes; remove private\_routing default value * **drift**: Preserve prior state values for optional fields not returned by API * **healthcheck**: Use buildHealthcheckPlanChecks helper for correct plan checks per migration source; update assertions * **leaked\_credential\_check\_rule**: Handle empty ID from v4 provider state migration * **list\_item**: Remove context * **logpush\_job**: Update model for migration * **ruleset**: Fix migration; add redirects\_for\_ai\_training to SourceV4ActionParametersModel; fix duplicate model attribute * **worker**: Add UseStateForUnknown() plan modifiers and update tests for observability.traces * **workers\_custom\_domain**: Handle HTTP 200 no content header; update assertions * **workers\_script**: Fix model drift * **zero\_trust\_access\_identity\_provider**: Fix boolean drifts * **zero\_trust\_device\_managed\_networks**: Upgrade resource state * **zero\_trust\_gateway\_policy**: Make filters Computed+Optional to prevent drift * **zero\_trust\_gateway\_settings**: Fix breaking changes; implement sweeper to reset account to clean defaults * **zone\_setting**: Migration test improvements and fixes #### Documentation * **healthcheck**: Update port description to clarify defaults * Add application-scoped access policy migration guidance * Update zone\_settings\_override migration guide for tf-migrate v2 workflow #### For more information * [Terraform Provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) * [Version 5 Migration Guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-migration) * [Documentation on using Terraform with Cloudflare](https://edgetunnel-b2h.pages.dev/terraform/) Apr 24, 2026 1. ### [Automate migration from Cloudflare's Terraform v4 to v5 provider](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-24-tf-migrate-tool-released/) [ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/) We're excited to announce **tf-migrate**, a purpose-built CLI tool that simplifies migrating from Cloudflare Terraform Provider v4 to v5. #### v5 is stable and ready for production **Terraform Provider v5 is stable and actively receiving updates.** We encourage all users to migrate to v5 to take advantage of ongoing enhancements and new capabilities. Cloudflare uses tf-migrate to migrate our own infrastructure — the same tool we're providing to the community — ensuring the best possible migration experience. #### What tf-migrate does **tf-migrate** automates the tedious and error-prone parts of the v4 to v5 migration process: * **Resource type renames** – Automatically updates `cloudflare_record` → `cloudflare_dns_record`, `cloudflare_access_application` → `cloudflare_zero_trust_access_application`, and 40+ other renamed resources * **Attribute transformations** – Updates field names (e.g., `value` → `content` for DNS records) and restructures nested blocks * **Moved block generation** – Creates Terraform 1.8+ `moved` blocks to prevent resource replacements and ensure zero-downtime migrations * **Cross-file reference updates** – Automatically finds and updates all references to renamed resources across your entire configuration * **Dry-run mode** – Preview all changes before applying them to ensure safety Combined with the automatic state upgraders introduced in v5.19+, tf-migrate eliminates the manual work and risk that previously made v5 migrations challenging. Tf-migrate operates directly on the config, and the built-in state upgraders handle the rest. #### Supported resources Tf-migrate currently supports the most common Terraform resources our customers use. We are actively working to expand coverage, with the most commonly used resources prioritized first. For the complete list of supported resources and their migration status, refer to the [v5 Stabilization Tracker ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/6237). This list is updated regularly as additional resources are stabilized and migration support is added. Resources not yet supported by tf-migrate will need to be migrated manually using the [version 5 upgrade guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade). The upgrade guide provides step-by-step instructions for handling resource renames, attribute changes, and state migrations. #### Get started * [Download tf-migrate ↗](https://github.com/cloudflare/tf-migrate/releases) * [Version 5 Migration Guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-migration) * [Terraform Provider documentation ↗](https://edgetunnel-b2h.pages.dev/terraform/) * [v5 Stabilization Tracker ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/6237) We have been releasing Betas over the past month and a half while testing this tool. See the full changelog of those Betas here: [tf-migrate releases ↗](https://github.com/cloudflare/tf-migrate/releases). Apr 23, 2026 1. ### [AAGUID restrictions and AMR matching for Access independent MFA](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-23-independent-mfa-aaguid-amr/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) [Independent MFA](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/independent-mfa/) in Cloudflare Access now supports two additional organization-level controls: * **[Restrict authenticators by AAGUID](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/independent-mfa/#restrict-authenticators-by-aaguid)** — Limit enrollment to a specific set of WebAuthn authenticators using their [AAGUID ↗](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#authenticator-attestation-guid). This is useful for organizations that require FIPS-validated security keys or company-issued hardware. AAGUIDs are managed through a new [List](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/) type. * **[AMR matching](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/independent-mfa/#use-identity-provider-mfa)** — Skip the independent MFA prompt when the identity provider has already performed an equivalent MFA. Access reads the `amr` claim defined in [RFC 8176 ↗](https://datatracker.ietf.org/doc/html/rfc8176) and matches supported values such as `hwk`, `otp`, and `fpt` to the authenticator types allowed on the application or policy. This prevents users from having to complete MFA twice when their identity provider already enforces it. To get started, refer to [Independent MFA](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/independent-mfa/). Apr 23, 2026 1. ### [Audit Logs v2 — Organization-level support](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-23-audit-logs-v2-organization-level/) [ Audit Logs ](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/review-audit-logs/) Audit Logs v2 now supports organization-level audit logs. Org Admins can retrieve audit events for actions performed at the organization level via the Audit Logs v2 API. To retrieve organization-level audit logs, use the following endpoint: ```bash GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit ``` This release covers user-initiated actions performed through organization-level APIs. Audit logs for system-initiated actions, a dashboard UI, and Logpush support for organizations will be added in future releases. Note Organization-level audit logs are separate from account-level audit logs. Actions performed within a specific account continue to be available via the account-level Audit Logs UI, Audit Logs v2 API, and Logpush. For more information, refer to the [Audit Logs documentation](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/). Apr 23, 2026 1. ### [Go SDK v6.10.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-23-go-sdk-v6100/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)[ Go SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) #### v6.10.0 In this release, you'll see a number of breaking changes. This is primarily due to changes in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes See the [v6.10.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/MIGRATION%5FGUIDE.md) for before/after code examples and actions needed for each change. #### Abuse Reports - Registrar WHOIS Report Field Removals Several fields have been removed from `AbuseReportNewParamsBodyAbuseReportsRegistrarWhoisReportRegWhoRequest`: * `RegWhoGoodFaithAffirmation` * `RegWhoLawfulProcessingAgreement` * `RegWhoLegalBasis` * `RegWhoRequestType` * `RegWhoRequestedDataElements` #### AI Search - Instance Params Restructured The `InstanceNewParams` and `InstanceUpdateParams` types have been significantly restructured. Many fields have been moved or removed: * `InstanceNewParams.TokenID`, `Type`, `CreatedFromAISearchWizard`, `WorkerDomain` removed * `InstanceUpdateParams` — most configuration fields removed (including `IndexMethod`, `IndexingOptions`, `MaxNumResults`, `Metadata`, `Paused`, `PublicEndpointParams`, `Reranking`, `RerankingModel`, `RetrievalOptions`, `RewriteModel`, `RewriteQuery`, `ScoreThreshold`, `SourceParams`, `Summarization`, `SummarizationModel`, `SystemPromptAISearch`, `SystemPromptIndexSummarization`, `SystemPromptRewriteQuery`, `TokenID`, `CreatedFromAISearchWizard`, `WorkerDomain`) * `InstanceSearchParams.Messages` field removed along with `InstanceSearchParamsMessage` and `InstanceSearchParamsMessagesRole` types #### AI Search - InstanceItem Service Removed The `InstanceItemService` type has been removed. The items sub-resource at `client.AISearch.Instances.Items` no longer exists in the non-namespace path. Use `client.AISearch.Namespaces.Instances.Items` instead. #### AI Search - Token Types Removed The following types have been removed from the `ai_search` package: * `TokenDeleteResponse` * `TokenListParams` (and associated `TokenListParamsOrderBy`, `TokenListParamsOrderByDirection`) #### Email Security - Investigate Move Return Type Change The `Investigate.Move.New()` method now returns a raw slice instead of a paginated wrapper: * `New()` returns `*[]InvestigateMoveNewResponse` instead of `*pagination.SinglePage[InvestigateMoveNewResponse]` * `NewAutoPaging()` method removed #### Hyperdrive - Config Params Restructured The `ConfigEditParams` type lost its `MTLS` and `Name` fields. The `HyperdriveMTLSParam` type lost `MTLS` and `Host` fields. The `Host` field on origin config changed from `param.Field[string]` to a plain `string`. #### IAM - UserGroupMember Params and Return Types Changed The `UserGroupMemberNewParams` struct has been restructured and the `New()` method now returns a paginated response: * `UserGroupMemberNewParams.Body` renamed to `UserGroupMemberNewParams.Members` * `UserGroupMemberNewParamsBody` renamed to `UserGroupMemberNewParamsMember` * `UserGroupMemberUpdateParams.Body` renamed to `UserGroupMemberUpdateParams.Members` * `UserGroupMemberUpdateParamsBody` renamed to `UserGroupMemberUpdateParamsMember` * `UserGroups.Members.New()` returns `*pagination.SinglePage[UserGroupMemberNewResponse]` instead of `*UserGroupMemberNewResponse` #### IAM - UserGroup List Direction Type Changed The `UserGroupListParams.Direction` field changed from `param.Field[string]` to `param.Field[UserGroupListParamsDirection]` (typed enum with `asc`/`desc` values). #### Pipelines - Delete Methods Now Return Typed Responses Several delete methods across Pipelines now return typed responses instead of bare error: * `Pipelines.DeleteV1()` returns `(*PipelineDeleteV1Response, error)` instead of `error` * `Pipelines.Sinks.Delete()` returns `(*SinkDeleteResponse, error)` instead of `error` * `Pipelines.Streams.Delete()` returns `(*StreamDeleteResponse, error)` instead of `error` #### Queues - Message Response Types Removed The following response envelope types have been removed: * `MessageBulkPushResponseSuccess` * `MessagePushResponseSuccess` * `MessageAckResponse` fields `RetryCount` and `Warnings` removed #### Secrets Store - Pagination Wrapper Removal and Type Changes Methods now return direct types instead of `SinglePage` wrappers, and several internal types have been removed. Associated `AutoPaging` methods have also been removed: * `Stores.New()` returns `*StoreNewResponse` instead of `*pagination.SinglePage[StoreNewResponse]` * `Stores.NewAutoPaging()` method removed * `Stores.Secrets.BulkDelete()` returns `*StoreSecretBulkDeleteResponse` instead of `*pagination.SinglePage[StoreSecretBulkDeleteResponse]` * `Stores.Secrets.BulkDeleteAutoPaging()` method removed * Removed types: `StoreDeleteResponse`, `StoreDeleteResponseEnvelopeResultInfo`, `StoreSecretDeleteResponse`, `StoreSecretDeleteResponseStatus`, `StoreSecretBulkDeleteResponse` (old shape), `StoreSecretBulkDeleteResponseStatus`, `StoreSecretDeleteResponseEnvelopeResultInfo` * `StoreNewParams` restructured (old `StoreNewParamsBody` removed) * `StoreSecretBulkDeleteParams` restructured #### Stream - AudioTracks Return Type Change The `AudioTracks.Get()` method now returns a dedicated response type instead of a paginated list. The `GetAutoPaging()` method has been removed: * `Get()` returns `*AudioTrackGetResponse` instead of `*pagination.SinglePage[Audio]` * `GetAutoPaging()` method removed #### Stream - Clip Type Removal and Return Type Change The `Clip.New()` method now returns the shared `Video` type. The following types have been entirely removed: * `Clip`, `ClipPlayback`, `ClipStatus`, `ClipWatermark` #### Stream - Copy and Clip Params Field Removals * `ClipNewParams.MaxDurationSeconds`, `ThumbnailTimestampPct`, `Watermark` removed * `CopyNewParams.ThumbnailTimestampPct`, `Watermark` removed #### Stream - Download and Webhook Changes * `DownloadNewResponseStatus` type removed * `WebhookUpdateResponse` and `WebhookGetResponse` changed from `interface{}` type aliases to full struct types #### Zero Trust - Access AI Control MCP Portal Union Types Removed The following union interface types have been removed: * `AccessAIControlMcpPortalListResponseServersUpdatedPromptsUnion` * `AccessAIControlMcpPortalListResponseServersUpdatedToolsUnion` * `AccessAIControlMcpPortalReadResponseServersUpdatedPromptsUnion` * `AccessAIControlMcpPortalReadResponseServersUpdatedToolsUnion` #### Features #### Vulnerability Scanner (`client.VulnerabilityScanner`) **NEW SERVICE:** Full vulnerability scanning management * **CredentialSets** \- CRUD for credential sets (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) * **Credentials** \- Manage credentials within sets (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) * **Scans** \- Create and manage vulnerability scans (`New`, `List`, `Get`) * **TargetEnvironments** \- Manage scan target environments (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) #### AI Search - Namespaces (`client.AISearch.Namespaces`) **NEW SERVICE:** Namespace-scoped AI Search management * `New()`, `Update()`, `List()`, `Delete()`, `ChatCompletions()`, `Read()`, `Search()` * **Instances** \- Namespace-scoped instances (`New`, `Update`, `List`, `Delete`, `ChatCompletions`, `Read`, `Search`, `Stats`) * **Jobs** \- Instance job management (`New`, `Update`, `List`, `Get`, `Logs`) * **Items** \- Instance item management (`List`, `Delete`, `Chunks`, `NewOrUpdate`, `Download`, `Get`, `Logs`, `Sync`, `Upload`) #### Browser Rendering - Devtools (`client.BrowserRendering.Devtools`) **NEW SERVICE:** DevTools protocol browser control * **Session** \- List and get devtools sessions * **Browser** \- Browser lifecycle management (`New`, `Delete`, `Connect`, `Launch`, `Protocol`, `Version`) * **Page** \- Get page by target ID * **Targets** \- Manage browser targets (`New`, `List`, `Activate`, `Get`) #### Registrar (`client.Registrar`) **NEW:** Domain check and search endpoints * `Check()` \- `POST /accounts/{account_id}/registrar/domain-check` * `Search()` \- `GET /accounts/{account_id}/registrar/domain-search` **NEW:** Registration management (`client.Registrar.Registrations`) * `New()`, `List()`, `Edit()`, `Get()` * `RegistrationStatus.Get()` \- Get registration workflow status * `UpdateStatus.Get()` \- Get update workflow status #### Cache - Origin Cloud Regions (`client.Cache.OriginCloudRegions`) **NEW SERVICE:** Manage origin cloud region configurations * `New()`, `List()`, `Delete()`, `BulkDelete()`, `BulkEdit()`, `Edit()`, `Get()`, `SupportedRegions()` #### Zero Trust - DLP Settings (`client.ZeroTrust.DLP.Settings`) **NEW SERVICE:** DLP settings management * `Update()`, `Delete()`, `Edit()`, `Get()` #### Radar * `AgentReadiness.Summary()` \- Agent readiness summary by dimension * `AI.MarkdownForAgents.Summary()` \- Markdown-for-agents summary * `AI.MarkdownForAgents.Timeseries()` \- Markdown-for-agents timeseries #### IAM (`client.IAM`) * `UserGroups.Members.Get()` \- Get details of a specific member in a user group * `UserGroups.Members.NewAutoPaging()` \- Auto-paging variant for adding members * `UserGroups.NewParams.Policies` changed from required to optional #### Bot Management * `ContentBotsProtection` field added to `BotFightModeConfiguration` and `SubscriptionConfiguration` (`block`/`disabled`) #### Deprecations None in this release. #### Get started * [Download Go SDK v6.10.0 ↗](https://github.com/cloudflare/cloudflare-go/releases/tag/v6.10.0) * [Go SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/go/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/MIGRATION%5FGUIDE.md) Apr 22, 2026 1. ### [Custom dashboards available to all customers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-22-custom-dashboards-ga/) [ Analytics ](https://edgetunnel-b2h.pages.dev/analytics/)[ Log Explorer ](https://edgetunnel-b2h.pages.dev/log-explorer/) Custom Dashboards are now available to all Cloudflare customers. Build personalized views that highlight the metrics most critical to your infrastructure and security posture, moving beyond standard product dashboards. This update significantly expands the data available for visualization. Build charts based on any of the **100+ datasets** available via the Cloudflare GraphQL API, covering everything from WAF events and Workers metrics to Load Balancing and Zero Trust logs. #### Log Explorer integration For Log Explorer customers, you can now turn raw log queries directly into dashboard charts. When you identify a specific pattern or spike while investigating logs, save that query as a visualization to monitor those signals in real-time without leaving the dashboard. #### Key benefits * **Unified visibility**: Consolidate signals from different Cloudflare products (for example, HTTP Traffic and R2 Storage) into a single view. * **Flexible monitoring**: Create charts that focus on specific status codes, ASN regions, or security actions that matter to your business. * **Expanded limits**: Log Explorer customers can create up to **100 dashboards** (up from 25 for standard customers). ![Custom Dashboards home page showing dashboard list and chart previews](https://edgetunnel-b2h.pages.dev/_astro/customdashboardshome.BIpSvImM_T5dlH.webp) To get started, refer to the [Custom Dashboards documentation](https://edgetunnel-b2h.pages.dev/analytics/custom-dashboards/). Apr 22, 2026 1. ### [R2 Data Catalog snapshot expiration now removes unreferenced data files](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-22-snapshot-expiration-cleans-data-files/) [ R2 ](https://edgetunnel-b2h.pages.dev/r2/) [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/), a managed [Apache Iceberg ↗](https://iceberg.apache.org/) catalog built into R2, now removes unreferenced data files during automatic snapshot expiration. This improvement reduces storage costs and eliminates the need to run manual maintenance jobs to reclaim space from deleted data. Previously, snapshot expiration only cleaned up Iceberg metadata files such as manifests and manifest lists. Data files that were no longer referenced by active snapshots remained in R2 storage until you manually ran `remove_orphan_files` or `expire_snapshots` through an engine like Spark. This required extra operational overhead and left stale data files consuming storage. Snapshot expiration now handles both metadata and data file cleanup automatically. When a snapshot is expired, any data files that are no longer referenced by retained snapshots are removed from R2 storage. ```bash # Enable catalog-level snapshot expiration npx wrangler r2 bucket catalog snapshot-expiration enable my-bucket \ --older-than-days 7 \ --retain-last 10 ``` To learn more about snapshot expiration and other automatic maintenance operations, refer to the [table maintenance documentation](https://edgetunnel-b2h.pages.dev/r2/data-catalog/table-maintenance/). Apr 21, 2026 1. ### [Country rules supported in Unified Routing](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-unified-routing-geoip-country-rules/) [ Cloudflare Network Firewall ](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) [Cloudflare Advanced Network Firewall](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/) Country rules are now supported for accounts using [Unified Routing](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#unified-routing-mode-beta) mode. This feature requires a Cloudflare Advanced Network Firewall subscription. You can create firewall rules that match traffic based on source or destination country to enforce geographic access policies across your network. This is the first of the Cloudflare Advanced Network Firewall features to become available in Unified Routing. Support for additional features - IP Lists, ASN Lists, Threat Intel Lists, IDS, Rate Limiting, SIP, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#beta-limitations). Apr 21, 2026 1. ### [Network Overview page in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-network-overview-page/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) A new **Network Overview** page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products. From the Network Overview page, you can: * **Connect resources with [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/)** \- Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet. * **Monitor traffic with Network Flow** \- Get real-time visibility into traffic volume from your routers. * **Configure Address Maps** \- Map dedicated static IPs or BYOIP prefixes to specific hostnames. * **Explore Magic Transit and Cloudflare WAN** \- Set up DDoS protection for your networks and connectivity for your branch offices and data centers. To find it, go to [**Networking** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/overview) in the dashboard sidebar. If you already use [Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/), [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/), or other Cloudflare network services products, your existing experience is unchanged. ![Network Overview page in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/network-overview.4FLDtULW_Z1MDOti.webp) Apr 21, 2026 1. ### [Additional step context and ReadableStream support now available in Workflows step.do()](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-step-context-and-readable-streams/) [ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/) [Workflows](https://edgetunnel-b2h.pages.dev/workflows/) now provides additional context inside `step.do()` callbacks and supports returning `ReadableStream` to handle larger step outputs. #### Step context properties The `step.do()` callback receives a context object with new properties [alongside](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-06-step-context-available/) `attempt`: * **`step.name`** — The name passed to `step.do()` * **`step.count`** — How many times a step with that name has been invoked in this instance (1-indexed) * Useful when running the same step in a loop. * **`config`** — The resolved step configuration, including `timeout` and `retries` with defaults applied **TypeScript** ```ts type ResolvedStepConfig = { retries: { limit: number; delay: WorkflowDelayDuration | number; backoff?: "constant" | "linear" | "exponential"; }; timeout: WorkflowTimeoutDuration | number; }; type WorkflowStepContext = { step: { name: string; count: number; }; attempt: number; config: ResolvedStepConfig; }; ``` #### ReadableStream support in `step.do()` Steps can now return a `ReadableStream` directly. Although non-stream step outputs are [limited to 1 MiB](https://edgetunnel-b2h.pages.dev/workflows/reference/limits/), streamed outputs support much larger payloads. **TypeScript** ```ts const largePayload = await step.do("fetch-large-file", async () => { const object = await env.MY_BUCKET.get("large-file.bin"); return object.body; }); ``` Note that streamed outputs are still considered part of the Workflow instance storage limit. Apr 21, 2026 1. ### [Container logs page now includes relevant Worker and Durable Object logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-correlated-worker-durable-object-logs/) [ Containers ](https://edgetunnel-b2h.pages.dev/containers/) The Container logs page now displays related [Worker](https://edgetunnel-b2h.pages.dev/workers/) and [Durable Object](https://edgetunnel-b2h.pages.dev/durable-objects/) logs alongside container logs. This co-locates all relevant log events for a container application in one place, making it easier to trace requests and debug issues. ![Container logs page showing Worker and Durable Object logs alongside container logs](https://edgetunnel-b2h.pages.dev/_astro/container-worker-logs.BBQ7NRse_1cLVb3.webp) You can filter to a single source when you need to isolate Container, Worker, or Durable Object output. For information on configuring container logging, refer to [How do Container logs work?](https://edgetunnel-b2h.pages.dev/containers/faq/#how-do-container-logs-work). Apr 21, 2026 1. ### [Introducing Billable Usage dashboard and Budget alerts](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts. #### Billable Usage dashboard The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill. The dashboard displays: * A bar chart showing daily usage charges for your billing period * A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs * Ability to view previous billing periods Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice. To access the dashboard, go to **Manage Account** \> **Billing** \> **Billable Usage**. ![Screenshot of the Billable Usage dashboard in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/billable-usage-dashboard.CQvMdtrp_Z2qynps.webp) #### Budget alerts Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end. To configure a budget alert: 1. Go to **Manage Account** \> **Billing** \> **Billable Usage**. 2. Select **Set Budget Alert**. 3. Enter a budget threshold amount greater than $0. 4. Select **Create**. Alternatively, configure alerts via **Notifications** \> **Add** \> **Budget Alert**. ![Create Budget Alert modal in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/budget-alert-modal.BjIzGOLV_Zr8DX5.webp) You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold. Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported. For more information, refer to the [Usage based billing documentation](https://edgetunnel-b2h.pages.dev/billing/understand/usage-based-billing/). Apr 21, 2026 1. ### [Logpush subrequest merging for HTTP requests](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-logpush-subrequests-merging/) [ Logs ](https://edgetunnel-b2h.pages.dev/logs/) When a Cloudflare Worker intercepts a visitor request, it can dispatch additional outbound fetch calls called subrequests. By default, each subrequest generates its own log entry in Logpush, resulting in multiple log lines per visitor request. With subrequest merging enabled, subrequest data is embedded as a nested array field on the parent log record instead. #### What's new * New subrequest\_merging field on Logpush jobs — Set "merge\_subrequests": true when creating or updating an http\_requests Logpush job to enable the feature. * New Subrequests log field — When subrequest merging is enabled, a Subrequests field (`array\`) is added to each parent request log record. Each element in the array contains the standard http\_requests fields for that subrequest. #### Limitations * Applies to the http\_requests (zone-scoped) dataset only. * A maximum of 50 subrequests are merged per parent request. Subrequests beyond this limit are passed through unmodified as individual log entries. * Subrequests must complete within 5 minutes of the visitor request. Subrequests that exceed this window are passed through unmodified. * Subrequests that do not qualify appear as separate log entries — no data is lost. * Subrequest merging is being gradually rolled out and is not yet available on all zones. Contact your account team for concerns or to ensure it is enabled for your zone. * For more information, refer to [Subrequests](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/subrequests/). Apr 21, 2026 1. ### [WAF Release - 2026-04-21](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers. **Key Findings** * Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise. * Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce. **Impact** Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ---------------------------------------------------------------------- | --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...ee159e2e | N/A | Command Injection - Generic 8 - uri | Log | Block | This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta" | | Cloudflare Managed Ruleset | ...a15308cf | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2 ). The rule previously known as "Command Injection - Generic 8" is now renamed to "Command Injection - Generic 8 - body". | | Cloudflare Managed Ruleset | ...958047ed | N/A | MySQL - SQLi - Executable Comment - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "MySQL - SQLi - Executable Comment - Body" (ID: ...7bd2d8fa ) The rule previously known as "MySQL - SQLi - Executable Comment" is now renamed to "MySQL - SQLi - Executable Comment - Body". | | Cloudflare Managed Ruleset | ...582cc559 | N/A | MySQL - SQLi - Executable Comment - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a16639d3 | N/A | MySQL - SQLi - Executable Comment - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...44f24211 | N/A | Magento 2 - Unrestricted file upload - 2 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...bf170a17 | N/A | Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...8c2ac1a7 | N/A | SQLi - Sleep Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Sleep Function" (ID: ...f77e8d54 ) | | Cloudflare Managed Ruleset | ...4dacaeb8 | N/A | SQLi - Sleep Function - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...ed4c9ece | N/A | SQLi - Sleep Function - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1dfa64df | N/A | SQLi - Probing - uri | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...4c62e2e7 | N/A | SQLi - Probing - header | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...aab28ea1 | N/A | SQLi - Probing - body | Disabled | Disabled | This is a new detection. This rule is merged into the original rule "SQLi - Probing" (ID: ...b4026c88 ) | | Cloudflare Managed Ruleset | ...20999be0 | N/A | SQLi - Probing 2 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. | | Cloudflare Managed Ruleset | ...d7aa0008 | N/A | SQLi - UNION in MSSQL - Body | Disabled | Disabled | This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: ...ee5e35fd ) and contains updated rule logic. | | Cloudflare Managed Ruleset | ...a67d8561 | N/A | SQLi - UNION - 3 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. | | Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI | Disabled | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...70282f38 | N/A | XSS, HTML Injection - Embed Tag - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...23f4d718 | N/A | XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...6978def1 | N/A | XSS, HTML Injection - Link Tag - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI | Disabled | Disabled | This is a new detection. | Apr 21, 2026 1. ### [WebSocket binary messages now delivered as Blob by default](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-websocket-standard-binary-type/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Binary frames received on a `WebSocket` are now delivered to the `message` event as [Blob ↗](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects by default. This matches the [WebSocket specification ↗](https://websockets.spec.whatwg.org/) and standard browser behavior. Previously, binary frames were always delivered as [ArrayBuffer ↗](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global%5FObjects/ArrayBuffer). The [binaryType](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/websockets/#binarytype) property on `WebSocket` controls the delivery type on a per-WebSocket basis. This change has been active for Workers with compatibility dates on or after `2026-03-17`, via the [websocket\_standard\_binary\_type](https://edgetunnel-b2h.pages.dev/workers/configuration/compatibility-flags/#websocket-standard-binary-type) compatibility flag. We should have documented this change when it shipped but didn't. We're sorry for the trouble that caused. If your Worker handles binary WebSocket messages and assumes `event.data` is an `ArrayBuffer`, the frames will arrive as `Blob` instead, and a naive `instanceof ArrayBuffer` check will silently drop every frame. To opt back into `ArrayBuffer` delivery, assign `binaryType` before calling `accept()`. This works regardless of the compatibility flag: **JavaScript** ```js const resp = await fetch("https://example.com", { headers: { Upgrade: "websocket" }, }); const ws = resp.webSocket; // Opt back into ArrayBuffer delivery for this WebSocket. ws.binaryType = "arraybuffer"; ws.accept(); ws.addEventListener("message", (event) => { if (typeof event.data === "string") { // Text frame. } else { // event.data is an ArrayBuffer because we set binaryType above. } }); ``` If you are not ready to migrate and want to keep `ArrayBuffer` as the default for all WebSockets in your Worker, add the `no_websocket_standard_binary_type` flag to your [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/). This change has no effect on the Durable Object hibernatable WebSocket [webSocketMessage](https://edgetunnel-b2h.pages.dev/durable-objects/best-practices/websockets/) handler, which continues to receive binary data as `ArrayBuffer`. For more information, refer to [WebSockets binary messages](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/websockets/#binary-messages). Apr 20, 2026 1. ### [Network session analytics dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-20-network-session-analytics/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) The new [Network session analytics](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/network-sessions/) dashboard is now available in Cloudflare One. This dashboard provides visibility into your network traffic patterns, helping you understand how traffic flows through your Cloudflare One infrastructure. ![Cloudflare One Network Session Analytics](https://edgetunnel-b2h.pages.dev/_astro/cf1-network-session-analytics.Gl90hEcp_MuWRb.webp) #### What you can do with Network session analytics * **Analyze geographic distribution**: View a world map showing where your network traffic originates, with a list of top locations by session count. * **Monitor key metrics**: Track session count, total bytes transferred, and unique users. * **Identify connection issues**: Analyze connection close reasons to troubleshoot network problems. * **Review protocol usage**: See which network protocols (TCP, UDP, ICMP) are most used. #### Dashboard features * **Summary metrics**: Session count, bytes total, and unique users * **Traffic by location**: World map visualization and location list with top traffic sources * **Top protocols**: Breakdown of TCP, UDP, ICMP, and ICMPv6 traffic * **Connection close reasons**: Insights into why sessions terminated (client closed, origin closed, timeouts, errors) #### How to access 1. Log in to [Cloudflare One ↗](https://dash.cloudflare.com). 2. Go to **Zero Trust** \> **Insights** \> **Dashboards**. 3. Select **Network session analytics**. For more information, refer to the [Network session analytics documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/analytics/network-sessions/). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/10/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/10/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```