--- title: Changelogs image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) All products ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Jul 01, 2026 1. ### [Use Google Artifact Registry images with Containers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-google-artifact-registry-images/) [ Containers ](https://edgetunnel-b2h.pages.dev/containers/) Containers now support [Google Artifact Registry ↗](https://cloud.google.com/artifact-registry) images. After you configure credentials, you can use a fully qualified Google Artifact Registry image reference in your [Wrangler configuration](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/#containers) instead of first pushing the image to Cloudflare Registry. Provide the service account email with `--gar-email` and pipe the service account JSON key through `stdin`: ```bash cat | npx wrangler containers registries configure -docker.pkg.dev --gar-email= --secret-name= ``` * [ wrangler.jsonc ](#tab-panel-4948) * [ wrangler.toml ](#tab-panel-4949) **JSONC** ```jsonc { "$schema": "./node_modules/wrangler/config-schema.json", "containers": [ { "image": "-docker.pkg.dev///:" } ] } ``` **TOML** ```toml # Example: us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest [[containers]] image = "-docker.pkg.dev///:" ``` Only `*-docker.pkg.dev` hosts are supported. To configure credentials, refer to [Use private Google Artifact Registry images](https://edgetunnel-b2h.pages.dev/containers/platform-details/image-management/#use-private-google-artifact-registry-images). For more information, refer to [Image management](https://edgetunnel-b2h.pages.dev/containers/platform-details/image-management/). Jul 01, 2026 1. ### [Images binding is now billed per unique transformation](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-binding-unique-transformations/) [ Cloudflare Images ](https://edgetunnel-b2h.pages.dev/images/) The [Images binding](https://edgetunnel-b2h.pages.dev/images/optimization/binding/) is now billed per unique transformation, matching the model already used for URL-based transformations. Repeat requests for the same combination of source image and parameters within the same calendar month are counted only once. Previously, every call to the binding counted as a separate transformation regardless of whether the image or parameters were unique. With this change, you can call the binding on hot paths without paying for each individual request. Calls to [.info()](https://edgetunnel-b2h.pages.dev/images/optimization/binding/#infostream) are no longer billed. For more information, refer to [Images pricing](https://edgetunnel-b2h.pages.dev/images/pricing/#images-transformed) and the [Images binding documentation](https://edgetunnel-b2h.pages.dev/images/optimization/binding/). Jul 01, 2026 1. ### [Reduced end-to-end latency for vector changes](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-improved-wal-throughput/) [ Vectorize ](https://edgetunnel-b2h.pages.dev/vectorize/) We have greatly improved the throughput of the Vectorize [write-ahead log (WAL) ↗](https://blog.cloudflare.com/building-vectorize-a-distributed-vector-database-on-cloudflare-developer-platform/#the-wal). As a result, we have significantly reduced the end-to-end latency for a vector change to become queryable: median latency has dropped from 2 minutes to under 30 seconds, and p99 latency from 5 minutes to under 2 minutes. ![Vectorize p99 WAL batch end-to-end latency improved](https://edgetunnel-b2h.pages.dev/_astro/vectorize-p99-wal-batch-end-to-end-latency-improvement.k8gtzlG7_Z21AKmQ.webp) This means inserts, upserts, and deletes are reflected in query results faster, improving the freshness of semantic search, recommendation, and retrieval-augmented generation (RAG) workloads. You do not need to change your code or configuration to benefit from this improvement. For more information, refer to the [Vectorize documentation](https://edgetunnel-b2h.pages.dev/vectorize/). Jul 01, 2026 1. ### [WAF Release - 2026-07-01](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This release adds targeted coverage for a path traversal flaw in Fortinet FortiSandbox (CVE-2026-39813) and transitions the Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule action from Block to Disabled. **Key Findings** * CVE-2026-39813: A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ----------------------------------------------------------- | --------------- | ---------- | --------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...d84c92c9 | N/A | Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c12cf9c8 | N/A | Anomaly:Header:User-Agent - Fake Bing or MSN Bot | Enabled | Disabled | We are changing the action for this rule from BLOCK to Disabled | Jun 30, 2026 1. ### [New permissions and roles for Gateway policies and lists](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-gateway-granular-permissions/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) You can now assign granular, resource-scoped roles for [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) firewall policies and [Zero Trust lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/). Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control. #### What is new When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the following resource-scoped roles are now available: | Role | Description | | ------------------------------------------ | ------------------------------------------------------------------------------------------- | | Zero Trust Gateway Firewall Policies Admin | Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. | | Zero Trust Gateway DNS Policies Admin | Can view and edit Gateway DNS policies. | | Zero Trust Gateway HTTP Policies Admin | Can view and edit Gateway HTTP policies. | | Zero Trust Gateway Network Policies Admin | Can view and edit Gateway Network policies. | | Zero Trust Gateway Egress Policies Admin | Can view and edit Gateway Egress policies. | | Zero Trust Gateway Resolver Policies Admin | Can view and edit Gateway Resolver policies. | | Zero Trust Gateway Policies Admin | Can view and edit all Gateway policies. | | Zero Trust Gateway Policies Read | Can view all Gateway policies. | | Zero Trust Gateway Read Only | Can view all Gateway resources. | | Zero Trust DNS Locations Admin | Can view and edit DNS locations. | | Zero Trust Proxy Endpoints Admin | Can view and edit Gateway Proxy Endpoints. | | Zero Trust Account Lists Admin | Can view and edit all Gateway and Access lists. | | Zero Trust Account Lists Read | Can view all Gateway and Access lists. | These roles allow you to: * Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration. * Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes. * Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration. You can also now assign _Resource-scoped roles_. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. **Existing account-level roles continue to work.** A member with the `Cloudflare Gateway` or `Cloudflare Zero Trust` role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens. #### Get started * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference. * Learn how to [create permission policies](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/) that use these roles. Jun 30, 2026 1. ### [Account-scoped firewall events dataset in Logpush](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-account-level-firewall-events/) [ Logs ](https://edgetunnel-b2h.pages.dev/logs/) Cloudflare Logpush now supports [firewall events as an account-scoped dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/). Configure a single Logpush job at the account level to receive firewall events for every zone in the account, instead of creating and maintaining a separate job per zone. The dataset includes a new [ZoneName](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/#zonename) field so you can identify which zone each event came from when consuming logs in your downstream pipeline. #### What's available * A new account-scoped `firewall_events` dataset, configurable via the [Logpush API](https://edgetunnel-b2h.pages.dev/api/resources/logpush/subresources/jobs/) or the Cloudflare dashboard. * The same fields and filter expressions supported by the existing [zone-scoped firewall events dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/zone/firewall%5Fevents/), plus the new `ZoneName` field. * Support for all existing Logpush destinations. Jun 30, 2026 1. ### [Track memory usage for Workers and Durable Objects in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-memory-usage-metrics/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/)[ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/) You can now monitor how much memory your [Workers](https://edgetunnel-b2h.pages.dev/workers/) and [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/) consume across invocations with the new **Memory Usage** chart in the Workers Metrics tab, broken down by P50, P90, P99, and P999 percentiles. ![Memory usage chart showing P50, P90, P99, and P999 percentiles with deployment markers](https://edgetunnel-b2h.pages.dev/_astro/2026-06-26-memory-usage.B20y2uNp_2e7cPL.webp) Memory usage measures the V8 [isolate](https://edgetunnel-b2h.pages.dev/workers/reference/how-workers-works/#isolates) memory at the time of each invocation, subject to the [128 MB per-isolate limit](https://edgetunnel-b2h.pages.dev/workers/platform/limits/#memory) — a single isolate can handle many concurrent requests and shares memory across them. Use the Memory Usage chart to: * **Track memory trends** — Spot gradual increases that may indicate a memory leak before they cause `Exceeded Memory` errors. * **Correlate with deployments** — Deployment markers on the chart help you identify whether a new version introduced a memory regression. * **Right-size your Worker** — Understand your baseline memory footprint and how much headroom you have before hitting the 128 MB limit. For Durable Objects, memory usage reflects the in-memory state an object holds (class properties, caches, active WebSocket connections), which persists across invocations until the object is [hibernated or evicted](https://edgetunnel-b2h.pages.dev/durable-objects/concepts/durable-object-lifecycle/). This state is not preserved across eviction, hibernation, or a crash, so persist anything important to [storage](https://edgetunnel-b2h.pages.dev/durable-objects/best-practices/access-durable-objects-storage/). To view memory usage, open the **Metrics** tab for your [Worker ↗](https://dash.cloudflare.com/?to=/:account/workers/services/view/:worker/production/metrics) or [Durable Object namespace ↗](https://dash.cloudflare.com/?to=/:account/workers/durable-objects). For Durable Objects, you can filter by DO ID or name to drill down into memory usage for a specific object. You can also query memory usage programmatically via the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/tutorials/querying-workers-metrics/) using the `workersInvocationsAdaptive` dataset — the `quantiles.memoryUsageBytesP50` through `quantiles.memoryUsageBytesP999` fields return percentile values in bytes. For local memory debugging, you can also [profile memory with DevTools](https://edgetunnel-b2h.pages.dev/workers/observability/dev-tools/memory-usage/) to take heap snapshots and identify specific objects causing high memory usage. Jun 29, 2026 1. ### [Cloudflare One Client for Windows (version 2026.6.822.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-29-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. * Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. * Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details. * Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** * Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. * Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in Windows Accessibility settings. * Path MTU Discovery (PMTUD) is now enabled by default. * The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. * Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. * Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. * Fixed a high CPU issue when the device wakes from sleep. * Users can now register with team names in any case format without errors. * New UI fixes * Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. * Added a re-auth button and banner to the home screen so users don't miss it when their session expires. * Added clear error messaging when the Cloudflare certificate needs to be installed. * Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. * New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. * Added ability to configure proxy mode for consumer users. * Added back the option to quit for consumer users. **Known issues** * Single sign-on in the embedded WebView2 authentication browser may fail to use the Windows primary account, prompting for an interactive sign-in. * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * In rare cases, a registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click "Ok" with the default highlighted option. Jun 29, 2026 1. ### [Cloudflare One Client for macOS (version 2026.6.822.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-29-warp-macos-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. * Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details. * Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** * Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. * Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. * Path MTU Discovery (PMTUD) is now enabled by default. * Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. * Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. * Users can now register with team names in any case format without errors. * New UI fixes * Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. * Added a re-auth button and banner to the home screen so users don't miss it when their session expires. * Added clear error messaging when the Cloudflare certificate needs to be installed. * Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. * New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. * Added ability to configure proxy mode for consumer users. * Added back the option to quit for consumer users. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * When deploying with Microsoft Intune, the client may be repeatedly reinstalled because Intune adds the client's embedded framework bundles to its install-detection list, and those frameworks cannot be detected as installed on their own. See [Repeated reinstalls on macOS with Microsoft Intune](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#repeated-reinstalls-on-macos-with-microsoft-intune) for the workaround. Jun 29, 2026 1. ### [Cloudflare One Client for Linux (version 2026.6.822.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-29-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. * Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details. **Additional changes and improvements** * Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. * [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) functionality using the Cloudflare One Client is now supported on RHEL 9 and 10. * Cloudflare Mesh now supports [hostname-based routing](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#hostname-routes). * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. * Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the system display settings. * Path MTU Discovery (PMTUD) is now enabled by default. * Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. * Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. * Fixed an issue where some Debian releases experienced inaccurate version reporting for posture checks. * Users can now register with team names in any case format without errors. * New UI fixes * Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. * Added a re-auth button and banner to the home screen so users don't miss it when their session expires. * Added clear error messaging when the Cloudflare certificate needs to be installed. * Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. * New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. * Added ability to configure proxy mode for consumer users. * Added back the option to quit for consumer users. For RHEL deployments, this release introduces a dependency on the [Extra Packages for Enterprise Linux](https://docs.fedoraproject.org/en-US/epel/) repository (EPEL). The EPEL repository provides packages that support the captive portal detection’s in-app browser authentication and system tray icon. See [Getting started with EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/) for instructions on enabling EPEL. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. Jun 28, 2026 1. ### [Workers fetch requests now support cf.vary](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-28-cf-vary-request-option/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Workers `fetch()` requests now support the `cf.vary` request option. Use `cf.vary` to control how Cloudflare caches origin responses with a `Vary` header for a single subrequest. * [ JavaScript ](#tab-panel-4956) * [ TypeScript ](#tab-panel-4957) **src/index.js** ```js export default { async fetch(request) { return fetch(request, { cf: { vary: { default: { action: "bypass" }, headers: { accept: { action: "normalize", media_types: ["text/html", "application/json"], }, "accept-language": { action: "normalize", languages: ["en", "fr", "de"], }, }, }, }, }); }, }; ``` **src/index.ts** ```ts export default { async fetch(request): Promise { return fetch(request, { cf: { vary: { default: { action: "bypass" }, headers: { accept: { action: "normalize", media_types: ["text/html", "application/json"], }, "accept-language": { action: "normalize", languages: ["en", "fr", "de"], }, }, }, }, }); }, } satisfies ExportedHandler; ``` For more information, refer to [cf.vary](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/request/#the-cfvary-property). Jun 26, 2026 1. ### [Agents SDK adds background sub-agents and a unified turn entry point](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-26-agents-sdk-v0170/) [ Agents ](https://edgetunnel-b2h.pages.dev/agents/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) The latest release of the [Agents SDK ↗](https://github.com/cloudflare/agents) makes it easier to run long work in the background, drive turns through one entry point, and keep chat agents working through deploys, evictions, and reconnects. This release adds first-class detached (background) sub-agent runs with live progress and durable milestones, a single `runTurn` turn-admission entry point, and a large round of recovery and reliability fixes that continue converging `@cloudflare/think` and `@cloudflare/ai-chat` onto one model. #### Background sub-agents with progress and milestones `runAgentTool` can now dispatch a sub-agent without blocking the calling turn. A detached run returns a handle immediately and is owned by a durable, eviction-surviving backbone instead of being abandoned when the dispatching turn ends. * [ JavaScript ](#tab-panel-4954) * [ TypeScript ](#tab-panel-4955) **JavaScript** ```js class OrdersAgent extends Think { async startImport(input) { // Fire-and-forget, or wire a durable completion callback // (by method name, like schedule()): await this.runAgentTool(ImportAgent, { input, detached: { onFinish: "onImportDone", maxBudgetMs: 60 * 60 * 1000 }, }); } // result.status: "completed" | "error" | "aborted" | "interrupted" async onImportDone(run, result) {} } ``` **TypeScript** ```ts class OrdersAgent extends Think { async startImport(input) { // Fire-and-forget, or wire a durable completion callback // (by method name, like schedule()): await this.runAgentTool(ImportAgent, { input, detached: { onFinish: "onImportDone", maxBudgetMs: 60 * 60 * 1000 }, }); } // result.status: "completed" | "error" | "aborted" | "interrupted" async onImportDone(run, result) {} } ``` Highlights: * **Durable, exactly-once-on-the-happy-path completion** via a warm fast path plus a self-scheduling reconcile backbone that survives eviction and deploys. * **Bounded.** An absolute `maxBudgetMs` ceiling (default 24h) and `cancelAgentTool(runId)` keep abandoned runs from holding a concurrency slot forever. * **`detached: { notify: true }`** lets a finished background run inject a message back into the chat so the model reacts to the result — no hand-wired `onFinish` needed. Sub-agents can also report mid-run progress that rides their own turn stream back to the parent's connected clients: * [ JavaScript ](#tab-panel-4952) * [ TypeScript ](#tab-panel-4953) **JavaScript** ```js // Inside the child sub-agent: await this.reportProgress({ fraction: 0.6, phase: "deploying", message: "Generating menu page…", }); ``` **TypeScript** ```ts // Inside the child sub-agent: await this.reportProgress({ fraction: 0.6, phase: "deploying", message: "Generating menu page…", }); ``` Progress surfaces on `AgentToolRunState.progress` via `useAgentToolEvents`, so a background-runs tray can render a live bar without drilling in, and the latest snapshot is persisted for inspection after eviction. Naming a `milestone` promotes a signal to a durable, replayable row, and `detached: { onMilestones }` can surface a milestone as a synthetic chat message (`"narrate"` for a cheap status line, or `"react"` to drive a model turn). #### One entry point for turns: `runTurn` `@cloudflare/think` adds a public `runTurn(options)` facade that unifies turn admission behind a single `mode`: * [ JavaScript ](#tab-panel-4950) * [ TypeScript ](#tab-panel-4951) **JavaScript** ```js await this.runTurn({ mode: "wait", messages }); // saveMessages / continueLastTurn await this.runTurn({ mode: "submit", messages }); // durable submitMessages await this.runTurn({ mode: "stream", messages }); // chat() ``` **TypeScript** ```ts await this.runTurn({ mode: "wait", messages }); // saveMessages / continueLastTurn await this.runTurn({ mode: "submit", messages }); // durable submitMessages await this.runTurn({ mode: "stream", messages }); // chat() ``` `stream` mode accepts array and function inputs to match `wait` mode, and all entry points now route through a shared internal admission path that throws a clear error on nested blocking admissions that previously could deadlock. #### Recovery and reliability A large part of this release continues hardening recovery and converging `@cloudflare/think` and `@cloudflare/ai-chat` onto one model: * **Stream stall watchdog.** `AIChatAgent` can detect and recover from a hung model/transport stream via the opt-in `chatStreamStallTimeoutMs` watchdog. With `chatRecovery` enabled the stall routes into the same bounded-recovery machinery a deploy or eviction uses; otherwise it surfaces as a terminal stream error so the spinner clears. * **Interrupted tool-call repair.** `AIChatAgent` now repairs a transcript with a dead server-tool call before re-entering inference (parity with `@cloudflare/think`), so a recovered turn no longer fails with `AI_MissingToolResultsError`. An overridable `repairInterruptedToolPart(part)` hook lets apps customize the repaired shape. * **Stuck status after reconnect.** Fixed AI SDK `status` getting stuck when a reconnect races a turn that has been accepted but has not started streaming yet, so the UI now renders the in-flight turn instead of settling on `ready`. * **Live "recovering…" on connect.** `AIChatAgent` now replays the recovering status to a client that connects mid-recovery, so `useAgentChat`'s `isRecovering` reflects in-progress recovery immediately instead of appearing frozen. * **Terminal connection failures.** The client stops reconnecting on terminal WebSocket close events and exposes them via `connectionError` / `onConnectionError` on `AgentClient`, `useAgent`, and `useAgentChat`. * **Agent-tool child recovery.** A healthy long-running sub-agent run is no longer abandoned as `interrupted` after a deploy (both `@cloudflare/think` and `AIChatAgent`). * **Workflows from sub-agent facets.** Agent Workflows can now start from sub-agent facets, with callbacks and Workflow RPC routed back to the originating facet. * Plus forward-progress crediting convergence, broadcast-first give-up ordering, an event-driven auto-continuation barrier, and structured row-size compaction in `AIChatAgent`. #### Other improvements * **Shared chat React core.** A new `agents/chat/react` entry exposes `useAgentChat`, transport helpers, and shared wire types, with `syncMessagesToServer` for server-authoritative transcript storage. `@cloudflare/think/react` and `@cloudflare/ai-chat/react` are now thin wrappers over it. * **Optional `ai` peer.** The root `agents` and `@cloudflare/codemode` runtimes no longer reference AI SDK types, so they bundle without `ai` / `zod` installed; AI-specific entry points still require the peer when imported. `just-bash` likewise moves to an optional peer used only by the skills bash runner. * **Code Mode.** The default `DynamicWorkerExecutor` timeout increases from 30s to 60s, executions now dispose the dynamically-loaded Worker and its RPC stub after each run (fixing a flaky isolate-shutdown assertion), connector imports are cleaned up, and the outer MCP tool-call context is passed to `openApiMcpServer` request callbacks. * **Voice.** Voice turns now support AI SDK `fullStream` responses (and warn when `textStream` is used). * **MCP.** `McpAgent` server-to-client requests can now be sent from callbacks that do not inherit the agent's async context, including callbacks reached through Worker Loader RPC. * **Experimental: server actions and channels.** This release lays groundwork for guarded server actions (`action()` / `getActions()` with a durable replay ledger and approvals) and a unified channels surface (`configureChannels()`, `deliverNotice()`). Both are experimental and their APIs may change, so we don't recommend depending on them yet. #### Upgrade To update to the latest version: npm yarn pnpm bun ``` npm i agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest @cloudflare/codemode@latest @cloudflare/voice@latest ``` ``` yarn add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest @cloudflare/codemode@latest @cloudflare/voice@latest ``` ``` pnpm add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest @cloudflare/codemode@latest @cloudflare/voice@latest ``` ``` bun add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest @cloudflare/codemode@latest @cloudflare/voice@latest ``` Refer to the [Think documentation](https://edgetunnel-b2h.pages.dev/agents/harnesses/think/), [Code Mode documentation](https://edgetunnel-b2h.pages.dev/agents/tools/codemode/), and [Agents documentation](https://edgetunnel-b2h.pages.dev/agents/) for more information. Jun 26, 2026 1. ### [Service token support for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-26-mcp-portal-service-tokens/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) You can now connect autonomous agents and bots to an [MCP server portal](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) using an [Access service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/). Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow. To set this up: * Add a [Service Auth policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#service-auth) that matches your service token to the portal's Access application. * Add a Service Auth policy that matches the same token to each linked MCP server's Access application. * Turn **Require user auth** off (`on_behalf: false`) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant. The bot connects with `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers and sees the tools from every linked server it is authorized for. Servers that still require per-user OAuth are excluded from service token sessions because a service token cannot complete a per-user OAuth grant. For step-by-step setup, refer to [Connect with a service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token). Jun 26, 2026 1. ### [New \`us\` jurisdiction for Durable Objects](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-26-durable-objects-us-jurisdiction/) [ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Durable Objects now supports a `us` [jurisdiction](https://edgetunnel-b2h.pages.dev/durable-objects/reference/data-location/#restrict-durable-objects-to-a-jurisdiction), letting you create Durable Objects that only run and store data within the United States. Use the `us` jurisdiction when you need to keep a Durable Object's compute and storage inside the United States to meet data residency requirements. Create a namespace restricted to the `us` jurisdiction the same way as any other jurisdiction: **JavaScript** ```js // Worker export default { async fetch(request, env) { const usSubnamespace = env.MY_DURABLE_OBJECT.jurisdiction("us"); const stub = usSubnamespace.getByName("general"); return stub.fetch(request); }, }; ``` Workers may still access Durable Objects constrained to the `us` jurisdiction from anywhere in the world. The jurisdiction constraint only controls where the Durable Object itself runs and persists data. For the full list of supported jurisdictions, refer to [Data location — Restrict Durable Objects to a jurisdiction](https://edgetunnel-b2h.pages.dev/durable-objects/reference/data-location/#restrict-durable-objects-to-a-jurisdiction). Jun 25, 2026 1. ### [Search API tokens by name](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-25-api-token-search/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating. #### What's new * **Dashboard search**: Both [account API tokens ↗](https://dash.cloudflare.com/?to=/:account/account-api-tokens) and [user API tokens ↗](https://dash.cloudflare.com/profile/api-tokens) pages now include a search bar. Type a name to filter results. * **API search support**: The [/user/tokens](https://edgetunnel-b2h.pages.dev/api/resources/user/subresources/tokens/methods/list/) and [/accounts/{account\_id}/tokens](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/tokens/methods/list/) endpoints now accept a `name` query parameter to filter tokens by name. For more information, refer to [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) and [Account API tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/). Jun 25, 2026 1. ### [Test Durable Object eviction with new cloudflare:test helpers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-25-durable-object-eviction-test-helpers/) [ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) The `@cloudflare/vitest-pool-workers` package now includes `evictDurableObject` and `evictAllDurableObjects` test helpers, exported from `cloudflare:test`. These helpers let you test how a Durable Object behaves across evictions, simulating the production lifecycle where an idle Durable Object can be evicted from memory. For more context, refer to [Lifecycle of a Durable Object](https://edgetunnel-b2h.pages.dev/durable-objects/concepts/durable-object-lifecycle/). **TypeScript** ```ts import { evictDurableObject, evictAllDurableObjects } from "cloudflare:test"; import { env } from "cloudflare:workers"; const id = env.COUNTER.idFromName("my-counter"); const stub = env.COUNTER.get(id); // Evict the Durable Object instance pointed to by a specific stub await evictDurableObject(stub); // Close WebSockets instead of hibernating them await evictDurableObject(stub, { webSockets: "close" }); // Evict all currently-running Durable Objects in evictable namespaces await evictAllDurableObjects(); ``` These helpers are available in `@cloudflare/vitest-pool-workers@0.16.20` and later. Learn more in the [Test APIs reference](https://edgetunnel-b2h.pages.dev/workers/testing/vitest-integration/test-apis/#durable-objects) and the [Testing Durable Objects guide](https://edgetunnel-b2h.pages.dev/durable-objects/examples/testing-with-durable-objects/#testing-eviction). Jun 24, 2026 1. ### [Cloudflare One Client for macOS (version 2026.6.782.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-warp-macos-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. **Additional changes and improvements** This release also introduces multiple fixes and improvements including: * Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. * Path MTU Discovery (PMTUD) is now enabled by default. * Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. * Users can now register with team names in any case format without errors. * New UI fixes * Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. * Added a re-auth button and banner to the home screen so users don't miss it when their session expires. * Added clear error messaging when the Cloudflare certificate needs to be installed. * Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. * New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. * Added ability to configure proxy mode for consumer users. * Added back the option to quit for consumer users. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. Jun 24, 2026 1. ### [Control AI Search similarity cache freshness](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-ai-search-similarity-cache-controls/) [ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/) [AI Search](https://edgetunnel-b2h.pages.dev/ai-search/) now gives you more control over [similarity cache](https://edgetunnel-b2h.pages.dev/ai-search/configuration/retrieval/cache/) freshness. Similarity cache helps reduce latency and inference cost by reusing responses for semantically similar queries. With these updates, you can choose how long responses are eligible for reuse and clear cached responses when they may be stale. #### Cache duration now defaults to 48 hours Previously, AI Search cached responses for a fixed duration of 30 days. Cached responses now use the instance's `cache_ttl` setting, and the default is **48 hours**. You can set `cache_ttl` when creating or updating an instance to choose a cache duration from 10 minutes to 6 days. Use a shorter TTL when your source content changes frequently and freshness is more important. Use a longer TTL when your content is stable and you want more cache reuse. For example, set `cache_ttl` to `518400` to retain cached responses for 6 days: ```json { "cache_ttl": 518400 } ``` #### Purge cached responses You can also purge all cached responses for an instance on demand. Purging cached responses does not delete indexed content or source files. It prevents AI Search from reusing previous cached responses, so subsequent similar queries generate fresh answers and repopulate the cache. ```bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/ai-search/instances/$INSTANCE_NAME/purge_cache" \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` You can also purge cached responses from the instance settings page in the Cloudflare dashboard. Refer to [similarity cache](https://edgetunnel-b2h.pages.dev/ai-search/configuration/retrieval/cache/) for the full list of supported `cache_ttl` values and more details about cache behavior. Jun 24, 2026 1. ### [Audit Logs v2 — Organization-level audit logs in Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-audit-logs-v2-organization-dashboard-ui/) [ Audit Logs ](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/review-audit-logs/) You can now, as an [Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/) Super Administrator, view organization-level [audit logs](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/) in the Cloudflare dashboard, in addition to the existing [API access](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/#organization-activity-logs). Organization audit logs help you monitor activity across your organization. You can see who performed an action, what changed, when it happened, how it was performed, and whether it succeeded or failed. You can filter and search logs by actor, action, result, resource, request details, and timestamp. Use these logs to troubleshoot changes, investigate unexpected access, and support security or compliance workflows. ![Organization audit logs in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/Audit_logs_v2_organization_dashboard.De-uwPva_Z1QU6mw.webp) If you are viewing account-level audit logs and the account belongs to an organization where you are an Organization Super Administrator, select **View Organization Audit Logs** to open the parent organization's audit logs. ![View Organization Audit Logs button](https://edgetunnel-b2h.pages.dev/_astro/Audit_logs_v2_view_organization_button.Ch7CaBB-_Z10mKrb.webp) To get started, go to **Organizations**, select your organization, then go to **Manage Organization** \> **Audit Logs**. For more information, refer to the [Audit Logs documentation](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/). Jun 24, 2026 1. ### [New WebSocket Analytics Logpush dataset and updated fields](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-log-fields-updated/) [ Logs ](https://edgetunnel-b2h.pages.dev/logs/) Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/): #### New datasets * **WebSocket Analytics**: A new dataset with fields including `BytesReceivedClient`, `BytesReceivedOrigin`, `BytesSentClient`, `BytesSentOrigin`, `ClientASN`, `ClientIP`, `ClientRequestHost`, `ClientRequestPath`, `ClientRequestUserAgent`, `ColoCode`, `ConnectionCloseReason`, `ConnectionCloseSource`, `ConnectionID`, `ConnectionTransportCloseCode`, `EdgeEndTimestamp`, `EdgeStartTimestamp`, and `RayID`. #### Updated fields in existing datasets * **Firewall events** (added): `ZoneName`. The Firewall events dataset is now also available for [account-scope Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/), in addition to the existing zone scope. * **Email Security Alerts** (added): `BCC`, `DKIMResult`, `DMARCPolicy`, `DMARCResult`, and `SPFResult`. For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/). Jun 24, 2026 1. ### [Precise IP location and richer AS details on the Cloudflare Radar IP page](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-radar-ip-page-improvements/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) now plots your IPv4 and IPv6 locations on the [IP page ↗](https://radar.cloudflare.com/ip), shows the Cloudflare data centers serving your connection, and includes more detail about the autonomous system (AS) your primary IP belongs to. #### Your IP location on the map The map of your connection now shows: * **IP location markers** — The primary IP will show as a red marker. When both IP addresses do not geolocate to the same place, a second marker will appear in blue with a note explaining why IPv4 and IPv6 can resolve to different locations. * **Cloudflare data center markers** — Cloudflare data centers now show as orange dots on the map and the one you are connected to is highlighted. * **Data center connectors** — Each line connects your IP markers to their respective data centers. ![Map showing Cloudflare data centers and a marker representing the IP location with a line connected to a data center](https://edgetunnel-b2h.pages.dev/_astro/ip-page-geolocation.BJ53oUtj_ZhL3mu.webp) Due to the data policies of our geolocation provider, this detailed location is only available for your own IP. Other IP addresses keep the current country-level view. #### Extended AS information The AS card on the IP page now shows additional detail about the network an IP belongs to — including alternate names, the operator website, and an estimate of the AS user population — alongside the AS number and country. Visit the [Cloudflare Radar IP page ↗](https://radar.cloudflare.com/ip) to explore more details about your IP. Jun 23, 2026 1. ### [Workflows rollback handlers now include step context](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-16-rollback-options/) [ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/) [Workflows](https://edgetunnel-b2h.pages.dev/workflows/) makes it easier to build reliable multi-step applications that can recover when downstream systems fail. Rollback handlers now receive the original [step context](https://edgetunnel-b2h.pages.dev/workflows/build/step-context/) via a `ctx` object for the step being rolled back. This includes `ctx.step.name`, `ctx.step.count`, `ctx.attempt`, and the step `config` with defaults applied. The [step configuration](https://edgetunnel-b2h.pages.dev/workflows/build/workers-api/#workflowstepconfig) includes the retry and timeout settings used for that step, so you can customize your step recovery logic according to those fields. **TypeScript** ```ts await step.do( "create charge", async () => { const charge = await createCharge(); return { chargeId: charge.id }; }, { rollback: async ({ ctx, output, error }) => { // `output` is the value returned by the step being rolled back. const { chargeId } = output as { chargeId: string }; await refundCharge(chargeId, { // `ctx` is the original step context, including step name, count, attempt, and config. reason: `${ctx.step.name}: ${error.message}`, }); }, rollbackConfig: { // `rollbackConfig` controls retries and timeout for the rollback handler. retries: { limit: 3, delay: "30 seconds", backoff: "linear" }, timeout: "5 minutes", }, }, ); ``` Refer to [rollback options](https://edgetunnel-b2h.pages.dev/workflows/build/workers-api/#rollback-options) to learn more. Jun 23, 2026 1. ### [Regionalized IP Bindings for Regional Services](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-23-regionalized-ip-bindings/) [ Data Localization Suite ](https://edgetunnel-b2h.pages.dev/data-localization/) Regional Services now supports **Regionalized IP Bindings**, letting you regionalize traffic at the IP layer for prefixes you bring to Cloudflare through [Bring Your Own IP (BYOIP)](https://edgetunnel-b2h.pages.dev/byoip/). Where [Regional Hostnames](https://edgetunnel-b2h.pages.dev/data-localization/regional-services/regional-hostnames/) regionalize traffic by hostname, Regionalized IP Bindings let you bind a CIDR from one of your prefixes to a region — ideal for address-map deployments and any service you address by IP rather than hostname. Cloudflare then terminates TLS and processes traffic to those addresses only within the data centers in that region. Regionalized IP Bindings requires the Regional Services and Regional Services for BYOIP entitlements. Contact your account team to enable them. To get started, refer to [Regionalized IP Bindings](https://edgetunnel-b2h.pages.dev/data-localization/regional-services/ip-bindings/). Jun 23, 2026 1. ### [Cloudflare AMP/SXG is now end of life.](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-23-amp-sxg-end-of-life/) [ Speed ](https://edgetunnel-b2h.pages.dev/speed/) Cloudflare Accelerated Mobile Pages (AMP) and Signed Exchanges (SXG) support has reached end of life. The features have been disabled since October 2025, so customers who had them configured should see no change to their traffic. Customers will no longer be able to configure AMP/SXG through API or rulesets. The Zone API will start throwing errors. Rulesets with the SXG configuration will fail to save until SXG has been removed. Jun 23, 2026 1. ### [WAF Release - 2026-06-23](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-23-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces new managed protection to address a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520). **Key Findings** * CVE-2026-10520: An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges. The flaw stems from improper sanitization of input strings parsed during internal configuration handling. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ------------------------------------------------------ | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...242fdf83 | N/A | Ivanti Sentry - Command Injection - CVE:CVE-2026-10520 | Log | Block | This is a new detection. | ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/3/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/3/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```