---
title: Cloudflare One Changelog
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

Cloudflare One

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jan 13, 2026
1. ### [WARP client for Windows (version 2025.10.186.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-13-warp-windows-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features. New features include the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect), and a new WARP client device posture check for [Antivirus](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/).

**Changes and improvements**

  * Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint.
  * Fixed an issue that caused occasional audio degradation and increased CPU usage on Windows by optimizing route configurations for large [domain-based split tunnel rules](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels).
  * The [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly.
  * [Proxy mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying.
  * Fixed an issue where sending large messages to the daemon by Inter-Process Communication (IPC) could cause the daemon to fail and result in service interruptions.
  * Added support for a new WARP client device posture check for [Antivirus](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/). The check confirms the presence of an antivirus program on a Windows device with the option to check if the antivirus is up to date.

**Known issues**

  * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution.
  * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later.
  * DNS resolution may be broken when the following conditions are all true:

    * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
    * A custom DNS server address is configured on the primary network adapter.
    * The custom DNS server address on the primary network adapter is changed while WARP is connected.  
  To work around this issue, reconnect the WARP client by toggling off and back on.

Jan 13, 2026
1. ### [WARP client for macOS (version 2025.10.186.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-13-warp-macos-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect).

**Changes and improvements**

  * The [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly.
  * [Proxy mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying.
  * Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint.

Jan 13, 2026
1. ### [WARP client for Linux (version 2025.10.186.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-13-warp-linux-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect).  
WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025\. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com).

**Changes and improvements**

  * The [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly.
  * Linux [disk encryption posture check](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption/) now supports non-filesystem encryption types like `dm-crypt`.
  * [Proxy mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying.
  * Fixed an issue where the GUI becomes unresponsive when the **Re-Authenticate in browser** button is clicked.
  * Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint.

Jan 12, 2026
1. ### [Enhanced visibility for post-delivery actions](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-12-enhanced-visibility-post-delivery-actions/)  
[ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/)  
The Action Log now provides enriched data for post-delivery actions to improve troubleshooting. In addition to success confirmations, failed actions now display the targeted Destination folder and a specific failure reason within the Activity field.  
Note  
Error messages will vary depending on whether you are using Google Workspace or Microsoft 365.  
![failure-log-example](https://edgetunnel-b2h.pages.dev/_astro/enhanced-visibility-post-delivery-actions.BNiyPtJU_GFx2V.webp)  
This update allows you to see the full lifecycle of a failed action. For instance, if an administrator tries to move an email that has already been deleted or moved manually, the log will now show the multiple retry attempts and the specific destination error.  
This applies to all Email Security packages:

  * **Enterprise**
  * **Enterprise + PhishGuard**

Jan 08, 2026
1. ### [Cloudflare admin activity logs capture creation of DNS over HTTP (DoH) users](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-08-access-audit-log-for-doh-users/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
Cloudflare [admin activity logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/) now capture each time a [DNS over HTTP (DoH) user](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/dns/dns-over-https/) is created.  
These logs can be viewed from the [Cloudflare One dashboard ↗](https://one.dash.cloudflare.com/), pulled via the [Cloudflare API](https://edgetunnel-b2h.pages.dev/api/), and exported through [Logpush](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/).

Dec 31, 2025
1. ### [Breakout traffic visibility via NetFlow](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-31-connector-breakout-traffic-netflow/)  
[ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
Magic WAN Connector now exports NetFlow data for breakout traffic to Magic Network Monitoring (MNM), providing visibility into traffic that bypasses Cloudflare's security filtering.  
This feature allows you to:

  * Monitor breakout traffic statistics in the Cloudflare dashboard.
  * View traffic patterns for applications configured to bypass Cloudflare.
  * Maintain visibility across all traffic passing through your Magic WAN Connector.  
For more information, refer to [NetFlow statistics](https://edgetunnel-b2h.pages.dev/cloudflare-wan/analytics/netflow-analytics/).

Dec 17, 2025
1. ### [Shadow IT - domain level SaaS analytics](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-17-shadow-it-domain-analytics/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
Zero Trust has again upgraded its **Shadow IT analytics**, providing you with unprecedented visibility into your organizations use of SaaS tools. With this dashboard, you can review who is using an application and volumes of data transfer to the application.  
With this update, you can review data transfer metrics at the domain level, rather than just the application level, providing more granular insight into your data transfer patterns.  
![New Domain Level Metrics](https://edgetunnel-b2h.pages.dev/_astro/shadow-it-domain.DoZnGAtf_Z1mHw4r.webp)  
These metrics can be filtered by all available filters on the dashboard, including user, application, or content category.  
Both the analytics and policies are accessible in the Cloudflare [Zero Trust dashboard ↗](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control.

Dec 16, 2025
1. ### [New duplicate action for supported Cloudflare One resources](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-16-new-duplicate-action-for-supported-cloudflare-one-resources/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
You can now duplicate specific Cloudflare One resources with a single click from the dashboard.  
Initially supported resources:

  * Access Applications
  * Access Policies
  * Gateway Policies  
To try this out, simply click on the overflow menu (⋮) from the resource table and click _Duplicate_. We will continue to add the Duplicate action for resources throughout 2026.

Dec 09, 2025
1. ### [WARP client for Windows (version 2025.10.118.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-09-warp-windows-beta/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).  
This release contains minor fixes and improvements.

**Changes and improvements**

  * The [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly.
  * [Proxy mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying.
  * Fixed an issue where sending large messages to the WARP daemon by Inter-Process Communication (IPC) could cause WARP to crash and result in service interruptions.

**Known issues**

  * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution.
  * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later.
  * DNS resolution may be broken when the following conditions are all true:

    * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
    * A custom DNS server address is configured on the primary network adapter.
    * The custom DNS server address on the primary network adapter is changed while WARP is connected.  
  To work around this issue, reconnect the WARP client by toggling off and back on.

Dec 09, 2025
1. ### [WARP client for macOS (version 2025.10.118.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-09-warp-macos-beta/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).  
This release contains minor fixes and improvements.

**Changes and improvements**

  * The [Local Domain Fallback](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly.
  * [Proxy mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying.

Dec 03, 2025
1. ### [Reclassifications to Submissions](https://edgetunnel-b2h.pages.dev/changelog/post/2025-12-03-submission-terminology-update/)  
[ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/)  
We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare.  
Submissions are leveraged to tune future variants of campaigns. To respect data sanctity, providing a submission does not change the original disposition of the emails submitted.  
![nav_example](https://edgetunnel-b2h.pages.dev/_astro/reclassification-submission.B6nL5Hw7_Z2qliyJ.webp)  
This applies to all Email Security packages:

  * **Advantage**
  * **Enterprise**
  * **Enterprise + PhishGuard**

Nov 18, 2025
1. ### [Adjustment to Final Disposition Column](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-18-temporary-adjustment-to-final-disposition-column/)  
[ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/)  
#### Adjustment to Final Disposition column  
#### The **Final Disposition** column in **Submissions** \> **Team Submissions** tab is changing for non-Phishguard customers.  
#### What's Changing

  * Column will be called **Status** instead of **Final Disposition**
  * Column status values will now be: **Submitted**, **Accepted** or **Rejected**.  
#### Next Steps  
We will listen carefully to your feedback and continue to find comprehensive ways to communicate updates on your submissions. Your submissions will continue to be addressed at an even greater rate than before, fuelling faster and more accurate email security improvement.

Nov 17, 2025
1. ### [New Cloudflare One Navigation and Product Experience](https://edgetunnel-b2h.pages.dev/changelog/post/new-cloudflare-one-navigation-and-product-experience/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
The Zero Trust dashboard and navigation is receiving significant and exciting updates. The dashboard is being restructured to better support common tasks and workflows, and various pages have been moved and consolidated.  
There is a new guided experience on login detailing the changes, and you can use the Zero Trust dashboard search to find product pages by both their new and old names, as well as your created resources. To replay the guided experience, you can find it in Overview > Get Started.  
![Cloudflare One Dash Changes](https://edgetunnel-b2h.pages.dev/_astro/cf1-dash-changes.Uk_Y-2V-_ZUKoJR.webp)  
Notable changes

  * Product names have been removed from many top-level navigation items to help bring clarity to what they help you accomplish. For example, you can find Gateway policies under ‘Traffic policies' and CASB findings under ‘Cloud & SaaS findings.'
  * You can view all analytics, logs, and real-time monitoring tools from ‘Insights.'
  * ‘Networks' better maps the ways that your corporate network interacts with Cloudflare. Some pages like Tunnels, are now a tab rather than a full page as part of these changes. You can find them at Networks > Connectors.
  * Settings are now located closer to the tools and resources they impact. For example, this means you'll find your WARP configurations at Team & Resources > Devices.  
![New Cloudflare One Navigation](https://edgetunnel-b2h.pages.dev/_astro/new-cf1-navigation.B7-E-9CV_18BSsx.webp)  
No changes to our API endpoint structure or to any backend services have been made as part of this effort.

Nov 14, 2025
1. ### [Generate Cloudflare Access SSH certificate authority (CA) directly from the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-14-ssh-ca-enhancements/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
SSH with [Cloudflare Access for Infrastructure](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) allows you to use short-lived SSH certificates to eliminate SSH key management and reduce security risks associated with lost or stolen keys.  
Previously, users had to generate this certificate by using the [Cloudflare API ↗](https://edgetunnel-b2h.pages.dev/api/) directly. With this update, you can now create and manage this certificate in the [Cloudflare One dashboard ↗](https://one.dash.cloudflare.com) from the **Access controls** \> **Service credentials** page.  
![Navigate to Access controls and then Service credentials to see where you can generate an SSH CA](https://edgetunnel-b2h.pages.dev/_astro/SSH-CA-generation.DYa9RnX1_ZKuDAo.webp)  
For more details, refer to [Generate a Cloudflare SSH CA](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#generate-a-cloudflare-ssh-ca).

Nov 14, 2025
1. ### [New SaaS Security weekly digests with API CASB](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-14-casb-digest/)  
[ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/)  
You can now stay on top of your SaaS security posture with the new **CASB Weekly Digest** notification. This opt-in email digest is delivered to your inbox every Monday morning and provides a high-level summary of your organization's Cloudflare API CASB findings from the previous week.  
This allows security teams and IT administrators to get proactive, at-a-glance visibility into new risks and integration health without having to log in to the dashboard.  
To opt in, navigate to **Manage Account** \> **Notifications** in the Cloudflare dashboard to configure the **CASB Weekly Digest** alert type.  
#### Key capabilities

  * **At-a-glance summary** — Review new high/critical findings, most frequent finding types, and new content exposures from the past 7 days.
  * **Integration health** — Instantly see the status of all your connected SaaS integrations (Healthy, Unhealthy, or Paused) to spot API connection issues.
  * **Proactive alerting** — The digest is sent automatically to all subscribed users every Monday morning.
  * **Easy to configure** — Users can opt in by enabling the notification in the Cloudflare dashboard under **Manage Account** \> **Notifications**.  
#### Learn more

  * Configure [notification preferences](https://edgetunnel-b2h.pages.dev/notifications/) in Cloudflare.  
The CASB Weekly Digest notification is available to all Cloudflare users today.

Nov 12, 2025
1. ### [DEX Logpush jobs](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-12-dex-logpush-jobs/)  
[ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/)  
[Digital Experience Monitoring (DEX)](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) provides visibility into WARP device metrics, connectivity, and network performance across your Cloudflare SASE deployment.  
We've released four new WARP and DEX device data sets that can be exported via [Cloudflare Logpush](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/). These Logpush data sets can be exported to R2, a cloud bucket, or a SIEM to build a customized logging and analytics experience.

  1. [DEX Application Tests](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/dex%5Fapplication%5Ftests/)
  2. [DEX Device State Events](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/dex%5Fdevice%5Fstate%5Fevents/)
  3. [WARP Config Changes](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/warp%5Fconfig%5Fchanges/)
  4. [WARP Toggle Changes](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/warp%5Ftoggle%5Fchanges/)  
To create a new DEX or WARP Logpush job, customers can go to the account level of the Cloudflare dashboard > Analytics & Logs > Logpush to get started.  
![DEX logpush job creation dashboard](https://edgetunnel-b2h.pages.dev/_astro/dex_logpush_datasets.CtCk36pX_Z1tuyHu.webp)

Nov 11, 2025
1. ### [WARP client for Windows (version 2025.9.558.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-11-warp-windows-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues.

**Changes and improvements**

  * Fixed an inconsistency with [Global WARP override](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#disconnect-warp-on-all-devices) settings in multi-user environments when switching between users.
  * The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues.
  * Fixed an issue where deleting a registration was erroneously reported as having failed.
  * Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery).
  * Improvements for the [OS version](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) WARP client check. Windows Updated Build Revision (UBR) numbers can now be checked by the client to ensure devices have required security patches and features installed.
  * The WARP client now supports Windows 11 ARM-based machines. For information on known limitations, refer to the [Known limitations page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#cloudflare-one-client-disconnected-on-windows-arm).

**Known issues**

  * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution.
  * Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://edgetunnel-b2h.pages.dev/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server).
  * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later.
  * DNS resolution may be broken when the following conditions are all true:

    * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
    * A custom DNS server address is configured on the primary network adapter.
    * The custom DNS server address on the primary network adapter is changed while WARP is connected.  
  To work around this issue, reconnect the WARP client by toggling off and back on.

Nov 11, 2025
1. ### [WARP client for macOS (version 2025.9.558.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-11-warp-macos-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues.

**Changes and improvements**

  * The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues.
  * Fixed an issue where deleting a registration was erroneously reported as having failed.
  * Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery).

**Known issues**

  * Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://edgetunnel-b2h.pages.dev/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server).

Nov 11, 2025
1. ### [WARP client for Linux (version 2025.9.558.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-11-warp-linux-ga/)  
[ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)  
A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).  
This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues.  
WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025\. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com/).

**Changes and improvements**

  * The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues.
  * Fixed an issue where deleting a registration was erroneously reported as having failed.
  * Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery).

Nov 11, 2025
1. ### [cloudflared proxy-dns command will be removed starting February 2, 2026](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-11-cloudflared-proxy-dns/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting February 2, 2026, the `cloudflared proxy-dns` command will be removed from all new `cloudflared` [releases](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/).  
This change is being made to enhance security and address a potential vulnerability in an underlying DNS library. This vulnerability is specific to the `proxy-dns` command and does not affect any other `cloudflared` features, such as the core [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) service.  
The `proxy-dns` command, which runs a client-side [DNS-over-HTTPS (DoH)](https://edgetunnel-b2h.pages.dev/1.1.1.1/encryption/dns-over-https/) proxy, has been an officially undocumented feature for several years. This functionality is fully and securely supported by our actively developed products.  
Versions of `cloudflared` released before this date will not be affected and will continue to operate. However, note that our [official support policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#deprecated-releases) for any `cloudflared` release is one year from its release date.  
#### Migration paths  
We strongly advise users of this undocumented feature to migrate to one of the following officially supported solutions before February 2, 2026, to continue benefiting from secure [DNS-over-HTTPS](https://edgetunnel-b2h.pages.dev/1.1.1.1/encryption/dns-over-https/).  
#### End-user devices  
The preferred method for enabling DNS-over-HTTPS on user devices is the [Cloudflare WARP client](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). The WARP client automatically secures and proxies all DNS traffic from your device, integrating it with your organization's [Zero Trust policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and [posture checks](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/).  
#### Servers, routers, and IoT devices  
For scenarios where installing a client on every device is not possible (such as servers, routers, or IoT devices), we recommend using the [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/).  
Instead of running `cloudflared proxy-dns` on a machine, you can install the WARP Connector on a single Linux host within your private network. This connector will act as a gateway, securely routing all DNS and network traffic from your [entire subnet](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/routes/) to Cloudflare for [filtering and logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/).

Nov 06, 2025
1. ### [Automatic Return Routing (Beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-06-automatic-return-routing-beta/)  
[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
Magic WAN now supports Automatic Return Routing (ARR), allowing customers to configure Magic on-ramps (IPsec/GRE/CNI) to learn the return path for traffic flows without requiring static routes.  
Key benefits:

  * **Route-less mode**: Static or dynamic routes are optional when using ARR.
  * **Overlapping IP space support**: Traffic originating from customer sites can use overlapping private IP ranges.
  * **Symmetric routing**: Return traffic is guaranteed to use the same connection as the original on-ramp.  
This feature is currently in beta and requires the new Unified Routing mode (beta).  
For configuration details, refer to [Configure Automatic Return Routing](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-routes/#configure-automatic-return-routing-beta).

Nov 06, 2025
1. ### [Designate WAN link for breakout traffic](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-06-connector-designate-wan-link-breakout/)  
[ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)  
Magic WAN Connector now allows you to designate a specific WAN port for breakout traffic, giving you deterministic control over the egress path for latency-sensitive applications.  
With this feature, you can:

  * Pin breakout traffic for specific applications to a preferred WAN port.
  * Ensure critical traffic (such as Zoom or Teams) always uses your fastest or most reliable connection.
  * Benefit from automatic failover to standard WAN port priority if the preferred port goes down.  
This is useful for organizations with multiple ISP uplinks who need predictable egress behavior for performance-sensitive traffic.  
For configuration details, refer to [Designate WAN ports for breakout apps](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#designate-wan-ports-for-breakout-apps).

Nov 06, 2025
1. ### [Applications to be remapped to the new categories](https://edgetunnel-b2h.pages.dev/changelog/post/2025-11-06-applications-recategorised-plan/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
We have previously added new application categories to better reflect their content and improve HTTP traffic management: refer to [Changelog](https://edgetunnel-b2h.pages.dev/cloudflare-one/changelog/gateway/#2025-10-28). While the new categories are live now, we want to ensure you have ample time to review and adjust any existing rules you have configured against old categories. The remapping of existing applications into these new categories will be completed by January 30, 2026\. This timeline allows you a dedicated period to:

  * Review the new category structure.
  * Identify any policies you have that target the older categories.
  * Adjust your rules to reference the new, more precise categories before the old mappings change. Once the applications have been fully remapped by January 30, 2026, you might observe some changes in the traffic being mitigated or allowed by your existing policies. We encourage you to use the intervening time to prepare for a smooth transition.

**Applications being remappedd**

| Application Name                | Existing Category | New Category                 |
| ------------------------------- | ----------------- | ---------------------------- |
| Google Photos                   | File Sharing      | Photography & Graphic Design |
| Flickr                          | File Sharing      | Photography & Graphic Design |
| ADP                             | Human Resources   | Business                     |
| Greenhouse                      | Human Resources   | Business                     |
| myCigna                         | Human Resources   | Health & Fitness             |
| UnitedHealthcare                | Human Resources   | Health & Fitness             |
| ZipRecruiter                    | Human Resources   | Business                     |
| Amazon Business                 | Human Resources   | Business                     |
| Jobcenter                       | Human Resources   | Business                     |
| Jobsuche                        | Human Resources   | Business                     |
| Zenjob                          | Human Resources   | Business                     |
| DocuSign                        | Legal             | Business                     |
| Postident                       | Legal             | Business                     |
| Adobe Creative Cloud            | Productivity      | Photography & Graphic Design |
| Airtable                        | Productivity      | Development                  |
| Autodesk Fusion360              | Productivity      | IT Management                |
| Coursera                        | Productivity      | Education                    |
| Microsoft Power BI              | Productivity      | Business                     |
| Tableau                         | Productivity      | Business                     |
| Duolingo                        | Productivity      | Education                    |
| Adobe Reader                    | Productivity      | Business                     |
| AnpiReport                      | Productivity      | Travel                       |
| ビズリーチ                           | Productivity      | Business                     |
| doda (デューダ)                     | Productivity      | Business                     |
| 求人ボックス                          | Productivity      | Business                     |
| マイナビ2026                        | Productivity      | Business                     |
| Power Apps                      | Productivity      | Business                     |
| RECRUIT AGENT                   | Productivity      | Business                     |
| シフトボード                          | Productivity      | Business                     |
| スタンバイ                           | Productivity      | Business                     |
| Doctolib                        | Productivity      | Health & Fitness             |
| Miro                            | Productivity      | Photography & Graphic Design |
| MyFitnessPal                    | Productivity      | Health & Fitness             |
| Sentry Mobile                   | Productivity      | Travel                       |
| Slido                           | Productivity      | Photography & Graphic Design |
| Arista Networks                 | Productivity      | IT Management                |
| Atlassian                       | Productivity      | Business                     |
| CoderPad                        | Productivity      | Business                     |
| eAgreements                     | Productivity      | Business                     |
| Vmware                          | Productivity      | IT Management                |
| Vmware Vcenter                  | Productivity      | IT Management                |
| AWS Skill Builder               | Productivity      | Education                    |
| Microsoft Office 365 (GCC)      | Productivity      | Business                     |
| Microsoft Exchange Online (GCC) | Productivity      | Business                     |
| Canva                           | Sales & Marketing | Photography & Graphic Design |
| Instacart                       | Shopping          | Food & Drink                 |
| Wawa                            | Shopping          | Food & Drink                 |
| McDonald's                      | Shopping          | Food & Drink                 |
| Vrbo                            | Shopping          | Travel                       |
| American Airlines               | Shopping          | Travel                       |
| Booking.com                     | Shopping          | Travel                       |
| Ticketmaster                    | Shopping          | Entertainment & Events       |
| Airbnb                          | Shopping          | Travel                       |
| DoorDash                        | Shopping          | Food & Drink                 |
| Expedia                         | Shopping          | Travel                       |
| EasyPark                        | Shopping          | Travel                       |
| UEFA Tickets                    | Shopping          | Entertainment & Events       |
| DHL Express                     | Shopping          | Business                     |
| UPS                             | Shopping          | Business                     |  
For more information on creating HTTP policies, refer to [Applications and app types](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/application-app-types/).

Oct 28, 2025
1. ### [Access private hostname applications support all ports/protocols](https://edgetunnel-b2h.pages.dev/changelog/post/2025-10-28-access-application-support-for-all-ports-and-protocols/)  
[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
[Cloudflare Access for private hostname applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) can now secure traffic on all ports and protocols.  
Previously, applying Zero Trust policies to private applications required the application to use HTTPS on port `443` and support Server Name Indicator (SNI).  
This update removes that limitation. As long as the application is reachable via a Cloudflare off-ramp, you can now enforce your critical security controls — like single sign-on (SSO), MFA, device posture, and variable session lengths — to any private application. This allows you to extend Zero Trust security to services like SSH, RDP, internal databases, and other non-HTTPS applications.  
![Example private application on non-443 port](https://edgetunnel-b2h.pages.dev/_astro/internal_private_app_any_port.DNXnEy0u_2rybRJ.webp)  
For example, you can now create a self-hosted application in Access for `ssh.testapp.local` running on port `22`. You can then build a policy that only allows engineers in your organization to connect after they pass an SSO/MFA check and are using a corporate device.  
This feature is generally available across all plans.

Oct 28, 2025
1. ### [CASB introduces new granular roles](https://edgetunnel-b2h.pages.dev/changelog/post/2025-10-28-casb-roles/)  
[ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/)  
Cloudflare CASB (Cloud Access Security Broker) now supports two new granular roles to provide more precise access control for your security teams:

  * **Cloudflare CASB Read:** Provides read-only access to view CASB findings and dashboards. This role is ideal for security analysts, compliance auditors, or team members who need visibility without modification rights.
  * **Cloudflare CASB:** Provides full administrative access to configure and manage all aspects of the CASB product.  
These new roles help you better enforce the principle of least privilege. You can now grant specific members access to CASB security findings without assigning them broader permissions, such as the **Super Administrator** or **Administrator** roles.  
To enable [Data Loss Prevention (DLP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/), scans in CASB, account members will need the **Cloudflare Zero Trust** role.  
You can find these new roles when inviting members or creating API tokens in the Cloudflare dashboard under **Manage Account** \> **Members**.  
To learn more about managing roles and permissions, refer to the [Manage account members and roles documentation](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/6/#page","headline":"Cloudflare One Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/6/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```