---
title: Changelogs
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

All products

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 23, 2025
1. ### [WARP client for Windows (version 2025.5.943.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-23-warp-windows-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes and improvements.

**Changes and improvements**

  * WARP proxy mode now uses the operating system's DNS settings. Changes made to system DNS settings while in proxy mode require the client to be turned off then back on to take effect.
  * Changes to the [SCCM VPN boundary support](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#sccm-vpn-boundary-support) feature to no longer restart the SMS Agent Host (`ccmexec.exe`) service.
  * Fixed an issue affecting clients in Split Tunnel Include mode, where access to split-tunneled traffic was blocked after reconnecting the client.

**Known issues**

  * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution.
  * Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server).
  * Devices with `KB5055523` installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later.
  * DNS resolution may be broken when the following conditions are all true:

    * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
    * A custom DNS server address is configured on the primary network adapter.
    * The custom DNS server address on the primary network adapter is changed while WARP is connected.  
  To work around this issue, reconnect the WARP client by toggling off and back on.

Jul 23, 2025
1. ### [WARP client for macOS (version 2025.5.943.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-23-warp-macos-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes and improvements.

**Changes and improvements**

  * WARP proxy mode now uses the operating system's DNS settings. Changes made to system DNS settings while in proxy mode require the client to be turned off then back on to take effect.
  * Fixed an issue affecting clients in Split Tunnel Include mode, where access to split-tunneled traffic was blocked after reconnecting the client.
  * For macOS deployments, the WARP client can now be managed using an `mdm.xml` file placed in `/Library/Application Support/Cloudflare/mdm.xml`. This new configuration option offers an alternative to the still supported method of deploying a managed plist through an MDM solution.

**Known issues**

  * macOS Sequoia: Due to changes Apple introduced in macOS 15.0.x, the WARP client may not behave as expected. Cloudflare recommends the use of macOS 15.4 or later.
  * Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server).

Jul 23, 2025
1. ### [WARP client for Linux (version 2025.5.943.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-23-warp-linux-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes and improvements.

**Changes and improvements**

  * WARP proxy mode now uses the operating system's DNS settings. Changes made to system DNS settings while in proxy mode require the client to be turned off then back on to take effect.
  * Fixed an issue affecting clients in Split Tunnel Include mode, where access to split-tunneled traffic was blocked after reconnecting the client.

**Known issues**

  * Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server).

Jul 22, 2025
1. ### [Browser Rendering now supports local development](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-22-br-local-dev/)  
[ Browser Run ](https://edgetunnel-b2h.pages.dev/browser-run/)  
You can now run your Browser Rendering locally using `npx wrangler dev`, which spins up a browser directly on your machine before deploying to Cloudflare's global network. By running tests locally, you can quickly develop, debug, and test changes without needing to deploy or worry about usage costs.  
Get started with this [example guide](https://edgetunnel-b2h.pages.dev/browser-run/how-to/deploy-worker/) that shows how to use Cloudflare's [fork of Puppeteer](https://edgetunnel-b2h.pages.dev/browser-run/puppeteer/) (you can also use [Playwright](https://edgetunnel-b2h.pages.dev/browser-run/playwright/)) to take screenshots of webpages and store the results in [Workers KV](https://edgetunnel-b2h.pages.dev/kv/).

Jul 22, 2025
1. ### [Test out code changes before shipping with per-branch preview deployments for Cloudflare Workers](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-23-workers-preview-urls/)  
[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
Now, when you connect your Cloudflare Worker to a git repository on GitHub or GitLab, each branch of your repository has its own stable preview URL, that you can use to preview code changes before merging the pull request and deploying to production.  
This works the same way that Cloudflare Pages does — every time you create a pull request, you'll automatically get a shareable preview link where you can see your changes running, without affecting production. The link stays the same, even as you add commits to the same branch. These preview URLs are named after your branch and are posted as a comment to each pull request. The URL stays the same with every commit and always points to the latest version of that branch.  
![PR comment preview](https://edgetunnel-b2h.pages.dev/_astro/preview-urls-comment.0wQffFIq_2uQPCz.webp)  
#### Preview URL types  
Each comment includes **two preview URLs** as shown above:

  * **Commit Preview URL**: Unique to the specific version/commit (e.g., `<version-prefix>-<worker-name>.<subdomain>.workers.dev`)
  * **Branch Preview URL**: A stable alias based on the branch name (e.g., `<branch-name>-<worker-name>.<subdomain>.workers.dev`)  
#### How it works  
When you create a pull request:

  * **A preview alias is automatically created** based on the Git branch name (e.g., `<branch-name>` becomes `<branch-name>-<worker-name>.<subdomain>.workers.dev`)
  * **No configuration is needed**, the alias is generated for you
  * **The link stays the same** even as you add commits to the same branch
  * **Preview URLs are posted directly to your pull request as comments** (just like they are in Cloudflare Pages)  
#### Custom alias name  
You can also assign a custom preview alias using the [Wrangler CLI](https://edgetunnel-b2h.pages.dev/workers/wrangler/), by passing the `--preview-alias` flag when [uploading a version](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/general/#versions-upload) of your Worker:  
```bash  
wrangler versions upload --preview-alias staging  
```  
#### Limitations while in beta

  * Only available on the **workers.dev** subdomain (custom domains not yet supported)
  * Requires **Wrangler v4.21.0+**
  * Preview URLs are not generated for Workers that use [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/)
  * Not yet supported for [Workers for Platforms](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/workers-for-platforms/)

Jul 22, 2025
1. ### [Google Bard Application replaced by Gemini](https://edgetunnel-b2h.pages.dev/changelog/post/2025-08-15-gemini-application-replaces-bard/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
The **Google Bard** application (ID: 1198) has been deprecated and fully removed from the system. It has been replaced by the **Gemini** application (ID: 1340). Any existing Gateway policies that reference the old Google Bard application will no longer function. To ensure your policies continue to work as intended, you should update them to use the new Gemini application. We recommend replacing all instances of the deprecated Bard application with the new Gemini application in your Gateway policies. For more information about application policies, please see the [Cloudflare Gateway documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/application-app-types/).

Jul 22, 2025
1. ### [Audio mode for Media Transformations](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-22-media-transformations-audio-mode/)  
[ Stream ](https://edgetunnel-b2h.pages.dev/stream/)  
We now support `audio` mode! Use this feature to extract audio from a source video, outputting an M4A file to use in downstream workflows like [AI inference](https://edgetunnel-b2h.pages.dev/workers-ai/), content moderation, or transcription.  
For example,

**Example URL**  
```text  
https://example.com/cdn-cgi/media/<OPTIONS>/<SOURCE-VIDEO>  
https://example.com/cdn-cgi/media/mode=audio,time=3s,duration=60s/<input video with diction>  
```  
For more information, learn about [Transforming Videos](https://edgetunnel-b2h.pages.dev/stream/transform-videos/).

Jul 21, 2025
1. ### [Virtual Cloudflare One Appliance with KVM support (open beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-21-virtual-appliance-kvm-proxmox/)  
[ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
The KVM-based virtual Cloudflare One Appliance is now in open beta with official support for Proxmox VE.  
Customers can deploy the virtual appliance on KVM hypervisors to connect branch or data center networks to Cloudflare WAN without dedicated hardware.  
For setup instructions, refer to [Configure a virtual Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/configure-virtual-appliance/).

Jul 21, 2025
1. ### [Subaddressing support in Email Routing](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-21-subaddressing/)  
[ Email Service ](https://edgetunnel-b2h.pages.dev/email-service/)  
Subaddressing, as defined in [RFC 5233 ↗](https://www.rfc-editor.org/rfc/rfc5233), also known as plus addressing, is now supported in Email Routing. This enables using the "+" separator to augment your custom addresses with arbitrary detail information.  
Now you can send an email to `user+detail@example.com` and it will be captured by the `user@example.com` custom address. The `+detail` part is ignored by Email Routing, but it can be captured next in the processing chain in the logs, an [Email Worker](https://edgetunnel-b2h.pages.dev/email-service/api/route-emails/email-handler/) or an [Agent application ↗](https://github.com/cloudflare/agents/tree/main/examples/email-agent).  
Customers can use this feature to dynamically add context to their emails, such as tracking the source of an email or categorizing emails without needing to create multiple custom addresses.  
![Subaddressing](https://edgetunnel-b2h.pages.dev/_astro/subaddressing.x65bljxx_Z2W6LN.webp)  
Check our [Developer Docs](https://edgetunnel-b2h.pages.dev/email-service/configuration/email-routing-addresses/#subaddressing) to learn how to enable subaddressing in Email Routing.

Jul 21, 2025
1. ### [WAF Release - 2025-07-21 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-21-emergency/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week's update highlights several high-impact vulnerabilities affecting Microsoft SharePoint Server. These flaws, involving unsafe deserialization, allow unauthenticated remote code execution over the network, posing a critical threat to enterprise environments relying on SharePoint for collaboration and document management.

**Key Findings**

  * Microsoft SharePoint Server (CVE-2025-53770): A critical vulnerability involving unsafe deserialization of untrusted data, enabling unauthenticated remote code execution over the network. This flaw allows attackers to execute arbitrary code on vulnerable SharePoint servers without user interaction.
  * Microsoft SharePoint Server (CVE-2025-53771): A closely related deserialization issue that can be exploited by unauthenticated attackers, potentially leading to full system compromise. The vulnerability highlights continued risks around insecure serialization logic in enterprise collaboration platforms.

**Impact**  
Together, these vulnerabilities significantly weaken the security posture of on-premise Microsoft SharePoint Server deployments. By enabling remote code execution without authentication, they open the door for attackers to gain persistent access, deploy malware, and move laterally across enterprise environments.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                 | Previous Action | New Action | Comments                |
| -------------------------- | ----------- | -------------- | ----------------------------------------------------------- | --------------- | ---------- | ----------------------- |
| Cloudflare Managed Ruleset | ...2168f6f0 | 100817         | Microsoft SharePoint - Deserialization - CVE:CVE-2025-53770 | N/A             | Block      | This is a New Detection |
| Cloudflare Managed Ruleset | ...8de656c4 | 100818         | Microsoft SharePoint - Deserialization - CVE:CVE-2025-53771 | N/A             | Block      | This is a New Detection |  
For more details, also refer to [our blog ↗](https://blog.cloudflare.com/cloudflare-protects-against-critical-sharepoint-vulnerability-cve-2025-53770/).

Jul 21, 2025
1. ### [WAF Release - 2025-07-21](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-21-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week's update spotlights several critical vulnerabilities across Citrix NetScaler Memory Disclosure, FTP servers and network application. Several flaws enable unauthenticated remote code execution or sensitive data exposure, posing a significant risk to enterprise security.

**Key Findings**

  * Wing FTP Server (CVE-2025-47812): A critical Remote Code Execution (RCE) vulnerability that enables unauthenticated attackers to execute arbitrary code with root/SYSTEM-level privileges by exploiting a Lua injection flaw.
  * Infoblox NetMRI (CVE-2025-32813): A remote unauthenticated command injection flaw that allows an attacker to execute arbitrary commands, potentially leading to unauthorized access.
  * Citrix Netscaler ADC (CVE-2025-5777, CVE-2023-4966): A sensitive information disclosure vulnerability, also known as "Citrix Bleed2", that allows the disclosure of memory and subsequent remote access session hijacking.
  * Akamai CloudTest (CVE-2025-49493): An XML External Entity (XXE) injection that could lead to read local files on the system by manipulating XML input.

**Impact**  
These vulnerabilities affect critical enterprise infrastructure, from file transfer services and network management appliances to application delivery controllers. The Wing FTP RCE and Infoblox command injection flaws offer direct paths to deep system compromise, while the Citrix "Bleed2" and Akamai XXE vulnerabilities undermine system integrity by enabling session hijacking and sensitive data theft.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                       | Previous Action | New Action | Comments                |
| -------------------------- | ----------- | -------------- | ----------------------------------------------------------------- | --------------- | ---------- | ----------------------- |
| Cloudflare Managed Ruleset | ...3461ec9e | 100804         | BerriAI - SSRF - CVE:CVE-2024-6587                                | Log             | Log        | This is a New Detection |
| Cloudflare Managed Ruleset | ...5199b58a | 100805         | Wing FTP Server - Remote Code Execution - CVE:CVE-2025-47812      | Log             | Block      | This is a New Detection |
| Cloudflare Managed Ruleset | ...919a91a4 | 100807         | Infoblox NetMRI - Command Injection - CVE:CVE-2025-32813          | Log             | Block      | This is a New Detection |
| Cloudflare Managed Ruleset | ...7899130f | 100808         | Citrix Netscaler ADC - Buffer Error - CVE:CVE-2025-5777           | Log             | Disabled   | This is a New Detection |
| Cloudflare Managed Ruleset | ...d1cf8e08 | 100809         | Citrix Netscaler ADC - Information Disclosure - CVE:CVE-2023-4966 | Log             | Block      | This is a New Detection |
| Cloudflare Managed Ruleset | ...6e70469f | 100810         | Akamai CloudTest - XXE - CVE:CVE-2025-49493                       | Log             | Block      | This is a New Detection |

Jul 18, 2025
1. ### [New APIs for Brand Protection setup](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-18-brand-protection-api/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  
The Brand Protection API is now available, allowing users to create new queries and delete existing ones, fetch matches and more!  
What you can do:

  * **create new string or logo query**
  * **delete string or logo queries**
  * **download matches for both logo and string queries**
  * **read matches for both logo and string queries**  
Ready to start? Check out the [Brand Protection API](https://edgetunnel-b2h.pages.dev/api/resources/brand%5Fprotection/) in our documentation.

Jul 17, 2025
1. ### [The Cloudflare Vite plugin now supports Vite 7](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-17-vite-plugin-vite-7-support/)  
[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
[Vite 7 ↗](https://vite.dev/blog/announcing-vite7) is now supported in the Cloudflare Vite plugin. See the [Vite changelog ↗](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md#700-2025-06-24) for a list of changes.  
Note that the minimum Node.js versions supported by Vite 7 are 20.19 and 22.12\. We continue to support Vite 6 so you do not need to immediately upgrade.

Jul 17, 2025
1. ### [New detection entry type: Document Matching for DLP](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-17-document-matching/)  
[ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/)  
You can now create [document-based](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#document-entries) detection entries in DLP by uploading example documents. Cloudflare will encrypt your documents and create a unique fingerprint of the file. This fingerprint is then used to identify similar documents or snippets within your organization's traffic and stored files.  
![DLP](https://edgetunnel-b2h.pages.dev/_astro/document-match.CcN8pGgR_Z1e3PDm.webp)  

**Key features and benefits:**

  * **Upload documents, forms, or templates:** Easily upload .docx and .txt files (up to 10 MB) that contain sensitive information you want to protect.
  * **Granular control with similarity percentage:** Define a minimum similarity percentage (0-100%) that a document must meet to trigger a detection, reducing false positives.
  * **Comprehensive coverage:** Apply these document-based detection entries in:

    * **Gateway policies:** To inspect network traffic for sensitive documents as they are uploaded or shared.
    * **CASB (Cloud Access Security Broker):** To scan files stored in cloud applications for sensitive documents at rest.
  * **Identify sensitive data:** This new detection entry type is ideal for identifying sensitive data within completed forms, templates, or even small snippets of a larger document, helping you prevent data exfiltration and ensure compliance.  
Once uploaded and processed, you can add this new document entry into a DLP profile and policies to enhance your data protection strategy.

Jul 15, 2025
1. ### [Faster, more reliable UDP traffic for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-15-udp-improvements/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Your real-time applications running over [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel.  
This is a foundational improvement to Cloudflare Tunnel, delivered automatically to all customers. There are no settings to configure — your UDP traffic is already flowing faster and more reliably.

**What’s new:**

  * **Faster UDP performance**: We've significantly reduced the latency for establishing new UDP sessions, making applications like private DNS much more responsive.
  * **Greater reliability for mixed traffic**: UDP packets are no longer affected by heavy TCP traffic, preventing timeouts and connection drops for your real-time services.  
Learn more about running [TCP or UDP applications](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-applications) and [private networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/).

Jul 14, 2025
1. ### [Terraform v5.7.0 now available](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-11-terraform-v570-provider/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/)  
Earlier this year, we announced the launch of the new [Terraform v5 Provider](https://edgetunnel-b2h.pages.dev/changelog/2025-02-03-terraform-v5-provider/). We are aware of the high number of [issues ↗](https://github.com/cloudflare/terraform-provider-cloudflare) reported by the Cloudflare community related to the v5 release, with 13.5% of resources impacted. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and relability, including the v5.7 release.  
Thank you for continuing to raise issues and please keep an eye on this changelog for more information about upcoming releases.  
#### Changes

  * Addressed permanent diff bug on Cloudflare Tunnel config
  * State is now saved correctly for Zero Trust Access applications
  * Exact match is now working as expected within `data.cloudflare_zero_trust_access_applications`
  * `cloudflare_zero_trust_access_policy` now supports OIDC claims & diff issues resolved
  * Self hosted applications with private IPs no longer require a public domain for `cloudflare_zero_trust_access_application`.
  * New resource:  
    * `cloudflare_zero_trust_tunnel_warp_connector`
  * Other bug fixes  
For a more detailed look at all of the changes, see the [changelog ↗](https://github.com/cloudflare/terraform-provider-cloudflare/releases/tag/v5.7.0) in GitHub.  
#### Issues Closed

  * [#5563: cloudflare\_logpull\_retention is missing import ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5563)
  * [#5608: cloudflare\_zero\_trust\_access\_policy in 5.5.0 provider gives error upon apply unexpected new value: .app\_count: was cty.NumberIntVal(0), but now cty.NumberIntVal(1) ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5608)
  * [#5612: data.cloudflare\_zero\_trust\_access\_applications does not exact match ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5612)
  * [#5532: cloudflare\_zero\_trust\_access\_identity\_provider detects changes on every plan ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5532)
  * [#5662: cloudflare\_zero\_trust\_access\_policy does not support OIDC claims ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5662)
  * [#5565: Running Terraform with the cloudflare\_zero\_trust\_access\_policy resource results in updates on every apply, even when no changes are made - breaks idempotency ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5565)
  * [#5529: cloudflare\_zero\_trust\_access\_application: self hosted applications with private ips require public domain  ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5529)  
If you have an unaddressed issue with the provider, we encourage you to check the [open issues ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues) and open a new one if one does not already exist for what you are experiencing.  
#### Upgrading  
We suggest holding on migration to v5 while we work on stabilization of the v5 provider. This will ensure Cloudflare can work ahead and avoid any blocking issues.  
If you'd like more information on migrating from v4 to v5, please make use of the [migration guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade). We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of `terraform plan` to test your changes before applying, and let us know if you encounter any additional issues by reporting to our [GitHub repository ↗](https://github.com/cloudflare/terraform-provider-cloudflare).  
#### For more info

  * [Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs)
  * [Documentation on using Terraform with Cloudflare](https://edgetunnel-b2h.pages.dev/terraform/)

Jul 14, 2025
1. ### [WAF Release - 2025-07-14](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-14-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week’s vulnerability analysis highlights emerging web application threats that exploit modern JavaScript behavior and SQL parsing ambiguities. Attackers continue to refine techniques such as attribute overloading and obfuscated logic manipulation to evade detection and compromise front-end and back-end systems.

**Key Findings**

  * XSS – Attribute Overloading: A novel cross-site scripting technique where attackers abuse custom or non-standard HTML attributes to smuggle payloads into the DOM. These payloads evade traditional sanitization logic, especially in frameworks that loosely validate attributes or trust unknown tokens.
  * XSS – onToggle Event Abuse: Exploits the lesser-used onToggle event (triggered by elements like `<details>`) to execute arbitrary JavaScript when users interact with UI elements. This vector is often overlooked by static analyzers and can be embedded in seemingly benign components.

**Impact**  
These vulnerabilities target both user-facing components and back-end databases, introducing potential vectors for credential theft, session hijacking, or full data exfiltration. The XSS variants bypass conventional filters through overlooked HTML behaviors, while the obfuscated SQLi enables attackers to stealthily probe back-end logic, making them especially difficult to detect and block.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                 | Previous Action | New Action | Comments                |
| -------------------------- | ----------- | -------------- | --------------------------- | --------------- | ---------- | ----------------------- |
| Cloudflare Managed Ruleset | ...2aa3d845 | 100798         | XSS - Attribute Overloading | Log             | Block      | This is a New Detection |
| Cloudflare Managed Ruleset | ...37548d06 | 100799         | XSS - OnToggle              | Log             | Block      | This is a New Detection |

Jul 10, 2025
1. ### [New onboarding guides for Zero Trust](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-09-onboarding-resources/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
Use our brand new onboarding experience for Cloudflare Zero Trust. New and returning users can now engage with a **Get Started** tab with walkthroughs for setting up common use cases end-to-end.  
![Zero Trust onboarding guides](https://edgetunnel-b2h.pages.dev/_astro/zt-onboarding-guides._18EfPbe_NEBk9.webp)  
There are eight brand new onboarding guides in total:

  * Securely access a private network (sets up device client and Tunnel)
  * Device-to-device / mesh networking (sets up and connects multiple device clients)
  * Network to network connectivity (sets up and connects multiple WARP Connectors, makes reference to Magic WAN availability for Enterprise)
  * Secure web traffic (sets up device client, Gateway, pre-reqs, and initial policies)
  * Secure DNS for networks (sets up a new DNS location and Gateway policies)
  * Clientless web access (sets up Access to a web app, Tunnel, and public hostname)
  * Clientless SSH access (all the same + the web SSH experience)
  * Clientless RDP access (all the same + RDP-in-browser)  
Each flow walks the user through the steps to configure the essential elements, and provides a “more details” panel with additional contextual information about what the user will accomplish at the end, along with why the steps they take are important.  
Try them out now in the [Zero Trust dashboard ↗](https://one.dash.cloudflare.com/?to=/:account/home)!

Jul 09, 2025
1. ### [Usage tracking](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-09-usage-tracking/)  
[ Log Explorer ](https://edgetunnel-b2h.pages.dev/log-explorer/)  
[Log Explorer](https://edgetunnel-b2h.pages.dev/log-explorer/) customers can now monitor their data ingestion volume to keep track of their billing. Monthly usage is displayed at the top of the [Log Search](https://edgetunnel-b2h.pages.dev/log-explorer/log-search/) and [Manage Datasets](https://edgetunnel-b2h.pages.dev/log-explorer/manage-datasets/) screens in Log Explorer.  
![Ingested data](https://edgetunnel-b2h.pages.dev/_astro/ingested-data.D2flqRIu_Z2v4FHF.webp)

Jul 08, 2025
1. ### [Faster indexing and new Jobs view in AutoRAG](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-08-autorag-jobs-view/)  
[ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/)  
You can now expect **3-5× faster indexing** in AutoRAG, and with it, a brand new **Jobs view** to help you monitor indexing progress.  
With each AutoRAG, indexing jobs are automatically triggered to sync your data source (i.e. R2 bucket) with your Vectorize index, ensuring new or updated files are reflected in your query results. You can also trigger jobs manually via the [Sync API](https://edgetunnel-b2h.pages.dev/api/resources/ai-search/subresources/rags/) or by clicking “Sync index” in the dashboard.  
With the new jobs observability, you can now:

  * View the status, job ID, source, start time, duration and last sync time for each indexing job
  * Inspect real-time logs of job events (e.g. `Starting indexing data source...`)
  * See a history of past indexing jobs under the Jobs tab of your AutoRAG  
This makes it easier to understand what’s happening behind the scenes.

**Coming soon:** We’re adding APIs to programmatically check indexing status, making it even easier to integrate AutoRAG into your workflows.  
Try it out today on the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/ai/autorag).

Jul 08, 2025
1. ### [HEIC support in Cloudflare Images](https://edgetunnel-b2h.pages.dev/changelog/post/heic-support/)  
[ Cloudflare Images ](https://edgetunnel-b2h.pages.dev/images/)  
You can use Images to ingest HEIC images and serve them in supported output formats like AVIF, WebP, JPEG, and PNG.  
When inputting a HEIC image, dimension and sizing limits may still apply. Refer to our documentation to see limits for [uploading to Images](https://edgetunnel-b2h.pages.dev/images/storage/upload-images/methods/) or [transforming a remote image](https://edgetunnel-b2h.pages.dev/images/optimization/transformations/overview/).

Jul 07, 2025
1. ### [Cloudy summaries for Access and Gateway Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-07-cloudy-summaries-access-gateway/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
Cloudy, Cloudflare's AI Agent, will now automatically summarize your [Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) block logs.  
In the log itself, Cloudy will summarize what occurred and why. This will be helpful for quick troubleshooting and issue correlation.  
![Cloudy AI summarizes a log](https://edgetunnel-b2h.pages.dev/_astro/cloudy-explanation.oFZR6cXa_Z2e1RtR.webp)  
If you have feedback about the Cloudy summary - good or bad - you can provide that right from the summary itself.

Jul 07, 2025
1. ### [New App Library for Zero Trust Dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-07-dashboard-app-library/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
Cloudflare Zero Trust customers can use the App Library to get full visibility over the SaaS applications that they use in their Gateway policies, CASB integrations, and Access for SaaS applications.

**App Library**, found under **My Team**, makes information available about all Applications that can be used across the Zero Trust product suite.  
![Zero Trust App Library](https://edgetunnel-b2h.pages.dev/_astro/app-library.D403GJ9j_1SfMgP.webp)  
You can use the App Library to see:

  * How Applications are defined
  * Where they are referenced in policies
  * Whether they have Access for SaaS configured
  * Review their CASB findings and integration status.  
Within individual Applications, you can also track their usage across your organization, and better understand user behavior.

Jul 07, 2025
1. ### [Increased IP List Limits for Enterprise Accounts](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-07-increased-ip-list-limits/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
We have significantly increased the limits for [IP Lists](https://edgetunnel-b2h.pages.dev/waf/tools/lists/) on Enterprise plans to provide greater flexibility and control:

  * **Total number of lists**: Increased from 10 to 1,000.
  * **Total number of list items**: Increased from 10,000 to 500,000.  
Limits for other list types and plans remain unchanged. For more details, refer to the [lists availability](https://edgetunnel-b2h.pages.dev/waf/tools/lists/#availability).

Jul 07, 2025
1. ### [WAF Release - 2025-07-07](https://edgetunnel-b2h.pages.dev/changelog/post/2025-07-07-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week’s roundup uncovers critical vulnerabilities affecting enterprise VoIP systems, webmail platforms, and a popular JavaScript framework. The risks range from authentication bypass to remote code execution (RCE) and buffer handling flaws, each offering attackers a path to elevate access or fully compromise systems.

**Key Findings**

  * Next.js - Auth Bypass: A newly detected authentication bypass flaw in the Next.js framework allows attackers to access protected routes or APIs without proper authorization, undermining application access controls.
  * Fortinet FortiVoice (CVE-2025-32756): A buffer error vulnerability in FortiVoice systems that could lead to memory corruption and potential code execution or service disruption in enterprise telephony environments.
  * Roundcube (CVE-2025-49113): A critical RCE flaw allowing unauthenticated attackers to execute arbitrary PHP code via crafted requests, leading to full compromise of mail servers and user inboxes.

**Impact**  
These vulnerabilities affect core business infrastructure, from web interfaces to voice communications and email platforms. The Roundcube RCE and FortiVoice buffer flaw offer potential for deep system access, while the Next.js auth bypass undermines trust boundaries in modern web apps.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                             | Previous Action | New Action | Comments                |
| -------------------------- | ----------- | -------------- | ------------------------------------------------------- | --------------- | ---------- | ----------------------- |
| Cloudflare Managed Ruleset | ...7eb35ee6 | 100795         | Next.js - Auth Bypass                                   | Log             | Disabled   | This is a New Detection |
| Cloudflare Managed Ruleset | ...c329aeb0 | 100796         | Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756 | Log             | Disabled   | This is a New Detection |
| Cloudflare Managed Ruleset | ...ab314023 | 100797         | Roundcube - Remote Code Execution - CVE:CVE-2025-49113  | Log             | Disabled   | This is a New Detection |

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/32/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/32/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```