---
title: Changelogs
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

All products

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 08, 2026
1. ### [Workers AI toMarkdown and AI Search now supports GIF and BMP image conversion](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-gif-bmp-image-support/)  
[ Workers AI ](https://edgetunnel-b2h.pages.dev/workers-ai/)[ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/)  
Workers AI [Markdown conversion](https://edgetunnel-b2h.pages.dev/workers-ai/features/markdown-conversion/) (`toMarkdown`) now supports `.gif` and `.bmp` image files, in addition to the JPEG, PNG, WebP, and SVG formats already supported.  
GIF and BMP files run through the same [image pipeline](https://edgetunnel-b2h.pages.dev/workers-ai/features/markdown-conversion/how-it-works/#images) as other formats. Each image is resized if needed (and for animated GIFs, only the first frame is used), then passed to an object-detection model to identify what it contains. Those detected objects prompt a vision model that writes a natural-language description of the image, which becomes searchable, machine-readable Markdown.  
[AI Search](https://edgetunnel-b2h.pages.dev/ai-search/) uses `toMarkdown` automatically to process the files it ingests, so any `.gif` and `.bmp` files are included the next time your index syncs, with no configuration changes required. This helps when your content mixes formats, for example a support knowledge base full of screenshots or an archive of BMP scans.  
Learn more about [Markdown conversion](https://edgetunnel-b2h.pages.dev/workers-ai/features/markdown-conversion/) and the full list of [AI Search's supported file types](https://edgetunnel-b2h.pages.dev/ai-search/configuration/data-source/#supported-file-types).

Jul 08, 2026
1. ### [IPsec downgrade protection (beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-ipsec-downgrade-protection/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
Cloudflare IPsec now supports the [IKE\_SA\_INIT\_FULL\_TRANSCRIPT\_AUTH ↗](https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-downgrade-prevention/) IKEv2 extension to protect against downgrade attacks on IPsec tunnels.  
IKEv2's original authentication design has each endpoint sign only its own outbound messages, not the full handshake transcript. A quantum-capable [on-path attacker ↗](https://www.cloudflare.com/learning/security/threats/on-path-attack/) can exploit this to bypass post-quantum key exchange by downgrading the connection to classical cryptography. The `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` extension addresses this by having both peers sign the entire handshake transcript during the authentication exchange, preventing an attacker from manipulating the negotiation without detection.  
Key details:

  * Available in beta for Cloudflare WAN and Magic Transit IPsec tunnels.
  * Cloudflare sends the `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` notification unconditionally as a responder when the feature flag is enabled.
  * Both the initiator (your device) and responder (Cloudflare) must support the extension for downgrade protection to be effective.
  * This feature is currently gated by a per-account feature flag. Contact your account team to turn it on.  
Refer to [Downgrade protection](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/gre-ipsec-tunnels/#improved-downgrade-protection-beta) for more details.

Jul 08, 2026
1. ### [Query R2 Data Catalog tables with R2 SQL from the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-query-r2-sql-from-dashboard/)  
[ R2 SQL ](https://edgetunnel-b2h.pages.dev/r2-sql/)  
You can now query your [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) tables with [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) directly from the Cloudflare dashboard, without installing a CLI or wiring up a client. This makes it easy to explore your [Apache Iceberg ↗](https://iceberg.apache.org/) data, validate queries, and inspect results in one place.  
![R2 SQL Query Editor](https://edgetunnel-b2h.pages.dev/_astro/r2-sql-studio.DCmHJaqy_Z1PiDx0.webp)  
To get started, go to [R2 Data Catalog ↗](https://dash.cloudflare.com/?to=/:account/data-catalog/overview) in the Cloudflare dashboard and select **Query data** to launch the built-in SQL editor. From there you can:

  * **Write and run queries interactively** — Iterate on R2 SQL directly in the browser with syntax highlighting and autocomplete, instead of re-running commands through Wrangler or the REST API.
  * **Explore your data** — Explore your namespaces and tables alongside the editor so you can discover what's queryable without leaving the page or using other tools.
  * **Understand results and performance** — View result sets with per-query statistics, export them, and get helpful `EXPLAIN` outputs to see exactly how a query runs.  
Note  
Your R2 SQL credential is generated and stored for you and can be rotated in the R2 Data Catalog settings page.

Jul 08, 2026
1. ### [Moondream 3.1 now available on Workers AI](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-moondream31-workers-ai/)  
[ Workers AI ](https://edgetunnel-b2h.pages.dev/workers-ai/)  
Partnering with [Moondream ↗](https://moondream.ai/) to bring their latest model [@cf/moondream/moondream3.1-9B-A2B](https://edgetunnel-b2h.pages.dev/workers-ai/models/moondream3.1-9B-A2B/) to Workers AI. Moondream 3.1 is a fast vision language model built on a mixture-of-experts architecture with 9B total parameters and 2B active, delivering frontier-level visual reasoning while retaining fast, cost-efficient inference.  
Moondream 3.1 is designed for real-world vision tasks, with a 32K token context window for handling complex queries and structured outputs.  
#### Key capabilities

  * **Query** — ask open-ended questions about an image, with an optional reasoning parameter
  * **Caption** — generate short, normal, or long descriptions of an image
  * **Point** — return coordinates for objects matching a target phrase
  * **Detect** — return bounding boxes for objects matching a target phrase  
#### Real-time vision at the edge  
Vision workloads like live camera feeds, robotics, content moderation, and interactive agents need answers in milliseconds, not seconds. Moondream 3.1's small active footprint (2B active parameters) pairs well with Workers AI's serverless, globally distributed inference: requests run close to your users, and streaming responses start returning tokens almost immediately.  
In our testing, first tokens streamed back in roughly 20–30 ms, and results were fast across every task. The example end-to-end times below (client-observed median, including network round trip) are for a simple, single-subject image. Actual latency depends heavily on the image and how much detail you ask for.

| Task    | End-to-end (p50) |
| ------- | ---------------- |
| query   | \~770 ms         |
| caption | \~480 ms         |
| point   | \~145 ms         |
| detect  | \~160 ms         |  
At these speeds you can call the model inline while handling a request rather than pushing the work to a background queue or a separate service. That opens up use cases where a slow response breaks the experience: moderating user-uploaded images before they are stored, locating an object in a video frame to drive a live overlay, extracting fields from a document during a form submission, or letting an agent inspect a screenshot and decide its next step within a single turn.  
#### Get started  
Use Moondream 3.1 through the [Workers AI binding](https://edgetunnel-b2h.pages.dev/workers-ai/configuration/bindings/) (`env.AI.run()`) or the REST API at `/ai/run`. You can also use [AI Gateway](https://edgetunnel-b2h.pages.dev/ai-gateway/) with these endpoints.  
For more information, refer to the [Moondream 3.1 model page](https://edgetunnel-b2h.pages.dev/workers-ai/models/moondream3.1-9B-A2B/) and [pricing](https://edgetunnel-b2h.pages.dev/workers-ai/platform/pricing/).

Jul 08, 2026
1. ### [Cloudflare Drop](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-cloudflare-drag-and-drop/)  
[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
[Cloudflare Drop ↗](https://cloudflare.com/drop) lets you deploy a static site to Cloudflare without requiring a Cloudflare account to get started.  
![Cloudflare Drag and Drop upload screen for browsing folders or ZIP files](https://edgetunnel-b2h.pages.dev/_astro/cloudflare-drag-and-drop-upload.KujM69eS_2q5iiu.webp)  
Upload a folder or zip file of static assets (static HTML, CSS, JavaScript, images, and fonts) and get a temporary live preview that stays live for 1 hour. During that window, you can test the site, share the preview URL, or [claim the deployment](https://edgetunnel-b2h.pages.dev/workers/platform/claim-deployments/) to keep it.  
![Cloudflare Drag and Drop temporary live preview screen with claim and copy claim link actions](https://edgetunnel-b2h.pages.dev/_astro/cloudflare-drag-and-drop-preview.BQ1__XRX_2eteg3.webp)  
When you are ready to make the deployment permanent, click **Claim** to sign in or create a Cloudflare account. You can claim the site into an existing Cloudflare account or create a new account for the deployment.  
Note  
If you are creating a new account, you will need to verify your email address before continuing.  
![Cloudflare Drag and Drop claim account screen with a countdown before the claim link expires](https://edgetunnel-b2h.pages.dev/_astro/cloudflare-drag-and-drop-claim.8Zv6px9B_Z1vMkhk.webp)  
After claiming the site, you can:

  * **Add a domain**: [Connect](https://edgetunnel-b2h.pages.dev/workers/configuration/routing/custom-domains/) an existing domain or purchase a new one for your site.
  * **Enable [observability](https://edgetunnel-b2h.pages.dev/workers/observability/)**: Monitor your site's performance and usage.
  * **Enable [Markdown for Agents](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/)**: Allow AI agents to access your site's content in Markdown.
  * **Control access**: Make your site [private](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) and choose who can view it.  
![Claimed Cloudflare Drag and Drop site setup screen showing options to add a domain, control access, enable observability, and enable Markdown for agents](https://edgetunnel-b2h.pages.dev/_astro/cloudflare-drag-and-drop-post-claim.DvlaNmI7_Zmbdcj.webp)

Jul 07, 2026
1. ### [Cloudflare One Client for Windows (version 2026.6.850.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-warp-windows-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account, causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available.

Jul 07, 2026
1. ### [Workflows pricing adds per-step billing. Step and storage billing to start no earlier than August 10, 2026.](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-workflows-billing-updates/)  
[ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/)  
[Workflows](https://edgetunnel-b2h.pages.dev/workflows/) pricing now includes per-step billing. Requests and CPU time billing have been enabled since the initial public beta and is not changing.  
#### Workflows adds step billing  
A step is each unit of work executed by a Workflow, including step operations such as [sleeping](https://edgetunnel-b2h.pages.dev/workflows/build/sleeping-and-retrying/) or [waiting for events](https://edgetunnel-b2h.pages.dev/workflows/build/events-and-parameters/).  
You can query Workflows analytics, including `stepCount` for a Workflow instance, with the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/workflows/observability/metrics-analytics/#query-via-the-graphql-api).  
#### Steps and storage billing to take effect August 10th, 2026  
Starting no earlier than August 10th, 2026, Cloudflare will begin billing for step and storage usage on Workers Paid plans.  
Storage pricing has been published since Workflows became generally available and is not changing. Storage is measured as persisted Workflow state in GB-months.

| Dimension | Workers Free           | Workers Paid                                                        |
| --------- | ---------------------- | ------------------------------------------------------------------- |
| Steps     | 3,000 included per day | 500,000 included per month, then $0.80 per additional 100,000 steps |
| Storage   | 1 GB-month included    | 1 GB-month included, then $0.20 per additional GB-month             |  
Developers on the Workers Free plan will not be charged for steps or storage beyond the included amounts.  
Cloudflare will not bill step and storage usage before August 10, 2026.  
You can review Workflows usage in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/) before this change takes effect. To reduce costs, consider reducing the number of steps per Workflow or improving the memory efficiency of your stored state.  
Refer to the [Workflows pricing](https://edgetunnel-b2h.pages.dev/workflows/reference/pricing/) page for full details.

Jul 07, 2026
1. ### [File transfer controls for browser-based RDP (beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-rdp-file-transfer-beta/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
You can now configure file transfer controls for browser-based RDP with Cloudflare Access, allowing you to restrict whether users can upload or download files between their local machine and the remote Windows server.  
![File transfer connection settings in the Access policy configuration.](https://edgetunnel-b2h.pages.dev/_astro/file-transfer-policy-control.CiSEa5rr_Z1oqxAg.webp)  
This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting file transfers, you can prevent sensitive data from being moved out of the remote session to a user's personal device.  
#### Configuration options  
File transfer controls are configured per policy within your Access application, alongside existing [text clipboard controls](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#connection-settings). For each policy, you can select one of the following options:

  * **Client to remote RDP session allowed** — Users can upload files from their local machine into the browser-based RDP session.
  * **Remote RDP session to client allowed** — Users can download files from the browser-based RDP session to their local machine.
  * **Both directions allowed** — Users can upload and download files between their local machine and the browser-based RDP session.
  * **Disable copying/pasting** — Users are not allowed to transfer files between their local machine and the browser-based RDP session.  
By default, file transfer is denied for new policies. For existing Access applications created before this feature was available, file transfer remains denied.  
#### How it works  
To upload, drag files into the browser window or select the settings gear icon on the left side of the RDP session. To download, copy a file in the remote session and select the settings gear to download it, download multiple files as a zip, or print PDFs to a local printer.  
![The clipboard side panel showing files available for transfer.](https://edgetunnel-b2h.pages.dev/_astro/clipboard-side-panel.Us2RfXfs_Z1hkXRl.webp) ![A remote document ready for download or local printing.](https://edgetunnel-b2h.pages.dev/_astro/remote-doc-ready-for-download-or-print-local.Dcm5hrGD_kMExI.webp)  
This feature is in beta and available on all Zero Trust plans. For more information, refer to [File transfer for browser-based RDP](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#transfer-files).

Jul 07, 2026
1. ### [Browser Isolation support for authorization proxy endpoints](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-authorization-proxy-endpoint-support/)  
[ Browser Isolation ](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
[Browser Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/) now supports Gateway [authorization proxy endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint). You can apply [HTTP Isolate policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/isolation-policies/) to traffic routed through authorization proxy endpoints, the same way you can for traffic from the Cloudflare One Client.  
Previously, only [source IP proxy endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#source-ip-endpoint) supported Browser Isolation, and only with non-identity policies. Because authorization proxy endpoints authenticate users through an identity provider, you can now apply identity-based Isolate policies to PAC file-proxied traffic without requiring the Cloudflare One Client.  
To get started, [create an authorization proxy endpoint](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint) and [build an Isolate policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/isolation-policies/).

Jul 07, 2026
1. ### [New Browser Run endpoint for accessibility trees](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-browser-run-accessibility-tree-endpoint/)  
[ Browser Run ](https://edgetunnel-b2h.pages.dev/browser-run/)  
[Browser Run](https://edgetunnel-b2h.pages.dev/browser-run/) now supports a standalone `/accessibilityTree` endpoint, giving agent and automation workflows direct access to the browser's accessibility tree for a rendered webpage.  
An accessibility tree is the browser's structured view of a rendered page: roles, names, states, values, and hierarchy. It is useful for accessibility tooling, but also for AI agents and automation workflows that need page structure without the noise of raw HTML or the cost of screenshots.  
For AI agents, this means less inference from pixels and less parsing HTML. You can provide the page structure directly, helping agents identify available elements and determine which actions they can take.  
With the new `/accessibilityTree` endpoint, you can request the accessibility tree directly when you only need the semantic structure of a page. If you need multiple page formats in a single API call, you can use the [/snapshot](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/snapshot/) endpoint, which also returns Markdown, HTML, and screenshots.  
```bash  
curl -X POST 'https://api.cloudflare.com/client/v4/accounts/<accountId>/browser-run/accessibilityTree' \
  -H 'Authorization: Bearer <apiToken>' \
  -H 'Content-Type: application/json' \
  -d '{  
    "url": "https://example.com/"  
}'  
```  
```json  
{  
  "success": true,  
  "result": {  
    "accessibilityTree": {  
      "role": "RootWebArea",  
      "name": "Example Domain",  
      "children": [  
        {  
          "role": "heading",  
          "name": "Example Domain",  
          "level": 1  
        },  
        {  
          "role": "link",  
          "name": "Learn more"  
        }  
      ]  
    }  
  }  
}  
```  
Use `interestingOnly` to return only semantically meaningful nodes, or `root` to capture the accessibility tree for a specific subtree.  
Refer to the [/accessibilityTree documentation](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/accessibility-tree-endpoint/) for usage examples and supported parameters.

Jul 07, 2026
1. ### [New WebSocket Analytics Logpush dataset](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-websocket-analytics-dataset/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Enterprise customers can now push per-connection WebSocket analytics to any [Logpush destination](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/enable-destinations/) using the new `websocket_analytics` dataset. Each log record is emitted when a WebSocket connection closes and includes fields that were previously only available to Cloudflare engineers via internal tooling.  
Key fields include:

  * **`ConnectionCloseReason`** — why the connection ended: `peerReset`, `peerNoError`, `timedOut`, `upstreamReset`, `protocolViolation`, `unspecifiedError`, or `none`.
  * **`ConnectionCloseSource`** — which side initiated the close: `upstream`, `downstream`, `me`, or `both`.
  * **`ConnectionTransportCloseCode`** — the TLS alert code or TCP-level close code for additional precision.
  * **`RayID`** — correlate WebSocket connection events with your existing HTTP Request logs.  
The dataset also includes directional byte counts (`BytesSentClient`, `BytesReceivedClient`, `BytesSentOrigin`, `BytesReceivedOrigin`), connection timestamps, client IP, colo code, and request metadata from the original WebSocket upgrade.  
This data lets you build alerts on connection close patterns — for example, detecting spikes in TCP resets (`ConnectionCloseReason == "peerReset"`) grouped by host and data center — directly in your existing log analysis tools.  
For the full list of available fields, refer to [WebSocket Analytics](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/zone/websocket%5Fanalytics/).

Jul 07, 2026
1. ### [R2 Data Catalog warns before you delete data manually](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-06-r2-data-catalog-delete-warnings/)  
[ R2 ](https://edgetunnel-b2h.pages.dev/r2/)  
[R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) is a managed [Apache Iceberg ↗](https://iceberg.apache.org/) catalog built directly into your R2 bucket. Iceberg tracks your data through a tree of metadata files, so every insert, update, and delete must go through a catalog transaction. Manually adding, modifying, or deleting objects outside the catalog can leave pointers referencing files that no longer exist, corrupting the table into an inconsistent state that is difficult to recover from.  
To help prevent this, the R2 dashboard and Wrangler now warn you when you attempt a manual delete operation on a Data Catalog-enabled bucket.  
#### Dashboard  
When you try to delete objects from a bucket that has R2 Data Catalog enabled, the dashboard displays a warning explaining that the operation could leave the catalog in an invalid state, with a link to the documentation for deleting data correctly. You can cancel the operation or choose to proceed anyway.  
![R2 dashboard warning shown before deleting objects from a Data Catalog-enabled bucket](https://edgetunnel-b2h.pages.dev/_astro/data-catalog-delete-warning.DoBR0sFO_1wfGWd.webp)  
#### Wrangler  
Wrangler now checks whether a bucket is Data Catalog-enabled before running a delete and warns you before continuing:  
```txt  
Data Catalog is enabled for this bucket.  
Proceeding may leave the data catalog in an invalid state. Continue?  
```  
To learn how to safely manage and delete data in your tables, refer to the [R2 Data Catalog documentation](https://edgetunnel-b2h.pages.dev/r2/data-catalog/).

Jul 06, 2026
1. ### [Self-serve registration of Cloudflare One Virtual Appliance in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-06-virtual-appliance-self-serve-ui/)  
[ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
You can now register a [Cloudflare One Virtual Appliance](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/) and generate its license key directly from the dashboard, without contacting your account team.  
![Registering a Cloudflare One Virtual Appliance and generating its authentication key from the Connectors page](https://edgetunnel-b2h.pages.dev/_astro/2026-07-06-virtual-appliance-self-serve-ui.Dn2NC_ql_1WdiRS.webp)  
  * On the **Connectors** page, select **Add an appliance** and choose **Virtual appliance** to register a virtual appliance and generate its authentication key.
  * Use **Regenerate authentication key** from a virtual appliance connector's menu to rotate its key. The previous key is immediately and irrevocably revoked.
  * The authentication key is shown only once — copy and store it securely.  
This complements the existing [API and Terraform self-serve workflow](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/configure-virtual-appliance/#register-a-virtual-appliance-and-generate-a-license-key) for provisioning virtual appliances. Hardware appliances continue to use the existing account-team fulfillment workflow.  
For details, refer to [Configure a Cloudflare One Virtual Appliance](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/configure-virtual-appliance/).

Jul 04, 2026
1. ### [Declare Durable Object class lifecycle with \`exports\`](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-declarative-do-class-exports/)  
[ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
A new declarative [exports](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-objects-migrations/) field in your Wrangler configuration file replaces the imperative [migrations](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-object-class-migrations-legacy/) array for managing Durable Object class lifecycle. Instead of writing an ordered list of migration steps with unique tags, you declare each Durable Object class your Worker exports and Cloudflare compares that against what's already deployed to determine what Durable Object state needs to be created, renamed, or deleted.  
With legacy migrations, renaming `ChatRoom` to `Room` requires retaining both tagged steps:

**Before — legacy migrations**  
```jsonc  
{  
  "migrations": [  
    { "tag": "v1", "new_sqlite_classes": ["ChatRoom"] },  
    {  
      "tag": "v2",  
      "renamed_classes": [{ "from": "ChatRoom", "to": "Room" }],  
    },  
  ],  
}  
```  
With `exports`, you instead declare `Room` as the current class and mark `ChatRoom` as renamed:

**After — declarative exports**  
```jsonc  
{  
  "exports": {  
    "ChatRoom": {  
      "type": "durable-object",  
      "state": "renamed",  
      "renamed_to": "Room",  
    },  
    "Room": { "type": "durable-object", "storage": "sqlite" },  
  },  
}  
```  
Each entry is keyed by class name. The `state` field carries the lifecycle (`created` by default — a live class — plus tombstone states `deleted`, `renamed`, and `transferred`, and the `expecting-transfer` receiving state for cross-Worker transfers).  
Key improvements over the legacy `migrations` array:

  * **No migration tags.** The current `exports` map is the source of truth — there is no historical chain of `v1`, `v2`, `v3` entries to maintain.
  * **Structured deployment output.** Wrangler reports when it creates, updates, deletes, renames, or transfers Durable Object classes. It also identifies stale configuration entries that are safe to remove. Deployments with no changes or notices do not print this output.
  * **Zero-downtime rename and transfer patterns are first-class.** Tombstones may coexist with the source class still in code, enabling a [three-deploy rename](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-objects-migrations/#avoid-downtime-during-a-rename) and a [four-deploy cross-Worker transfer](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-objects-migrations/#transfer-a-durable-object-class-between-workers) without runtime errors during the rollout window.
  * **Cross-Worker safety.** When you delete or rename a class, Cloudflare lists every other Worker in your account whose bindings still reference the namespace, so you can redeploy them before the change goes live.  
Existing Workers using the legacy [migrations](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-object-class-migrations-legacy/) array continue to work unchanged. To move to `exports`, refer to the [migration guide](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-objects-migrations/#migrate-from-the-legacy-migrations-flow). `exports` and `migrations` are mutually exclusive within a single Worker.  
For the full reference, refer to [Durable Object class exports](https://edgetunnel-b2h.pages.dev/durable-objects/reference/durable-objects-migrations/).

Jul 03, 2026
1. ### [Simpler runtime types with @cloudflare/workers-types v5](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-03-workers-types-v5/)  
[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
We have released version 5 of [@cloudflare/workers-types ↗](https://www.npmjs.com/package/@cloudflare/workers-types). This release simplifies the package to expose only the latest runtime types.  
We still recommend that you generate types for your Worker using [wrangler types](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#types), but if you want to use the package directly, you can install it with your package manager of choice:  
 npm  yarn  pnpm  bun  
```  
npm i -D @cloudflare/workers-types@latest  
```  
```  
yarn add -D @cloudflare/workers-types@latest  
```  
```  
pnpm add -D @cloudflare/workers-types@latest  
```  
```  
bun add -d @cloudflare/workers-types@latest  
```  
The package now exposes two entrypoints:

  * `@cloudflare/workers-types` reflects the latest compatibility date, using the latest stable compatibility flags.
  * `@cloudflare/workers-types/experimental` reflects APIs behind experimental compatibility flags.  
The dated entrypoints, such as `@cloudflare/workers-types/2022-11-30` and `@cloudflare/workers-types/2023-03-01`, are removed. With runtime type generation in [Wrangler v4](https://edgetunnel-b2h.pages.dev/workers/wrangler/), you can generate these with the `wrangler types` command to create types locked to your Worker's compatibility date.  
For more information, refer to [TypeScript language support](https://edgetunnel-b2h.pages.dev/workers/languages/typescript/).

Jul 02, 2026
1. ### [Manage AI Search sync jobs with Wrangler CLI](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-manage-sync-jobs/)  
[ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/)  
When you connect a [data source](https://edgetunnel-b2h.pages.dev/ai-search/configuration/data-source/) to your [AI Search](https://edgetunnel-b2h.pages.dev/ai-search/) instance, AI Search runs sync jobs to keep your index up to date with your content. You can now manage those jobs directly from [Wrangler](https://edgetunnel-b2h.pages.dev/ai-search/wrangler-commands/).  
For example, you can trigger a sync job from your CI/CD or automated pipelines with the `jobs create` command so your index refreshes when you push a change:  
```sh  
wrangler ai-search jobs create my-instance  
```  
This creates an asynchronous sync job that checks for changes in your data source, and sends new, modified, or deleted files to be indexed. The following commands are available:

| Command                        | Description                    |
| ------------------------------ | ------------------------------ |
| wrangler ai-search jobs create | Trigger a new sync job         |
| wrangler ai-search jobs list   | List sync jobs for an instance |
| wrangler ai-search jobs get    | Get details for a job          |
| wrangler ai-search jobs cancel | Cancel a running job           |
| wrangler ai-search jobs logs   | View log entries for a job     |  
All commands accept `--namespace`/`-n` (defaults to `default`) and `--json` for structured output that automation and AI agents can parse directly. The `list` and `logs` commands also support `--page` and `--per-page` for pagination, and `cancel` prompts for confirmation unless you pass `-y`/`--force`.  
For full usage details, refer to the [AI Search Wrangler commands documentation](https://edgetunnel-b2h.pages.dev/ai-search/wrangler-commands/).

Jul 02, 2026
1. ### [Cache multiple versions of a URL with Vary](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-vary-for-cache-rules/)  
[ Cache / CDN ](https://edgetunnel-b2h.pages.dev/cache/)  
Your origin can serve different responses for the same URL — different languages based on `Accept-Language`, or different formats based on `Accept` — by returning a [Vary ↗](https://www.rfc-editor.org/rfc/rfc9110.html#name-vary) response header. Cloudflare's cache now honors that header directly in [Cache Rules](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/), so the same URL can hold multiple cached versions and each request is matched to the right one. Content that previously had to bypass cache to stay correct can now be cached, following standard [HTTP caching behavior ↗](https://www.rfc-editor.org/rfc/rfc9111.html#name-calculating-cache-keys-with).  
#### What changed  
Your origin now decides which request headers matter by listing them in its `Vary` response, and you control how Cloudflare treats each one. When you have enabled Vary using a cache rule and a response includes a `Vary` header, the request headers listed become part of the cache key.  
For each header your origin varies on, choose one of three actions:

| Action      | Behavior                                                                                                      | Best for                                                                   |
| ----------- | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| normalize   | Converts equivalent header values to the same cache key value before matching, collapsing redundant versions. | Most Accept, Accept-Language, and Accept-Encoding use cases.               |
| passthrough | Uses the raw header value to select the cached version and forwards it to the origin unchanged.               | When byte-for-byte differences in the header value should create versions. |
| bypass      | Bypasses cache whenever this header name appears in the origin's Vary response.                               | Per-user values, or headers with too many possible values to cache safely. |  
#### Benefits

  * **Higher cache hit ratios**: `normalize` treats semantically equivalent headers as one version. For example, `Accept-Language: en-US, fr;q=0.8` and `Accept-Language: fr;q=0.8, en-GB` both resolve to the same cache key, so you serve more requests from cache instead of the origin.
  * **Correct content negotiation**: Requests always receive the cached version that matches their headers, so language and format variants stay accurate.
  * **No origin or Worker changes required**: If your origin already sends `Vary`, you configure the behavior entirely in Cache Rules.
  * **Standards-aligned**: Cache key calculation follows RFC 9111, and `Vary: *` continues to bypass cache as required by RFC 9110.  
#### Availability  
Vary in Cache Rules is available on all plans (Free, Pro, Business, and Enterprise). For per-request control in Workers subrequests, use the [cf.vary](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/request/#the-cfvary-property) property.  
#### Get started  
Configure Vary in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/:zone/caching/cache-rules) under **Caching** \> **Cache Rules**, or through the [Rulesets API](https://edgetunnel-b2h.pages.dev/ruleset-engine/rulesets-api/). To learn how Vary affects cache keys and how each action works, refer to [Vary](https://edgetunnel-b2h.pages.dev/cache/concepts/vary/) and the [Cache Rules Vary setting](https://edgetunnel-b2h.pages.dev/cache/how-to/cache-rules/settings/#vary).

Jul 02, 2026
1. ### [Updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### Updated fields in existing datasets

  * **Gateway DNS** (added): `AppliedMaxTTL` and `UpstreamRecordTTLs`.
  * **Gateway HTTP** (added): `Warnings`.
  * **HTTP requests** (added): `CacheLockWaitedMs`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

Jul 02, 2026
1. ### [Hostname routing for Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-mesh-hostname-routing/)  
[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
You can now add [hostname routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes) to a Cloudflare Mesh node, in addition to CIDR routes.

  1. [Client device](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
  Requests `wiki.internal.local`
  2. DNS query ↓
  3. [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
  Returns a token IP, then rewrites the destination to the real private IP.  
  `100.80.0.0/16`
  4. [Hostname route](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes) ↓
  5. [Mesh node](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
  Forwards traffic to the host on the local network
  6. ↓
  7. Private host  
  `wiki.internal.local` · `10.0.0.50`  
Instead of managing IP ranges, you can attract traffic for a hostname to a Mesh node:

  * **Private hostname** (for example, `wiki.internal.local`) — reach an internal application by name, which is useful when it has an unknown or ephemeral IP. On Mesh you do not need to run a DNS server; a local hosts-file entry on the node is enough, or you can use a Gateway resolver policy for split DNS.
  * **Public hostname** (for example, `www.example.com`) — route that hostname's traffic through the node and egress via the node's public IP.  
[ Go to **Mesh** ](https://dash.cloudflare.com/?to=/:account/mesh)  
For setup steps, prerequisites, and DNS options, refer to [Hostname routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes).

Jul 02, 2026
1. ### [Work across multiple accounts with Wrangler auth profiles](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-wrangler-auth-profiles/)  
[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
[Wrangler CLI](https://edgetunnel-b2h.pages.dev/workers/wrangler/) now supports auth profiles: named logins that you scope to specific Cloudflare accounts and switch between automatically, based on the directory you are working in.  
A profile is a named OAuth login bound to a directory. Commands run in that directory, and its subdirectories, use the matching account — so you can move between accounts without re-running `wrangler login`.  
Use profiles to keep a separate login for each client when working at an agency, or to separate staging and production into different accounts. Pair a profile with an `account_id` in your [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/) so a command cannot reach the wrong account.  
```sh  
# Create a profile for each account, choosing which accounts it can reach  
wrangler auth create client-a  
wrangler auth activate client-a ~/clients/client-a  
wrangler auth create client-b  
wrangler auth activate client-b ~/clients/client-b  
```  
Use the `--profile` flag to run a single command with a specific profile:  
```sh  
wrangler deploy --profile personal  
```  
In CI and other automated environments, `CLOUDFLARE_API_TOKEN` still takes precedence over all profiles.  
For setup, the resolution order, and the full command reference, refer to [Authentication profiles](https://edgetunnel-b2h.pages.dev/workers/wrangler/profiles/).

Jul 01, 2026
1. ### [Cloudflare One Client for Linux (version 2026.6.836.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-warp-linux-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This package is the same release as 2026.6.822.0, with a fix for our RPM package. Previously the repository served a single build to every OS version, so an install could pull a dependency that isn't available on that release. The repository now serves the correct build for each operating system version, so installs automatically pull the dependencies that version requires. Debian and Ubuntu were not affected.  
If you installed version 2026.6.822.0 on an RPM-based distribution, we recommend refreshing your repository configuration:  
```bash  
sudo curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo  
sudo dnf clean all  
sudo dnf install cloudflare-warp  
```

Jul 01, 2026
1. ### [Fix redirect URL fragment encoding for single-page applications](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-spa-redirect-fragment-fix/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
Access now correctly preserves URL fragment characters (`/`, `?`, `=`, `&`, `;`) when redirecting users back to an application after login. Previously, these characters were encoded with `encodeURIComponent`, which mangled fragment-based routes used by single-page applications (SPAs).  
For example, an SPA URL like `https://app.example.com/#/dashboard?tab=settings&view=advanced` would previously redirect to a broken URL after login. This is now handled correctly.  
If your SPA users were experiencing broken navigation after authenticating through Access, this fix resolves the issue without any configuration changes.

Jul 01, 2026
1. ### [Independent MFA for infrastructure applications](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-ssh-mfa-piv-keys/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
[Access for Infrastructure](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now supports independent multi-factor authentication (MFA) for SSH connections using YubiKey PIV keys. This adds a hardware-backed second factor to SSH access, ensuring that a compromised device session alone is not sufficient to reach your servers.  
With per-application and per-policy configuration, you can enforce PIV key authentication for sensitive usernames (for example, `root`) while applying different requirements for other usernames. You can also set an MFA session duration to control how often users must re-authenticate.  
#### Enrollment  
Users enroll their YubiKey PIV key through the [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/). For enrollment instructions and SSH client setup, refer to [Enroll a PIV key for infrastructure apps](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-piv-key-for-infrastructure-apps).  
#### Configuration  
For setup instructions, refer to [Enforce MFA for infrastructure applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications).

Jul 01, 2026
1. ### [New options to manage AI traffic](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-ai-traffic-options/)  
[ Bots ](https://edgetunnel-b2h.pages.dev/bots/)  
Not all AI traffic is the same. Now, all customers — including those on the Free plan — can manage AI crawlers based on what they actually do on your site. Cloudflare groups AI traffic into three behaviors you can control independently: [Search, Agent, and Training](https://edgetunnel-b2h.pages.dev/bots/concepts/bot/#ai-bots). This lets you keep the automated traffic that sends readers and revenue back to you, while blocking the traffic that only takes from your content.  
Each behavior maps to a real use case. **Search** covers crawlers that index your content so they can answer questions about it later, where you should expect referral traffic or other equitable compensation in return. **Agent** covers automated activity acting in real time on a person's behalf, such as chat fetch bots and browser-use agents. **Training** covers crawlers that take your content to train or fine-tune a model. For each preset you can choose to block on all pages, block only on pages that display ads, or choose not to block.  
![The Configure AI bot traffic policies screen, where Search, Agent, and Training can each be set to allow, block, or block only on pages with ads](https://edgetunnel-b2h.pages.dev/_astro/ai-bot-traffic-policies.BqXU7Gmv_Z24E74g.webp)  
Starting **September 15, 2026**, new domains onboarding to Cloudflare receive updated defaults: Bots classified as Training or as Agent are blocked on pages that display ads, while **Search** remains allowed. On that date, multi-purpose crawlers that combine Search and Training will be affected by the new defaults to block Training. All customers can [opt out of the new defaults ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/settings) at any time before September 15.

Jul 01, 2026
1. ### [More visibility into bot traffic with BotBase and Attribution Business Insights](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-botbase-attribution-business-insights/)  
[ Bots ](https://edgetunnel-b2h.pages.dev/bots/)  
With Content Independence Day 2026, [Enterprise Bot Management](https://edgetunnel-b2h.pages.dev/bots/get-started/bot-management/) customers get two new tools that make bot traffic far easier to see and reason about: [BotBase](https://edgetunnel-b2h.pages.dev/bots/botbase/), a searchable directory of every bot Cloudflare tracks, and [Attribution Business Insights](https://edgetunnel-b2h.pages.dev/bots/attribution-business-insights/), a dashboard that shows how much value each crawler sends back to your business.  
BotBase is Cloudflare's directory of all known bots and agents, available directly in the dashboard. It shows how Cloudflare classifies each bot by behavior — Search, Agent, Training, and other categories such as Transact, Data Collection, SEO, and Ads Verification — so you can understand why a given crawler is visiting you. You can search and filter the full catalogue, filter your own traffic down to a single bot to investigate its activity on your zone, and copy any bot's detection ID to target it precisely in [Security rules](https://edgetunnel-b2h.pages.dev/security/rules/). Every tracked bot in BotBase is also published in [Cloudflare Radar's bots and agents directory ↗](https://radar.cloudflare.com/bots/directory).  
Attribution Business Insights is built for content owners and business decision-makers who want to know which bots help or harm their business, without reading rule syntax. The dashboard reports crawl-to-referral ratios both site-wide and per bot operator — comparing how often a company crawls your content against how many visitors it actually refers back — over the last 24 hours, 7 days, or 30 days. Each operator is labeled with Cloudflare's [updated classification](https://edgetunnel-b2h.pages.dev/bots/concepts/bot/verified-bots/) and an action status of Allowed, Blocked, or Partially blocked, giving stakeholders a shared, at-a-glance view of the AI traffic reaching your site.  
![The Attribution Business Insights dashboard, showing bot traffic, content page requests, crawl-to-referral ratio, and a per-operator bot activity table](https://edgetunnel-b2h.pages.dev/_astro/attribution-business-insights.Cu-ZtxkX_1SkuMS.webp)

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/2/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```