---
title: Changelogs
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

All products

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jun 02, 2026
1. ### [Agents SDK v0.14.0: Agent Skills, messengers, scheduled tasks, Workflows, and hardened chat recovery](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-02-agents-sdk-v0140/)  
[ Agents ](https://edgetunnel-b2h.pages.dev/agents/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
The latest release of the [Agents SDK ↗](https://github.com/cloudflare/agents) adds four new ways to build with `@cloudflare/think`: on-demand Agent Skills, chat messengers (starting with Telegram), declarative scheduled tasks, and durable reasoning steps inside Workflows. This release also significantly hardens durable chat recovery, so turns reliably ride through deploys, evictions, and stalled model streams in production.  
#### Agent Skills (experimental)  
Give an agent a catalog of on-demand instructions, resources, and scripts. A skill source adds a catalog to the system prompt, and the model activates a skill only when a task matches — so a large library of capabilities does not bloat every prompt.

  * [  JavaScript ](#tab-panel-4985)
  * [  TypeScript ](#tab-panel-4986)

**JavaScript**  
```js  
import { Think, skills } from "@cloudflare/think";  
import bundledSkills from "agents:skills";  
export class SkillsAgent extends Think {  
  getSkills() {  
    return [  
      bundledSkills,  
      skills.r2(this.env.SKILLS_BUCKET, { prefix: "skills/" }),  
    ];  
  }  
}  
```

**TypeScript**  
```ts  
import { Think, skills } from "@cloudflare/think";  
import bundledSkills from "agents:skills";  
export class SkillsAgent extends Think<Env> {  
  getSkills() {  
    return [  
      bundledSkills,  
      skills.r2(this.env.SKILLS_BUCKET, { prefix: "skills/" }),  
    ];  
  }  
}  
```  
The `agents:skills` import bundles a local `./skills` directory through the Agents Vite plugin (one directory per skill, each with a `SKILL.md`). Skills can also load from R2 or a manifest. When skills are available, Think exposes `activate_skill`, `read_skill_resource`, and an optional `run_skill_script` tool. Skill loading is resilient: a duplicate or failing source is skipped with a warning instead of breaking the agent.  
Agent Skills are **experimental**, and script execution in particular is early. The API may change in a future release. We would love your feedback — tell us what you are building and what is missing in the [Agents repository ↗](https://github.com/cloudflare/agents/discussions).  
#### Messengers  
Connect a Think agent directly to a chat platform. Think owns the webhook route, conversation routing, durable reply fiber, and streamed delivery back to the provider. Telegram ships as the first provider.

  * [  JavaScript ](#tab-panel-4995)
  * [  TypeScript ](#tab-panel-4996)

**JavaScript**  
```js  
import { Think } from "@cloudflare/think";  
import {  
  defineMessengers,  
  ThinkMessengerStateAgent,  
} from "@cloudflare/think/messengers";  
import telegramMessenger from "@cloudflare/think/messengers/telegram";  
export { ThinkMessengerStateAgent };  
export class SupportAgent extends Think {  
  getMessengers() {  
    return defineMessengers({  
      telegram: telegramMessenger({  
        token: this.env.TELEGRAM_BOT_TOKEN,  
        userName: "support_bot",  
        secretToken: this.env.TELEGRAM_WEBHOOK_SECRET_TOKEN,  
      }),  
    });  
  }  
}  
```

**TypeScript**  
```ts  
import { Think } from "@cloudflare/think";  
import {  
  defineMessengers,  
  ThinkMessengerStateAgent,  
} from "@cloudflare/think/messengers";  
import telegramMessenger from "@cloudflare/think/messengers/telegram";  
export { ThinkMessengerStateAgent };  
export class SupportAgent extends Think<Env> {  
  getMessengers() {  
    return defineMessengers({  
      telegram: telegramMessenger({  
        token: this.env.TELEGRAM_BOT_TOKEN,  
        userName: "support_bot",  
        secretToken: this.env.TELEGRAM_WEBHOOK_SECRET_TOKEN,  
      }),  
    });  
  }  
}  
```  
Each Chat SDK thread maps to its own Think sub-agent by default, so group chats and direct messages do not share memory. Multiple bots, custom conversation routing, and custom providers are all supported.  
#### Scheduled tasks  
Declare recurring, timezone-aware prompts and handlers with a typed domain-specific language (DSL). Think reconciles the declarations on startup and re-arms the next occurrence after each run, backed by durable idempotent submissions.

  * [  JavaScript ](#tab-panel-4993)
  * [  TypeScript ](#tab-panel-4994)

**JavaScript**  
```js  
import { Think, defineScheduledTasks } from "@cloudflare/think";  
export class DigestAgent extends Think {  
  getScheduledTasks() {  
    return defineScheduledTasks({  
      weeklyCommitReport: {  
        schedule: "every week on monday at 09:00",  
        prompt:  
          "Compile my GitHub commits for the last week and summarize them.",  
      },  
      workout: {  
        schedule: "every day at 08:00 in Europe/London",  
        prompt: "Start my workout.",  
      },  
    });  
  }  
}  
```

**TypeScript**  
```ts  
import { Think, defineScheduledTasks } from "@cloudflare/think";  
export class DigestAgent extends Think<Env> {  
  getScheduledTasks() {  
    return defineScheduledTasks({  
      weeklyCommitReport: {  
        schedule: "every week on monday at 09:00",  
        prompt:  
          "Compile my GitHub commits for the last week and summarize them.",  
      },  
      workout: {  
        schedule: "every day at 08:00 in Europe/London",  
        prompt: "Start my workout.",  
      },  
    });  
  }  
}  
```  
#### Think Workflows  
Run a model-driven reasoning step inside a Cloudflare Workflow with `ThinkWorkflow` and `step.prompt()`, with durable typed structured output, long waits, and approval gates.

  * [  JavaScript ](#tab-panel-4997)
  * [  TypeScript ](#tab-panel-4998)

**JavaScript**  
```js  
import { z } from "zod";  
import { ThinkWorkflow } from "@cloudflare/think/workflows";  
const draftSchema = z.object({  
  title: z.string(),  
  summary: z.string(),  
  labels: z.array(z.string()),  
});  
export class TriageWorkflow extends ThinkWorkflow {  
  async run(event, step) {  
    const draft = await step.prompt("triage-issue", {  
      prompt: `Triage issue #${event.payload.issueNumber}`,  
      output: draftSchema,  
      timeout: "3 days",  
    });  
    await step.do("apply-labels", async () => {  
      await this.agent.applyLabels(draft.labels);  
    });  
  }  
}  
```

**TypeScript**  
```ts  
import { z } from "zod";  
import { ThinkWorkflow } from "@cloudflare/think/workflows";  
import type { ThinkWorkflowStep } from "@cloudflare/think/workflows";  
import type { AgentWorkflowEvent } from "agents/workflows";  
const draftSchema = z.object({  
  title: z.string(),  
  summary: z.string(),  
  labels: z.array(z.string()),  
});  
export class TriageWorkflow extends ThinkWorkflow<TriageAgent, Params> {  
  async run(event: AgentWorkflowEvent<Params>, step: ThinkWorkflowStep) {  
    const draft = await step.prompt("triage-issue", {  
      prompt: `Triage issue #${event.payload.issueNumber}`,  
      output: draftSchema,  
      timeout: "3 days",  
    });  
    await step.do("apply-labels", async () => {  
      await this.agent.applyLabels(draft.labels);  
    });  
  }  
}  
```  
#### Production hardening for durable chat recovery  
Durable chat turns have always been designed to survive a mid-turn deploy or Durable Object eviction. This release is a major hardening pass on that machinery for production.

  * **Better recovery during deploys.** Turns now ride through continuous deploys and evictions without losing completed work or re-running tools that already ran.
  * **A live "recovering…" signal.** `useAgentChat` exposes a new `isRecovering` flag, so a recovering turn shows progress instead of looking frozen. Most UIs render `isStreaming || isRecovering` as "busy".
  * **Stalled streams recover.** Set `chatStreamStallTimeoutMs` to route a hung provider stream into the same recovery path instead of leaving an infinite spinner.
  * **Sub-agents re-attach.** On parent recovery, an in-flight `agentTool()` child is re-attached to its result rather than abandoned and re-run, so long-running children no longer lose work under deploys.  
#### MCP transport improvements

  * **Resumable streams** — In-flight tool calls over Server-Sent Events (SSE) survive a dropped connection. Clients reconnect with `Last-Event-ID` and replay anything they missed.
  * **Readable server IDs** — `addMcpServer` accepts an optional `id`, so tools surface as readable keys (for example `tool_github_create_pull_request`) instead of opaque connection IDs.
  * **Better handling of concurrent requests** — Overlapping JSON-RPC requests are now correctly correlated to their responses across the HTTP and RPC transports.  
#### Other improvements

  * **Compaction** — A `Session`'s `tokenCounter` now also drives the compaction boundary decision ("what to compress"), not just the fire/no-fire trigger.
  * **`@cloudflare/worker-bundler`** — Adds a `virtualModules` option to `createWorker` to provide in-memory module source during bundling.
  * **Client-tool continuations** — Parallel tool results now coalesce into a single continuation, immediate resume requests attach to the pending continuation, and server-side `needsApproval` continuations resume reliably after approval.  
#### Upgrade  
To update to the latest version:  
 npm  yarn  pnpm  bun  
```  
npm i agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest  
```  
```  
yarn add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest  
```  
```  
pnpm add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest  
```  
```  
bun add agents@latest @cloudflare/think@latest @cloudflare/ai-chat@latest  
```  
Refer to the [Agents API reference](https://edgetunnel-b2h.pages.dev/agents/runtime/) and [Chat agents documentation](https://edgetunnel-b2h.pages.dev/agents/communication-channels/chat/chat-agents/) for more information.

Jun 02, 2026
1. ### [Cisco IOS XE](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-02-cisco-ios-xe/)  
[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
The Cisco IOS XE third-party integration guide for Cloudflare WAN has been updated to include:

  * Post Quantum Cryptography (PQC)
  * Policy-Based Routing (PBR)
  * IP Service Level Agreement (IP SLA)  
This link will take you directly to the updated [Cisco IOS XE](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/third-party/cisco-ios-xe/) guide.

Jun 01, 2026
1. ### [New Turnstile Events Logpush dataset in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-01-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### New datasets

  * **Turnstile Events**: A new dataset with fields including `ASN`, `Action`, `BrowserMajor`, `BrowserName`, `ClientIP`, `CountryCode`, `EventType`, `Hostname`, `OSMajor`, `OSName`, `Sitekey`, `Timestamp`, and `UserAgent`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

May 29, 2026
1. ### [Cloudflare One Client for macOS (version 2026.5.1155.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-warp-macos-beta/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).  
This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

  * Right click context menu to access the most common client actions quickly
  * Built-in captive portal login experience

**Additional Changes and improvements**

  * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details.
  * Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details.
  * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
  * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details.
  * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
  * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details.
  * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
  * Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks (United inflight Wi-Fi was the reported case). The browser now reliably loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.
  * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.

**Known issues**

  * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
  * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release.

May 29, 2026
1. ### [Cloudflare One Client for Windows (version 2026.5.1155.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-warp-windows-beta/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).  
This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

  * Right click context menu to access the most common client actions quickly
  * Built-in captive portal login experience

**Additional Changes and improvements**

  * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details.
  * Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details.
  * Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details.
  * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
  * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details.
  * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
  * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details.
  * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
  * The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications.
  * Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser.
  * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.

**Known issues**

  * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.
  * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
  * Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release.
  * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.
  * DNS resolution may be broken when the following conditions are all true:
    * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
    * A custom DNS server address is configured on the primary network adapter.
    * The custom DNS server address on the primary network adapter is changed while the client is connected.  
      To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface.

May 29, 2026
1. ### [Share sandbox previews through Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-sandbox-named-tunnels/)  
[ Agents ](https://edgetunnel-b2h.pages.dev/agents/)  
[Sandboxes](https://edgetunnel-b2h.pages.dev/sandbox/) can expose a service running inside the container on a public preview URL through the `sandbox.tunnels` namespace. The SDK uses `cloudflared` inside the sandbox so you can share a running service without configuring `exposePort()` or a custom domain.  
By default, `sandbox.tunnels.get(port)` creates a [quick tunnel ↗](https://try.cloudflare.com/) on a zero-config `*.trycloudflare.com` URL — no Cloudflare account, DNS record, or custom domain required. This is perfect for quick development and for `.workers.dev` deployments.

  * [  JavaScript ](#tab-panel-4989)
  * [  TypeScript ](#tab-panel-4990)

**JavaScript**  
```js  
import { getSandbox } from "@cloudflare/sandbox";  
const sandbox = getSandbox(env.Sandbox, "my-sandbox");  
await sandbox.startProcess("python -m http.server 8080");  
const tunnel = await sandbox.tunnels.get(8080);  
console.log(tunnel.url); // → https://random-words-here.trycloudflare.com  
```

**TypeScript**  
```ts  
import { getSandbox } from "@cloudflare/sandbox";  
const sandbox = getSandbox(env.Sandbox, "my-sandbox");  
await sandbox.startProcess("python -m http.server 8080");  
const tunnel = await sandbox.tunnels.get(8080);  
console.log(tunnel.url); // → https://random-words-here.trycloudflare.com  
```  
#### Named tunnels  
For more control you can create a named tunnel through `sandbox.tunnels.get(port, { name })`. A named tunnel binds a hostname (`<name>.<your-zone>`) backed by a [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) and a CNAME record on your zone resulting in something like [https://my-app-preview.example.com ↗](https://my-app-preview.example.com).  
Unlike quick tunnels, which generate a new random URL each time, a named tunnel produces a persistent URL that survives container restarts. This makes named tunnels suitable for production use cases where you want control over the tunnel and it's origin.

  * [  JavaScript ](#tab-panel-4987)
  * [  TypeScript ](#tab-panel-4988)

**JavaScript**  
```js  
const tunnel = await sandbox.tunnels.get(8080, { name: "my-app-preview" });  
console.log(tunnel.url); // → https://my-app-preview.example.com  
```

**TypeScript**  
```ts  
const tunnel = await sandbox.tunnels.get(8080, { name: "my-app-preview" });  
console.log(tunnel.url); // → https://my-app-preview.example.com  
```  
Calling `sandbox.destroy()` tears down the Cloudflare Tunnel and the associated DNS record alongside the container, so you do not leave dangling tunnels or records behind.  
#### Upgrade  
To update to the latest version:  
 npm  yarn  pnpm  bun  
```  
npm i @cloudflare/sandbox@latest  
```  
```  
yarn add @cloudflare/sandbox@latest  
```  
```  
pnpm add @cloudflare/sandbox@latest  
```  
```  
bun add @cloudflare/sandbox@latest  
```  
For full API details, refer to the [Sandbox tunnels reference](https://edgetunnel-b2h.pages.dev/sandbox/api/tunnels/).

May 29, 2026
1. ### [D1 migrations support nested layouts via \`migrations\_pattern\`](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-04-migrations-pattern/)  
[ D1 ](https://edgetunnel-b2h.pages.dev/d1/)  
You can now point `wrangler d1 migrations apply` at a nested migrations layout — such as the one produced by [Drizzle ↗](https://orm.drizzle.team/) (`migrations/0001_init/migration.sql`) — using the new `migrations_pattern` D1 binding config:

**JSONC**  
```jsonc  
{  
  "d1_databases": [  
    {  
      "binding": "DB",  
      "database_name": "my-database",  
      "database_id": "<UUID>",  
      "migrations_dir": "migrations",  
      "migrations_pattern": "migrations/*/migration.sql",  
    },  
  ],  
}  
```  
`migrations_pattern` is a glob (relative to your Wrangler config file) used to discover migration files. It defaults to `${migrations_dir}/*.sql`, so existing projects keep working unchanged. Each migration's name is recorded in the migrations table as a path relative to `migrations_dir`.  
To learn more, visit D1's [migrations documentation](https://edgetunnel-b2h.pages.dev/d1/reference/migrations/#nested-migration-layouts).

May 29, 2026
1. ### [Updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### Updated fields in existing datasets

  * **DEX Device State Events** (added): `DeviceRegistrationProfileID`.
  * **Gateway HTTP** (added): `AddedHeaders`, `DeletedHeaders`, and `SetHeaders`.
  * **HTTP requests** (added): `MatchedRules`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

May 29, 2026
1. ### [TLS bug detection in the Cloudflare Radar post-quantum checker](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-radar-pq-tls-bug-detection/)  
[ Radar ](https://edgetunnel-b2h.pages.dev/radar/)  
The [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) [post-quantum TLS support checker ↗](https://radar.cloudflare.com/post-quantum#website-support) now also reports TLS bugs detected during the handshake test. When a scanned host exhibits compatibility issues, the results include details on the specific bugs detected, along with guidance on how to investigate and remediate each issue. The bugs section only appears for hosts where issues are found.  
The following TLS bugs are detected:

  * **Split ClientHello** — The connection fails with a fragmented post-quantum `ClientHello` but succeeds with classical handshakes. Typically caused by middleboxes or firewalls that cannot reassemble split TLS messages.
  * **HRR Failure** — The server sends a `HelloRetryRequest` but fails to complete the handshake afterward.
  * **Unknown Keyshare** — The server cannot handle unknown key exchange algorithms and fails instead of responding with a `HelloRetryRequest` as required by the TLS 1.3 specification.  
![TLS bug detection results in the Radar post-quantum checker](https://edgetunnel-b2h.pages.dev/_astro/pq-tls-bug-detection.BrmsVMno_ZIsLXh.webp)  
Bug detection data is available through the existing [/post\_quantum/tls/support](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/post%5Fquantum/subresources/tls/methods/support/) endpoint.  
Visit the [Post-Quantum Encryption ↗](https://radar.cloudflare.com/post-quantum#website-support) page to test a host.

May 29, 2026
1. ### [Cloudflare's Realtime WebSocket adapter now auto-reconnects and buffers WebRTC media](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-websocket-adapter-auto-reconnect/)  
[ Realtime ](https://edgetunnel-b2h.pages.dev/realtime/)  
[Cloudflare Realtime SFU](https://edgetunnel-b2h.pages.dev/realtime/sfu/) is a [WebRTC Selective Forwarding Unit that runs on Cloudflare's global network](https://edgetunnel-b2h.pages.dev/realtime/sfu/calls-vs-sfus/), so you can route live audio, video, and data between WebRTC clients around the world without managing SFU infrastructure or regions.  
When you use the [WebSocket adapter](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/) to stream WebRTC media to a WebSocket endpoint, the adapter now auto-reconnects and buffers audio and video after brief endpoint disconnects or restarts.  
#### Streaming WebRTC media to WebSocket endpoints  
Many teams also use Realtime SFU as the media layer for backend applications, such as transcription, recording, note-taking, and agentic media-processing services. These systems often need to consume live WebRTC audio or video from the SFU in backend infrastructure, including [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/), [Workers](https://edgetunnel-b2h.pages.dev/workers/), [Containers](https://edgetunnel-b2h.pages.dev/containers/), or external services, without running a WebRTC client themselves.  
The [WebSocket adapter](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/) bridges that gap by streaming WebRTC media from the SFU to a standard WebSocket endpoint as application-consumable payloads: [PCM audio frames and JPEG video frames](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#media-formats).  
#### What changed  
When you use the WebSocket adapter in [Stream mode (egress)](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#stream-mode-egress) to send live audio or video from the SFU to your own WebSocket endpoint, the SFU now [automatically reconnects](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#automatic-reconnection-for-streaming) after brief endpoint disconnects or restarts. This is especially helpful for long-running media pipelines where the WebSocket endpoint may briefly restart while a recording, transcription, or live analysis job is still in progress.  
Previously, a brief disconnect from your WebSocket endpoint could close the adapter and require your application to recreate it before media could resume. Now, the SFU retries the same endpoint for up to 5 seconds with no API change required. If the endpoint comes back within that window, audio and video delivery resumes automatically.  
The reconnect behavior also includes [live-first media buffering](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#media-buffering-during-reconnect), so brief interruptions reduce media loss without replaying stale video.  
#### Reconnect behavior  
During reconnect:

  * Audio uses a short bounded backlog to reduce audible loss. If the interruption lasts longer than the backlog can cover, older audio may be dropped.
  * Video resumes from the [latest available JPEG frame](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#video-jpeg) instead of replaying stale frames.
  * Recovery is best effort and does not guarantee gapless or exactly-once delivery.  
If the endpoint remains unavailable after the 5-second reconnect window, the adapter closes and must be recreated.  
#### Learn more

  * [WebSocket adapter](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/)
  * [Automatic reconnection for streaming](https://edgetunnel-b2h.pages.dev/realtime/sfu/media-transport-adapters/websocket-adapter/#automatic-reconnection-for-streaming)
  * [Get started with Realtime SFU](https://edgetunnel-b2h.pages.dev/realtime/sfu/get-started/)
  * [Realtime SFU example architecture](https://edgetunnel-b2h.pages.dev/realtime/sfu/example-architecture/)
  * [Realtime vs Regular SFUs](https://edgetunnel-b2h.pages.dev/realtime/sfu/calls-vs-sfus/)
  * [Global SFU Network Visualization ↗](https://realtime-sfu.dev-demos.workers.dev/)

May 29, 2026
1. ### [Security scans more frequent](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-security-insights-default-scans/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  
Security Insights scans now run more often. Cloudflare scans Free accounts **every 7 days**, Pro and Business accounts **every 3 days**, and Enterprise accounts **daily**.  
In addition, all accounts and zones now receive scans by default. You no longer need to enable scans before Cloudflare checks your account for misconfigurations, vulnerabilities, and other security risks.  
Granular on-demand scans are now available on any plan. You can trigger an on-demand scan for any zone, insight, insight type from the Cloudflare dashboard in order to quickly re-check your security posture after remediating an issue.  
To learn more, refer to the [Security Insights documentation](https://edgetunnel-b2h.pages.dev/security/security-insights/).

May 28, 2026
1. ### [Tool and prompt aliases for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-mcp-portal-tool-prompt-aliases/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
When you connect third-party MCP servers through [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/), you have no control over how the server author named tools or wrote descriptions. Unclear names make it harder for AI agents to select the right tool and harder for users to understand what is available.  
You can now [rename tools and prompts](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases) and rewrite their descriptions directly on the portal, without modifying the upstream server. For example, a tool named `super_cool_tool` can become `search_customer_records` with a description tailored to your organization.  
![Edit tool modal showing name and description fields for an MCP server tool](https://edgetunnel-b2h.pages.dev/_astro/portal-edit-tool-modal.DrxORhBl_Z1NtRnj.webp)  
Modified tools display a **Modified** label in the tools list so administrators can see which tools have been customized at a glance.  
![Tools authorized list showing a modified label on a renamed tool](https://edgetunnel-b2h.pages.dev/_astro/portal-tools-authorized-modified.B674Xvip_12xxcK.webp)  
Aliases override the metadata that MCP clients receive. You can set them at two levels:

  * **Per portal**: Applies only within a specific portal. Takes precedence over server-level aliases.
  * **Per server**: Applies across all portals that use the server.  
You can reset an alias at any time to restore the original upstream name.  
For more information, refer to [Tool and prompt aliases](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases).

May 28, 2026
1. ### [Use Browser Run Quick Actions directly from Workers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-use-browser-run-quick-actions-directly-from-workers/)  
[ Browser Run ](https://edgetunnel-b2h.pages.dev/browser-run/)  
You can now call [Browser Run Quick Actions](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/) directly from a [Cloudflare Worker](https://edgetunnel-b2h.pages.dev/workers/) using the `quickAction()` method on the browser binding. This simplifies how Workers interact with Browser Run by removing the need for API tokens or external HTTP requests. Your Worker communicates with Browser Run directly over Cloudflare's network, resulting in simpler code and lower latency.  
With the `quickAction()` method you can:

  * [Capture screenshots](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/screenshot-endpoint/) from URLs or HTML
  * [Generate PDFs](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/pdf-endpoint/) with custom styling, headers, and footers
  * [Extract HTML content](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/content-endpoint/) from fully rendered pages
  * [Convert pages to Markdown](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/markdown-endpoint/)
  * [Extract structured JSON](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/json-endpoint/) using AI
  * [Scrape elements](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/scrape-endpoint/) with CSS selectors
  * [Get all links](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/links-endpoint/) from a page
  * [Capture snapshots](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/snapshot/) (HTML + screenshot in one request)  
To get started, add a browser binding to your Wrangler configuration:

  * [  wrangler.jsonc ](#tab-panel-4983)
  * [  wrangler.toml ](#tab-panel-4984)

**JSONC**  
```jsonc  
{  
  "compatibility_date": "2026-03-24",  
  "browser": {  
    "binding": "BROWSER"  
  }  
}  
```

**TOML**  
```toml  
compatibility_date = "2026-03-24"  
[browser]  
binding = "BROWSER"  
```  
Then call any Quick Action directly from your Worker. For example, to capture a screenshot:

  * [  JavaScript ](#tab-panel-4991)
  * [  TypeScript ](#tab-panel-4992)

**JavaScript**  
```js  
const screenshot = await env.BROWSER.quickAction("screenshot", {  
  url: "https://www.cloudflare.com/",  
});  
```

**TypeScript**  
```ts  
const screenshot = await env.BROWSER.quickAction("screenshot", {  
  url: "https://www.cloudflare.com/",  
});  
```  
The `quickAction()` method requires a compatibility date of `2026-03-24` or later.  
For setup instructions and the full list of available actions, refer to [Browser Run Quick Actions](https://edgetunnel-b2h.pages.dev/browser-run/quick-actions/).

May 28, 2026
1. ### [High availability replica management for Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-mesh-ha-replica-ui/)  
[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
The [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) dashboard now shows per-replica details for [high availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/high-availability/) nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page.  
![Mesh HA replica tabs showing active and passive replicas with per-replica Mesh IPs and a manual failover option](https://edgetunnel-b2h.pages.dev/_astro/mesh-ha-replicas.Dvf1GMmQ_Z2i6nGi.webp)  
#### What's new

  * **Replica tabs** on the node detail page — switch between replicas to see each one's Mesh IP, edge data center, origin IP, platform, version, and uptime.
  * **Active/passive badges** identify which replica is currently routing traffic.
  * **Manual failover** — promote a passive replica to active with a single click. The previous active replica switches to standby.
  * **HA badge** in the overview table identifies nodes running multiple replicas.
  * **Active replica IP** shown in the overview table — the dashboard now resolves which replica is active and displays the correct Mesh IP.  
#### Manual failover  
To manually promote a passive replica:

  1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/mesh), go to **Networking** \> **Mesh**.
  2. Select an HA-enabled node.
  3. Select the passive replica tab.
  4. Select **Promote to active** and confirm.  
Traffic reroutes to the promoted replica immediately. Refer to [High availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/high-availability/) for details on failover behavior.

May 28, 2026
1. ### [Wrangler supports SSH ProxyCommand for Containers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-ssh-proxy-command/)  
[ Containers ](https://edgetunnel-b2h.pages.dev/containers/)  
[Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/) supports using `wrangler containers ssh` as an OpenSSH `ProxyCommand` for [Containers](https://edgetunnel-b2h.pages.dev/containers/). This lets your local SSH client connect to a running Container through Wrangler.  
```sh  
ssh -o ProxyCommand="wrangler containers ssh %h" cloudchamber@<INSTANCE_ID>  
```  
When standard input and output are piped, Wrangler forwards data to the SSH server in the Container. You can also pass `--stdio` to force this mode.  
For more information, refer to the [SSH documentation](https://edgetunnel-b2h.pages.dev/containers/ssh/).

May 28, 2026
1. ### [Send emails with named recipient addresses](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-named-email-recipients/)  
[ Email Service ](https://edgetunnel-b2h.pages.dev/email-service/)  
You can now send emails with display names on recipient addresses in addition to the existing `from` support. Pass an object with `email` and an optional `name` field for `to`, `cc`, `bcc`, `replyTo`, or `from`:

  * [  JavaScript ](#tab-panel-4999)
  * [  TypeScript ](#tab-panel-5000)

**src/index.js**  
```js  
export default {  
  async fetch(request, env) {  
    const response = await env.EMAIL.send({  
      from: { email: "support@example.com", name: "Support Team" },  
      to: { email: "jane@example.com", name: "Jane Doe" },  
      cc: [  
        "manager@company.com",  
        { email: "team@company.com", name: "Engineering Team" },  
      ],  
      subject: "Welcome!",  
      html: "<h1>Thanks for joining!</h1>",  
      text: "Thanks for joining!",  
    });  
    return Response.json({ messageId: response.messageId });  
  },  
};  
```

**src/index.ts**  
```ts  
export default {  
  async fetch(request, env): Promise<Response> {  
    const response = await env.EMAIL.send({  
      from: { email: "support@example.com", name: "Support Team" },  
      to: { email: "jane@example.com", name: "Jane Doe" },  
      cc: [  
        "manager@company.com",  
        { email: "team@company.com", name: "Engineering Team" },  
      ],  
      subject: "Welcome!",  
      html: "<h1>Thanks for joining!</h1>",  
      text: "Thanks for joining!",  
    });  
    return Response.json({ messageId: response.messageId });  
  },  
} satisfies ExportedHandler<Env>;  
```  
Plain strings remain fully supported for backward compatibility, and you can mix strings and named objects in the same array.  
Refer to the [Workers API](https://edgetunnel-b2h.pages.dev/email-service/api/send-emails/workers-api/) and [REST API](https://edgetunnel-b2h.pages.dev/email-service/api/send-emails/rest-api/) documentation for full request examples.

May 28, 2026
1. ### [Pipelines pricing announced](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-pipelines-pricing-announced/)  
[ Pipelines ](https://edgetunnel-b2h.pages.dev/pipelines/)  
[Cloudflare Pipelines](https://edgetunnel-b2h.pages.dev/pipelines/) is a streaming data platform that ingests events, transforms them with SQL, and writes to [R2](https://edgetunnel-b2h.pages.dev/r2/) as JSON, Parquet, or [Apache Iceberg ↗](https://iceberg.apache.org/) tables. Pipelines now has published pricing based on two usage dimensions: the volume of data processed by SQL transforms and the volume of data delivered to sinks. Ingress into a Pipeline stream is free.

**Billing is not yet enabled. We will provide at least 30 days notice before we start charging for Pipelines usage.**  
Pipelines pricing model is designed to charge per GB based on what you use:

  * **Streams (ingress)**: Free, regardless of volume.
  * **SQL transforms**: $0.04 / GB for stateless transforms (filter, reshape, unnest, cast, compute).
  * **Sinks**: $0.03 / GB for JSON, $0.06 / GB for Parquet or Iceberg output.  
Workers Free plans include 1 GB / month for each dimension. Workers Paid plans include 50 GB / month.  
For full pricing details and billing examples, refer to [Pipelines pricing](https://edgetunnel-b2h.pages.dev/pipelines/platform/pricing/).

May 28, 2026
1. ### [R2 SQL pricing announced](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-r2-sql-pricing-announced/)  
[ R2 SQL ](https://edgetunnel-b2h.pages.dev/r2-sql/)  
[R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) is a serverless, distributed query engine that runs SQL against [Apache Iceberg ↗](https://iceberg.apache.org/) tables stored in [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/). R2 SQL now has published pricing based on a single dimension: the volume of compressed data scanned to execute your queries. At $2.50 / TB ($0.0025 / GB), R2 SQL is priced at half the cost of AWS Athena and less than half of Google BigQuery on-demand.  
Billing is not yet enabled. We will provide at least 30 days notice before we start charging for R2 SQL usage.  
Data scanned is measured on compressed bytes read from R2 object storage. This matches what you see in your R2 bucket — if a Parquet file is 100 MB on disk, scanning that file bills for 100 MB. Each query has a minimum billing increment of 10 MB.  
Free plans include 1 GB / month and Paid plans include 10 GB / month. Standard [R2 storage and operations](https://edgetunnel-b2h.pages.dev/r2/pricing/) and [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/platform/pricing/) charges apply separately.  
For full pricing details and billing examples, refer to [R2 SQL pricing](https://edgetunnel-b2h.pages.dev/r2-sql/platform/pricing/).

May 28, 2026
1. ### [R2 Data Catalog pricing announced](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-r2-data-catalog-pricing-announced/)  
[ R2 ](https://edgetunnel-b2h.pages.dev/r2/)  
[R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) is a managed [Apache Iceberg ↗](https://iceberg.apache.org/) data catalog built directly into R2 buckets, queryable by any Iceberg-compatible engine such as Spark, Snowflake, and DuckDB. R2 Data Catalog now has published pricing for catalog operations and table compaction, in addition to standard [R2 storage and operations](https://edgetunnel-b2h.pages.dev/r2/pricing/).  
Billing is not yet enabled. We will provide at least 30 days notice before we start charging for R2 Data Catalog usage.  
Pricing is based on two dimensions:

  * **Catalog operations**: $9.00 / million operations for metadata requests such as creating tables, reading table metadata, and updating table properties.
  * **Compaction**: $0.005 / GB processed and $2.00 / million objects processed. These charges only apply when automatic compaction is turned on for a table.  
Both dimensions include a monthly free tier: 1 million catalog operations, 10 GB of compaction data processed, and 1 million compaction objects processed.  
For full pricing details and billing examples, refer to [R2 Data Catalog pricing](https://edgetunnel-b2h.pages.dev/r2/data-catalog/platform/pricing/).

May 28, 2026
1. ### [R2 Data Catalog gets a dedicated dashboard experience](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-r2-data-catalog-dashboard/)  
[ R2 ](https://edgetunnel-b2h.pages.dev/r2/)  
[R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) is a managed [Apache Iceberg ↗](https://iceberg.apache.org/) data catalog built directly into your R2 bucket. It exposes a standard Iceberg REST catalog interface so you can connect query engines like [Spark](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/spark-scala/), [Snowflake](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/snowflake/), [DuckDB](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/duckdb/), and [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) to your data in R2.  
R2 Data Catalog now has a dedicated section in the Cloudflare dashboard, replacing the previous settings panel embedded in R2 bucket configuration. The new experience includes:  
![R2 Data Catalog dashboard overview](https://edgetunnel-b2h.pages.dev/_astro/data-catalog-dashboard.BsKDvUQn_Z1Twgl3.webp)  
  * **Catalog overview** — View all your catalogs in one place with catalog request counts, bucket sizes, and table maintenance status at a glance.
  * **Guided setup wizard** — Create a catalog in three steps: choose or create an R2 bucket, configure table maintenance (compaction and snapshot expiration), and review. The wizard creates the bucket and generates a service credential automatically.
  * **Settings management** — A dedicated settings page for each catalog with sections for general configuration, table maintenance, service credentials, and disabling the catalog. You can now enable and configure [snapshot expiration](https://edgetunnel-b2h.pages.dev/r2/data-catalog/table-maintenance/) directly from the dashboard.
  * **Built-in metrics** — Five charts on each catalog's metrics tab: bytes compacted, files compacted, catalog requests, storage size, and snapshots expired.  
To get started, go to **R2 Data Catalog** in the Cloudflare dashboard or refer to the [getting started guide](https://edgetunnel-b2h.pages.dev/r2/data-catalog/get-started/) and [manage catalogs documentation](https://edgetunnel-b2h.pages.dev/r2/data-catalog/manage-catalogs/).

May 28, 2026
1. ### [Record specific participant audio tracks in RealtimeKit](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-realtimekit-track-recording/)  
[ Realtime ](https://edgetunnel-b2h.pages.dev/realtime/)  
You can now record specific participant audio tracks in RealtimeKit with [track recording](https://edgetunnel-b2h.pages.dev/realtime/realtimekit/recording-guide/track-recording/). Track recording creates separate WebM files for each participant instead of a single composite recording, which is useful for post-processing, transcription, and regulated or content-sensitive workflows.  
To record specific participants, pass `user_ids` when starting a track recording:  
```bash  
curl --request POST \
  --url https://api.cloudflare.com/client/v4/accounts/<account_id>/realtime/kit/<app_id>/recordings/track \
  --header 'Authorization: Bearer <api_token>' \
  --header 'Content-Type: application/json' \
  --data '{  
  "meeting_id": "97440c6a-140b-40a9-9499-b23fd7a3868a",  
  "user_ids": ["user-123", "user-456"]  
}'  
```  
To pass `user_ids` for selective track recording, use the following minimum SDK versions:

  * Web Core: `@cloudflare/realtimekit` version `1.4.0` or later
  * Web UI Kit: `@cloudflare/realtimekit-ui`, `@cloudflare/realtimekit-react-ui`, or `@cloudflare/realtimekit-angular-ui` version `1.1.2` or later
  * Android Core or iOS Core: version `2.0.0` or later
  * Android UI Kit or iOS UI Kit: version `1.1.0` or later  
[RealtimeKit](https://edgetunnel-b2h.pages.dev/realtime/realtimekit/) provides SDKs and UI components so that you can build your own meeting experience on Cloudflare's [global WebRTC infrastructure](https://edgetunnel-b2h.pages.dev/realtime/#realtime-sfu). Teams today build products ranging from telehealth to education on RealtimeKit for global audiences. You can get started today with our [Quickstart](https://edgetunnel-b2h.pages.dev/realtime/realtimekit/quickstart/) or take a look at our [Cloudflare Meet repo ↗](https://github.com/cloudflare/meet) as a reference.

May 27, 2026
1. ### [Write regex using natural language in Cloudflare One](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudy-regex-assistance/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
[Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) policy selectors which support regular expressions can now be authored in the dashboard using natural language. When building a [policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/expression-syntax/) with a regex-based selector (like `matches regex`), you can describe what you want to match in plain English and the Cloudflare Agent will generate and validate a corresponding regular expression.  
![Write policy regex using natural language](https://edgetunnel-b2h.pages.dev/_astro/gateway-regex-ai-generation.CtJ0S6FS_Z1WVe4K.webp)  
To get started, select a regex-compatible selector in the [Gateway policy builder](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and select the icon. You'll see an input field for natural language, such as "any URL starting with /api/v1" or ".com, .net, and .app hosts which contain `gooogle` in the host."  
You can also use the tool to explain existing regular expressions. If a policy already contains a regex pattern, you can instantly generate a plain-language description.  
A built-in feedback mechanism allows you to rate each interaction to help improve output quality over time.  
For more information, refer to [Cloudflare One firewall policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and expect to see the same functionality supported soon in [Data loss prevention profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/).

May 27, 2026
1. ### [Transformation flows in Images](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-transformation-flows/)  
[ Cloudflare Images ](https://edgetunnel-b2h.pages.dev/images/)  
![Custom flow configuration panel](https://edgetunnel-b2h.pages.dev/_astro/custom-flow.DeAGR8BY_iGLSK.webp)  
Flows are automated rules that pair conditions (such as file extension, URL path, or query parameter) with parameters. Set up a flow to automatically apply image optimization to matching requests on your zone without writing code or changing URLs.  
There are two modes for transformation flows:

  * **[Provider flows](https://edgetunnel-b2h.pages.dev/images/optimization/transformations/flows/#set-up-a-provider-flow)** — Migrate from another image optimization service. Your existing URLs continue to work while Cloudflare rewrites provider-specific parameters to their Cloudflare equivalents. Currently, Cloudflare supports provider flows for Fastly Image Optimizer.
  * **[Custom flows](https://edgetunnel-b2h.pages.dev/images/optimization/transformations/flows/#set-up-a-custom-flow)** — Define your own conditions and actions for use cases like automatic format conversion, [responsive sizing](https://edgetunnel-b2h.pages.dev/images/optimization/make-responsive-images/#using-widthauto) with `width=auto`, or directory-based optimization.  
To get started, go to **Images** \> **Transformations** \> **Automation** in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/images/transformations).  
Learn more about [transformation flows](https://edgetunnel-b2h.pages.dev/images/optimization/transformations/flows/).

May 27, 2026
1. ### [Cloudflare Tunnel now runs connectivity pre-checks at startup](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudflared-connectivity-prechecks/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting with [cloudflared version 2026.5.2 ↗](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) automates the entire [connectivity pre-checks workflow](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked.  
![cloudflared connectivity pre-checks output](https://edgetunnel-b2h.pages.dev/_astro/cloudflared-connectivity-prechecks.DRwN6tGe_c1XGu.webp)  
On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks:

  * **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs.
  * **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`.
  * **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates.  
Results are printed in a scannable CLI table with three states:

  * ✅ **Pass** — the check succeeded.
  * ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up.
  * ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`).  
If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors.  
Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide.  
To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/).

May 26, 2026
1. ### [Cloudflare One Client for macOS (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-macos-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

  * Right click context menu to access the most common client actions quickly
  * Built-in captive portal login experience

**Additional Changes and improvements**

  * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.
  * Fixed a proxy mode connection stall issue.

**Known issues**

  * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
  * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release.

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/6/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/6/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```