Cloudflare Release Notes

We're announcing the GA of Optional OAuth Scopes.
OAuth client developers can now classify configured scopes as required or optional in the Cloudflare dashboard. By default, all configured scopes remain required.

What's New

• Optional Scopes: OAuth clients can now mark configured scopes as optional, allowing applications to request them without requiring users to approve them.
• Scope Selection: On the consent screen, users must grant required scopes but can decline optional scopes. This helps customers apply least-privilege access to applications, CLIs, and workloads. Optional scopes are selected by default.
• Templates: The consent screen now includes Read Only and Full Access templates to make scope selection faster and easier.
• Search: Users can now search scopes in the consent screen.

Learn how to select client scopes and edit optional permissions.

Original source

Leaked credentials detection now scans the Authorization request header for Basic Authentication credentials. Previously, the detection only inspected request bodies, query strings, and headers for well-known web applications or custom detection locations, which meant credentials sent through HTTP Basic Authentication were not covered by default.

This new default scan location decodes the Authorization: Basic <credentials> header and compares the extracted username and password against Cloudflare's database of leaked credentials, the same way as other default scan locations. Matches populate the existing leaked credentials fields, such as cf.waf.credential_check.password_leaked, and trigger the Exposed-Credential-Check managed transform header if configured, so you can reuse existing custom rules and rate limiting rules without changes.

This change was applied automatically for zones with leaked credentials detection enabled. No configuration changes are required.

For more information, refer to Leaked credentials detection.

Original source

We're announcing the GA of Optional OAuth Scopes.

OAuth client developers can now classify configured scopes as required or optional in the Cloudflare dashboard. By default, all configured scopes remain required.

What's New

• Optional Scopes: OAuth clients can now mark configured scopes as optional, allowing applications to request them without requiring users to approve them.
• Scope Selection: On the consent screen, users must grant required scopes but can decline optional scopes. This helps customers apply least-privilege access to applications, CLIs, and workloads. Optional scopes are selected by default.
• Templates: The consent screen now includes Read Only and Full Access templates to make scope selection faster and easier.
• Search: Users can now search scopes in the consent screen.

Learn how to select client scopes and edit optional permissions.

Original source

GPT-5.6 Sol is available through AI Gateway, and for a limited time you can use it at 50% off. If you are already using AI Gateway, point to the openai/gpt-5.6-sol model and the discounted pricing applies automatically — no promo code needed.

The promotion is available for Unified Billing users only (not Bring Your Own Keys). Load credits onto AI Gateway and start sending requests to openai/gpt-5.6-sol.

Discounted pricing during the promotion:

Usage Promotional price Standard price Input $2.50 per 1M tokens $5 per 1M tokens Output $15 per 1M tokens $30 per 1M tokens Cache read $0.25 per 1M tokens $0.50 per 1M tokens

The promotion runs through September 18, 2026. After that date, GPT-5.6 Sol requests return to standard pricing.

For more details, refer to the Unified Billing documentation and the GPT-5.6 Sol model page.

Original source

GPT-5.6 Sol is available through AI Gateway, and for a limited time you can use it at 50% off. If you are already using AI Gateway, point to the openai/gpt-5.6-sol model and the discounted pricing applies automatically — no promo code needed.

The promotion is available for Unified Billing users only (not Bring Your Own Keys). Load credits onto AI Gateway and start sending requests to openai/gpt-5.6-sol.

Discounted pricing during the promotion:

Usage

Promotional price

Standard price

Input

$2.50 per 1M tokens

$5 per 1M tokens

Output

$15 per 1M tokens

$30 per 1M tokens

Cache read

$0.25 per 1M tokens

$0.50 per 1M tokens

The promotion runs through September 18, 2026. After that date, GPT-5.6 Sol requests return to standard pricing.

For more details, refer to the Unified Billing documentation and the GPT-5.6 Sol model page.

Original source

GPT-5.6 Sol is available through AI Gateway, and for a limited time you can use it at 50% off. If you are already using AI Gateway, point to the openai/gpt-5.6-sol model and the discounted pricing applies automatically — no promo code needed.

The promotion is available for Unified Billing users only (not Bring Your Own Keys). Load credits onto AI Gateway and start sending requests to openai/gpt-5.6-sol.

Discounted pricing during the promotion

Usage | Promotional price | Standard price
Input | $2.50 per 1M tokens | $5 per 1M tokens
Output | $15 per 1M tokens | $30 per 1M tokens
Cache read | $0.25 per 1M tokens | $0.50 per 1M tokens

The promotion runs through September 18, 2026. After that date, GPT-5.6 Sol requests return to standard pricing.

For more details, refer to the Unified Billing documentation and the GPT-5.6 Sol model page.

Original source

Additional changes and improvements

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary.

When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks.

• Fixed a process leak in the Windows GUI that could exhaust system resources during IPC client-creation failures.
• Fixed being unable to switch organizations when the client was stuck in the "Device not in organization" state.
• Fixed an issue where Microsoft Defender would falsely flag the Cloudflare One Client installation as malicious when installing with Intune.
• Made the Windows domain-joined posture check more reliable.
• A DNS search domain parsing failure no longer prevents connection.
• Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected.
• Fixed missing certificate error display due to a race condition.
• Fixed empty black window after transitioning from docked dual displays to undocked/internal display.

Known issues

None

For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/

For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Original source

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary.

When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks.

Additional changes and improvements

• Fixed the client not allowing login to another organization when currently showing "Device not in organization."
• A DNS search domain parsing failure no longer prevents connection.
• Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected.
• Fixed missing certificate error display due to a race condition.
• Fixed crash when trying to connect to captive portal on Wi-Fi.
• Fixed empty black window after transitioning from docked dual displays to undocked/internal display.

Known issues

None

For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/

For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Original source

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary.

When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks.

Additional changes and improvements

• Fixed the client not allowing login to another organization when currently showing "Device not in organization."
• A DNS search domain parsing failure no longer prevents connection.
• Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected.
• Fixed missing certificate error display due to a race condition.
• Fixed empty black window after transitioning from docked dual displays to undocked/internal display.
• Fixed hostname routes not working for Cloudflare Mesh when the IP addresses of the hostnames are local addresses.

Known issues

• When in DNS Only mode, the client may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Local Domain Fallback works as expected in other client modes.

For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/

For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Original source

You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a Cloudflare Tunnel. These settings control how cloudflared connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files.

When editing a published application, expand Additional application settings to configure parameters organized into three categories:

HTTP

Set a custom HTTP Host header or disable chunked encoding.

TLS

Configure origin server name, CA pool, TLS timeout, disable TLS verification, match SNI to host, or enable HTTP/2 to origin.

Connection

Tune connect timeout, keep-alive timeout, keep-alive connections, TCP keep-alive interval, proxy type, or disable Happy Eyeballs.

Go to Tunnels ↗

For the full list of origin parameters, refer to Origin parameters.

Original source

You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a Cloudflare Tunnel. These settings control how cloudflared connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files.

When editing a published application, expand Additional application settings to configure parameters organized into three categories:

HTTP

Set a custom HTTP Host header or disable chunked encoding.

TLS

Configure origin server name, CA pool, TLS timeout, disable TLS verification, match SNI to host, or enable HTTP/2 to origin.

Connection

Tune connect timeout, keep-alive timeout, keep-alive connections, TCP keep-alive interval, proxy type, or disable Happy Eyeballs.

Go to Tunnels ↗

For the full list of origin parameters, refer to Origin parameters.

Original source

Minor Changes

• #15026 6529f0c Thanks @petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

{
  "name": "my-worker",
  "main": "worker.js",
  "compatibility_date": "2026-07-01",
  "containers": [
    { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
  ],
  "exports": {
    "MyContainerDO": {
      "type": "durable-object",
      "storage": "sqlite",
      "container": "my-container"
    }
  }
}

The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

• a container reference names a container that does not exist
• two Durable Object exports claim the same container
• a container and a Durable Object export disagree about which one they are linked to
• a container ends up linked to no Durable Object at all
• two containers share a name
• a container's class_name names a Durable Object whose storage is legacy-kv
• two containers are attached to the same Durable Object

That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

• #15211 bc5726b Thanks @nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.
• #14999 ba54f0d Thanks @mittalpk! - Fix .env loading on Windows leaking stale, differently-cased duplicate keys

On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env. When a key was set again under a different casing (e.g. a value in .env.local overriding one from .env with different casing), the previous casing was never removed from the underlying object. env.PATH/env.Path still returned the correct, latest value, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — would see both the stale and current key.

Duplicate entries no longer appear, so environment variables passed to subprocesses and any code that lists the environment now see only the latest value for each variable.

• #15044 b7422b0 Thanks @stareezy-1! - Normalize structural CRLF line endings before sending D1 commands to the remote query API

wrangler d1 migrations apply --remote and wrangler d1 execute --remote --command failed with incomplete input: SQLITE_ERROR when the SQL contained CRLF line endings inside a compound statement such as a CREATE TRIGGER ... BEGIN ... END; body. Structural line endings are now normalized to LF before the command is sent to the D1 query API, while CRLF inside quoted values and identifiers remains unchanged.

• #15046 186339c Thanks @erwinzhang7! - Fixes D1 SQL statements not handling lowercase ends correctly

wrangler d1 execute and wrangler d1 migrations apply split a SQL file into statements before running them. A BEGIN or CASE block closed with a lowercase end was not recognised as closed, so every statement after it was folded into that block instead of being run on its own. SQLite accepts either case, so a file like this applied only the trigger and silently skipped the table:

CREATE TRIGGER IF NOT EXISTS update_trigger AFTER UPDATE ON items
begin
DELETE FROM updates WHERE item_id=old.id;
end;
CREATE TABLE after_the_trigger (id TEXT PRIMARY KEY);

Files written with an uppercase END were unaffected. Both cases now behave the same.

• #15231 4f922dc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency
From
To

@cloudflare/workers-types
^5.20260811.1
^5.20260814.1

workerd
1.20260811.1
1.20260814.1

• #15248 4d74b8d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency
From
To

@cloudflare/workers-types
^5.20260814.1
^5.20260815.1

workerd
1.20260814.1
1.20260815.1

• #15185 1f79ace Thanks @jamesopstad! - Resolve --latest to the newest compatibility date supported by the installed runtime

wrangler deploy --latest and wrangler versions upload --latest resolved the compatibility date to the current date, and wrangler pages download config did the same for projects configured to always use the latest compatibility date. Both write that date into a configuration file for subsequent commands to use, so a date that the installed workerd did not yet support left the project unable to run wrangler dev.

These now resolve to the latest compatibility date supported by this version of Wrangler, which is the release date of the workerd it ships with.

• #15151 49f73de Thanks @maximilliangrand! - Fix spurious Trailing comma jsonc(519) warnings for wrangler.jsonc in VS Code 1.131+

Trailing commas in wrangler.jsonc files that reference Wrangler's JSON schema are no longer reported as errors by recent versions of VS Code. Wrangler always accepted these files; only the editor warning was wrong.

• #14983 7cee278 Thanks @kdelay! - Respect CLOUDFLARE_ACCOUNT_ID in wrangler pages project list, create and delete

These three commands could target a previously used account even when CLOUDFLARE_ACCOUNT_ID was set, failing with Authentication error [code: 10000] in setups with more than one account. They now use the account named by CLOUDFLARE_ACCOUNT_ID, matching the rest of wrangler pages. When the variable is unset, the previously used account is still selected, as before.

• #15153 265256a Thanks @podonnell-dev! - Fix wrangler preview base-config commands showing an inherited script positional
• #15185 1f79ace Thanks @jamesopstad! - Use a fixed default compatibility date rather than the current date

When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• #15239 f431166 Thanks @jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime types

Runtime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit nodejs_compat flag. Node.js globals continue to come from @types/node instead of being generated as any declarations that override those types.

• #15196 8fb2b87 Thanks @skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance region

Container builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either compliance_region or CLOUDFLARE_COMPLIANCE_REGION.

• #15082 75cf407 Thanks @penalosa! - Enable the new configuration format in the cf-wrangler dev delegate

Projects started through cf dev now load cloudflare.config.ts and optional wrangler.config.ts, matching the configuration used by the delegate's build path.

Updated dependencies [1277a72, 4f922dc, 4d74b8d, 2e0c962, 8777180]:

• [email protected]

Original source

Patch Changes

• #15206 1277a72 Thanks @petebacondarwin! - Recover automatically from a partially downloaded Chrome install for the Browser Run binding

  If the Chrome download for a browser binding was interrupted — a cancelled dev session, a killed test run, a machine going to sleep — the next launch could fail indefinitely with Failed to launch the browser process!, usually alongside a message about being unable to load resources.pak. @puppeteer/browsers treats an install as present as soon as the executable exists, and the Chrome archives extract alphabetically, so the executable is written long before the resources it needs. Every subsequent launch then reused the half-written directory, and the only way out was deleting the Chrome cache by hand.

  Miniflare now detects this: an install that Chrome has never successfully started from is cleared and re-downloaded on a failed launch, rather than reused forever. Overlapping launches also share a single download instead of racing to populate the same directory.

• #15231 4f922dc Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency
  From
  To
  @cloudflare/workers-types
  ^5.20260811.1
  ^5.20260814.1
  workerd
  1.20260811.1
  1.20260814.1

• #15248 4d74b8d Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency
  From
  To
  @cloudflare/workers-types
  ^5.20260814.1
  ^5.20260815.1
  workerd
  1.20260814.1
  1.20260815.1

• #15143 2e0c962 Thanks @teamleaderleo! - Prevent workerd from remaining running during Miniflare shutdown when browser or proxy cleanup is slow or fails.

• #15232 8777180 Thanks @vicb! - Bump capnp-es to 0.0.16.

Original source

Patch Changes

• #15217 1447950 Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  @angular/create
  22.1.3
  22.1.4

• #15218 6d71eeb Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  create-solid
  0.8.1
  0.10.0

• #15219 ee15a07 Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  create-next-app
  16.3.0
  16.3.1

• #15220 1282749 Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  create-vinext-app
  1.0.0-beta.1
  1.0.0-beta.2

• #15221 7af190a Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  create-analog
  2.6.4
  2.7.0

• #15222 afe5788 Thanks @dependabot! - Update dependencies of "create-cloudflare"
  The following dependency versions have been updated:
  Dependency
  From
  To
  create-vike
  0.0.673
  0.0.675

• #14953 05959fb Thanks @edmundhung! - Update the Hello World templates to use the latest version of @cloudflare/vitest-pool-workers.

• #15185 1f79ace Thanks @jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

Original source

Patch Changes

• #15088 fb6b51b Thanks @Neal006! - Report malformed container SSH keys and a non-object containers.configuration as config errors instead of crashing

Previously, a containers entry with a malformed authorized_keys or trusted_user_ca_keys entry (a missing or non-string public_key, or an entry that is not an object), or a containers.configuration set to null, made Wrangler exit with a stack trace and "If you think this is a bug, please open an issue" rather than pointing at the field.

These configurations now produce an ordinary configuration error naming the offending field and array index, such as containers.authorized_keys[0].public_key must be a string. A public_key that is not an ED25519 key is also now reported with correct grammar.

• #15010 1b73c87 Thanks @LeSingh1! - Report an invalid queues.consumers value as a configuration error instead of crashing

Previously, setting queues.consumers to something other than an array (for example null or a string) could crash Wrangler or produce a flood of confusing extra errors. You now get a single clear message telling you the field must be an array.

Original source