--- title: Changelogs image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) All products ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) May 26, 2026 1. ### [Cloudflare One Client for Windows (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Fixed a proxy mode connection stall issue. **Known issues** * Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. May 26, 2026 1. ### [Cloudflare One Client for Linux (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. * Fixed a proxy mode connection stall issue. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 26, 2026 1. ### [BYPASS status now returned for uncacheable responses](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-bypass-status-for-uncacheable-responses/) [ Cache / CDN ](https://edgetunnel-b2h.pages.dev/cache/) Cloudflare now returns a `BYPASS` [cache status](https://edgetunnel-b2h.pages.dev/cache/concepts/cache-responses/) whenever a response is not cacheable, instead of the previous mix of `BYPASS` and `MISS` that depended on why Cloudflare chose not to cache the response. There are multiple reasons Cloudflare may refuse to cache a response — for example, the response exceeds the [maximum cacheable file size](https://edgetunnel-b2h.pages.dev/cache/concepts/default-cache-behavior/#cacheable-size-limits) for your plan, the origin sends `Cache-Control: no-cache`, `private`, or `max-age=0`, the response includes a `Set-Cookie` header, or the request includes an `Authorization` header. Previously, only some of these conditions returned `BYPASS`. Others — such as responses exceeding the maximum cacheable file size — returned `MISS` on every request, regardless of whether [Origin Cache Control](https://edgetunnel-b2h.pages.dev/cache/concepts/cache-control/#origin-cache-control-behavior) was on or off. Because the response could never be cached, every subsequent request also returned `MISS`, which looked indistinguishable from a broken cache and made it hard to tell whether Cloudflare was trying and failing to cache the asset or had deliberately chosen not to cache it. `BYPASS` now consistently signals that Cloudflare refused to cache the response, regardless of the reason. `MISS` is reserved for cacheable responses that simply were not in the local cache at request time. #### What to expect in your analytics After this change rolls out, you should see: * **MISS rate decreases**: Uncacheable responses no longer count as cache misses. * **BYPASS rate increases**: These same responses are now reported as bypasses. * **Cache hit ratio increases**: Hit ratio calculations no longer include uncacheable traffic that could never have been cached, giving you a more accurate view of cache effectiveness. Your total request volume and origin traffic are unchanged — only the cache status label is different. #### Browser cache TTL behavior is preserved The cache status label is the only thing changing — browser cache TTL handling for any given response is identical to what it was before: * Responses that historically returned `MISS` because Cloudflare refused to cache them (for example, responses over the maximum cacheable file size) now return `BYPASS`, but continue to have browser cache TTL applied — exactly as they did when they were labeled `MISS`. * Responses that historically returned `BYPASS` and skipped browser cache TTL continue to skip browser cache TTL. In both cases, the decision to apply browser cache TTL depends on the underlying reason Cloudflare did not cache the response, not on the new `BYPASS` label. May 26, 2026 1. ### [Flagship now in public beta](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-public-beta/) [ Flagship ](https://edgetunnel-b2h.pages.dev/flagship/) **[Flagship](https://edgetunnel-b2h.pages.dev/flagship/)** is now in public beta. Evaluate feature flags directly from Cloudflare Workers with no outbound HTTP calls, using globally distributed flag configuration backed by Workers KV and Durable Objects. Flagship supports typed flag values, targeting rules, percentage rollouts, audit history, and OpenFeature-compatible SDKs. Evaluate a flag from a Worker in a few lines of code: * [ JavaScript ](#tab-panel-5005) * [ TypeScript ](#tab-panel-5006) **src/index.js** ```js export default { async fetch(request, env) { const showNewCheckout = await env.FLAGS.getBooleanValue( "new-checkout", false, ); return new Response(showNewCheckout ? "New checkout" : "Standard checkout"); }, }; ``` **src/index.ts** ```ts export default { async fetch(request: Request, env: Env): Promise { const showNewCheckout = await env.FLAGS.getBooleanValue("new-checkout", false); return new Response( showNewCheckout ? "New checkout" : "Standard checkout", ); }, } satisfies ExportedHandler; ``` Start creating flags from the Cloudflare dashboard today. Refer to the [Flagship documentation](https://edgetunnel-b2h.pages.dev/flagship/get-started/) to get started. May 21, 2026 1. ### [Call any AI model through AI Gateway's new REST API](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-rest-api/) [ AI Gateway ](https://edgetunnel-b2h.pages.dev/ai-gateway/) AI Gateway now uses the AI REST API on `api.cloudflare.com`. You can call any model — whether from OpenAI, Anthropic, Google, or hosted on Workers AI — through one unified API, using the same endpoints and authentication regardless of provider. Four endpoints are available: * `POST /ai/run` — universal endpoint for all models and modalities * `POST /ai/v1/chat/completions` — OpenAI SDK compatible * `POST /ai/v1/responses` — OpenAI Responses API compatible * `POST /ai/v1/messages` — Anthropic SDK compatible ```bash curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --header "Content-Type: application/json" \ --data '{ "model": "openai/gpt-5.5", "messages": [{"role": "user", "content": "What is Cloudflare?"}] }' ``` All AI Gateway features — logging, caching, rate limiting, and guardrails — are applied automatically. Third-party models are billed through [Unified Billing](https://edgetunnel-b2h.pages.dev/ai-gateway/features/unified-billing/), so you do not need to manage separate provider API keys. Third-party model requests are routed through your account's default gateway, which is created automatically on first use. To route requests through a specific gateway, add the `cf-aig-gateway-id` header. If you are already calling Workers AI models through the existing REST API, that path (`/ai/run/@cf/{model}`) continues to work. To call Workers AI models through AI Gateway, use the `@cf/` model prefix (for example, `@cf/moonshotai/kimi-k2.6`) and include the `cf-aig-gateway-id` header to specify which gateway to route through. For more details and examples, refer to the [REST API documentation](https://edgetunnel-b2h.pages.dev/ai-gateway/usage/rest-api/). May 21, 2026 1. ### [Modernized Billing Profile with new payment options](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-modernised-billing-profile/) [ Billing ](https://edgetunnel-b2h.pages.dev/billing/) The [Billing Profile](https://edgetunnel-b2h.pages.dev/billing/get-started/update-billing-info/) now has a modern UI and a single space that unifies billing information, payment method management and an enhanced subscriptions view under a single **Subscriptions** tab. #### What changed The **Subscriptions** tab brings billing information, payment method management, and your subscriptions together in one place. The payment management and **Pay overdue balances** flows now use the latest checkout as product purchase flows, so you can pay with Apple Pay, Google Pay, Link, and [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/) alongside cards and PayPal. New cards complete 3D Secure authentication when the issuer requires it — for example, the EU under PSD2 and India under RBI. ![Modernized Billing Profile with the Subscriptions tab](https://edgetunnel-b2h.pages.dev/_astro/2026-05-21-modernised-billing-profile.D6PysUnl_Z1dpUam.webp) For details, refer to the [Billing Home](https://edgetunnel-b2h.pages.dev/billing/) documentation. May 21, 2026 1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. #### What is new When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can: * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions. * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network. * Scope a single policy to one or many Tunnels and Mesh nodes at once. #### How it works Granular permissions are a parallel layer to existing account-level roles — they do not replace them. * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens. * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource. * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to. #### Get started * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/). * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/). * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference. May 21, 2026 1. ### [Reach Cloudflare WAN destinations from Workers VPC](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-vpc-networks-cloudflare-wan/) [ Workers VPC ](https://edgetunnel-b2h.pages.dev/workers-vpc/) You can now use [VPC Network](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/) bindings with `network_id: "cf1:network"` to reach your full private network from Workers, including: * [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes and client devices * Subnet routes and hostname routes announced through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) or Cloudflare Mesh * Destinations connected through [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) on-ramps — GRE, IPsec, and CNI This means a single VPC Network binding can route Worker requests to private services regardless of how those services are connected to Cloudflare: through a Cloudflare Tunnel from a cloud VPC, a Mesh node on a private subnet, or a Cloudflare WAN on-ramp from your data center or branch site. * [ wrangler.jsonc ](#tab-panel-5001) * [ wrangler.toml ](#tab-panel-5002) **JSONC** ```jsonc { "vpc_networks": [ { "binding": "PRIVATE_NETWORK", "network_id": "cf1:network", "remote": true, }, ], } ``` **TOML** ```toml [[vpc_networks]] binding = "PRIVATE_NETWORK" network_id = "cf1:network" remote = true ``` At runtime, the URL you pass to `fetch()` determines the destination: **JavaScript** ```js // Reach a service behind a Cloudflare WAN IPsec on-ramp const response = await env.PRIVATE_NETWORK.fetch("http://10.50.0.100:8080/api"); ``` Note For destinations behind Cloudflare WAN on-ramps (GRE, IPsec, or CNI), your network must route the [Cloudflare source IP range](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-cloudflare-source-ips/) back through the on-ramp so reply traffic returns to Cloudflare. Without this route, stateful flows will fail. This is part of standard Cloudflare WAN onboarding. For configuration options, refer to [VPC Networks](https://edgetunnel-b2h.pages.dev/workers-vpc/configuration/vpc-networks/). May 20, 2026 1. ### [New DNS records UX is rolling out](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-20-new-dns-records-ux/) [ DNS ](https://edgetunnel-b2h.pages.dev/dns/) Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans. ![New DNS records UX](https://edgetunnel-b2h.pages.dev/_astro/new-dns-ux.Bfs_yXPa_VJoah.webp) #### What is new * **Better table experience**: resizable and hideable columns, row pinning, advanced filters with logical operators (AND/OR), configurable pagination, and expanded input fields so long values are no longer cut off. * **First-class mobile experience**: responsive layout with a touch-friendly, card-based UI and compact controls for small screens. * **DNS quick reference**: bite-sized explainers for DNS, proxy status, and TTL, available directly in the product to help users configure records without leaving the page. * **Modern frontend**: a refactor onto Cloudflare's new UI framework that improves performance and lays the foundation for future improvements. ![New DNS records UX](https://edgetunnel-b2h.pages.dev/_astro/new-dns-ux.DV6gCbme_2cImvu.webp) #### Rollout plan Dates are subject to change based on feedback received during the rollout. * **20 May - 05 June**: ramped rollout to Free, then Pro and Business plans. * **08 June - 03 July**: ramped rollout to Enterprise plans. #### Share your feedback Once the new experience is turned on for your account, look for the feedback link at the top of the DNS records page in the Cloudflare dashboard and let us know what you think. Your input helps us prioritize the next round of improvements. May 20, 2026 1. ### [Content type distribution and API traffic share on Cloudflare Radar](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-20-radar-content-type-and-api-traffic/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) now includes two new charts on the [traffic page ↗](https://radar.cloudflare.com/traffic) that provide deeper insights into the composition of HTTP traffic: a content type distribution chart and an API traffic share chart. #### Content type distribution The new [**Content type** ↗](https://radar.cloudflare.com/traffic#content-type) chart displays the distribution of HTTP response content types, grouped into high-level categories. A traffic type selector allows filtering by human, bot, or all traffic. The existing [**Bot vs. Human** ↗](https://radar.cloudflare.com/traffic#bot-vs-human) chart also gained a content type category filter, allowing users to see the bot/human split for specific content categories. ![Screenshot of the content type distribution chart on the Radar traffic page](https://edgetunnel-b2h.pages.dev/_astro/content-type-distribution.Dz2q1n6W_26btAV.webp) Content type categories: * **HTML** — Web pages (`text/html`) * **Images** — All image formats (`image/*`) * **JSON** — JSON data and API responses (`application/json`, `*+json`) * **JavaScript** — Scripts (`application/javascript`, `text/javascript`) * **CSS** — Stylesheets (`text/css`) * **Plain Text** — Unformatted text (`text/plain`) * **Fonts** — Web fonts (`font/*`, `application/font-*`) * **XML** — XML documents and feeds (`text/xml`, `application/xml`, `application/rss+xml`, `application/atom+xml`) * **YAML** — Configuration files (`text/yaml`, `application/yaml`) * **Video** — Video content and streaming (`video/*`, `application/ogg`, `*mpegurl`) * **Audio** — Audio content (`audio/*`) * **Markdown** — Markdown documents (`text/markdown`) * **Documents** — PDFs, Office documents, ePub, CSV (`application/pdf`, `application/msword`, `text/csv`) * **Binary** — Executables, archives, WebAssembly (`application/octet-stream`, `application/zip`, `application/wasm`) * **Serialization** — Binary API formats (`application/protobuf`, `application/grpc`, `application/msgpack`) * **Other** — All other content types The `CONTENT_TYPE` dimension and `contentType` filter are available on the HTTP [summary](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/summary%5Fv2/), [timeseries groups](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/timeseries%5Fgroups%5Fv2/), and [timeseries](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/timeseries/) endpoints. #### API traffic share The new [**API traffic** ↗](https://radar.cloudflare.com/traffic#api-traffic) chart shows the percentage of dynamic (non-cacheable) HTTP request traffic that is API-related. API traffic is identified by JSON or XML response content types (`application/json`, `application/xml`, `text/xml`) on HTTP requests that returned a 200 status code. A traffic type selector allows switching between human traffic, bot traffic, or all traffic. ![Screenshot of the API traffic share chart on the Radar traffic page](https://edgetunnel-b2h.pages.dev/_astro/api-traffic-share._xl0TThn_Jb1Ti.webp) The `API_TRAFFIC` dimension is available on the existing HTTP [summary](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/summary%5Fv2/) and [timeseries groups](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/timeseries%5Fgroups%5Fv2/) endpoints. An `apiTraffic` filter (`API` or `NON_API`) can also be applied to [HTTP timeseries](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/http/methods/timeseries/) requests to retrieve raw request counts for API-only or non-API traffic. Visit the [Radar traffic page ↗](https://radar.cloudflare.com/traffic) to explore these new charts. May 20, 2026 1. ### [WAF Release - 2026-05-20](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-20-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ---------------------------------------------------- | --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...9e9c068d | N/A | Sitecore - Cache Poisoning - CVE:CVE-2025-53693 Beta | N/A | Block | This rule is merged into the original rule "Sitecore - Cache Poisoning - CVE:CVE-2025-53693" (ID: ...7c5b669c ). | May 19, 2026 1. ### [Cloudflare as identity provider and account membership selector](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-cloudflare-as-identity-provider/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Cloudflare Access now supports using Cloudflare itself as an [identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/). If you publish an Access application and select Cloudflare as the login method, users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes. Authentication is backed by Cloudflare's own account security (including multi-factor authentication), making it both simpler to set up and more secure than OTP-based login for most use cases. Cloudflare is now the **default identity provider for all newly created Zero Trust accounts**, replacing One-time PIN. This also enables two new capabilities: * **Cloudflare Account Member selector** — A new [policy selector](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#cloudflare-access-selectors) that matches users based on their membership in a Cloudflare account. You can target the current account or specify a different account ID for cross-account access scenarios. * **Restrict to account members** — An identity provider configuration option that limits authentication to users who are members of your Cloudflare account. To get started, add Cloudflare as an [identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) in your Zero Trust settings. May 19, 2026 1. ### [Event subscriptions for Artifacts lifecycle events](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-event-subscriptions/) [ Artifacts ](https://edgetunnel-b2h.pages.dev/artifacts/)[ Queues ](https://edgetunnel-b2h.pages.dev/queues/) You can now receive [event notifications](https://edgetunnel-b2h.pages.dev/queues/event-subscriptions/) for [Artifacts](https://edgetunnel-b2h.pages.dev/artifacts/) repository changes and consume them from a Worker to build commit-driven automation. This allows you to: * Run custom workflows when a repository is created or imported * Kick off a build and deploy a change when an agent pushes to a repo * Trigger a review agent on every push Available events include: * **Account-level events** (`artifacts` source) — `repo.created`, `repo.deleted`, `repo.forked`, `repo.imported` * **Repository-level events** (`artifacts.repo` source) — `pushed`, `cloned`, `fetched` To learn more, refer to [Artifacts documentation](https://edgetunnel-b2h.pages.dev/artifacts/guides/event-subscriptions/). May 19, 2026 1. ### [CASB adds support for Claude Compliance API](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-casb-claude-compliance-api/) [ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) [Cloudflare CASB](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/) now integrates with the [Claude Compliance API ↗](https://support.claude.com/en/articles/13015708-access-the-compliance-api). This enhancement gives security teams visibility into Claude usage patterns, admin activity, and compliance-relevant events across their organization. The Claude Compliance API provides structured access to audit logs and administrative actions within Claude Enterprise and Claude Platform. Cloudflare CASB ingests this data to surface security findings that help organizations enhance their security posture and enforce AI governance. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: * **Public projects** — Projects set to public visibility * **Project attachment** — Files and documents added to projects that violate DLP policies * **Chat files** — User-uploaded and provider-generated files that violate DLP policies * **Chat messages** — User prompts and provider responses that violate DLP policies * **Artifacts** — Provider-generated documents and files that violate DLP policies #### Learn more This [integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/) is available to all Cloudflare One customers. New Cloudflare customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the dashboard. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. May 19, 2026 1. ### [MRT Explorer on Cloudflare Radar](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-radar-mrt-explorer/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) now includes an [MRT Explorer ↗](https://radar.cloudflare.com/routing/mrt-explorer) tool in the Routing section. Route collectors like RIPE RIS and RouteViews publish MRT (Multi-Threaded Routing Toolkit) dump files containing BGP announcements, withdrawals, and route attributes. The new tool parses these files entirely in the browser — nothing gets uploaded. #### Loading a file Paste a URL to fetch an MRT file remotely, drag and drop one onto the page, or browse for a local file. Gzip and bzip2 compressed files are supported. A sample file is also available to get started right away. ![Screenshot of the MRT Explorer file input form](https://edgetunnel-b2h.pages.dev/_astro/mrt-explorer-form.DKnzUqMC_eLAcj.webp) #### Inspecting events Once parsed, the tool lists every BGP event with its timestamp, prefix, AS path, OTC (Only to Customer), and community attributes. ![Screenshot of the MRT Explorer event list](https://edgetunnel-b2h.pages.dev/_astro/mrt-explorer-list.8fq2u5Kc_16oUq3.webp) #### Event details Clicking on the "View details" action opens a modal with additional properties and the full event JSON. ![Screenshot of the MRT Explorer event details modal](https://edgetunnel-b2h.pages.dev/_astro/mrt-explorer-details.EMcHevWw_Z2ctmxN.webp) #### Shareable URLs When loading a file by URL, the query string captures the source so the link can be shared directly — the recipient's browser immediately fetches and parses the same file. Try the [MRT Explorer on Cloudflare Radar ↗](https://radar.cloudflare.com/routing/mrt-explorer). May 18, 2026 1. ### [Manage Artifacts namespaces and repos with Wrangler CLI](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-18-wrangler-support/) [ Artifacts ](https://edgetunnel-b2h.pages.dev/artifacts/) You can now manage [Artifacts](https://edgetunnel-b2h.pages.dev/artifacts/) namespaces, repos, and repo-scoped tokens directly from Wrangler CLI. Available commands: * `wrangler artifacts namespaces list` — List Artifacts namespaces in your account. * `wrangler artifacts namespaces get` — Get metadata for a namespace. * `wrangler artifacts repos create` — Create a repo in a namespace. * `wrangler artifacts repos list` — List repos in a namespace. * `wrangler artifacts repos get` — Get metadata for a repo. * `wrangler artifacts repos delete` — Delete a repo. * `wrangler artifacts repos issue-token` — Issue a repo-scoped token for Git access. To get started, refer to the [Wrangler Artifacts commands documentation](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/artifacts/). May 18, 2026 1. ### [Network Analytics support for Unified Routing](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-18-unified-routing-network-analytics/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/) [Network Analytics](https://edgetunnel-b2h.pages.dev/analytics/network-analytics/) is now fully supported for accounts using [Unified Routing](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#unified-routing-mode-beta) mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane. This closes a parity gap for customers who had moved tunnels onto Unified Routing and lost visibility into their dataplane traffic in the Network Analytics dashboard. No configuration change is required — analytics data is collected automatically for all accounts with Unified Routing enabled. For the remaining beta limitations, refer to [Traffic steering beta limitations](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#beta-limitations). May 18, 2026 1. ### [Share local dev servers through Cloudflare Tunnel in Wrangler and Vite](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-18-local-dev-tunnels/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now share local dev sessions through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) and get a public URL when using either [Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/) or the [Cloudflare Vite plugin](https://edgetunnel-b2h.pages.dev/workers/vite-plugin/). This is useful when you need to share a preview, test a webhook, or access your app from another device. ![Vite local dev tunnel demo](https://edgetunnel-b2h.pages.dev/_astro/vite-local-dev-tunnel.CW4xpgIR_ZmyQ8a.webp) This lets you either: * start a temporary [Quick tunnel](https://edgetunnel-b2h.pages.dev/tunnel/setup/#quick-tunnels-development) with a random `*.trycloudflare.com` hostname, or * use an existing [named tunnel](https://edgetunnel-b2h.pages.dev/tunnel/setup/#create-a-tunnel) for a stable hostname and to restrict access with [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/). To start a tunnel, press `t` in Wrangler or `t + Enter` in Vite while your dev server is running. For details on setting up a named tunnel, refer to [Share a local dev server](https://edgetunnel-b2h.pages.dev/workers/local-development/local-dev-tunnels/). May 15, 2026 1. ### [Hyperdrive exposes database connection pool size metrics](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-15-hyperdrive-pool-size-metrics/) [ Hyperdrive ](https://edgetunnel-b2h.pages.dev/hyperdrive/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now view the size of your Hyperdrive database connection pools, giving you the ability to self-diagnose connection issues. Using the Cloudflare dashboard or the `hyperdrivePoolSizesAdaptiveGroups` dataset in the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/getting-started/), you can see `waitingClients`, `currentPoolSize`, `availablePoolSlots`, and `maxPoolSize` for each of your configurations. A new **Pool connections** chart has been added to the **Metrics** tab of each Hyperdrive configuration in the [Cloudflare dashboard ↗](https://dash.cloudflare.com). You can use the location selector to drill down into specific locations hosting your connection pool by airport code. ![Hyperdrive pool size metrics chart](https://edgetunnel-b2h.pages.dev/_astro/hyperdrive-pool-size-metrics-chart.DZxLTFgB_3zcIK.webp) The chart shows: * **Waiting clients**: Client requests waiting for an available connection. * **Open connections**: Active connections to your database. * **Pool size maximum**: Your configured origin connection limit. Connection contention appears as a spike in waiting clients, or when open connections consistently approach the pool size maximum. If your open connections regularly approach this limit, consider contacting Cloudflare to [increase your Hyperdrive connection limit](https://edgetunnel-b2h.pages.dev/hyperdrive/platform/limits/#request-a-limit-increase). #### Pool size metrics The `hyperdrivePoolSizesAdaptiveGroups` dataset in the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/getting-started/) exposes the following key connection pool metrics for each Hyperdrive configuration: Under `avg`: * **`currentPoolSize`** — Average number of connections currently open in the pool. * **`availablePoolSlots`** — Average number of pool connections available for checkout. * **`waitingClients`** — Average number of clients waiting for a connection from the pool. Under `max`: * **`maxPoolSize`** — Configured maximum size of the connection pool. * **`currentPoolSize`** — Peak number of connections open in the pool. * **`waitingClients`** — Peak number of clients waiting for a connection from the pool. For more information, refer to [Metrics and analytics](https://edgetunnel-b2h.pages.dev/hyperdrive/observability/metrics/) and [Connection pooling](https://edgetunnel-b2h.pages.dev/hyperdrive/concepts/connection-pooling/). May 15, 2026 1. ### [R2 SQL now supports JOINs, subqueries, and multi-table queries](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-14-joins-subqueries-multi-table-queries/) [ R2 SQL ](https://edgetunnel-b2h.pages.dev/r2-sql/) [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) is Cloudflare's serverless, distributed SQL engine for querying [Apache Iceberg ↗](https://iceberg.apache.org/) tables stored in [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/). R2 SQL runs directly on Cloudflare's global network with no infrastructure to manage, so you can analyze data in R2 without exporting it to an external warehouse. R2 SQL now supports joining multiple Iceberg tables in a single query. You can combine tables with JOINs, filter with subqueries, and define multi-table CTEs to build complex analytical queries. #### New capabilities * **JOINs** — `INNER JOIN`, `LEFT JOIN`, `RIGHT JOIN`, `FULL OUTER JOIN`, `CROSS JOIN`, and implicit joins (comma-separated `FROM` with conditions in `WHERE`) * **Subqueries** — `IN` / `NOT IN`, `EXISTS` / `NOT EXISTS`, scalar subqueries in `SELECT` / `WHERE` / `HAVING`, and derived tables (subqueries in `FROM`) * **Multi-table CTEs** — `WITH` clauses can reference different tables and include JOINs * **Self-joins** — join a table with itself using different aliases * **Multi-way joins** — join three or more tables in a single query #### Examples #### Two-table JOIN with aggregation ```sql SELECT z.domain, z.plan, COUNT(*) AS request_count FROM my_namespace.zones z INNER JOIN my_namespace.http_requests h ON z.zone_id = h.zone_id WHERE z.plan = 'enterprise' GROUP BY z.domain, z.plan ORDER BY request_count DESC LIMIT 20 ``` #### `EXISTS` subquery ```sql SELECT z.domain, z.plan FROM my_namespace.zones z WHERE EXISTS ( SELECT 1 FROM my_namespace.firewall_events f WHERE f.zone_id = z.zone_id AND f.action = 'block' ) ORDER BY z.domain LIMIT 20 ``` #### Multi-table CTE with JOIN ```sql WITH top_zones AS ( SELECT zone_id, COUNT(*) AS req_count FROM my_namespace.http_requests GROUP BY zone_id ORDER BY req_count DESC LIMIT 50 ), zone_threats AS ( SELECT zone_id, COUNT(*) AS threat_count FROM my_namespace.firewall_events WHERE risk_score > 0.5 GROUP BY zone_id ) SELECT tz.zone_id, tz.req_count, COALESCE(zt.threat_count, 0) AS threat_count FROM top_zones tz LEFT JOIN zone_threats zt ON tz.zone_id = zt.zone_id ORDER BY tz.req_count DESC LIMIT 20 ``` For the full syntax reference, refer to the [SQL reference](https://edgetunnel-b2h.pages.dev/r2-sql/sql-reference/). For performance guidance with joins, refer to [Limitations and best practices](https://edgetunnel-b2h.pages.dev/r2-sql/reference/limitations-best-practices/). May 15, 2026 1. ### [WAF Release - 2026-05-15 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-15-emergency-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's `is_args` stale-state bug (CVE-2026-42945). **Key Findings** CVE-2026-42945: nginx Heap Buffer Overflow via Stale `is_args` in Rewrite Module Successful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in `ngx_http_script_copy_capture_code()` causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution. We strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` referencing capture groups. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...7e52be73 | N/A | nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...9df0ee6c | N/A | nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945 | N/A | Block | This is a new detection. | May 14, 2026 1. ### [New Domains tab in the Workers dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-14-domains-tab/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) In your Worker's dashboard, there is now a dedicated **Domains** tab where you can purchase a new domain through Cloudflare Registrar and have it automatically connected, add an [existing domain](https://edgetunnel-b2h.pages.dev/workers/configuration/routing/custom-domains/), and manage all of your Worker's routing in one place. ![The new Domains tab in the Workers dashboard](https://edgetunnel-b2h.pages.dev/_astro/domains-tab.Cey2Oyr-_B4kIf.webp) You can also enable or disable your [workers.dev subdomain](https://edgetunnel-b2h.pages.dev/workers/configuration/routing/workers-dev/) and [Preview URLs](https://edgetunnel-b2h.pages.dev/workers/versions-and-deployments/preview-urls/), put them behind [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/) to require sign-in, and jump directly to [analytics](https://edgetunnel-b2h.pages.dev/analytics/) or domain overview for any connected domain. To get started, go to **Workers & Pages**, select a Worker, and open the **Domains** tab. [ Go to **Workers & Pages** ](https://dash.cloudflare.com/?to=/:account/workers-and-pages) May 13, 2026 1. ### [Agents SDK v0.12.4: chat recovery, routing retries, durable Think submissions, and Voice connection control](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-13-agents-sdk-v0124/) [ Agents ](https://edgetunnel-b2h.pages.dev/agents/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) The latest release of the [Agents SDK ↗](https://github.com/cloudflare/agents) brings more reliable chat recovery, fixes Agent state synchronization during reconnects, adds durable submissions for Think, exposes routing retry configuration, and adds connection control for Voice agents. #### Chat recovery improvements `@cloudflare/ai-chat` now keeps server turns running when a browser or client stream is interrupted. This is useful for long-running AI responses where users refresh the page, close a tab, or temporarily lose connection. Calling `stop()` still cancels the server turn. Set `cancelOnClientAbort: true` if browser or client aborts should also cancel the server turn: * [ JavaScript ](#tab-panel-5003) * [ TypeScript ](#tab-panel-5004) **JavaScript** ```js const chat = useAgentChat({ agent: "assistant", name: "user-123", cancelOnClientAbort: true, }); ``` **TypeScript** ```ts const chat = useAgentChat({ agent: "assistant", name: "user-123", cancelOnClientAbort: true, }); ``` Notable bug fixes: * Chat stream resume negotiation no longer throws when replay races with a closed WebSocket connection. * Recovered chat continuations no longer leave `useAgentChat` stuck in a streaming state when the original socket disconnects before a terminal response. * Approval auto-continuation preserves reasoning parts and persists continuation reasoning in the final message. * `isServerStreaming` now resets correctly when a resumed stream moves from the fallback observer path to a transport-owned stream. #### Agent state and routing fixes `agents@0.12.4` prevents duplicate initial state frames during WebSocket connection setup. This avoids stale initial state messages overwriting state updates already sent by the client. Agent recovery is also more reliable when tool calls span a Durable Object restart. Recovery now defers user finish hooks until after agent startup and isolates hook failures, so one failed hook does not block other recovered runs from finalizing. `getAgentByName()` now supports `routingRetry` for transient Durable Object routing failures: * [ JavaScript ](#tab-panel-5007) * [ TypeScript ](#tab-panel-5008) **JavaScript** ```js import { getAgentByName } from "agents"; const agent = await getAgentByName(env.AssistantAgent, "user-123", { routingRetry: { maxAttempts: 3, }, }); ``` **TypeScript** ```ts import { getAgentByName } from "agents"; const agent = await getAgentByName(env.AssistantAgent, "user-123", { routingRetry: { maxAttempts: 3, }, }); ``` #### Durable Think submissions `@cloudflare/think` now supports durable programmatic submissions. `submitMessages()` provides durable acceptance, idempotent retries, status inspection, cancellation, and cleanup for server-driven turns that should continue after the caller returns. `Think.chat()` RPC turns now run inside chat recovery fibers and persist their stream chunks. Interrupted sub-agent turns can recover partial output instead of starting over. `ChatOptions.tools` has been removed from the TypeScript API. Define durable tools on the child agent or use agent tools for orchestration. Runtime `options.tools` values passed by legacy callers are ignored with a warning. #### Think message pruning behavior change `@cloudflare/think` no longer applies `pruneMessages({ toolCalls: "before-last-2-messages" })` to model context by default. The previous default could strip client-side tool results from longer multi-turn flows. `truncateOlderMessages` still runs as before, so context cost remains bounded. Subclasses that relied on the old aggressive pruning can opt back in from `beforeTurn`: * [ JavaScript ](#tab-panel-5011) * [ TypeScript ](#tab-panel-5012) **JavaScript** ```js import { Think } from "@cloudflare/think"; import { pruneMessages } from "ai"; export class MyAgent extends Think { beforeTurn(ctx) { return { messages: pruneMessages({ messages: ctx.messages, toolCalls: "before-last-2-messages", }), }; } } ``` **TypeScript** ```ts import { Think } from "@cloudflare/think"; import { pruneMessages } from "ai"; export class MyAgent extends Think { beforeTurn(ctx) { return { messages: pruneMessages({ messages: ctx.messages, toolCalls: "before-last-2-messages", }), }; } } ``` #### Voice agent connection control `@cloudflare/voice` adds an `enabled` option to `useVoiceAgent`. React apps can now delay creating and connecting a `VoiceClient` until prerequisites such as capability tokens are ready. * [ JavaScript ](#tab-panel-5009) * [ TypeScript ](#tab-panel-5010) **JavaScript** ```js const voice = useVoiceAgent({ agent: "MyVoiceAgent", enabled: Boolean(token), }); ``` **TypeScript** ```ts const voice = useVoiceAgent({ agent: "MyVoiceAgent", enabled: Boolean(token), }); ``` This release also fixes Workers AI speech-to-text session edge cases and `withVoice` text streaming from AI SDK `textStream` responses. #### Other improvements * **Streamable HTTP routing** — Server-to-client requests now route through the originating POST stream when no standalone SSE stream is available. * **Structured tool output** — Tool output shapes are preserved when truncating older messages or oversized persisted rows. * **Non-chat Think tool steps** — Think agent-tool children can complete without emitting assistant text and can return structured output through `getAgentToolOutput`. * **Sub-agent schedules** — Stale sub-agent schedule rows are pruned when their owning facet registry entry no longer exists. * **`@cloudflare/codemode`** — Adds a browser-safe export with an iframe sandbox executor and resolves OpenAPI specs inside the sandbox to avoid Worker Loader RPC size limits. #### Upgrade To update to the latest version: ```sh npm i agents@latest @cloudflare/ai-chat@latest @cloudflare/think@latest @cloudflare/voice@latest ``` Refer to the [Agents API reference](https://edgetunnel-b2h.pages.dev/agents/runtime/) and [Chat agents documentation](https://edgetunnel-b2h.pages.dev/agents/communication-channels/chat/chat-agents/) for more information. May 13, 2026 1. ### [New Logpush datasets and updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-13-log-fields-updated/) [ Logs ](https://edgetunnel-b2h.pages.dev/logs/) Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/): #### New datasets * **Email Security Post-Delivery Events**: A new dataset with fields including `AlertID`, `CompletedAt`, `Destination`, `FinalDisposition`, `Folder`, `From`, `FromName`, `MessageID`, `MessageTimestamp`, `MicrosoftTenantID`, `Operation`, `PostfixID`, `Reasons`, `Recipient`, `RequestedAt`, `RequestedBy`, `RequestedDisposition`, `Status`, `Subject`, `Success`, and `To`. * **Magic Network Monitoring Flow Logs**: A new dataset with fields including `AWSVPCFlowJSON`, `Bits`, `DestinationAS`, `DestinationAddress`, `DestinationPort`, `DeviceID`, `EgressBits`, `EgressPackets`, `Ethertype`, `FlowProtocol`, `FlowTimestamp`, `NumFlows`, `PacketID`, `Packets`, `Protocol`, `RuleIDs`, `SampleRate`, `SampleRateType`, `SamplerAddress`, `SourceAS`, `SourceAddress`, `SourcePort`, `TcpFlags`, and `Timestamp`. #### Updated fields in existing datasets * **Firewall events** (added): `AISecurityInjectionScore`, `AISecurityPIICategories`, `AISecurityTokenCount`, and `AISecurityUnsafeTopicCategories`. * **HTTP requests** (added): `AISecurityInjectionScore`, `AISecurityPIICategories`, `AISecurityTokenCount`, `AISecurityUnsafeTopicCategories`, and `Subrequests`. For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/). May 13, 2026 1. ### [/cdn-cgi/rum endpoint now returns 405 for non-POST requests](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-13-rum-405-method-not-allowed/) [ Cloudflare Web Analytics ](https://edgetunnel-b2h.pages.dev/web-analytics/) The `/cdn-cgi/rum` beacon endpoint now returns `405 Method Not Allowed` for non-POST requests instead of `404 Not Found`. The response includes an `Allow: POST, OPTIONS` header per [RFC 9110 §15.5.6 ↗](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.6). Previously, sending a `GET` or other non-POST request to this endpoint returned a `404`, which was misleading because it suggested the endpoint did not exist. The new `405` response clearly indicates that the endpoint exists but only accepts `POST` requests. The Web Analytics beacon (`beacon.min.js`) already uses `POST` for all metric submissions, so this change does not affect normal beacon operation. `OPTIONS` requests for CORS preflight continue to work as before. For more information, refer to the [Web Analytics FAQ](https://edgetunnel-b2h.pages.dev/web-analytics/faq/#why-am-i-getting-a-405-method-not-allowed-error-from-cdn-cgirum). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/7/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/7/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```