--- title: Developer platform Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Developer platform ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) May 07, 2026 1. ### [WAF and framework adapter mitigations for React and Next.js vulnerabilities](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-06-react-nextjs-vulnerabilities/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/)[ WAF ](https://edgetunnel-b2h.pages.dev/waf/) Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels. **We strongly recommend updating your application and its dependencies immediately.** Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`). #### WAF protections Cloudflare WAF rules deployed in response to prior React Server Component CVEs ([CVE-2025-55184 ↗](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) and [CVE-2026-23864 ↗](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg)) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset. | Ruleset | Rule description | Rule ID | Default action | | -------------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------- | -------------- | | Cloudflare Managed Ruleset | React - DoS - [CVE-2025-55184 ↗](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) | 2694f1610c0b471393b21aef102ec699 | Block | | Cloudflare Managed Ruleset | React - DoS - [CVE-2026-23864 ↗](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg) | aaede80b4d414dc89c443cea61680354 | Block | The existing rules detect the underlying attack patterns generically. As a result, they apply to the new [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) denial-of-service vulnerability in Server Components and the corresponding Next.js advisory [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj). Cloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) / [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj), [GHSA-267c-6grr-h53f ↗](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f), and [GHSA-mg66-mrh9-m8jx ↗](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx). If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the [WAF changelog](https://edgetunnel-b2h.pages.dev/waf/change-log/changelog/). Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible. Several of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations. Customers on Pro, Business, or Enterprise plans should ensure that [Managed Rules are enabled](https://edgetunnel-b2h.pages.dev/waf/get-started/#1-deploy-the-cloudflare-managed-ruleset). #### Next.js adapters **Vinext:** [Vinext ↗](https://github.com/cloudflare/vinext) is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` ([PR #1118 ↗](https://github.com/cloudflare/vinext/pull/1118), [PR #1112 ↗](https://github.com/cloudflare/vinext/pull/1112)) to prevent accidentally running a vulnerable version of React with Vinext. **OpenNext on Cloudflare:** OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions ([PR #1255 ↗](https://github.com/opennextjs/opennextjs-cloudflare/pull/1255)). #### Summary of disclosed vulnerabilities | Advisory | Severity | Issue | WAF status | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) / [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) | High | Denial of service in Server Components | **WAF rules in place:** 2694f1610c0b471393b21aef102ec699, aaede80b4d414dc89c443cea61680354Cloudflare is investigating additional managed WAF coverage | | [GHSA-267c-6grr-h53f ↗](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule | | [GHSA-mg66-mrh9-m8jx ↗](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx) | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule | | [GHSA-492v-c6pp-mqqv ↗](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv) | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-c4j6-fc7j-m34r ↗](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r) | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-36qx-fr4f-26g5 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5) | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-ffhc-5mcf-pf4q ↗](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q) | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-gx5p-jg67-6x7h ↗](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h) | Moderate | XSS in beforeInteractive scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-h64f-5h5j-jqjh ↗](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh) | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-wfc6-r584-vfw7 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7) | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-vfv6-92ff-j949 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949) | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-3g8h-86w9-wvmq ↗](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq) | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior | May 07, 2026 1. ### [Introducing Stream Bindings for Workers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-stream-workers-binding/) [ Stream ](https://edgetunnel-b2h.pages.dev/stream/) You can now interact with your Stream video library using new bindings for Workers! This allows customers to upload content to Stream, provision direct uploads, manage videos, and generate signed URLs from a Worker without making authenticated API calls. We're excited to bring Stream and Workers closer together to empower more programmatic pipelines, tighter integrations, and support generative AI and inference workloads. Use the Stream binding when you want to: * Upload videos from URLs or create basic direct upload links for end users * Generate signed playback tokens without managing signing keys * Manage video metadata, captions, downloads, and watermarks * Build video pipelines entirely within Workers To get started, add the Stream binding to your Wrangler configuration: * [ wrangler.jsonc ](#tab-panel-3431) * [ wrangler.toml ](#tab-panel-3432) **JSONC** ```jsonc { "$schema": "./node_modules/wrangler/config-schema.json", "stream": { "binding": "STREAM" } } ``` **TOML** ```toml [stream] binding = "STREAM" ``` **Generate a video with AI and upload directly to Stream** or send a URL of a file you already have: * [ JavaScript ](#tab-panel-3437) * [ TypeScript ](#tab-panel-3438) **JavaScript** ```js const aiResponse = await env.AI.run( "google/veo-3.1", { prompt: "A dog walking next to a river", duration: "10s", aspect_ratio: "16:9", resolution: "1080p", generate_audio: true, }, { gateway: { id: "experiments" }, }, ); // Veo will return a URL of the generated asset. const videoUrl = aiResponse.result.video; // Alternative option: a video of the Austin Office mobile // const videoUrl = 'https://pub-d9fcbc1abcd244c1821f38b99017347f.r2.dev/aus-mobile.mp4'; // Upload to Stream by providing a URL const streamVideo = await env.STREAM.upload(videoUrl); // The streamVideo response will include the video ID, playback and manifest // URLs, and other information, just like the REST API. ``` **TypeScript** ```ts const aiResponse = await env.AI.run( 'google/veo-3.1', { prompt: 'A dog walking next to a river', duration: '10s', aspect_ratio: '16:9', resolution: '1080p', generate_audio: true, }, { gateway: { id: 'experiments' }, }, ); // Veo will return a URL of the generated asset. const videoUrl = aiResponse.result.video; // Alternative option: a video of the Austin Office mobile // const videoUrl = 'https://pub-d9fcbc1abcd244c1821f38b99017347f.r2.dev/aus-mobile.mp4'; // Upload to Stream by providing a URL const streamVideo = await env.STREAM.upload(videoUrl); // The streamVideo response will include the video ID, playback and manifest // URLs, and other information, just like the REST API. ``` **Generate a signed URL without using a signing key** or an API call: * [ JavaScript ](#tab-panel-3433) * [ TypeScript ](#tab-panel-3434) **JavaScript** ```js const video_id = "ce800be43a9772f4bb02f35b860fb516"; const token = await env.STREAM.video(video_id).generateToken(); // Use the "token" in an iframe embed code, manifest URL, or thumbnail: const embedUrl = `https://customer-igynxd2rwhmuoxw8.cloudflarestream.com/${token}/iframe`; ``` **TypeScript** ```ts const video_id = 'ce800be43a9772f4bb02f35b860fb516'; const token = await env.STREAM.video(video_id).generateToken(); // Use the "token" in an iframe embed code, manifest URL, or thumbnail: const embedUrl = `https://customer-igynxd2rwhmuoxw8.cloudflarestream.com/${token}/iframe`; ``` **Get and set video properties** easily: * [ JavaScript ](#tab-panel-3435) * [ TypeScript ](#tab-panel-3436) **JavaScript** ```js const video_id = "46c8b7f480d410840758c1cb14a72e47"; const result = await env.STREAM.video(video_id).details(); await env.STREAM.video(video_id).update({ meta: { name: "sample video" }, }); ``` **TypeScript** ```ts const video_id = '46c8b7f480d410840758c1cb14a72e47'; const result = await env.STREAM.video(video_id).details(); await env.STREAM.video(video_id).update({ meta: { name: 'sample video' } }); ``` For setup instructions and the full API reference, refer to [Bind to Workers API](https://edgetunnel-b2h.pages.dev/stream/manage-video-library/bindings/). #### Get started with your Agent > Add a binding for Cloudflare Stream (env.STREAM). On the watch page, use the Stream binding to get info based on the ID, and leverage video.meta.name as the page title. May 07, 2026 1. ### [Automatic tracing across Durable Object and Worker subrequests](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-automatic-tracing-across-do-and-worker-subrequests/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now get a single unified trace across Worker-to-Worker subrequests, with trace context propagating automatically. Previously, [automatic tracing](https://edgetunnel-b2h.pages.dev/workers/observability/traces/) produced disconnected traces when a Worker called another Worker through a [service binding](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/service-bindings/) or [Durable Object](https://edgetunnel-b2h.pages.dev/durable-objects/). ![Unified trace showing nested spans across a Durable Object subrequest and a service binding call](https://edgetunnel-b2h.pages.dev/_astro/2026-04-28-worker-to-worker-context-prop.Db1qNQJL_BUxyi.webp) This means you can: * Follow a request through your entire Worker architecture in one trace view * See service binding and Durable Object calls as nested child spans instead of separate traces * Debug cross-Worker request flows in the Cloudflare dashboard or in an external observability platform via [OpenTelemetry](https://edgetunnel-b2h.pages.dev/workers/observability/exporting-opentelemetry-data/) [Tracing must be enabled](https://edgetunnel-b2h.pages.dev/workers/observability/traces/#how-to-enable-tracing) in your Wrangler configuration for traces to be recorded. Checkout [Workers tracing](https://edgetunnel-b2h.pages.dev/workers/observability/traces/) to get started. Up next, we are working on external trace context propagation using [W3C Trace Context standards ↗](https://www.w3.org/TR/trace-context/), which will allow traces from your Workers to link with traces from services outside of Cloudflare. May 04, 2026 1. ### [Pipelines and R2 Data Catalog now supported in Terraform](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-terraform-support/) [ Pipelines ](https://edgetunnel-b2h.pages.dev/pipelines/) [Cloudflare Pipelines](https://edgetunnel-b2h.pages.dev/pipelines/) ingests streaming data via [Workers](https://edgetunnel-b2h.pages.dev/workers/) or HTTP endpoints, transforms it with SQL, and writes it to [R2](https://edgetunnel-b2h.pages.dev/r2/) as Apache Iceberg tables. [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) manages those Iceberg tables, compaction, and compatibility with query engines like [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/), [Spark](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/spark-scala/), and [DuckDB](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/duckdb/). You can now create and manage both products using Terraform, supported in the [Cloudflare Terraform provider v5.19.0 ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs). This adds four new resources that let you define your entire data pipeline as infrastructure-as-code: a data catalog, a stream for ingestion, a sink that writes to R2 Data Catalog or R2, and a pipeline that connects them with SQL. The new Terraform resources are: * [cloudflare\_r2\_data\_catalog ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/r2%5Fdata%5Fcatalog) — enable the data catalog on an R2 bucket * [cloudflare\_pipeline\_stream ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline%5Fstream) — create a stream that receives events via HTTP or Worker bindings * [cloudflare\_pipeline\_sink ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline%5Fsink) — create a sink that writes to R2 Data Catalog or R2 * [cloudflare\_pipeline ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/pipeline) — create a pipeline with SQL connecting a stream to a sink Here is a minimal example that creates a stream, an R2 Data Catalog sink, and a pipeline: ```hcl resource "cloudflare_pipeline_stream" "my_stream" { account_id = var.cloudflare_account_id name = "my_stream" format = { type = "json" } schema = { fields = [{ name = "value" type = "json" required = true }] } http = { enabled = true, authentication = false, cors = {} } worker_binding = { enabled = false } } resource "cloudflare_pipeline_sink" "my_sink" { account_id = var.cloudflare_account_id name = "my_sink" type = "r2_data_catalog" format = { type = "parquet" } schema = { fields = [] } config = { account_id = var.cloudflare_account_id bucket = "my-pipeline-bucket" table_name = "my_table" token = var.catalog_token } } resource "cloudflare_pipeline" "my_pipeline" { account_id = var.cloudflare_account_id name = "my_pipeline" sql = "INSERT INTO ${cloudflare_pipeline_sink.my_sink.name} SELECT * FROM ${cloudflare_pipeline_stream.my_stream.name}" } ``` For a full end-to-end example that includes R2 bucket creation, data catalog setup, and scoped API token provisioning, refer to the [Pipelines Terraform documentation](https://edgetunnel-b2h.pages.dev/pipelines/reference/terraform/). May 01, 2026 1. ### [Run Workflows inside Dynamic Workers with the @cloudflare/dynamic-workflows library](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-01-dynamic-workflows/) [ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now use [@cloudflare/dynamic-workflows ↗](https://github.com/cloudflare/dynamic-workflows) to run a [Workflow](https://edgetunnel-b2h.pages.dev/workflows/) inside a [Dynamic Worker](https://edgetunnel-b2h.pages.dev/dynamic-workers/), ensuring durable execution for code that is loaded at runtime. The Worker Loader loads Dynamic Workers on demand, which previously made durability challenging. Even within a Dynamic Worker, a Workflow might sleep for hours or days between steps, and by the time it resumes, the original Dynamic Worker code would no longer be in memory. The library solves this by tagging each Workflow instance with metadata that identifies which Dynamic Worker to load — for example, a tenant ID — then reloading the matching Dynamic Worker through the Worker Loader whenever a Workflow awakens. Because Dynamic Workers are created on-demand, you do not have to register each Workflow up front or manage them individually. Load the Workflow code in the Dynamic Worker when it is needed, and the Workflows engine handles persistence and retries behind the scenes. Your Workflow code itself is unaffected by the routing and behaves as normal. This unlocks patterns where the Workflow code itself is dynamic. For example, this is useful with: * **SaaS platforms** where each tenant defines their own automation, such as onboarding sequences, approval chains, or billing retry logic. * **AI agent frameworks** where agents generate and execute multi-step plans at runtime, surviving restarts and waiting for human approval between tool calls. * **Multi-tenant job systems** where each customer submits their own processing logic and every step persists progress and retries on failure. **TypeScript** ```ts import { createDynamicWorkflowEntrypoint, DynamicWorkflowBinding, wrapWorkflowBinding, type WorkflowRunner, } from "@cloudflare/dynamic-workflows"; export { DynamicWorkflowBinding }; interface Env { WORKFLOWS: Workflow; LOADER: WorkerLoader; } function loadTenant(env: Env, tenantId: string) { return env.LOADER.get(tenantId, async () => ({ compatibilityDate: "2026-01-01", mainModule: "index.js", modules: { "index.js": await fetchTenantCode(tenantId) }, // The Dynamic Worker uses this exactly like a real Workflow binding; // every create() is tagged with { tenantId } automatically. env: { WORKFLOWS: wrapWorkflowBinding({ tenantId }) }, })); } // The entrypoint name must match `class_name` in the workflows binding of your Wrangler config file. export const DynamicWorkflow = createDynamicWorkflowEntrypoint( async ({ env, metadata }) => { const stub = loadTenant(env, metadata.tenantId as string); return stub.getEntrypoint("TenantWorkflow") as unknown as WorkflowRunner; }, ); export default { fetch(request: Request, env: Env) { const tenantId = request.headers.get("x-tenant-id")!; return loadTenant(env, tenantId).getEntrypoint().fetch(request); }, }; ``` For a full walkthrough, refer to the [Dynamic Workflows guide](https://edgetunnel-b2h.pages.dev/dynamic-workers/usage/dynamic-workflows/). Apr 30, 2026 1. ### [Go SDK v7.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-go-sdk-v700/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)[ Go SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v6.10.0...v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/compare/v6.10.0...v7.0.0) This is a major version release that includes breaking changes to three packages: `ai_search`, `email_security`, and `workers`. These changes reflect upstream API specification updates that improve type correctness and consistency. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes See the [v7.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md) for before/after code examples and actions needed for each change. #### AI Search - SearchForAgents Metadata Removed The `SearchForAgents` nested type has been removed from all instance metadata structs. This field is no longer part of the API specification. **Removed Types:** * `InstanceNewResponseMetadataSearchForAgents` * `InstanceUpdateResponseMetadataSearchForAgents` * `InstanceListResponseMetadataSearchForAgents` * `InstanceDeleteResponseMetadataSearchForAgents` * `InstanceReadResponseMetadataSearchForAgents` * `InstanceNewParamsMetadataSearchForAgents` * `InstanceUpdateParamsMetadataSearchForAgents` * `NamespaceInstanceNewResponseMetadataSearchForAgents` * `NamespaceInstanceUpdateResponseMetadataSearchForAgents` * `NamespaceInstanceListResponseMetadataSearchForAgents` * `NamespaceInstanceDeleteResponseMetadataSearchForAgents` * `NamespaceInstanceReadResponseMetadataSearchForAgents` * `NamespaceInstanceNewParamsMetadataSearchForAgents` * `NamespaceInstanceUpdateParamsMetadataSearchForAgents` #### Email Security - Path Parameter Type Changes Multiple Email Security settings sub-resources have changed their path parameter types from `int64` to `string`: * `AllowPolicies` (`policyID int64` \-> `policyID string`) * `BlockSenders` (`patternID int64` \-> `patternID string`) * `Domains` (`domainID int64` \-> `domainID string`) * `ImpersonationRegistry` (`displayNameID int64` \-> `impersonationRegistryID string`) * `TrustedDomains` (`trustedDomainID int64` \-> `trustedDomainID string`) #### Email Security - Investigate Parameter Rename The `Investigate.Get`, `Investigate.Move.New`, and `Investigate.Reclassify.New` methods now use `investigateID` instead of `postfixID` as the path parameter name. #### Email Security - Domains BulkDelete Method Removed The `SettingDomainService.BulkDelete` method and its associated types have been removed: * `SettingDomainBulkDeleteResponse` * `SettingDomainBulkDeleteParams` #### Email Security - TrustedDomains Return Type Change `SettingTrustedDomainService.New` now returns `*SettingTrustedDomainNewResponse` instead of `*SettingTrustedDomainNewResponseUnion`. #### Email Security - Investigate.Move Return Type Change `InvestigateMoveService.New` now returns `*pagination.SinglePage[InvestigateMoveNewResponse]` instead of `*[]InvestigateMoveNewResponse`. #### Workers - Observability Telemetry Filter Restructuring The observability telemetry filter parameter types have been restructured to support nested filter groups. New discriminated union types replace the previous flat filter arrays: * `ObservabilityTelemetryKeysParams.Filters` now accepts `FiltersObjectFilterUnion` (was `[]interface\{\}`) * `ObservabilityTelemetryQueryParams.Parameters.Filters` now accepts `FiltersObjectFilterUnion` * `ObservabilityTelemetryValuesParams.Filters` now accepts `FiltersObjectFilterUnion` New types include `FiltersObjectFiltersObject` (for group filters with `FilterCombination`) and `FiltersWorkersObservabilityFilterLeaf` (for leaf filters with typed `Operation`, `Type`, and `Value` fields). #### Features #### Organizations - Audit Logs (`client.Organizations.Logs.Audit`) **NEW SERVICE:** Query organization audit logs with cursor-based pagination. * `List()` \- Retrieve audit logs #### Browser Rendering (`client.BrowserRendering`) * `client.BrowserRendering.Devtools.Browser.Targets.Close()` \- Close a specific browser target (tab, page) by ID #### Queues (`client.Queues`) * `client.Queues.GetMetrics()` \- Retrieve queue metrics for a specific queue #### AI Search (`client.AISearch`) * Added `WaitForCompletion` parameter to `NamespaceInstanceItemNewOrUpdateParams` and `NamespaceInstanceItemSyncParams` for synchronous indexing confirmation #### Bug Fixes * **Magic Transit**: `ConnectorService.List` parameter name corrected from `query` to `params` (non-functional, affects generated documentation only) #### Deprecations None in this release. #### Get started * [Download Go SDK v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/releases/tag/v7.0.0) * [Go SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/go/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md) Apr 30, 2026 1. ### [Empty buckets and delete folders from the R2 dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-r2-empty-bucket-folder-delete/) [ R2 ](https://edgetunnel-b2h.pages.dev/r2/) You can now empty an entire [R2](https://edgetunnel-b2h.pages.dev/r2/) bucket or delete folders directly from the dashboard. Emptying a bucket is required before you can delete it. Previously, this required scripting or configuring [lifecycle rules](https://edgetunnel-b2h.pages.dev/r2/buckets/object-lifecycles/). Now, the dashboard can handle it in a single action. #### Empty a bucket Go to your bucket's **Settings** tab and select **Empty** under the **Empty Bucket** section. This deletes all objects in the bucket while preserving the bucket and its configuration. For large buckets, the operation runs in the background and the dashboard displays progress. Emptying a bucket is also a prerequisite for deleting it. The dashboard now guides you through both steps in one place. ![Empty Bucket and Delete Bucket sections in the R2 dashboard Settings tab](https://edgetunnel-b2h.pages.dev/_astro/empty-bucket-changelog.DjuMZppm_11Omax.webp) #### Delete folders R2 uses a flat object structure. The dashboard groups objects that share a common prefix into folders when the **View prefixes as directories** checkbox is selected. Deleting a folder removes every object under that prefix. From the **Objects** tab, you can select one or more folders and delete them alongside individual objects. For step-by-step instructions, refer to [Delete buckets](https://edgetunnel-b2h.pages.dev/r2/buckets/delete-buckets/) and [Delete objects](https://edgetunnel-b2h.pages.dev/r2/objects/delete-objects/). Apr 30, 2026 1. ### [Cloudflare Python SDK v5.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-python-v500/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v4.3.1...v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/compare/v4.3.1...v5.0.0) This is a major release of the Cloudflare Python SDK. It drops support for Python 3.8, adds 11 new API services, introduces optional aiohttp backend support for improved async concurrency, and includes hundreds of type and method updates across the entire API surface. **Please review the breaking changes below before upgrading.** A migration guide is available at [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md). #### Breaking Changes * **Python 3.8 is no longer supported.** The minimum required version is now Python 3.9. * **`typing-extensions` minimum version bumped** from `>=4.10` to `>=4.14`. The following resources have breaking changes. See the [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md) for detailed migration instructions. * `abusereports` * `acm.totaltls` * `apigateway.configurations` * `cloudforceone.threatevents` * `d1.database` * `intel.indicatorfeeds` * `logpush.edge` * `origintlsclientauth.hostnames` * `queues.consumers` * `radar.bgp` * `rulesets.rules` * `schemavalidation.schemas` * `snippets` * `zerotrust.dlp` * `zerotrust.networks` #### Features #### aiohttp Backend Support The async client now supports an optional `aiohttp` HTTP backend for improved concurrency performance. Install with `pip install cloudflare[aiohttp]` and use `DefaultAioHttpClient()` as the `http_client` parameter. #### Python 3.13 and 3.14 Support Python 3.13 and 3.14 are now tested and supported. #### New Services The following top-level resources are new in this release: | Resource | Client Path | Description | | --------------------- | ---------------------- | ---------------------------------------------------------------- | | AI Search | aisearch | AI-powered search capabilities | | Connectivity | connectivity | Connectivity testing and diagnostics | | Email Sending | email\_sending | Email send and send\_raw endpoints | | Fraud | fraud | Fraud detection and prevention | | Google Tag Gateway | google\_tag\_gateway | Google Tag Gateway management | | Organizations | organizations | Organization audit logs and management | | R2 Data Catalog | r2\_data\_catalog | R2 Data Catalog operations | | Realtime Kit | realtime\_kit | Realtime communication (Calls/TURN) | | Resource Tagging | resource\_tagging | Resource tagging and labeling | | Token Validation | token\_validation | Token validation configuration and rules | | Vulnerability Scanner | vulnerability\_scanner | Vulnerability scanning, credential sets, and target environments | #### New Endpoints on Existing Services * **api\_gateway**: Labels endpoints * **billing**: Billable usage PayGo endpoint * **brand\_protection**: v2 endpoints * **browser\_rendering**: DevTools methods * **cache**: Origin cloud regions resource * **custom\_origin\_trust\_store**: Custom origin trust store * **dns**: `dns_records/usage` endpoints * **email\_security**: Phishguard reports endpoint * **iam**: User groups and user group members resources * **radar**: Botnet Threat Feed and Post-Quantum endpoints * **workers**: Observability Destinations resources * **zero\_trust**: Access Users, DEX rules, Device IP Profile, Device Subnet, WARP Connector connections and failover, WARP Subnet, Gateway PAC files * **zones**: Zone environments endpoints #### Bug Fixes * Fixed `polymorphic_serialization` parameter in `model_dump` overrides * Added `BaseModel` base to response `SchemaFieldStruct`/`SchemaFieldList` stubs in Pipelines * Added missing `model_rebuild`/`update_forward_refs` for `SharedEntryCustomEntry` classes in DLP * Made `RunQueryParametersNeedleValue` a `BaseModel` with `arbitrary_types_allowed` in Workers * Removed duplicate `notification_url` field in webhook response types for Stream * Resolved pre-existing codegen type errors * Fixed `type: ignore[call-arg]` placement for mypy compatibility in Radar #### Deprecations Resources with `@deprecated` annotations on some methods include: `accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `kv`, `logpush`, `origin-tls-client-auth`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones` #### Get started * [Download Python SDK v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/releases/tag/v5.0.0) * [Python SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/python/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md) Apr 30, 2026 1. ### [Cloudflare TypeScript SDK v6.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-typescript-v600/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) Full Changelog: [v6.0.0-beta.2...v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/compare/v6.0.0-beta.2...v6.0.0) This is a major version release of the Cloudflare TypeScript SDK. It includes 11 entirely new top-level API resources, new sub-resources and methods across 50+ existing resources, SDK infrastructure improvements, and breaking changes to the generated API surface from the v5.x line. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes #### SDK Infrastructure * **Retry-After handling changed**: The SDK now respects any server-specified `Retry-After` value for rate-limited requests. Previously, values over 60 seconds were ignored and a default backoff was used instead. * **Empty response handling**: Responses with `content-length: 0` now return `undefined` instead of attempting to parse the body. * **Environment variable reading**: Empty string env vars (for example, `CLOUDFLARE_API_TOKEN=""`) are now treated as unset. * **Path query parameter merging**: URL search params embedded in endpoint paths are now extracted and merged into the query object. #### Removed Endpoints (17) 17 HTTP endpoints were removed from the SDK, affecting `abuse-reports`, `cloudforce-one`, `dlp/profiles/predefined`, `email-security/investigate`, `email-security/settings`, and `intel/ip-list`. #### Method Signature Changes * `client.ai.toMarkdown.transform(file, \{ ...params \})` \-> `client.ai.toMarkdown.transform(\{ ...params \})` \-- `file` moved from positional arg into params body * `client.radar.ai.toMarkdown.create(body, \{ ...params \})` \-> `client.radar.ai.toMarkdown.create(\{ ...params \})` \-- `body` moved from positional arg into params * `client.abuseReports.create(reportType, \{ ...params \})` \-> `client.abuseReports.create(reportParam, \{ ...params \})` \-- positional arg renamed * `client.iam.userGroups.members.create(userGroupId, [ ...body ])` \-> `client.iam.userGroups.members.create(userGroupId, [ ...members ])` \-- body array param renamed #### Renamed Client Paths * `client.originTLSClientAuth.hostnames.certificates` \-> `client.originTLSClientAuth.zoneCertificates` * `client.radar.netflows` \-> `client.radar.netFlows` (casing change) #### Return Type Changes (179) * **133 methods now return `null`** instead of a typed response object. This primarily affects delete operations across `accounts`, `cache`, `d1`, `filters`, `firewall`, `hyperdrive`, `iam`, `kv`, `logpush`, `logs`, `r2`, `stream`, `workers`, `zero-trust`, `zones`, and others. * **17 methods changed pagination type** (for example, `KeysCursorPaginationAfter` \-> `KeysCursorLimitPagination`). * **29 methods changed to a different named type** (for example, `CloudflaredCreateResponse` \-> `CloudflareTunnel`). #### Removed Types (43) 24 shared types removed from root namespace (`ASN`, `AuditLog`, `Member`, `Permission`, `Role`, `Subscription`, `Token`, etc.). 19 response types consolidated or renamed. #### Resource Restructuring 19 resources were restructured from single files to directories. Public API client paths are unchanged, but deep imports may break. #### New Top-Level Resources 11 entirely new resources added to the client: | Resource | Client Path | Methods | Description | | --------------------- | --------------------------- | ------- | ---------------------------------------- | | AI Search | client.aiSearch | 46 | Instances, namespaces, tokens, and items | | Connectivity | client.connectivity | 5 | Directory service APIs | | Email Sending | client.emailSending | 7 | Send and send\_raw endpoints | | Fraud | client.fraud | 2 | Fraud detection API | | Google Tag Gateway | client.googleTagGateway | 2 | Google Tag Gateway management | | Organizations | client.organizations | 8 | Organization profiles and audit logs | | R2 Data Catalog | client.r2DataCatalog | 11 | R2 Data Catalog routes | | Realtime Kit | client.realtimeKit | 54 | Realtime Kit APIs | | Resource Tagging | client.resourceTagging | 9 | Resource tagging routes | | Token Validation | client.tokenValidation | 13 | Token validation rules | | Vulnerability Scanner | client.vulnerabilityScanner | 21 | Vulnerability scanning | #### New Sub-Resources on Existing Resources * **browser-rendering**: `crawl`, `devtools` \- Crawl endpoints and DevTools methods * **cache**: `origin-cloud-regions` \- Origin cloud regions resource * **dns**: `usage` \- DNS records usage endpoints * **d1**: `time-travel` \- Time travel get\_bookmark and restore * **email-security**: `phishguard` \- Phishguard reports endpoint * **pipelines**: `sinks`, `streams` \- Pipelines restructure * **radar**: `agent-readiness`, `geolocations`, `post-quantum` \- New analytics endpoints * **workers**: `observability` \- Observability destinations * **zones**: `environments` \- Zone environments endpoints * **api-gateway**: `labels` \- Labels endpoints * **brand-protection**: `v2` \- V2 endpoints * **alerting**: `silences` \- Alert silencing API * **billing**: `usage` \- Billable usage PayGo endpoint * **iam**: `sso` \- SSO Connectors resource * **queues**: `getMetrics` method - Queues metrics endpoint * **registrar**: `registration-status`, `update-status` \- Registrar API convergence * **zero-trust**: DLP settings, DEX rules, Access Users, WARP Connector, WARP Subnets, Gateway PAC files, Gateway tenants #### Bug Fixes * Resolved type errors from codegen overwriting manual fixes * Fixed `post()` usage for to-markdown endpoints to resolve async type error * Added least-privilege permissions to all workflow jobs * Reverted erroneous removal of rulesets resource methods and types * Resolved prettier formatting errors in codegen output #### Deprecations The following resources now include `@deprecated` annotations on some methods: `accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `custom-nameservers`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `keyless-certificates`, `kv`, `logpush`, `origin-tls-client-auth`, `page-shield`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones` #### Get started * [Download TypeScript SDK v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/releases/tag/v6.0.0) * [TypeScript SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/typescript/) * [Full Changelog ↗](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md) Apr 30, 2026 1. ### [Web Analytics adds Navigation Type filtering and reporting](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-rum-navigation-types/) [ Cloudflare Web Analytics ](https://edgetunnel-b2h.pages.dev/web-analytics/) Cloudflare Web Analytics now supports **Navigation Type** reporting and filtering. This update allows developers and performance analysts to see how users are navigating between pages — whether through a link click or form submission, a page reload, or using the browser's back/forward buttons — and whether a browser cache hit occurred for these behaviors. Understanding navigation types is critical for optimizing user experience. For example, if a high volume of your traffic consists of "Back-forward" navigations versus "Back-forward Cache", those visitors are not benefiting from the Back/Forward Cache (bfcache) and therefore are experiencing higher load times due to potentially unnecessary network requests. The same applies for regular "Navigate" entries — where "Navigate Cache", "Navigate Prefetch Cache" and "Prerender" would provide instant document retrieval — and "Reload", where "Reload cache" would be more optimal. A high volume of "Reload" entries can also indicate a potential stability problem with your website. By identifying these patterns, you can tune your browser caching strategies to ensure HTML documents are served instantaneously from local caches rather than requiring a roundtrip to the network. For more information, refer to [Navigation Types](https://edgetunnel-b2h.pages.dev/web-analytics/data-metrics/dimensions/#navigation-types). #### Key benefits * **Monitor Cache Effectiveness:** See how often your site is served from the HTTP cache or bfcache. * **Identify Performance Bottlenecks:** Filter by the different types to understand performance opportunity of improving browser cache hit ratio. #### Analyze navigation types in the Cloudflare dashboard You can now find the **Navigation Type** dimension in the Web Analytics dashboard. You can filter to include/exclude one or more specific types using "equals", "does not equal", "in", or "not in" matchers. ![Navigation Type filter](https://edgetunnel-b2h.pages.dev/_astro/dash-web_analytics-navigation-type-filter.Cculflhp_Xm5Gz.webp) To check the list of popular navigation types, select **Page views** on the Web Analytics sidebar and scroll down to the bottom: ![Navigation Types list in Page Views tab](https://edgetunnel-b2h.pages.dev/_astro/dash-web_analytics-navigation-types-list.CWaiEQzO_Z1jlU23.webp) Apr 29, 2026 1. ### [Hyperdrive support for private databases with Workers VPC](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-hyperdrive-vpc-private-databases/) [ Hyperdrive ](https://edgetunnel-b2h.pages.dev/hyperdrive/) You can now connect Hyperdrive to a private database through a [Workers VPC service](https://edgetunnel-b2h.pages.dev/workers-vpc/). This is the recommended way to connect Hyperdrive to a private database that is not exposed to the public Internet. When creating a Hyperdrive configuration in the Cloudflare dashboard, choose **Connect to private database** and then **Workers VPC**. From there, you can select an existing VPC service or create a new one inline by picking a Cloudflare Tunnel and entering your origin host and TCP port. You can also create a Hyperdrive configuration backed by a Workers VPC service from the command line: ```sh npx wrangler hyperdrive create my-vpc-database \ --service-id \ --database \ --user \ --password \ --scheme postgresql ``` Workers VPC services are reusable across Hyperdrive configurations and can also be bound directly to Workers, so you can share the same private connection across multiple products. To get started, refer to [Connect Hyperdrive to a private database using Workers VPC](https://edgetunnel-b2h.pages.dev/hyperdrive/configuration/connect-to-private-database-vpc/). Apr 28, 2026 1. ### [Realtime backlog metrics now available for Queues](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-improved-queues-metrics/) [ Queues ](https://edgetunnel-b2h.pages.dev/queues/) [Queues](https://edgetunnel-b2h.pages.dev/queues/), Cloudflare's managed message queue, now exposes realtime backlog metrics via the dashboard, REST API, and JavaScript API. Three new fields are available: * **`backlog_count`** — the number of unacknowledged messages in the queue * **`backlog_bytes`** — the total size of those messages in bytes * **`oldest_message_timestamp_ms`** — the timestamp of the oldest unacknowledged message The following endpoints also now include a `metadata.metrics` object on the result field after successful message consumption: * `/accounts/{account_id}/queues/{queue_id}/messages/pull` * `/accounts/{account_id}/queues/{queue_id}/messages` * `/accounts/{account_id}/queues/{queue_id}/messages/batch` #### Javascript APIs Call `env.QUEUE.metrics()` to get realtime backlog metrics: **TypeScript** ```ts const { backlogCount, // number backlogBytes, // number oldestMessageTimestamp, // Date | undefined } = await env.QUEUE.metrics(); ``` `env.QUEUE.send()` and `env.QUEUE.sendBatch()` also now return a metrics object on the response. You can also query these fields via the [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/) or view realtime backlog on the [dashboard ↗](https://dash.cloudflare.com/?to=/:account/workers/queues). ![Queues realtime backlog](https://edgetunnel-b2h.pages.dev/_astro/2026-04-28-queues-metrics.BYi0hgrD_149xlT.webp) For more information, refer to [Queues metrics](https://edgetunnel-b2h.pages.dev/queues/observability/metrics/). Apr 24, 2026 1. ### [Terraform v5.19.0 now available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-24-terraform-v5190-provider/) [ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/) Terraform Provider v5.19.0 introduces 14 new resources spanning AI Gateway, Pipelines, R2 Data Catalog, User Groups, Vulnerability Scanner, Workers Observability, and Zero Trust capabilities. This release significantly improves the v4 to v5 migration experience with automatic state upgraders for 26 resources, working seamlessly with the new [tf-migrate CLI tool ↗](https://github.com/cloudflare/tf-migrate) to automate resource renames, attribute updates, and `moved` block generation. Together, these enhancements reduce manual migration effort and minimize risk when upgrading from v4 to v5. **Note:** `cmd/migrate` is deprecated in favor of `tf-migrate` and will be removed in a future release ([#7062 ↗](https://github.com/cloudflare/terraform-provider-cloudflare/pull/7062)) #### New Resources * **cloudflare\_ai\_gateway**: Manage AI Gateway instances * **cloudflare\_certificate\_authorities\_hostname\_associations**: Manage mTLS certificate hostname associations * **cloudflare\_custom\_page\_asset**: Manage custom page assets * **cloudflare\_pipeline**: Manage Cloudflare Pipelines * **cloudflare\_r2\_data\_catalog**: Manage R2 Data Catalog * **cloudflare\_user\_group**: Manage user groups * **cloudflare\_user\_group\_members**: Manage user group memberships * **cloudflare\_vulnerability\_scanner\_credential**: Manage vulnerability scanner credentials * **cloudflare\_vulnerability\_scanner\_credential\_set**: Manage vulnerability scanner credential sets * **cloudflare\_vulnerability\_scanner\_target\_environment**: Manage vulnerability scanner target environments * **cloudflare\_workers\_observability\_destination**: Manage Workers Observability destinations * **cloudflare\_zero\_trust\_device\_ip\_profile**: Manage Zero Trust device IP profiles * **cloudflare\_zero\_trust\_device\_subnet**: Manage Zero Trust device subnets * **cloudflare\_zero\_trust\_dlp\_settings**: Manage Zero Trust DLP settings #### Features #### V4 to V5 Migration State Upgraders State upgraders added for seamless migration from v4 to v5 for the following resources: * account * account\_member * account\_token * authenticated\_origin\_pulls * authenticated\_origin\_pulls\_hostname\_certificate * byo\_ip\_prefix * custom\_hostname * custom\_ssl * leaked\_credential\_check * leaked\_credential\_check\_rule * logpush\_ownership\_challenge * mtls\_certificate * observatory\_scheduled\_test * pages\_domain * regional\_tiered\_cache * turnstile\_widget * workers\_custom\_domain * zero\_trust\_device\_custom\_profile * zero\_trust\_device\_default\_profile * zero\_trust\_device\_posture\_integration * zero\_trust\_gateway\_certificate * zero\_trust\_gateway\_settings * zero\_trust\_organization * zero\_trust\_tunnel\_cloudflared\_virtual\_network * zone\_setting #### Other Features * **ruleset**: Add `content_converter` and `redirects_for_ai_training` support to configuration rules * **zero\_trust\_gateway\_logging**: Make importable #### Bug Fixes #### Migration & State Management * **account\_member**: Add UseStateForUnknown to status field to prevent drift * **authenticated\_origin\_pulls\_settings**: Fix no prior schema and no-op upgrade * **certificate\_pack**: Initialize empty lists instead of null in state upgrader to prevent drift * **migrations**: Handle ambiguous schema\_version state for v4/v5 coexistence * **zero\_trust\_access\_policy**: Fix nil pointer panic in state upgrader; set PriorSchema nil for v4 state upgrade #### Resource-Specific Fixes * **ai\_search\_instance**: Restore original defaults for cache and cache\_threshold; conflict resolution * **apijson**: Return empty object from MarshalForPatch when no fields are serializable * **dlp\_predefined\_profile**: Eliminate perpetual entries and enabled\_entries drift * **dns\_record**: Avoid unnecessary drift for ipv4\_only and ipv6\_only attributes; remove private\_routing default value * **drift**: Preserve prior state values for optional fields not returned by API * **healthcheck**: Use buildHealthcheckPlanChecks helper for correct plan checks per migration source; update assertions * **leaked\_credential\_check\_rule**: Handle empty ID from v4 provider state migration * **list\_item**: Remove context * **logpush\_job**: Update model for migration * **ruleset**: Fix migration; add redirects\_for\_ai\_training to SourceV4ActionParametersModel; fix duplicate model attribute * **worker**: Add UseStateForUnknown() plan modifiers and update tests for observability.traces * **workers\_custom\_domain**: Handle HTTP 200 no content header; update assertions * **workers\_script**: Fix model drift * **zero\_trust\_access\_identity\_provider**: Fix boolean drifts * **zero\_trust\_device\_managed\_networks**: Upgrade resource state * **zero\_trust\_gateway\_policy**: Make filters Computed+Optional to prevent drift * **zero\_trust\_gateway\_settings**: Fix breaking changes; implement sweeper to reset account to clean defaults * **zone\_setting**: Migration test improvements and fixes #### Documentation * **healthcheck**: Update port description to clarify defaults * Add application-scoped access policy migration guidance * Update zone\_settings\_override migration guide for tf-migrate v2 workflow #### For more information * [Terraform Provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) * [Version 5 Migration Guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-migration) * [Documentation on using Terraform with Cloudflare](https://edgetunnel-b2h.pages.dev/terraform/) Apr 24, 2026 1. ### [Automate migration from Cloudflare's Terraform v4 to v5 provider](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-24-tf-migrate-tool-released/) [ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/) We're excited to announce **tf-migrate**, a purpose-built CLI tool that simplifies migrating from Cloudflare Terraform Provider v4 to v5. #### v5 is stable and ready for production **Terraform Provider v5 is stable and actively receiving updates.** We encourage all users to migrate to v5 to take advantage of ongoing enhancements and new capabilities. Cloudflare uses tf-migrate to migrate our own infrastructure — the same tool we're providing to the community — ensuring the best possible migration experience. #### What tf-migrate does **tf-migrate** automates the tedious and error-prone parts of the v4 to v5 migration process: * **Resource type renames** – Automatically updates `cloudflare_record` → `cloudflare_dns_record`, `cloudflare_access_application` → `cloudflare_zero_trust_access_application`, and 40+ other renamed resources * **Attribute transformations** – Updates field names (e.g., `value` → `content` for DNS records) and restructures nested blocks * **Moved block generation** – Creates Terraform 1.8+ `moved` blocks to prevent resource replacements and ensure zero-downtime migrations * **Cross-file reference updates** – Automatically finds and updates all references to renamed resources across your entire configuration * **Dry-run mode** – Preview all changes before applying them to ensure safety Combined with the automatic state upgraders introduced in v5.19+, tf-migrate eliminates the manual work and risk that previously made v5 migrations challenging. Tf-migrate operates directly on the config, and the built-in state upgraders handle the rest. #### Supported resources Tf-migrate currently supports the most common Terraform resources our customers use. We are actively working to expand coverage, with the most commonly used resources prioritized first. For the complete list of supported resources and their migration status, refer to the [v5 Stabilization Tracker ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/6237). This list is updated regularly as additional resources are stabilized and migration support is added. Resources not yet supported by tf-migrate will need to be migrated manually using the [version 5 upgrade guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade). The upgrade guide provides step-by-step instructions for handling resource renames, attribute changes, and state migrations. #### Get started * [Download tf-migrate ↗](https://github.com/cloudflare/tf-migrate/releases) * [Version 5 Migration Guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-migration) * [Terraform Provider documentation ↗](https://edgetunnel-b2h.pages.dev/terraform/) * [v5 Stabilization Tracker ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/6237) We have been releasing Betas over the past month and a half while testing this tool. See the full changelog of those Betas here: [tf-migrate releases ↗](https://github.com/cloudflare/tf-migrate/releases). Apr 23, 2026 1. ### [Go SDK v6.10.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-23-go-sdk-v6100/) [ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)[ Go SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/) #### v6.10.0 In this release, you'll see a number of breaking changes. This is primarily due to changes in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. **Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments. #### Breaking Changes See the [v6.10.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/MIGRATION%5FGUIDE.md) for before/after code examples and actions needed for each change. #### Abuse Reports - Registrar WHOIS Report Field Removals Several fields have been removed from `AbuseReportNewParamsBodyAbuseReportsRegistrarWhoisReportRegWhoRequest`: * `RegWhoGoodFaithAffirmation` * `RegWhoLawfulProcessingAgreement` * `RegWhoLegalBasis` * `RegWhoRequestType` * `RegWhoRequestedDataElements` #### AI Search - Instance Params Restructured The `InstanceNewParams` and `InstanceUpdateParams` types have been significantly restructured. Many fields have been moved or removed: * `InstanceNewParams.TokenID`, `Type`, `CreatedFromAISearchWizard`, `WorkerDomain` removed * `InstanceUpdateParams` — most configuration fields removed (including `IndexMethod`, `IndexingOptions`, `MaxNumResults`, `Metadata`, `Paused`, `PublicEndpointParams`, `Reranking`, `RerankingModel`, `RetrievalOptions`, `RewriteModel`, `RewriteQuery`, `ScoreThreshold`, `SourceParams`, `Summarization`, `SummarizationModel`, `SystemPromptAISearch`, `SystemPromptIndexSummarization`, `SystemPromptRewriteQuery`, `TokenID`, `CreatedFromAISearchWizard`, `WorkerDomain`) * `InstanceSearchParams.Messages` field removed along with `InstanceSearchParamsMessage` and `InstanceSearchParamsMessagesRole` types #### AI Search - InstanceItem Service Removed The `InstanceItemService` type has been removed. The items sub-resource at `client.AISearch.Instances.Items` no longer exists in the non-namespace path. Use `client.AISearch.Namespaces.Instances.Items` instead. #### AI Search - Token Types Removed The following types have been removed from the `ai_search` package: * `TokenDeleteResponse` * `TokenListParams` (and associated `TokenListParamsOrderBy`, `TokenListParamsOrderByDirection`) #### Email Security - Investigate Move Return Type Change The `Investigate.Move.New()` method now returns a raw slice instead of a paginated wrapper: * `New()` returns `*[]InvestigateMoveNewResponse` instead of `*pagination.SinglePage[InvestigateMoveNewResponse]` * `NewAutoPaging()` method removed #### Hyperdrive - Config Params Restructured The `ConfigEditParams` type lost its `MTLS` and `Name` fields. The `HyperdriveMTLSParam` type lost `MTLS` and `Host` fields. The `Host` field on origin config changed from `param.Field[string]` to a plain `string`. #### IAM - UserGroupMember Params and Return Types Changed The `UserGroupMemberNewParams` struct has been restructured and the `New()` method now returns a paginated response: * `UserGroupMemberNewParams.Body` renamed to `UserGroupMemberNewParams.Members` * `UserGroupMemberNewParamsBody` renamed to `UserGroupMemberNewParamsMember` * `UserGroupMemberUpdateParams.Body` renamed to `UserGroupMemberUpdateParams.Members` * `UserGroupMemberUpdateParamsBody` renamed to `UserGroupMemberUpdateParamsMember` * `UserGroups.Members.New()` returns `*pagination.SinglePage[UserGroupMemberNewResponse]` instead of `*UserGroupMemberNewResponse` #### IAM - UserGroup List Direction Type Changed The `UserGroupListParams.Direction` field changed from `param.Field[string]` to `param.Field[UserGroupListParamsDirection]` (typed enum with `asc`/`desc` values). #### Pipelines - Delete Methods Now Return Typed Responses Several delete methods across Pipelines now return typed responses instead of bare error: * `Pipelines.DeleteV1()` returns `(*PipelineDeleteV1Response, error)` instead of `error` * `Pipelines.Sinks.Delete()` returns `(*SinkDeleteResponse, error)` instead of `error` * `Pipelines.Streams.Delete()` returns `(*StreamDeleteResponse, error)` instead of `error` #### Queues - Message Response Types Removed The following response envelope types have been removed: * `MessageBulkPushResponseSuccess` * `MessagePushResponseSuccess` * `MessageAckResponse` fields `RetryCount` and `Warnings` removed #### Secrets Store - Pagination Wrapper Removal and Type Changes Methods now return direct types instead of `SinglePage` wrappers, and several internal types have been removed. Associated `AutoPaging` methods have also been removed: * `Stores.New()` returns `*StoreNewResponse` instead of `*pagination.SinglePage[StoreNewResponse]` * `Stores.NewAutoPaging()` method removed * `Stores.Secrets.BulkDelete()` returns `*StoreSecretBulkDeleteResponse` instead of `*pagination.SinglePage[StoreSecretBulkDeleteResponse]` * `Stores.Secrets.BulkDeleteAutoPaging()` method removed * Removed types: `StoreDeleteResponse`, `StoreDeleteResponseEnvelopeResultInfo`, `StoreSecretDeleteResponse`, `StoreSecretDeleteResponseStatus`, `StoreSecretBulkDeleteResponse` (old shape), `StoreSecretBulkDeleteResponseStatus`, `StoreSecretDeleteResponseEnvelopeResultInfo` * `StoreNewParams` restructured (old `StoreNewParamsBody` removed) * `StoreSecretBulkDeleteParams` restructured #### Stream - AudioTracks Return Type Change The `AudioTracks.Get()` method now returns a dedicated response type instead of a paginated list. The `GetAutoPaging()` method has been removed: * `Get()` returns `*AudioTrackGetResponse` instead of `*pagination.SinglePage[Audio]` * `GetAutoPaging()` method removed #### Stream - Clip Type Removal and Return Type Change The `Clip.New()` method now returns the shared `Video` type. The following types have been entirely removed: * `Clip`, `ClipPlayback`, `ClipStatus`, `ClipWatermark` #### Stream - Copy and Clip Params Field Removals * `ClipNewParams.MaxDurationSeconds`, `ThumbnailTimestampPct`, `Watermark` removed * `CopyNewParams.ThumbnailTimestampPct`, `Watermark` removed #### Stream - Download and Webhook Changes * `DownloadNewResponseStatus` type removed * `WebhookUpdateResponse` and `WebhookGetResponse` changed from `interface{}` type aliases to full struct types #### Zero Trust - Access AI Control MCP Portal Union Types Removed The following union interface types have been removed: * `AccessAIControlMcpPortalListResponseServersUpdatedPromptsUnion` * `AccessAIControlMcpPortalListResponseServersUpdatedToolsUnion` * `AccessAIControlMcpPortalReadResponseServersUpdatedPromptsUnion` * `AccessAIControlMcpPortalReadResponseServersUpdatedToolsUnion` #### Features #### Vulnerability Scanner (`client.VulnerabilityScanner`) **NEW SERVICE:** Full vulnerability scanning management * **CredentialSets** \- CRUD for credential sets (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) * **Credentials** \- Manage credentials within sets (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) * **Scans** \- Create and manage vulnerability scans (`New`, `List`, `Get`) * **TargetEnvironments** \- Manage scan target environments (`New`, `Update`, `List`, `Delete`, `Edit`, `Get`) #### AI Search - Namespaces (`client.AISearch.Namespaces`) **NEW SERVICE:** Namespace-scoped AI Search management * `New()`, `Update()`, `List()`, `Delete()`, `ChatCompletions()`, `Read()`, `Search()` * **Instances** \- Namespace-scoped instances (`New`, `Update`, `List`, `Delete`, `ChatCompletions`, `Read`, `Search`, `Stats`) * **Jobs** \- Instance job management (`New`, `Update`, `List`, `Get`, `Logs`) * **Items** \- Instance item management (`List`, `Delete`, `Chunks`, `NewOrUpdate`, `Download`, `Get`, `Logs`, `Sync`, `Upload`) #### Browser Rendering - Devtools (`client.BrowserRendering.Devtools`) **NEW SERVICE:** DevTools protocol browser control * **Session** \- List and get devtools sessions * **Browser** \- Browser lifecycle management (`New`, `Delete`, `Connect`, `Launch`, `Protocol`, `Version`) * **Page** \- Get page by target ID * **Targets** \- Manage browser targets (`New`, `List`, `Activate`, `Get`) #### Registrar (`client.Registrar`) **NEW:** Domain check and search endpoints * `Check()` \- `POST /accounts/{account_id}/registrar/domain-check` * `Search()` \- `GET /accounts/{account_id}/registrar/domain-search` **NEW:** Registration management (`client.Registrar.Registrations`) * `New()`, `List()`, `Edit()`, `Get()` * `RegistrationStatus.Get()` \- Get registration workflow status * `UpdateStatus.Get()` \- Get update workflow status #### Cache - Origin Cloud Regions (`client.Cache.OriginCloudRegions`) **NEW SERVICE:** Manage origin cloud region configurations * `New()`, `List()`, `Delete()`, `BulkDelete()`, `BulkEdit()`, `Edit()`, `Get()`, `SupportedRegions()` #### Zero Trust - DLP Settings (`client.ZeroTrust.DLP.Settings`) **NEW SERVICE:** DLP settings management * `Update()`, `Delete()`, `Edit()`, `Get()` #### Radar * `AgentReadiness.Summary()` \- Agent readiness summary by dimension * `AI.MarkdownForAgents.Summary()` \- Markdown-for-agents summary * `AI.MarkdownForAgents.Timeseries()` \- Markdown-for-agents timeseries #### IAM (`client.IAM`) * `UserGroups.Members.Get()` \- Get details of a specific member in a user group * `UserGroups.Members.NewAutoPaging()` \- Auto-paging variant for adding members * `UserGroups.NewParams.Policies` changed from required to optional #### Bot Management * `ContentBotsProtection` field added to `BotFightModeConfiguration` and `SubscriptionConfiguration` (`block`/`disabled`) #### Deprecations None in this release. #### Get started * [Download Go SDK v6.10.0 ↗](https://github.com/cloudflare/cloudflare-go/releases/tag/v6.10.0) * [Go SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/go/) * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/MIGRATION%5FGUIDE.md) Apr 22, 2026 1. ### [R2 Data Catalog snapshot expiration now removes unreferenced data files](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-22-snapshot-expiration-cleans-data-files/) [ R2 ](https://edgetunnel-b2h.pages.dev/r2/) [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/), a managed [Apache Iceberg ↗](https://iceberg.apache.org/) catalog built into R2, now removes unreferenced data files during automatic snapshot expiration. This improvement reduces storage costs and eliminates the need to run manual maintenance jobs to reclaim space from deleted data. Previously, snapshot expiration only cleaned up Iceberg metadata files such as manifests and manifest lists. Data files that were no longer referenced by active snapshots remained in R2 storage until you manually ran `remove_orphan_files` or `expire_snapshots` through an engine like Spark. This required extra operational overhead and left stale data files consuming storage. Snapshot expiration now handles both metadata and data file cleanup automatically. When a snapshot is expired, any data files that are no longer referenced by retained snapshots are removed from R2 storage. ```bash # Enable catalog-level snapshot expiration npx wrangler r2 bucket catalog snapshot-expiration enable my-bucket \ --older-than-days 7 \ --retain-last 10 ``` To learn more about snapshot expiration and other automatic maintenance operations, refer to the [table maintenance documentation](https://edgetunnel-b2h.pages.dev/r2/data-catalog/table-maintenance/). Apr 21, 2026 1. ### [Additional step context and ReadableStream support now available in Workflows step.do()](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-step-context-and-readable-streams/) [ Workflows ](https://edgetunnel-b2h.pages.dev/workflows/) [Workflows](https://edgetunnel-b2h.pages.dev/workflows/) now provides additional context inside `step.do()` callbacks and supports returning `ReadableStream` to handle larger step outputs. #### Step context properties The `step.do()` callback receives a context object with new properties [alongside](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-06-step-context-available/) `attempt`: * **`step.name`** — The name passed to `step.do()` * **`step.count`** — How many times a step with that name has been invoked in this instance (1-indexed) * Useful when running the same step in a loop. * **`config`** — The resolved step configuration, including `timeout` and `retries` with defaults applied **TypeScript** ```ts type ResolvedStepConfig = { retries: { limit: number; delay: WorkflowDelayDuration | number; backoff?: "constant" | "linear" | "exponential"; }; timeout: WorkflowTimeoutDuration | number; }; type WorkflowStepContext = { step: { name: string; count: number; }; attempt: number; config: ResolvedStepConfig; }; ``` #### ReadableStream support in `step.do()` Steps can now return a `ReadableStream` directly. Although non-stream step outputs are [limited to 1 MiB](https://edgetunnel-b2h.pages.dev/workflows/reference/limits/), streamed outputs support much larger payloads. **TypeScript** ```ts const largePayload = await step.do("fetch-large-file", async () => { const object = await env.MY_BUCKET.get("large-file.bin"); return object.body; }); ``` Note that streamed outputs are still considered part of the Workflow instance storage limit. Apr 21, 2026 1. ### [Container logs page now includes relevant Worker and Durable Object logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-correlated-worker-durable-object-logs/) [ Containers ](https://edgetunnel-b2h.pages.dev/containers/) The Container logs page now displays related [Worker](https://edgetunnel-b2h.pages.dev/workers/) and [Durable Object](https://edgetunnel-b2h.pages.dev/durable-objects/) logs alongside container logs. This co-locates all relevant log events for a container application in one place, making it easier to trace requests and debug issues. ![Container logs page showing Worker and Durable Object logs alongside container logs](https://edgetunnel-b2h.pages.dev/_astro/container-worker-logs.BBQ7NRse_1cLVb3.webp) You can filter to a single source when you need to isolate Container, Worker, or Durable Object output. For information on configuring container logging, refer to [How do Container logs work?](https://edgetunnel-b2h.pages.dev/containers/faq/#how-do-container-logs-work). Apr 21, 2026 1. ### [Introducing Billable Usage dashboard and Budget alerts](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts. #### Billable Usage dashboard The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill. The dashboard displays: * A bar chart showing daily usage charges for your billing period * A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs * Ability to view previous billing periods Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice. To access the dashboard, go to **Manage Account** \> **Billing** \> **Billable Usage**. ![Screenshot of the Billable Usage dashboard in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/billable-usage-dashboard.CQvMdtrp_Z2qynps.webp) #### Budget alerts Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end. To configure a budget alert: 1. Go to **Manage Account** \> **Billing** \> **Billable Usage**. 2. Select **Set Budget Alert**. 3. Enter a budget threshold amount greater than $0. 4. Select **Create**. Alternatively, configure alerts via **Notifications** \> **Add** \> **Budget Alert**. ![Create Budget Alert modal in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/budget-alert-modal.BjIzGOLV_Zr8DX5.webp) You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold. Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported. For more information, refer to the [Usage based billing documentation](https://edgetunnel-b2h.pages.dev/billing/understand/usage-based-billing/). Apr 21, 2026 1. ### [WebSocket binary messages now delivered as Blob by default](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-websocket-standard-binary-type/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/) Binary frames received on a `WebSocket` are now delivered to the `message` event as [Blob ↗](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects by default. This matches the [WebSocket specification ↗](https://websockets.spec.whatwg.org/) and standard browser behavior. Previously, binary frames were always delivered as [ArrayBuffer ↗](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global%5FObjects/ArrayBuffer). The [binaryType](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/websockets/#binarytype) property on `WebSocket` controls the delivery type on a per-WebSocket basis. This change has been active for Workers with compatibility dates on or after `2026-03-17`, via the [websocket\_standard\_binary\_type](https://edgetunnel-b2h.pages.dev/workers/configuration/compatibility-flags/#websocket-standard-binary-type) compatibility flag. We should have documented this change when it shipped but didn't. We're sorry for the trouble that caused. If your Worker handles binary WebSocket messages and assumes `event.data` is an `ArrayBuffer`, the frames will arrive as `Blob` instead, and a naive `instanceof ArrayBuffer` check will silently drop every frame. To opt back into `ArrayBuffer` delivery, assign `binaryType` before calling `accept()`. This works regardless of the compatibility flag: **JavaScript** ```js const resp = await fetch("https://example.com", { headers: { Upgrade: "websocket" }, }); const ws = resp.webSocket; // Opt back into ArrayBuffer delivery for this WebSocket. ws.binaryType = "arraybuffer"; ws.accept(); ws.addEventListener("message", (event) => { if (typeof event.data === "string") { // Text frame. } else { // event.data is an ArrayBuffer because we set binaryType above. } }); ``` If you are not ready to migrate and want to keep `ArrayBuffer` as the default for all WebSockets in your Worker, add the `no_websocket_standard_binary_type` flag to your [Wrangler configuration file](https://edgetunnel-b2h.pages.dev/workers/wrangler/configuration/). This change has no effect on the Durable Object hibernatable WebSocket [webSocketMessage](https://edgetunnel-b2h.pages.dev/durable-objects/best-practices/websockets/) handler, which continues to receive binary data as `ArrayBuffer`. For more information, refer to [WebSockets binary messages](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/websockets/#binary-messages). Apr 20, 2026 1. ### [Cloudflare Pipelines as a Logpush destination](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-20-pipelines-logpush-destination/) [ Logs ](https://edgetunnel-b2h.pages.dev/logs/)[ Pipelines ](https://edgetunnel-b2h.pages.dev/pipelines/) Logpush has traditionally been great at delivering Cloudflare logs to a variety of destinations in JSON format. While JSON is flexible and easily readable, it can be inefficient to store and query at scale. With this release, you can now send your logs directly to [Pipelines](https://edgetunnel-b2h.pages.dev/pipelines/) to ingest, transform, and store your logs in [R2](https://edgetunnel-b2h.pages.dev/r2/) as Parquet files or Apache Iceberg tables managed by [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/). This makes the data footprint more compact and more efficient at querying your logs instantly with [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) or any other query engine that supports Apache Iceberg or Parquet. #### Transform logs before storage Pipelines SQL runs on each log record in-flight, so you can reshape your data before it is written. For example, you can drop noisy fields, redact sensitive values, or derive new columns: ```sql INSERT INTO http_logs_sink SELECT ClientIP, EdgeResponseStatus, to_timestamp_micros(EdgeStartTimestamp) AS event_time, upper(ClientRequestMethod) AS method, sha256(ClientIP) AS hashed_ip FROM http_logs_stream WHERE EdgeResponseStatus >= 400; ``` Pipelines SQL supports string functions, regex, hashing, JSON extraction, timestamp conversion, conditional expressions, and more. For the full list, refer to the [Pipelines SQL reference](https://edgetunnel-b2h.pages.dev/pipelines/sql-reference/). #### Get started To configure Pipelines as a Logpush destination, refer to [Enable Cloudflare Pipelines](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/enable-destinations/pipelines/). Apr 20, 2026 1. ### [R2 SQL adds JSON functions, EXPLAIN FORMAT JSON, and unpartitioned table support](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-20-r2-sql-json-functions-explain-format/) [ R2 SQL ](https://edgetunnel-b2h.pages.dev/r2-sql/) [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/) is Cloudflare's serverless, distributed, analytics query engine for querying [Apache Iceberg ↗](https://iceberg.apache.org/) tables stored in [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/). R2 SQL now supports functions for querying JSON data stored in Apache Iceberg tables, an easier way to parse query plans with `EXPLAIN FORMAT JSON`, and querying tables without partition keys stored in [R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/). JSON functions extract and manipulate JSON values directly in SQL without client-side processing: ```sql SELECT json_get_str(doc, 'name') AS name, json_get_int(doc, 'user', 'profile', 'level') AS level, json_get_bool(doc, 'active') AS is_active FROM my_namespace.sales_data WHERE json_contains(doc, 'email') ``` For a full list of available functions, refer to [JSON functions](https://edgetunnel-b2h.pages.dev/r2-sql/sql-reference/scalar-functions/#json-functions). `EXPLAIN FORMAT JSON` returns query execution plans as structured JSON for programmatic analysis and observability integrations: ```bash npx wrangler r2 sql query "${WAREHOUSE}" "EXPLAIN FORMAT JSON SELECT * FROM logpush.requests LIMIT 10;" ┌──────────────────────────────────────┐ │ plan │ ├──────────────────────────────────────┤ │ { │ │ "name": "CoalescePartitionsExec", │ │ "output_partitions": 1, │ │ "rows": 10, │ │ "size_approx": "310B", │ │ "children": [ │ │ { │ │ "name": "DataSourceExec", │ │ "output_partitions": 4, │ │ "rows": 28951, │ │ "size_approx": "900.0KB", │ │ "table": "logpush.requests", │ │ "files": 7, │ │ "bytes": 900019, │ │ "projection": [ │ │ "__ingest_ts", │ │ "CPUTimeMs", │ │ "DispatchNamespace", │ │ "Entrypoint", │ │ "Event", │ │ "EventTimestampMs", │ │ "EventType", │ │ "Exceptions", │ │ "Logs", │ │ "Outcome", │ │ "ScriptName", │ │ "ScriptTags", │ │ "ScriptVersion", │ │ "WallTimeMs" │ │ ], │ │ "limit": 10 │ │ } │ │ ] │ │ } │ └──────────────────────────────────────┘ ``` For more details, refer to [EXPLAIN](https://edgetunnel-b2h.pages.dev/r2-sql/sql-reference/#explain). Unpartitioned Iceberg tables can now be queried directly, which is useful for smaller datasets or data without natural time dimensions. For tables with more than 1000 files, partitioning is still recommended for better performance. Refer to [Limitations and best practices](https://edgetunnel-b2h.pages.dev/r2-sql/reference/limitations-best-practices/) for the latest guidance on using R2 SQL. Apr 20, 2026 1. ### [Moonshot AI Kimi K2.6 now available on Workers AI](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-20-kimi-k2-6-workers-ai/) [ Workers AI ](https://edgetunnel-b2h.pages.dev/workers-ai/) [@cf/moonshotai/kimi-k2.6](https://edgetunnel-b2h.pages.dev/workers-ai/models/kimi-k2.6/) is now available on Workers AI, in partnership with Moonshot AI for Day 0 support. Kimi K2.6 is a native multimodal agentic model from Moonshot AI that advances practical capabilities in long-horizon coding, coding-driven design, proactive autonomous execution, and swarm-based task orchestration. Built on a Mixture-of-Experts architecture with 1T total parameters and 32B active per token, Kimi K2.6 delivers frontier-scale intelligence with efficient inference. It scores competitively against GPT-5.4 and Claude Opus 4.6 on agentic and coding benchmarks, including BrowseComp (83.2), SWE-Bench Verified (80.2), and Terminal-Bench 2.0 (66.7). #### Key capabilities * **262.1k token context window** for retaining full conversation history, tool definitions, and codebases across long-running agent sessions * **Long-horizon coding** with significant improvements on complex, end-to-end coding tasks across languages including Rust, Go, and Python * **Coding-driven design** that transforms simple prompts and visual inputs into production-ready interfaces and full-stack workflows * **Agent swarm orchestration** scaling horizontally to 300 sub-agents executing 4,000 coordinated steps for complex autonomous tasks * **Vision inputs** for processing images alongside text * **Thinking mode** with configurable reasoning depth * **Multi-turn tool calling** for building agents that invoke tools across multiple conversation turns #### Differences from Kimi K2.5 If you are migrating from Kimi K2.5, note the following API changes: * K2.6 uses `chat_template_kwargs.thinking` to control reasoning, replacing `chat_template_kwargs.enable_thinking` * K2.6 returns reasoning content in the `reasoning` field, replacing `reasoning_content` #### Get started Use Kimi K2.6 through the [Workers AI binding](https://edgetunnel-b2h.pages.dev/workers-ai/configuration/bindings/) (`env.AI.run()`), the REST API at `/ai/run`, or the OpenAI-compatible endpoint at `/v1/chat/completions`. You can also use [AI Gateway](https://edgetunnel-b2h.pages.dev/ai-gateway/) with any of these endpoints. For more information, refer to the [Kimi K2.6 model page](https://edgetunnel-b2h.pages.dev/workers-ai/models/kimi-k2.6/) and [pricing](https://edgetunnel-b2h.pages.dev/workers-ai/platform/pricing/). Apr 16, 2026 1. ### [AI Search instances now include built-in storage and namespace Workers Bindings](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-16-ai-search-namespace-binding/) [ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/) New [AI Search](https://edgetunnel-b2h.pages.dev/ai-search/) instances created after today will work differently. New instances come with built-in storage and a vector index, so you can upload a file, have it indexed immediately, and search it right away. Additionally new Workers Bindings are now available to use with AI Search. The new namespace binding lets you create and manage instances at runtime, and cross-instance search API lets you query across multiple instances in one call. #### Built-in storage and vector index All new instances now comes with built-in storage which allows you to upload files directly to it using the [Items API](https://edgetunnel-b2h.pages.dev/ai-search/api/items/workers-binding/) or the dashboard. No R2 buckets to set up, no external data sources to connect first. **TypeScript** ```ts const instance = env.AI_SEARCH.get("my-instance"); // upload and wait for indexing to complete const item = await instance.items.uploadAndPoll("faq.md", content); // search immediately after indexing const results = await instance.search({ messages: [{ role: "user", content: "onboarding guide" }], }); ``` #### Namespace binding The new `ai_search_namespaces` binding replaces the previous `env.AI.autorag()` API provided through the `AI` binding. It gives your Worker access to all instances within a [namespace](https://edgetunnel-b2h.pages.dev/ai-search/concepts/namespaces/) and lets you create, update, and delete instances at runtime without redeploying. **JSONC** ```jsonc // wrangler.jsonc { "ai_search_namespaces": [ { "binding": "AI_SEARCH", "namespace": "default", }, ], } ``` **TypeScript** ```ts // create an instance at runtime const instance = await env.AI_SEARCH.create({ id: "my-instance", }); ``` For migration details, refer to [Workers binding migration](https://edgetunnel-b2h.pages.dev/ai-search/api/migration/workers-binding/). For more on namespaces, refer to [Namespaces](https://edgetunnel-b2h.pages.dev/ai-search/concepts/namespaces/). #### Cross-instance search Within the new AI Search binding, you now have access to a Search and Chat API on the namespace level. Pass an array of instance IDs and get one ranked list of results back. **TypeScript** ```ts const results = await env.AI_SEARCH.search({ messages: [{ role: "user", content: "What is Cloudflare?" }], ai_search_options: { instance_ids: ["product-docs", "customer-abc123"], }, }); ``` Refer to [Namespace-level search](https://edgetunnel-b2h.pages.dev/ai-search/api/search/workers-binding/#namespace-level) for details. Apr 16, 2026 1. ### [AI Search now has hybrid search and relevance boosting](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-16-hybrid-search-and-relevance-boosting/) [ AI Search ](https://edgetunnel-b2h.pages.dev/ai-search/) [AI Search](https://edgetunnel-b2h.pages.dev/ai-search/) now supports hybrid search and relevance boosting, giving you more control over how results are found and ranked. #### Hybrid search Hybrid search combines vector (semantic) search with BM25 keyword search in a single query. Vector search finds chunks with similar meaning, even when the exact words differ. Keyword search matches chunks that contain your query terms exactly. When you enable hybrid search, both run in parallel and the results are fused into a single ranked list. You can configure the tokenizer (`porter` for natural language, `trigram` for code), keyword match mode (`and` for precision, `or` for recall), and fusion method (`rrf` or `max`) per instance: **TypeScript** ```ts const instance = await env.AI_SEARCH.create({ id: "my-instance", index_method: { vector: true, keyword: true }, fusion_method: "rrf", indexing_options: { keyword_tokenizer: "porter" }, retrieval_options: { keyword_match_mode: "and" }, }); ``` Refer to [Search modes](https://edgetunnel-b2h.pages.dev/ai-search/concepts/search-modes/) for an overview and [Hybrid search](https://edgetunnel-b2h.pages.dev/ai-search/configuration/indexing/hybrid-search/) for configuration details. #### Relevance boosting Relevance boosting lets you nudge search rankings based on document metadata. For example, you can prioritize recent documents by boosting on `timestamp`, or surface high-priority content by boosting on a custom metadata field like `priority`. Configure up to 3 boost fields per instance or override them per request: **TypeScript** ```ts const results = await env.AI_SEARCH.get("my-instance").search({ messages: [{ role: "user", content: "deployment guide" }], ai_search_options: { retrieval: { boost_by: [ { field: "timestamp", direction: "desc" }, { field: "priority", direction: "desc" }, ], }, }, }); ``` Refer to [Relevance boosting](https://edgetunnel-b2h.pages.dev/ai-search/configuration/retrieval/boosting/) for configuration details. ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/developer-platform/5/#page","headline":"Developer platform Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/developer-platform/5/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```