{"company":{"name":"Cloudflare","slug":"cloudflare","website":"https://cloudflare.com","category":"security"},"question":"What has Cloudflare shipped recently?","answer":"In the last 30 days, Cloudflare shipped 147 tracked updates. The most recent was \"We just shipped support for the ugliest part of HTTP: Vary\" on 2026-09-22.","window":{"days":30,"updateCount":147,"returned":50},"generatedAt":"2026-09-22T18:59:22.123Z","updates":[{"title":"We just shipped support for the ugliest part of HTTP: Vary","summary":"Cloudflare introduced Vary support in Cache Rules across all plans, allowing customers to control how the CDN handles HTTP Vary headers. The feature lets origins declare which request headers may affect responses while enabling Cloudflare to normalize, bypass, or pass through variations to optimize cache efficiency.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://blog.cloudflare.com/vary-support/","publisher":"blog.cloudflare.com"},{"title":"Introducing Worker Previews: isolated preview environments for every change your agent makes","summary":"Cloudflare introduced Worker Previews, providing isolated, production-like environments for every Git branch. Each branch gets its own URL, configuration, state, and observability tools, enabling atomic, independently testable changes before merging to production. Previews support Durable Objects and Containers with isolated namespaces to prevent cross-contamination.","date":"2026-09-22","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://blog.cloudflare.com/worker-previews/","publisher":"blog.cloudflare.com"},{"title":"Cloudflare adds private MCP server support for MCP portals","summary":"Cloudflare now lets MCP server portals connect to private MCP servers via Cloudflare Gateway without exposing them to the public internet. Private servers are reachable through Cloudflare Tunnel, Mesh, or other connectors, while OAuth endpoints must remain publicly accessible.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-22-private-mcp-servers/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers Previews gains full observability with logs, traces, and metrics","summary":"Cloudflare expanded Workers Previews with independent observability features, including logs, traces, metrics, and Tail Workers, all configurable per Preview. Preview telemetry is now fully separated from production, enabling detailed debugging without impacting live traffic. Browser evidence can also be captured via Browser Run for end-to-end validation.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers/previews/test-and-debug/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers Previews gains scoped configuration and secrets management","summary":"Cloudflare updated Workers Previews to support scoped configuration via a dedicated `previews` block in Wrangler files, allowing teams to define Preview-specific variables, bindings, and secrets separate from production. Secrets can now be set once in a Base configuration and inherited by new Previews, with overrides possible per Preview. The update also clarifies which settings belong at the top level versus in the `previews` block.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers/previews/configuration/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers Previews: resource isolation and binding behavior clarified","summary":"Cloudflare updated Workers Previews documentation to clarify how resources like Durable Objects, KV namespaces, D1 databases, and Containers are isolated or shared across Previews. Key changes include automatic namespace provisioning for Durable Objects and Containers in Previews, and explicit guidance on binding configurations to prevent data sharing between Previews.","date":"2026-09-22","dateIsEstimated":false,"signalType":"technical","signalTypeLabel":"Technical","sourceUrl":"https://developers.cloudflare.com/workers/previews/resources/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare launches Worker Previews for isolated PR testing","summary":"Cloudflare introduced Worker Previews, enabling every pull request to deploy into an isolated, production-like environment with its own URL, configuration, observability, and isolated Durable Objects and Containers. Each Preview runs under the same Worker but remains isolated from production and other Previews.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-22-worker-previews/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers Builds integrates with Cursor Origin for automated deployments","summary":"Cloudflare added Cursor Origin support to Workers Builds, enabling automatic production deployments, branch preview URLs, and build status updates directly in Cursor Origin pull requests. Developers can install the Cloudflare app in Cursor to configure Worker builds and receive check runs for each build.","date":"2026-09-22","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-22-cursor-origin-workers-builds/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds automatic cleanup for inactive Access service tokens","summary":"Cloudflare Access now lets administrators automatically disable or delete service tokens that haven’t authenticated for 30–365 days. Eligible tokens must be older than the set period, unused, and not referenced by any Access policy. Cleanup occurs gradually in the background.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-22-service-token-inactivity-cleanup/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Rules now support up to 32 arguments in concat()","summary":"Cloudflare increased the maximum number of arguments for the `concat()` function in Rules expressions from 16 to 32, enabling richer dynamic value combinations. This change simplifies configurations that merge request data into single headers or values within Ruleset API transforms.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-22-concat-argument-limit/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare integrates Workers with Cursor Origin for automated CI/CD","summary":"Cloudflare launched a Cursor Origin integration enabling automatic builds and deployments of Workers when code is pushed to a production branch. The integration posts build status comments in pull requests, provides Preview URLs for isolated testing, and creates check runs in Cursor Origin for visibility. Teams can manage repository access and reinstall the app if connections fail.","date":"2026-09-22","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/workers/ci-cd/builds/git-integration/cursor-origin-integration/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers introduces Preview deployments for testing","summary":"Cloudflare added Worker Previews to its Workers platform, allowing developers to create preview deployments of Workers without deploying to production. The feature requires Wrangler 4.135.0 or later and supports configuration via a new `previews` block in Wrangler config files. Preview URLs provide live testing links tied to Git branches or custom names.","date":"2026-09-22","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers/previews/get-started/","publisher":"developers.cloudflare.com"},{"title":"Python Workers are now generally available","summary":"Cloudflare announced Python Workers are now generally available, making Python a first-class language in the Cloudflare Workers runtime. Developers can run Python frameworks like FastAPI, Django, and Flask natively, integrate with Cloudflare’s platform bindings (R2, D1, Hyperdrive, AI, etc.), and leverage Workers AI for serverless inference. The release includes new socket system call support for databases and expanded WebAssembly package compatibility via PEP 783.","date":"2026-09-21","dateIsEstimated":false,"signalType":"product_launch","signalTypeLabel":"Launch","sourceUrl":"https://blog.cloudflare.com/python-workers-ga/","publisher":"blog.cloudflare.com"},{"title":"Cloudflare updates Windows WARP client with 20+ fixes and new IPv4 routing support","summary":"Cloudflare released a beta update (v2026.8.1755.1) for its Windows Cloudflare One Client, addressing over 20 issues including DNS reliability, captive portal handling, and TPM-backed authentication. The update also adds support for routing non-RFC 1918 local IPv4 networks through WARP when unrestricted LAN inclusion is enabled.","date":"2026-09-21","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-21-warp-windows-beta/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Browser Run adds typed session and DevTools methods","summary":"Cloudflare’s Browser Run browser bindings now include typed methods for session management, outbound Worker routing, and DevTools operations. Developers can acquire sessions, manage targets, and route requests through Workers for authentication or private services.","date":"2026-09-21","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-21-browser-binding-methods/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare One Client for macOS beta adds IPv4 routing, DNS reliability fixes","summary":"Cloudflare released a beta update for its macOS Cloudflare One Client (version 2026.8.1755.1) addressing 15 bugs and adding support for routing non-RFC 1918 local IPv4 networks through WARP tunnels when unrestricted LAN inclusion is enabled. The update also improves DNS reliability on low-MTU networks and fixes client service crashes and connectivity issues.","date":"2026-09-21","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-21-warp-macos-beta/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds scoped access controls for Workers in dashboard","summary":"Cloudflare introduced a new feature allowing Super Administrators to invite teammates and grant scoped access to individual Workers directly from the Workers dashboard. Four access levels are available, ranging from read-only to full admin rights, with immediate or invitation-based onboarding.","date":"2026-09-21","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-21-invite-members-to-workers/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds dry-run validation for rules and rulesets before deployment","summary":"Cloudflare introduced a dry-run validation feature that checks rule and ruleset changes for syntax, permissions, and plan compatibility without deploying them. The feature is available in the dashboard for security and rate-limiting rules and via the Rulesets API using a `dry_run=true` parameter for mutations. Validation errors are surfaced without persisting changes.","date":"2026-09-21","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/ruleset-engine/rulesets-api/dry-run/","publisher":"developers.cloudflare.com"},{"title":"Saving another 100TB of RAM with math (and Rust)","summary":"Cloudflare reduced the memory footprint of its Pingora Backend Router by optimizing consistent hashing algorithms and Rust structs, reclaiming over 100TB of RAM globally. The changes stemmed from a ticket identifying excessive memory usage in the pingora-ketama library, leading to both algorithmic improvements and low-level memory optimizations.","date":"2026-09-18","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://blog.cloudflare.com/saving-100-tb-of-ram-with-math/","publisher":"blog.cloudflare.com"},{"title":"Cloudflare adds Inspect panel to Browser Run Session Recordings","summary":"Cloudflare introduced an Inspect panel for Browser Run Session Recordings, enabling developers to review console logs, network requests, and DOM structure after a session ends. The feature includes searchable logs, HAR file downloads, and API access to recorded network activity.","date":"2026-09-18","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-18-browser-run-session-recording-inspect/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare to deprecate 32-bit Windows and Intel-based macOS cloudflared builds in 2027","summary":"Cloudflare announced it will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared starting in 2027, halting new releases for these architectures. The move aligns with the end of OS support for both platforms, as Windows 10 and macOS 26 Tahoe were the last versions to support them.","date":"2026-09-18","dateIsEstimated":false,"signalType":"product_sunset","signalTypeLabel":"Sunset","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-18-cloudflared-architecture-deprecation/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare launches Unified Routing for WAN and Magic Transit","summary":"Cloudflare announced the general availability of Unified Routing, a new routing fabric integrating Cloudflare One with WAN and Magic Transit on-ramps. It introduces features like Automatic Return Routing, BGP support, and custom client subnets, recommended for all new accounts.","date":"2026-09-18","dateIsEstimated":false,"signalType":"product_launch","signalTypeLabel":"Launch","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-18-unified-routing-ga/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds DDoS attack traffic filtering to Logpush","summary":"Cloudflare introduced a feature to exclude identified DDoS attack traffic from Logpush datasets before delivery. The option applies to `http_requests`, `firewall_events`, and `network_analytics_logs` datasets and can be enabled via dashboard or API with a `filter_attack_traffic` flag.","date":"2026-09-18","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-18-filter-ddos-attack-traffic/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers now includes JavaScript RPC session spans in traces","summary":"Cloudflare Workers traces now automatically include JavaScript RPC session spans for Worker-to-Worker and Worker-to-Durable Object calls, providing deeper visibility into call lifetimes, method invocations, and nested execution paths. The feature is enabled via a simple Wrangler configuration toggle and requires no code changes.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-17-javascript-rpc-session-spans/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds rejectIfBusy option for Workers AI synchronous inference","summary":"Cloudflare introduced the `rejectIfBusy` option for Workers AI synchronous inference requests, allowing them to fail immediately when capacity is unavailable instead of waiting in a queue. The feature is available via Workers AI binding, REST API, and OpenAI-compatible endpoints.","date":"2026-09-17","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-17-reject-if-busy/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare enables self-serve Free account creation via dashboard, API, and Enterprise orgs","summary":"Cloudflare now allows all customers to create additional Free accounts directly in the dashboard, while Enterprise Super Administrators can provision up to five Free accounts within their organization. Programmatic account creation is also supported via API tokens or OAuth access tokens.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-15-free-account-creation/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers AI adds rejectIfBusy to fail synchronous inference requests when capacity is unavailable","summary":"Cloudflare introduced a `rejectIfBusy` option for Workers AI that immediately rejects synchronous inference requests when capacity is unavailable, returning a 429 error with code 3040. The feature is available via REST API, Workers binding, and OpenAI-compatible Chat Completions endpoints.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers-ai/features/reject-if-busy/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare expands Workers tracing with new spans and attributes","summary":"Cloudflare Workers now automatically captures a broader set of spans and attributes for observability without requiring code changes. New attributes include detailed HTTP request/response metadata, cache operations, RPC calls, D1 database queries, KV operations, and handler-specific fields like CPU time, execution model, and outcomes. This enhances debugging, performance monitoring, and third-party tool integration.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers/observability/traces/spans-and-attributes/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds batch and individual deletion for Workflow instances","summary":"Cloudflare introduced the ability to delete one or up to 100 Workflow instances and their stored state via the Workflows API or Wrangler 4.125.0+. Deleting an instance stops execution and frees storage, with batch operations supported up to 100 IDs at once.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-17-instance-delete/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds dry-run validation for Rulesets changes","summary":"Cloudflare introduced automatic validation for Rulesets changes in the dashboard and a new `dry_run=true` parameter for the Rulesets API. This prevents invalid configurations from being published by catching errors like invalid expressions, permission issues, or quota limits before deployment.","date":"2026-09-17","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-17-rulesets-dry-run-validation/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare expands Workflows Workers API with new step methods and instance management","summary":"Cloudflare updated its Workflows Workers API to introduce enhanced step methods like `step.do` with rollback options, `step.sleep`, `step.sleepUntil`, and `step.waitForEvent`, alongside improved instance status tracking via the Workers API and REST API. The changes enable more robust workflow orchestration, including retry configurations, event waiting, and binary output handling.","date":"2026-09-17","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/workflows/build/workers-api/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare R2 Data Catalog adds automated table maintenance for Iceberg tables","summary":"Cloudflare’s R2 Data Catalog now automates two critical maintenance operations for Apache Iceberg tables: compaction (combining small files into larger, efficient ones) and snapshot expiration (removing old snapshots and unreferenced data). These features reduce query latency, metadata overhead, and storage costs by optimizing table performance automatically.","date":"2026-09-17","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/r2-data-catalog/table-maintenance/","publisher":"developers.cloudflare.com"},{"title":"When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts","summary":"Cloudflare’s Page Shield ML detected four live malicious JavaScript campaigns on storefronts that evaded traditional scanners like VirusTotal and URLScan. The GNN-based model caught all eight payloads in real time, including dormant scripts triggered by specific conditions, while public scanners missed seven of them. A lightweight LLM on Workers AI provides a second opinion to reduce false positives.","date":"2026-09-16","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://blog.cloudflare.com/client-side-security-finds-4-malicious-campaigns/","publisher":"blog.cloudflare.com"},{"title":"Cloudflare updates AI Gateway with new guardrails, DLP, and rate-limiting controls","summary":"Cloudflare expanded its AI Gateway API with new updateable parameters including configurable guardrails (prompt/response blocking), data loss prevention (DLP) policies with BLOCK/FLAG actions, rate-limiting controls, BYOK-only mode, and cache invalidation settings. These changes enable customers to enforce stricter content policies and usage limits on AI workloads.","date":"2026-09-16","dateIsEstimated":true,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/api/resources/ai_gateway/methods/update/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Tunnel gains bulk route creation, origin settings UI, and live log streaming","summary":"Cloudflare Tunnel received three major updates: bulk route creation for multiple tunnels/mesh routes in one action, direct dashboard configuration of origin application settings (HTTP/TLS/connection parameters), and real-time log streaming in the dashboard. Hostname routing is now GA with a new public IPv4 range to avoid Chromium’s Local Network Access restrictions.","date":"2026-09-16","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds Hyperdrive support for Python Workers to connect to PostgreSQL and MySQL","summary":"Cloudflare now allows Python Workers to connect to PostgreSQL and MySQL databases via Hyperdrive, providing connection pooling and query caching. This expands Workers' database integration capabilities beyond JavaScript/TypeScript.","date":"2026-09-16","dateIsEstimated":false,"signalType":null,"signalTypeLabel":null,"sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-16-hyperdrive-python-workers/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare R2 Data Catalog gains table maintenance visibility and manual queueing","summary":"Cloudflare’s R2 Data Catalog now offers table-level maintenance visibility and manual compaction queueing in the dashboard. Users can inspect schedules, review audit logs of completed operations, and request maintenance directly from the table view, alongside an updated catalog layout and improved schema browser.","date":"2026-09-16","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-16-table-maintenance-dashboard/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers gains granular authorization with scoped roles","summary":"Cloudflare introduced four new Developer Platform roles (Metadata Read-Only, Content Read-Only, Editor, Admin) to scope access to individual Workers, enabling least-privilege permissions for teammates and agents. These roles are available immediately for all customers and can be assigned via the dashboard or API tokens.","date":"2026-09-15","dateIsEstimated":true,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://blog.cloudflare.com/workers-granular-authorization/","publisher":"blog.cloudflare.com"},{"title":"Cloudflare adds Hyperdrive support for Python Workers in beta","summary":"Cloudflare expanded Hyperdrive database connectivity to Python Workers, enabling PostgreSQL and MySQL connections via TCP sockets in beta. The feature requires a compatibility date of September 8, 2026 or later and supports recommended drivers like asyncpg and aiomysql.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/hyperdrive/examples/python-workers/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds .subscribe() to stream Workflow instance events","summary":"Cloudflare Workflows instances now support a .subscribe() method and a new API endpoint to stream real-time events, including step attempts, sleeps, waits, and rollbacks. Workers and applications can react to events without polling, with options to filter by event type or start from a specific cursor.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-15-instance-event-subscriptions/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare WAF release adds SSRF and command injection protections","summary":"Cloudflare’s September 15, 2026 WAF release introduces new threat detections for command injection, SSRF targeting cloud metadata, and version control information disclosure. Three managed rulesets now default to 'Block' instead of 'Log', including a new SSRF rule and an updated version control disclosure rule.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-15-waf-release/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds granular Worker permissions with four new roles","summary":"Cloudflare introduced four new roles to control access to specific Workers, enabling fine-grained permissions for teammates, agents, and CI/CD workflows. Roles range from Metadata Read-Only to Admin, with scoping available per Worker or across all Workers. The feature is available today via dashboard, API, or Terraform.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-15-granular-worker-permissions/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Access gains tag-based policies, fresh SAML auth, and Worker-wide protection","summary":"Cloudflare Access introduced tag-based target criteria for infrastructure applications, enabling policy matching by hostname or tags with include/require/exclude operators. It also added fresh SAML reauthentication requirements, scannable service token secret formats, and grace periods for secret rotation. New controls allow disabling service tokens temporarily and enabling Access on individual or all Workers at once, with resource-scoped roles for granular delegation.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/cloudflare-one/changelog/access/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workflows adds real-time event subscription without polling","summary":"Cloudflare Workflows introduced a `subscribe()` method allowing developers to receive historical and live instance events in real time without polling the `status()` API. Subscriptions deliver retained events first, then stream new events until terminal states like `workflow_completed` or `workflow_errored` are reached. Event filtering, cursor-based resumption, and automatic resource disposal are supported.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workflows/build/subscribe-to-instance-events/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare Workers rolls out granular role-based permissions and scopes","summary":"Cloudflare introduced a new role-based permission system for Workers, replacing legacy permissions with four distinct roles (Metadata Read-Only, Content Read-Only, Editor, Admin) and two scope levels (product-wide or per-Worker). The update enables granular access control for members, User Groups, and API tokens, with role assignments determining allowed actions like deployment, editing, or metadata viewing.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/workers/authorization/workers/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds tag-based target criteria to Access for Infrastructure","summary":"Cloudflare’s Access for Infrastructure now supports attaching key-value tags to infrastructure targets and using those tags in access policies via include, require, and exclude operators. Tags can be managed inline or via the Resource Tagging API and sync automatically across methods.","date":"2026-09-15","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-15-infrastructure-target-tags/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds shadowed record warnings for all zones","summary":"Cloudflare now displays warnings for shadowed DNS records across all zones, helping users identify records no longer authoritative due to subdomain delegation. Shadow metadata is also available via the DNS records API with `include_shadow_metadata=true`.","date":"2026-09-14","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-14-shadowed-record-warnings/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare updates cache behavior for HTTP range requests","summary":"Cloudflare revised its documentation to explain how it processes HTTP range requests, including eligibility rules, client response behavior, and origin request alignment. The update clarifies caching requirements for partial content responses and introduces constraints like 1 MiB cache boundary alignment for origin requests.","date":"2026-09-14","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/cache/reference/range-requests/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare adds hostname guardrails to Browser Run for secure automation","summary":"Cloudflare’s Browser Run now enforces hostname-based guardrails to restrict HTTP/HTTPS requests to permitted domains during browser automation sessions. This prevents external content loading and ensures workflows stay within defined boundaries. A new read-only mode for Live View also allows passive session observation without interaction.","date":"2026-09-14","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-14-guardrails/","publisher":"developers.cloudflare.com"},{"title":"Cloudflare AI Gateway adds provider credential requirement to prevent Unified Billing fallback","summary":"Cloudflare’s AI Gateway now enforces provider credential requirements for third-party requests to prevent fallback to Unified Billing. Users can enable the 'Require provider credentials' setting or set `byok_only: true` via API, with non-compliant requests returning HTTP 400 errors. Workers AI requests remain unaffected.","date":"2026-09-14","dateIsEstimated":false,"signalType":"feature_update","signalTypeLabel":"Feature","sourceUrl":"https://developers.cloudflare.com/changelog/post/2026-09-14-require-provider-credentials/","publisher":"developers.cloudflare.com"}],"attribution":{"source":"Spyingbee","url":"https://spyingbee.com/updates/cloudflare","citation":"Spyingbee, \"Cloudflare updates\", https://spyingbee.com/updates/cloudflare (retrieved 2026-09-22)"}}