--- title: Changelogs image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) All products ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) May 04, 2026 1. ### [Keyboard shortcuts for the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-keyboard-shortcuts/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press `?` anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your [profile settings ↗](https://dash.cloudflare.com/profile/settings). #### Navigate | Shortcut | Action | | --------- | ------------------------------------------------------ | | g h | Go to Home | | g a | Go to account overview | | g z | Go to zone overview | | g p | Go to your profile | | g w | Go to Workers & Pages | | g o | Go to Zero Trust | | g b | Go to billing | | g 1 – g 5 | Go to a recent or pinned item (by position in sidebar) | | t → | Move to the next tab | | t ← | Move to the previous tab | | p → | Move to the next page of a table | | p ← | Move to the previous page of a table | #### Take action | Shortcut | Action | | -------- | ------------------------------------ | | / | Open quick search | | ? | Show keyboard shortcuts | | s a | Switch account | | s z | Switch zone | | s . | Star or unstar the current zone | | p . | Pin or unpin the current page | | t s | Toggle the sidebar open or closed | | t m | Expand or collapse all sidebar menus | | t a | Toggle Ask AI sidebar | | d . | Toggle dark mode | | c u | Copy the current URL | | c d | Copy a deep link URL | May 04, 2026 1. ### [Pipelines and R2 Data Catalog now supported in Terraform](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-terraform-support/) [ Pipelines ](https://edgetunnel-b2h.pages.dev/pipelines/) [Cloudflare Pipelines](https://edgetunnel-b2h.pages.dev/pipelines/) ingests streaming data via [Workers](https://edgetunnel-b2h.pages.dev/workers/) or HTTP endpoints, transforms it with SQL, and writes it to [R2](https://edgetunnel-b2h.pages.dev/r2/) as Apache Iceberg tables. [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) manages those Iceberg tables, compaction, and compatibility with query engines like [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/), [Spark](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/spark-scala/), and [DuckDB](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/duckdb/). You can now create and manage both products using Terraform, supported in the [Cloudflare Terraform provider v5.19.0 ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs). This adds four new resources that let you define your entire data pipeline as infrastructure-as-code: a data catalog, a stream for ingestion, a sink that writes to R2 Data Catalog or R2, and a pipeline that connects them with SQL. The new Terraform resources are: * [cloudflare\_r2\_data\_catalog ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/r2%5Fdata%5Fcatalog) — enable the data catalog on an R2 bucket * [cloudflare\_pipeline\_stream ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline%5Fstream) — create a stream that receives events via HTTP or Worker bindings * [cloudflare\_pipeline\_sink ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline%5Fsink) — create a sink that writes to R2 Data Catalog or R2 * [cloudflare\_pipeline ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline) — create a pipeline with SQL connecting a stream to a sink Here is a minimal example that creates a stream, an R2 Data Catalog sink, and a pipeline: ```hcl resource "cloudflare_pipeline_stream" "my_stream" { account_id = var.cloudflare_account_id name = "my_stream" format = { type = "json" } schema = { fields = [{ name = "value" type = "json" required = true }] } http = { enabled = true, authentication = false, cors = {} } worker_binding = { enabled = false } } resource "cloudflare_pipeline_sink" "my_sink" { account_id = var.cloudflare_account_id name = "my_sink" type = "r2_data_catalog" format = { type = "parquet" } schema = { fields = [] } config = { account_id = var.cloudflare_account_id bucket = "my-pipeline-bucket" table_name = "my_table" token = var.catalog_token } } resource "cloudflare_pipeline" "my_pipeline" { account_id = var.cloudflare_account_id name = "my_pipeline" sql = "INSERT INTO ${cloudflare_pipeline_sink.my_sink.name} SELECT * FROM ${cloudflare_pipeline_stream.my_stream.name}" } ``` For a full end-to-end example that includes R2 bucket creation, data catalog setup, and scoped API token provisioning, refer to the [Pipelines Terraform documentation](https://edgetunnel-b2h.pages.dev/pipelines/reference/terraform/). May 04, 2026 1. ### [New routing widgets on Cloudflare Radar](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-radar-routing-widgets/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) is expanding its [Routing section ↗](https://radar.cloudflare.com/routing) with two new widgets that give a deeper view into how networks announce address space and how RPKI ROA coverage evolves over time. #### Top ASes by announced IP space on country pages Country routing pages now include a **Top ASes by announced IP space** chart, breaking down the IPv4 and IPv6 address space announced from a country across the autonomous systems that originate it. The chart stacks the IPv4 and IPv6 views vertically, with the top contributing ASes called out by color and the remaining networks aggregated as **Other**. ![Screenshot of the top ASes by announced IP space chart on a country routing page](https://edgetunnel-b2h.pages.dev/_astro/country-top-ases-ip-space.CoGqJB6W_Z5Vr9S.webp) #### RPKI ROA deployment timeseries The [RPKI sub-page ↗](https://radar.cloudflare.com/routing/rpki) adds an **RPKI ROA deployment** timeseries widget that tracks the share of announced BGP space covered by a valid Route Origin Authorization (ROA) over time, with separate IPv4 and IPv6 lines. A toggle switches the view between the share of covered **prefixes** and the share of covered **IP address space**. The widget is available on global, country, and AS views, so operators can monitor RPKI adoption progress and compare deployment trends across different scopes. ![Screenshot of the RPKI ROA deployment timeseries widget](https://edgetunnel-b2h.pages.dev/_astro/rpki-roa-deployment-timeseries.DTsP_V93_Z1MVOCh.webp) #### API endpoints The data behind these widgets is also available through two new endpoints on the [BGP](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/bgp/) API: * [/bgp/ips/top/ases](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/bgp/subresources/ips/subresources/top/methods/ases/) \- Returns the top autonomous systems by announced IP space (IPv4 `/24`s or IPv6 `/48`s), globally or filtered by country, snapped to the nearest 8-hour RIB boundary. * [/bgp/rpki/roas/timeseries](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/bgp/subresources/rpki/subresources/roas/methods/timeseries/) \- Returns RPKI ROA validation coverage over time, by share of prefixes or share of IP address space, split by IP version, with optional ASN or location filters. Visit the [Radar routing section ↗](https://radar.cloudflare.com/routing) to explore both widgets. May 04, 2026 1. ### [WAF Release - 2026-05-04](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors. **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------- | --------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...f0884a68 | N/A | XSS, HTML Injection - Object Tag - Body (beta) | Log | Block | This is a new detection. This rule is merged into the original rule "XSS, HTML Injection - Object Tag" (ID: ...0c14e284 ). | | Cloudflare Managed Ruleset | ...ff012303 | N/A | XSS, HTML Injection - Object Tag - Headers | Log | Block | This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - Headers (beta)" is now renamed to "XSS, HTML Injection - Object Tag - Headers". | | Cloudflare Managed Ruleset | ...16f921d9 | N/A | XSS, HTML Injection - Object Tag - URI | Log | Block | This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - URI (beta)" is now renamed to "XSS, HTML Injection - Object Tag - URI". | | Cloudflare Managed Ruleset | ...dc90d21a | N/A | Command Injection - Generic 9 - Body Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: ...0677175f ) | | Cloudflare Managed Ruleset | ...f8960375 | N/A | Command Injection - Generic 9 - Header Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: ...1eb7a999 ) | | Cloudflare Managed Ruleset | ...ef47a800 | N/A | Command Injection - Generic 9 - URI Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: ...97321c6c ) | | Cloudflare Managed Ruleset | ...beebf804 | N/A | Command Injection - Sleep - Body | N/A | Disabled | This is a new detection. The rule previously known as "Command Injection Sleep" is now renamed to "Command Injection - Sleep - Body". | | Cloudflare Managed Ruleset | ...0d257566 | N/A | Command Injection - Sleep - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1856fe86 | N/A | Command Injection - Sleep - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...e6e43c37 | N/A | Fortinet FortiSandbox - Command Injection - CVE:CVE-2026-39808 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...88118795 | N/A | Remote Code Execution - Common Bash Bypass - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...9299d53b | N/A | Remote Code Execution - Common Bash Bypass - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...b0bf33f9 | N/A | Remote Code Execution - Common Bash Bypass - Body - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass Body" (ID: ...efb7e5b9 ). The rule previously known as "Remote Code Execution - Common Bash Bypass Beta" is now renamed to "Remote Code Execution - Common Bash Bypass Body". | | Cloudflare Managed Ruleset | ...33bfe8b9 | N/A | PHP Object Injection - 2 - Body - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "PHP Object Injection - 2" (ID: ...161aafdc ) | | Cloudflare Managed Ruleset | ...29552387 | N/A | PHP Object Injection - 2 - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...8104f4c5 | N/A | PHP Object Injection - 2 - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...6a46201e | N/A | SQLi - DROP - 2 - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "SQLi - DROP - 2" (ID: ...48ac2221 ) | | Cloudflare Managed Ruleset | ...8b7f85ee | N/A | SQLi - DROP - 2 - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1546b5f0 | N/A | SQLi - DROP - 2 - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1e053dce | N/A | SmarterMail - Remote Code Execution - CVE:CVE-2026-24423 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...d0023a36 | N/A | SQLi - SELECT Expression - Body | Block | Disabled | Action changed | | Cloudflare Managed Ruleset | ...26cc211f | N/A | SQLi - String Concatenation - URI | Block | Disabled | Action changed | May 01, 2026 1. ### [Run Workflows inside Dynamic Workers with the @cloudflare/dynamic-workflows library](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-01-dynamic-workflows/) [ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now use [@cloudflare/dynamic-workflows ↗](https://github.com/cloudflare/dynamic-workflows) to run a [Workflow](https://edgetunnel-b2h.pages.dev/workflows/) inside a [Dynamic Worker](https://edgetunnel-b2h.pages.dev/dynamic-workers/), ensuring durable execution for code that is loaded at runtime. The Worker Loader loads Dynamic Workers on demand, which previously made durability challenging. Even within a Dynamic Worker, a Workflow might sleep for hours or days between steps, and by the time it resumes, the original Dynamic Worker code would no longer be in memory. The library solves this by tagging each Workflow instance with metadata that identifies which Dynamic Worker to load — for example, a tenant ID — then reloading the matching Dynamic Worker through the Worker Loader whenever a Workflow awakens. Because Dynamic Workers are created on-demand, you do not have to register each Workflow up front or manage them individually. Load the Workflow code in the Dynamic Worker when it is needed, and the Workflows engine handles persistence and retries behind the scenes. Your Workflow code itself is unaffected by the routing and behaves as normal. This unlocks patterns where the Workflow code itself is dynamic. For example, this is useful with: * **SaaS platforms** where each tenant defines their own automation, such as onboarding sequences, approval chains, or billing retry logic. * **AI agent frameworks** where agents generate and execute multi-step plans at runtime, surviving restarts and waiting for human approval between tool calls. * **Multi-tenant job systems** where each customer submits their own processing logic and every step persists progress and retries on failure. **TypeScript** ```ts import { createDynamicWorkflowEntrypoint, DynamicWorkflowBinding, wrapWorkflowBinding, type WorkflowRunner, } from "@cloudflare/dynamic-workflows"; export { DynamicWorkflowBinding }; interface Env { WORKFLOWS: Workflow; LOADER: WorkerLoader; } function loadTenant(env: Env, tenantId: string) { return env.LOADER.get(tenantId, async () => ({ compatibilityDate: "2026-01-01", mainModule: "index.js", modules: { "index.js": await fetchTenantCode(tenantId) }, // The Dynamic Worker uses this exactly like a real Workflow binding; // every create() is tagged with { tenantId } automatically. env: { WORKFLOWS: wrapWorkflowBinding({ tenantId }) }, })); } // The entrypoint name must match `class_name` in the workflows binding of your Wrangler config file. export const DynamicWorkflow = createDynamicWorkflowEntrypoint( async ({ env, metadata }) => { const stub = loadTenant(env, metadata.tenantId as string); return stub.getEntrypoint("TenantWorkflow") as unknown as WorkflowRunner; }, ); export default { fetch(request: Request, env: Env) { const tenantId = request.headers.get("x-tenant-id")!; return loadTenant(env, tenantId).getEntrypoint().fetch(request); }, }; ``` For a full walkthrough, refer to the [Dynamic Workflows guide](https://edgetunnel-b2h.pages.dev/dynamic-workers/usage/dynamic-workflows/). Apr 30, 2026 1. ### [Post-quantum IPsec interoperability with third-party devices](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-ipsec-post-quantum-third-party/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Cloudflare IPsec now supports post-quantum key agreement with compatible third-party devices. [Cisco ↗](https://www.cisco.com/) and [Fortinet ↗](https://www.fortinet.com/) are the first third-party vendors validated to interoperate with Cloudflare IPsec using ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). Post-quantum IPsec uses [RFC 9370 ↗](https://datatracker.ietf.org/doc/rfc9370/) and [draft-ietf-ipsecme-ikev2-mlkem ↗](https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-mlkem/) to negotiate hybrid key agreement during the IKEv2 `IKE_INTERMEDIATE` phase. This combines classical Diffie-Hellman (Group 20) with ML-KEM-768 or ML-KEM-1024 to protect against [harvest-now, decrypt-later ↗](https://en.wikipedia.org/wiki/Harvest%5Fnow,%5Fdecrypt%5Flater) attacks. Key details: * Compatible with Cisco 8000 Series Secure Routers with IOS XR Release 26.1.1 and Fortinet FortiOS 7.6.6 and later. * Uses ML-KEM-768 or ML-KEM-1024 as an additional Key Exchange to DH Group 20. * Follows RFC 9370 and draft-ietf-ipsecme-ikev2-mlkem standards. * No additional licensing required. Post-quantum IPsec with third-party devices is now generally available with confirmed interoperability for the platforms listed above. Cloudflare intends to support interoperability with more vendors as they build out support for draft-ietf-ipsecme-ikev2-mlkem. Contact your account team to discuss support for additional vendors. For supported key exchange methods and the list of validated platforms, refer to [GRE and IPsec tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/gre-ipsec-tunnels/#tested-third-party-vendor-interoperability). Apr 30, 2026 1. ### [Classify sensitive content with Data Classification](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-data-classification/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) Cloudflare DLP now includes **Data Classification**, which lets administrators organize and label sensitive content using labels, templates, and reusable data classes. With Data Classification, administrators can define labels such as sensitivity schemas and levels, and data tag groups and tags. Administrators can also build from Cloudflare-managed templates and create reusable data classes that combine detection entries, other data classes, sensitivity levels, and data tags. You can then use those classifications in custom DLP profiles to identify the severity of sensitive content, understand where it exists, and apply that logic consistently across DLP profiles. For more information, refer to [Data Classification](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/data-classification/). Apr 30, 2026 1. ### [New predefined detection entries are available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-standalone-predefined-detection-entries/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) Cloudflare DLP now includes new predefined detection entries. The expanded catalog includes detections for specific credential types, webhooks, addresses, tax identifiers, national IDs, financial data, and crypto wallets. Examples include `GitHub PAT`, `OpenAI API Key`, `Slack Webhook`, `Discord Webhook`, `US Physical Address`, and `Bitcoin Wallet`. For the full list, refer to [Predefined detection entries](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/predefined-detection-entries/). Apr 30, 2026 1. ### [Go SDK v7.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-go-sdk-v700/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)[ Go SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v6.10.0...v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/compare/v6.10.0...v7.0.0) This is a major version release that includes breaking changes to three packages: `ai_search`, `email_security`, and `workers`. These changes reflect upstream API specification updates that improve type correctness and consistency. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes See the [v7.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md) for before/after code examples and actions needed for each change. #### AI Search - SearchForAgents Metadata Removed The `SearchForAgents` nested type has been removed from all instance metadata structs. This field is no longer part of the API specification. **Removed Types:** * `InstanceNewResponseMetadataSearchForAgents` * `InstanceUpdateResponseMetadataSearchForAgents` * `InstanceListResponseMetadataSearchForAgents` * `InstanceDeleteResponseMetadataSearchForAgents` * `InstanceReadResponseMetadataSearchForAgents` * `InstanceNewParamsMetadataSearchForAgents` * `InstanceUpdateParamsMetadataSearchForAgents` * `NamespaceInstanceNewResponseMetadataSearchForAgents` * `NamespaceInstanceUpdateResponseMetadataSearchForAgents` * `NamespaceInstanceListResponseMetadataSearchForAgents` * `NamespaceInstanceDeleteResponseMetadataSearchForAgents` * `NamespaceInstanceReadResponseMetadataSearchForAgents` * `NamespaceInstanceNewParamsMetadataSearchForAgents` * `NamespaceInstanceUpdateParamsMetadataSearchForAgents` #### Email Security - Path Parameter Type Changes Multiple Email Security settings sub-resources have changed their path parameter types from `int64` to `string`: * `AllowPolicies` (`policyID int64` \-> `policyID string`) * `BlockSenders` (`patternID int64` \-> `patternID string`) * `Domains` (`domainID int64` \-> `domainID string`) * `ImpersonationRegistry` (`displayNameID int64` \-> `impersonationRegistryID string`) * `TrustedDomains` (`trustedDomainID int64` \-> `trustedDomainID string`) #### Email Security - Investigate Parameter Rename The `Investigate.Get`, `Investigate.Move.New`, and `Investigate.Reclassify.New` methods now use `investigateID` instead of `postfixID` as the path parameter name. #### Email Security - Domains BulkDelete Method Removed The `SettingDomainService.BulkDelete` method and its associated types have been removed: * `SettingDomainBulkDeleteResponse` * `SettingDomainBulkDeleteParams` #### Email Security - TrustedDomains Return Type Change `SettingTrustedDomainService.New` now returns `*SettingTrustedDomainNewResponse` instead of `*SettingTrustedDomainNewResponseUnion`. #### Email Security - Investigate.Move Return Type Change `InvestigateMoveService.New` now returns `*pagination.SinglePage[InvestigateMoveNewResponse]` instead of `*[]InvestigateMoveNewResponse`. #### Workers - Observability Telemetry Filter Restructuring The observability telemetry filter parameter types have been restructured to support nested filter groups. New discriminated union types replace the previous flat filter arrays: * `ObservabilityTelemetryKeysParams.Filters` now accepts `FiltersObjectFilterUnion` (was `[]interface\{\}`) * `ObservabilityTelemetryQueryParams.Parameters.Filters` now accepts `FiltersObjectFilterUnion` * `ObservabilityTelemetryValuesParams.Filters` now accepts `FiltersObjectFilterUnion` New types include `FiltersObjectFiltersObject` (for group filters with `FilterCombination`) and `FiltersWorkersObservabilityFilterLeaf` (for leaf filters with typed `Operation`, `Type`, and `Value` fields). #### Features #### Organizations - Audit Logs (`client.Organizations.Logs.Audit`) **NEW SERVICE:** Query organization audit logs with cursor-based pagination. * `List()` \- Retrieve audit logs #### Browser Rendering (`client.BrowserRendering`) * `client.BrowserRendering.Devtools.Browser.Targets.Close()` \- Close a specific browser target (tab, page) by ID #### Queues (`client.Queues`) * `client.Queues.GetMetrics()` \- Retrieve queue metrics for a specific queue #### AI Search (`client.AISearch`) * Added `WaitForCompletion` parameter to `NamespaceInstanceItemNewOrUpdateParams` and `NamespaceInstanceItemSyncParams` for synchronous indexing confirmation #### Bug Fixes * **Magic Transit**: `ConnectorService.List` parameter name corrected from `query` to `params` (non-functional, affects generated documentation only) #### Deprecations None in this release. #### Get started * [Download Go SDK v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/releases/tag/v7.0.0) * [Go SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/go/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md) Apr 30, 2026 1. ### [Empty buckets and delete folders from the R2 dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-r2-empty-bucket-folder-delete/) [ R2 ](https://edgetunnel-b2h.pages.dev/r2/) You can now empty an entire [R2](https://edgetunnel-b2h.pages.dev/r2/) bucket or delete folders directly from the dashboard. Emptying a bucket is required before you can delete it. Previously, this required scripting or configuring [lifecycle rules](https://edgetunnel-b2h.pages.dev/r2/buckets/object-lifecycles/). Now, the dashboard can handle it in a single action. #### Empty a bucket Go to your bucket's **Settings** tab and select **Empty** under the **Empty Bucket** section. This deletes all objects in the bucket while preserving the bucket and its configuration. For large buckets, the operation runs in the background and the dashboard displays progress. Emptying a bucket is also a prerequisite for deleting it. The dashboard now guides you through both steps in one place. ![Empty Bucket and Delete Bucket sections in the R2 dashboard Settings tab](https://edgetunnel-b2h.pages.dev/_astro/empty-bucket-changelog.DjuMZppm_11Omax.webp) #### Delete folders R2 uses a flat object structure. The dashboard groups objects that share a common prefix into folders when the **View prefixes as directories** checkbox is selected. Deleting a folder removes every object under that prefix. From the **Objects** tab, you can select one or more folders and delete them alongside individual objects. For step-by-step instructions, refer to [Delete buckets](https://edgetunnel-b2h.pages.dev/r2/buckets/delete-buckets/) and [Delete objects](https://edgetunnel-b2h.pages.dev/r2/objects/delete-objects/). Apr 30, 2026 1. ### [Cloud Observatory connection metrics improvements](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-radar-cloud-observatory-connection-metrics/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) The [Cloud Observatory ↗](https://radar.cloudflare.com/cloud-observatory) on [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) now provides improved connection metric insights, offering new ways to explore TCP round-trip time, TCP handshake duration, TLS handshake duration, and response header receive duration across cloud provider origin servers. The [Cloud Observatory overview ↗](https://radar.cloudflare.com/cloud-observatory#connection-metrics) now shows connection metrics broken down by cloud provider, making it easy to compare connection performance across Amazon Web Services, Google Cloud, Microsoft Azure, and Oracle Cloud. ![Screenshot of Cloud Observatory connection metrics broken down by cloud provider](https://edgetunnel-b2h.pages.dev/_astro/cloud-observatory-connection-metrics-by-provider.Bk9nSitV_ZDoxOq.webp) Each [provider page ↗](https://radar.cloudflare.com/cloud-observatory/amazon#connection-metrics) now shows connection metrics for the top five regions, with a selector to rank by lowest or highest values. ![Screenshot of Cloud Observatory connection metrics broken down by region for a provider](https://edgetunnel-b2h.pages.dev/_astro/cloud-observatory-connection-metrics-by-region.CbHAKXoc_Z1uDr6d.webp) Each [region page ↗](https://radar.cloudflare.com/cloud-observatory/amazon/us-east-1#connection-metrics) now displays connection metrics as percentile distributions (25th percentile, median, and 75th percentile), providing insight into the range and variability of connection times. ![Screenshot of Cloud Observatory connection metrics with percentile distribution for a region](https://edgetunnel-b2h.pages.dev/_astro/cloud-observatory-connection-metrics-percentiles.DJ9eAE0-_28jUar.webp) These views are also available through the [Origins API](https://edgetunnel-b2h.pages.dev/api/resources/radar/subresources/origins/), using the `timeseries_groups` endpoint with the `ORIGIN`, `REGION`, or `PERCENTILE` dimension. Apr 30, 2026 1. ### [Dark mode support on Cloudflare Radar](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-radar-dark-mode/) [ Radar ](https://edgetunnel-b2h.pages.dev/radar/) [**Radar**](https://edgetunnel-b2h.pages.dev/radar/) now supports **dark mode**. A theme selector in the upper right corner of the page lets users explicitly choose between three display options: * **Light** — standard light theme * **Dark** — full dark theme * **System** — follows the operating system preference ![Screenshot of the theme selector showing Light, Dark, and System options](https://edgetunnel-b2h.pages.dev/_astro/dark-mode-theme-selector.D5ih8e4q_2p6pP4.webp) The selected theme applies consistently across all Radar pages and widgets. ![Screenshot of the Cloudflare Radar overview page in dark mode](https://edgetunnel-b2h.pages.dev/_astro/dark-mode-overview.D-39RJlY_Z18x0mf.webp) The theme choice also applies to shared and embedded graphs. Try it out at [Cloudflare Radar ↗](https://radar.cloudflare.com). Apr 30, 2026 1. ### [Cloudflare Python SDK v5.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-python-v500/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v4.3.1...v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/compare/v4.3.1...v5.0.0) This is a major release of the Cloudflare Python SDK. It drops support for Python 3.8, adds 11 new API services, introduces optional aiohttp backend support for improved async concurrency, and includes hundreds of type and method updates across the entire API surface. **Please review the breaking changes below before upgrading.** A migration guide is available at [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md). #### Breaking Changes * **Python 3.8 is no longer supported.** The minimum required version is now Python 3.9. * **`typing-extensions` minimum version bumped** from `>=4.10` to `>=4.14`. The following resources have breaking changes. See the [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md) for detailed migration instructions. * `abusereports` * `acm.totaltls` * `apigateway.configurations` * `cloudforceone.threatevents` * `d1.database` * `intel.indicatorfeeds` * `logpush.edge` * `origintlsclientauth.hostnames` * `queues.consumers` * `radar.bgp` * `rulesets.rules` * `schemavalidation.schemas` * `snippets` * `zerotrust.dlp` * `zerotrust.networks` #### Features #### aiohttp Backend Support The async client now supports an optional `aiohttp` HTTP backend for improved concurrency performance. Install with `pip install cloudflare[aiohttp]` and use `DefaultAioHttpClient()` as the `http_client` parameter. #### Python 3.13 and 3.14 Support Python 3.13 and 3.14 are now tested and supported. #### New Services The following top-level resources are new in this release: | Resource | Client Path | Description | | --------------------- | ---------------------- | ---------------------------------------------------------------- | | AI Search | aisearch | AI-powered search capabilities | | Connectivity | connectivity | Connectivity testing and diagnostics | | Email Sending | email\_sending | Email send and send\_raw endpoints | | Fraud | fraud | Fraud detection and prevention | | Google Tag Gateway | google\_tag\_gateway | Google Tag Gateway management | | Organizations | organizations | Organization audit logs and management | | R2 Data Catalog | r2\_data\_catalog | R2 Data Catalog operations | | Realtime Kit | realtime\_kit | Realtime communication (Calls/TURN) | | Resource Tagging | resource\_tagging | Resource tagging and labeling | | Token Validation | token\_validation | Token validation configuration and rules | | Vulnerability Scanner | vulnerability\_scanner | Vulnerability scanning, credential sets, and target environments | #### New Endpoints on Existing Services * **api\_gateway**: Labels endpoints * **billing**: Billable usage PayGo endpoint * **brand\_protection**: v2 endpoints * **browser\_rendering**: DevTools methods * **cache**: Origin cloud regions resource * **custom\_origin\_trust\_store**: Custom origin trust store * **dns**: `dns_records/usage` endpoints * **email\_security**: Phishguard reports endpoint * **iam**: User groups and user group members resources * **radar**: Botnet Threat Feed and Post-Quantum endpoints * **workers**: Observability Destinations resources * **zero\_trust**: Access Users, DEX rules, Device IP Profile, Device Subnet, WARP Connector connections and failover, WARP Subnet, Gateway PAC files * **zones**: Zone environments endpoints #### Bug Fixes * Fixed `polymorphic_serialization` parameter in `model_dump` overrides * Added `BaseModel` base to response `SchemaFieldStruct`/`SchemaFieldList` stubs in Pipelines * Added missing `model_rebuild`/`update_forward_refs` for `SharedEntryCustomEntry` classes in DLP * Made `RunQueryParametersNeedleValue` a `BaseModel` with `arbitrary_types_allowed` in Workers * Removed duplicate `notification_url` field in webhook response types for Stream * Resolved pre-existing codegen type errors * Fixed `type: ignore[call-arg]` placement for mypy compatibility in Radar #### Deprecations Resources with `@deprecated` annotations on some methods include: `accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `kv`, `logpush`, `origin-tls-client-auth`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones` #### Get started * [Download Python SDK v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/releases/tag/v5.0.0) * [Python SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/python/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md) Apr 30, 2026 1. ### [Cloudflare TypeScript SDK v6.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-typescript-v600/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v6.0.0-beta.2...v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/compare/v6.0.0-beta.2...v6.0.0) This is a major version release of the Cloudflare TypeScript SDK. It includes 11 entirely new top-level API resources, new sub-resources and methods across 50+ existing resources, SDK infrastructure improvements, and breaking changes to the generated API surface from the v5.x line. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes #### SDK Infrastructure * **Retry-After handling changed**: The SDK now respects any server-specified `Retry-After` value for rate-limited requests. Previously, values over 60 seconds were ignored and a default backoff was used instead. * **Empty response handling**: Responses with `content-length: 0` now return `undefined` instead of attempting to parse the body. * **Environment variable reading**: Empty string env vars (for example, `CLOUDFLARE_API_TOKEN=""`) are now treated as unset. * **Path query parameter merging**: URL search params embedded in endpoint paths are now extracted and merged into the query object. #### Removed Endpoints (17) 17 HTTP endpoints were removed from the SDK, affecting `abuse-reports`, `cloudforce-one`, `dlp/profiles/predefined`, `email-security/investigate`, `email-security/settings`, and `intel/ip-list`. #### Method Signature Changes * `client.ai.toMarkdown.transform(file, \{ ...params \})` \-> `client.ai.toMarkdown.transform(\{ ...params \})` \-- `file` moved from positional arg into params body * `client.radar.ai.toMarkdown.create(body, \{ ...params \})` \-> `client.radar.ai.toMarkdown.create(\{ ...params \})` \-- `body` moved from positional arg into params * `client.abuseReports.create(reportType, \{ ...params \})` \-> `client.abuseReports.create(reportParam, \{ ...params \})` \-- positional arg renamed * `client.iam.userGroups.members.create(userGroupId, [ ...body ])` \-> `client.iam.userGroups.members.create(userGroupId, [ ...members ])` \-- body array param renamed #### Renamed Client Paths * `client.originTLSClientAuth.hostnames.certificates` \-> `client.originTLSClientAuth.zoneCertificates` * `client.radar.netflows` \-> `client.radar.netFlows` (casing change) #### Return Type Changes (179) * **133 methods now return `null`** instead of a typed response object. This primarily affects delete operations across `accounts`, `cache`, `d1`, `filters`, `firewall`, `hyperdrive`, `iam`, `kv`, `logpush`, `logs`, `r2`, `stream`, `workers`, `zero-trust`, `zones`, and others. * **17 methods changed pagination type** (for example, `KeysCursorPaginationAfter` \-> `KeysCursorLimitPagination`). * **29 methods changed to a different named type** (for example, `CloudflaredCreateResponse` \-> `CloudflareTunnel`). #### Removed Types (43) 24 shared types removed from root namespace (`ASN`, `AuditLog`, `Member`, `Permission`, `Role`, `Subscription`, `Token`, etc.). 19 response types consolidated or renamed. #### Resource Restructuring 19 resources were restructured from single files to directories. Public API client paths are unchanged, but deep imports may break. #### New Top-Level Resources 11 entirely new resources added to the client: | Resource | Client Path | Methods | Description | | --------------------- | --------------------------- | ------- | ---------------------------------------- | | AI Search | client.aiSearch | 46 | Instances, namespaces, tokens, and items | | Connectivity | client.connectivity | 5 | Directory service APIs | | Email Sending | client.emailSending | 7 | Send and send\_raw endpoints | | Fraud | client.fraud | 2 | Fraud detection API | | Google Tag Gateway | client.googleTagGateway | 2 | Google Tag Gateway management | | Organizations | client.organizations | 8 | Organization profiles and audit logs | | R2 Data Catalog | client.r2DataCatalog | 11 | R2 Data Catalog routes | | Realtime Kit | client.realtimeKit | 54 | Realtime Kit APIs | | Resource Tagging | client.resourceTagging | 9 | Resource tagging routes | | Token Validation | client.tokenValidation | 13 | Token validation rules | | Vulnerability Scanner | client.vulnerabilityScanner | 21 | Vulnerability scanning | #### New Sub-Resources on Existing Resources * **browser-rendering**: `crawl`, `devtools` \- Crawl endpoints and DevTools methods * **cache**: `origin-cloud-regions` \- Origin cloud regions resource * **dns**: `usage` \- DNS records usage endpoints * **d1**: `time-travel` \- Time travel get\_bookmark and restore * **email-security**: `phishguard` \- Phishguard reports endpoint * **pipelines**: `sinks`, `streams` \- Pipelines restructure * **radar**: `agent-readiness`, `geolocations`, `post-quantum` \- New analytics endpoints * **workers**: `observability` \- Observability destinations * **zones**: `environments` \- Zone environments endpoints * **api-gateway**: `labels` \- Labels endpoints * **brand-protection**: `v2` \- V2 endpoints * **alerting**: `silences` \- Alert silencing API * **billing**: `usage` \- Billable usage PayGo endpoint * **iam**: `sso` \- SSO Connectors resource * **queues**: `getMetrics` method - Queues metrics endpoint * **registrar**: `registration-status`, `update-status` \- Registrar API convergence * **zero-trust**: DLP settings, DEX rules, Access Users, WARP Connector, WARP Subnets, Gateway PAC files, Gateway tenants #### Bug Fixes * Resolved type errors from codegen overwriting manual fixes * Fixed `post()` usage for to-markdown endpoints to resolve async type error * Added least-privilege permissions to all workflow jobs * Reverted erroneous removal of rulesets resource methods and types * Resolved prettier formatting errors in codegen output #### Deprecations The following resources now include `@deprecated` annotations on some methods: `accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `custom-nameservers`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `keyless-certificates`, `kv`, `logpush`, `origin-tls-client-auth`, `page-shield`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones` #### Get started * [Download TypeScript SDK v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/releases/tag/v6.0.0) * [TypeScript SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/typescript/) * [Full Changelog ↗](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md) Apr 30, 2026 1. ### [Shared dictionaries passthrough now in open beta](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-shared-dictionaries-passthrough-beta/) [ Speed ](https://edgetunnel-b2h.pages.dev/speed/) [Shared dictionaries](https://edgetunnel-b2h.pages.dev/speed/optimization/content/shared-dictionaries/) ([RFC 9842 ↗](https://www.rfc-editor.org/rfc/rfc9842.html)) let an origin compress a response against a previous version of the same resource that the browser already has cached, so only the difference between versions travels over the wire. Shared dictionaries passthrough is now in open beta on all plans. #### What changed In passthrough mode, Cloudflare: * Forwards the `Use-As-Dictionary` and `Available-Dictionary` headers between client and origin without modification. * Treats `dcb` (Dictionary-Compressed Brotli) and `dcz` (Dictionary-Compressed Zstandard) as valid `Content-Encoding` values end to end, without recompressing them. * Extends the cache key to vary on `Available-Dictionary` and `Accept-Encoding` so each delta-compressed variant is cached correctly. Your origin manages the dictionary lifecycle: deciding which assets are dictionaries, attaching `Use-As-Dictionary` headers, and producing deltas in response to `Available-Dictionary` requests. Cloudflare handles the transport and the cache. In internal testing on a 272 KB JavaScript bundle, the asset shrinks from 92.1 KB with Gzip to 2.6 KB with delta Zstandard against the previous version — a 97% reduction over standard compression — with download times improving by 81–89% versus Gzip. Shared dictionaries work with browsers that advertise `dcb` or `dcz` in `Accept-Encoding`. Today, this includes Chrome 130 or later and Edge 130 or later. #### Get started Turn on passthrough for your zone with a single API call: ```bash curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/shared_dictionary_mode" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "value": "passthrough" }' ``` You can also turn it on under **Speed** \> **Settings** \> **Content Optimization** in the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/:zone/speed/optimization). For full origin setup instructions and a working test recipe, refer to [Shared dictionaries](https://edgetunnel-b2h.pages.dev/speed/optimization/content/shared-dictionaries/), or try the live demo at [canicompress.com ↗](https://canicompress.com/). Apr 30, 2026 1. ### [WAF Release - 2026-04-30 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-emergency-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940. **Key Findings** * CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks. **Impact** Successful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments. We strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ----------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. | Apr 30, 2026 1. ### [Web Analytics adds Navigation Type filtering and reporting](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-rum-navigation-types/) [ Cloudflare Web Analytics ](https://edgetunnel-b2h.pages.dev/web-analytics/) Cloudflare Web Analytics now supports **Navigation Type** reporting and filtering. This update allows developers and performance analysts to see how users are navigating between pages — whether through a link click or form submission, a page reload, or using the browser's back/forward buttons — and whether a browser cache hit occurred for these behaviors. Understanding navigation types is critical for optimizing user experience. For example, if a high volume of your traffic consists of "Back-forward" navigations versus "Back-forward Cache", those visitors are not benefiting from the Back/Forward Cache (bfcache) and therefore are experiencing higher load times due to potentially unnecessary network requests. The same applies for regular "Navigate" entries — where "Navigate Cache", "Navigate Prefetch Cache" and "Prerender" would provide instant document retrieval — and "Reload", where "Reload cache" would be more optimal. A high volume of "Reload" entries can also indicate a potential stability problem with your website. By identifying these patterns, you can tune your browser caching strategies to ensure HTML documents are served instantaneously from local caches rather than requiring a roundtrip to the network. For more information, refer to [Navigation Types](https://edgetunnel-b2h.pages.dev/web-analytics/data-metrics/dimensions/#navigation-types). #### Key benefits * **Monitor Cache Effectiveness:** See how often your site is served from the HTTP cache or bfcache. * **Identify Performance Bottlenecks:** Filter by the different types to understand performance opportunity of improving browser cache hit ratio. #### Analyze navigation types in the Cloudflare dashboard You can now find the **Navigation Type** dimension in the Web Analytics dashboard. You can filter to include/exclude one or more specific types using "equals", "does not equal", "in", or "not in" matchers. ![Navigation Type filter](https://edgetunnel-b2h.pages.dev/_astro/dash-web_analytics-navigation-type-filter.Cculflhp_Xm5Gz.webp) To check the list of popular navigation types, select **Page views** on the Web Analytics sidebar and scroll down to the bottom: ![Navigation Types list in Page Views tab](https://edgetunnel-b2h.pages.dev/_astro/dash-web_analytics-navigation-types-list.CWaiEQzO_Z1jlU23.webp) Apr 29, 2026 1. ### [Digital experience tests to authenticated resources and enhanced configuration](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-dex-tests-to-auth/) [ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) [Digital experience tests](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/tests/) now support testing applications protected by Cloudflare Access or third-party authentication. All authentication secrets are managed via [Cloudflare Secret Store](https://edgetunnel-b2h.pages.dev/secrets-store/). Digital experience tests also have enhanced configuration options including: * New HTTP methods (DELETE, PATCH, POST, PUT) * Secret Store headers, custom plain text headers, and custom request bodies * Advanced settings: follow redirects, response bodies, response headers, and allow untrusted certificates ![Digital experience test configuration for Cloudflare Access applications](https://edgetunnel-b2h.pages.dev/_astro/dex_test_auth_config.CD3G3zb__o7m7g.webp)![Digital experience enhanced test configuration](https://edgetunnel-b2h.pages.dev/_astro/dex_test_enhanced_config.Nsv7Vcob_ppxh5.webp) Apr 29, 2026 1. ### [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-instant-bank-payments-via-link/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/) You can now pay for Cloudflare services directly from your bank account using [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/). #### What changed [Link ↗](https://link.co/) now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow. ![Instant Bank Payments via Link at checkout](https://edgetunnel-b2h.pages.dev/_astro/2026-04-29-instant-bank-payments-link.ChGd-t7M_ZVtvgM.webp) #### How to use it 1. During checkout, select your bank account from your saved Link payment methods. 2. Confirm the payment. After your first Link authentication, your bank account is available for future purchases without re-entering details. #### Who is eligible Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout. Bank-based Link payments appear in your billing history with the payment method shown as `link` and last four digits as `0000`. For details, refer to the [Instant Bank Payments via Link documentation](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/). Apr 29, 2026 1. ### [Gateway Authorization Proxy and hosted PAC files are now generally available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-gateway-authorization-proxy-pac-files-ga/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) The [Gateway Authorization Proxy](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint) and [hosted PAC files](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#create-a-hosted-pac-file) are now generally available for all plan types. Authorization proxy endpoints add an identity-aware option alongside the existing [source IP proxy endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#source-ip-endpoint), using [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) authentication to verify who a user is before applying Gateway filtering — without installing the [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). Cloudflare-hosted PAC files let you create and distribute PAC files directly from Cloudflare One on Cloudflare's global network. These features are ideal for environments where deploying a device client is not an option, such as virtual desktops (VDI) or compliance-restricted endpoints. To get started, refer to the [proxy endpoints documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/). Apr 29, 2026 1. ### [Hyperdrive support for private databases with Workers VPC](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-hyperdrive-vpc-private-databases/) [ Hyperdrive ](https://edgetunnel-b2h.pages.dev/hyperdrive/) You can now connect Hyperdrive to a private database through a [Workers VPC service](https://edgetunnel-b2h.pages.dev/workers-vpc/). This is the recommended way to connect Hyperdrive to a private database that is not exposed to the public Internet. When creating a Hyperdrive configuration in the Cloudflare dashboard, choose **Connect to private database** and then **Workers VPC**. From there, you can select an existing VPC service or create a new one inline by picking a Cloudflare Tunnel and entering your origin host and TCP port. You can also create a Hyperdrive configuration backed by a Workers VPC service from the command line: ```sh npx wrangler hyperdrive create my-vpc-database \ --service-id \ --database \ --user \ --password \ --scheme postgresql ``` Workers VPC services are reusable across Hyperdrive configurations and can also be bound directly to Workers, so you can share the same private connection across multiple products. To get started, refer to [Connect Hyperdrive to a private database using Workers VPC](https://edgetunnel-b2h.pages.dev/hyperdrive/configuration/connect-to-private-database-vpc/). Apr 28, 2026 1. ### [Internet outage notifications for devices](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-dex-internet-outage-notification/) [ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) [Digital Experience](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) will display a dashboard notification when an Internet outage or traffic anomaly may impact a [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) device based on its geographic location or network connection. This Internet outage and traffic anomaly data is pulled from [Cloudflare Radar ↗](https://radar.cloudflare.com/). All Internet outage and traffic anomaly observations can be viewed in the [Radar Outage Center ↗](https://radar.cloudflare.com/outage-center). ![Digital Experience Monitoring dashboard notification for Internet outage impacting Cloudflare One Client devices](https://edgetunnel-b2h.pages.dev/_astro/dex_radar_ux_notification.CpdrUVYA_ZSzgIe.webp)![Digital Experience Monitoring dashboard analytics for Internet outage impacting Cloudflare One Client devices](https://edgetunnel-b2h.pages.dev/_astro/dex_radar_analytics.GaPxWM6C_2jLyzS.webp) Apr 28, 2026 1. ### [Cloudflare One Client speed tests](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-dex-speed-test/) [ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) IT teams can now remotely run speed tests from the [Cloudflare One Client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) to Cloudflare's network edge. Each speed test includes the following metrics: * Internet speed: download and upload throughput * Latency: download, upload, unloaded latency, and jitter * Network quality score: video streaming, webchat/real-time communication (RTC) In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Insights** \> **Digital experience** \> **Diagnostics** and select **Run diagnostics** to use the feature today. ![Cloudflare One client speed test result](https://edgetunnel-b2h.pages.dev/_astro/dex_speed_test.DukupcRs_gXUVw.webp) Apr 28, 2026 1. ### [Create and manage DLP detection entries outside of profiles](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-detection-entries-outside-profiles/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) You can now create, view, and manage DLP detection entries outside of profiles. Detection entries are no longer hidden inside individual profiles. Administrators can manage detection entries directly from the **Detection entries** section and use them in custom DLP profiles. For more information, refer to [Configure detection entries](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/). Apr 28, 2026 1. ### [Detect PII records with a new predefined DLP profile](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-pii-record-profile/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) Cloudflare DLP now includes a new predefined profile designed to detect PII records that contain multiple types of personal data: **Personally Identifiable Information (PII) Record**. Most predefined and custom DLP profiles match when any enabled detection entry matches. The **Personally Identifiable Information (PII) Record** profile is different. It only matches when at least three unique detection entries are found in close proximity, which reduces false positives from standalone values that may not represent a real PII record. Detection entries included in the profile: * AU Passport Number * American Express Card Number * Diners Club Card Number * US Driver's License Number * Email Address * Full Name * US Mailing Address * Mastercard Card Number * US Individual Tax Identification Number (ITIN) * US Passport Number * US Phone Number * Union Pay Card Number * United States SSN Numeric Detection * Visa Card Number For more information, refer to [predefined DLP profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/9/#page","headline":"Changelogs | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/9/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```