{"id":"src_HK2nmgE5Y4mYG_7XbNmud","slug":"cloudflare-cloudflare-one","name":"Cloudflare One Changelog","type":"feed","url":"https://developers.cloudflare.com/changelog/?area=cloudflare-one","orgId":"org_fW6EY8PY8Cr42ifo1IUAm","productId":"prod_asvsd1ug1PqS0j2DnzY-5","productSlug":"cloudflare-one","org":{"id":"org_fW6EY8PY8Cr42ifo1IUAm","slug":"cloudflare","name":"Cloudflare"},"isPrimary":false,"isHidden":false,"discovery":"curated","fetchPriority":"normal","metadata":"{\"feedUrl\":\"https://developers.cloudflare.com/changelog/rss/cloudflare-one.xml\",\"feedType\":\"rss\",\"feedDiscoveredAt\":\"2026-06-19T21:04:44.630Z\",\"noFeedFound\":false,\"feedContentDepth\":\"full\",\"feedEtag\":\"\\\"4dbc2c9cfe53343ee9fb84f551822e32\\\"\",\"feedContentLength\":\"1023871\",\"enrichment\":{\"consecutiveFailures\":1},\"sourceActor\":{\"nextAlarmAt\":\"2026-11-03T14:04:32.450Z\",\"lastAlarmAt\":\"2026-11-03T10:04:33.699Z\",\"managed\":true}}","notice":null,"kind":null,"stars":null,"starsFetchedAt":null,"releaseCount":332,"releasesLast30Days":34,"avgReleasesPerWeek":6.9,"latestVersion":null,"latestDate":"2026-11-02T00:00:00.000Z","changelogUrl":null,"hasChangelogFile":false,"lastFetchedAt":"2026-11-02T22:02:13.968Z","lastPolledAt":"2026-11-03T10:05:51.331Z","changeDetectedAt":null,"trackingSince":"2025-05-18T00:00:00.000Z","releases":[{"id":"rel_DaWTDLw_cs4S-gOnJBe50","version":null,"type":"feature","title":"Cloudflare One, Access - Organize and authorize Access service tokens with tags","summary":"Access service tokens now support up to five key-value tags, editable in the dashboard or service token API, searchable on the Service Tokens page, and queryable in Resource Tagging. A new Service Token Tag policy selector matches tokens by exact key-value pair in a Service Auth policy, so access can be granted by environment or team without listing each token.","titleGenerated":"Cloudflare One Access lets you tag service tokens and authorize by tag","titleShort":"Service tokens get tags; authorize by env or team","breaking":"none","importance":3,"content":"You can now assign key-value tags to [Access service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#tag-service-tokens) and use those tags to organize credentials or control application access. Each token supports up to five tags, such as `environment: production` or `team: payments`.\n\nAdd or edit tags when you create or update a token in the dashboard or service token API. You can search and filter by tag on the **Service Tokens** page. Tags also appear in [Resource Tagging](https://developers.cloudflare.com/resource-tagging/), where you can query them alongside other tagged resources.\n\nThe **Service Token Tag** policy selector matches valid tokens with an exact key-value pair. Use it in a **Service Auth** policy to authorize tokens by environment or team without listing each token individually. For example, this API policy configuration accepts valid tokens tagged `environment: production`:\n\n```\n{\n\t\"name\": \"Production service tokens\",\n\t\"decision\": \"non_identity\",\n\t\"include\": [\n\t\t{\n\t\t\t\"service_token_tag\": {\n\t\t\t\t\"key\": \"environment\",\n\t\t\t\t\"value\": \"production\"\n\t\t\t}\n\t\t}\n\t]\n}\n```\n\nFor setup instructions, refer to [Tag service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#tag-service-tokens) and [Authorize service tokens by tag](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#authorize-service-tokens-by-tag).","publishedAt":"2026-11-02T00:00:00.000Z","fetchedAt":"2026-11-02T22:01:57.687Z","url":"https://developers.cloudflare.com/changelog/post/2026-11-02-service-token-tags/","media":[],"coverageCount":0},{"id":"rel_gUXV5LUn6TcYOFcmAZzsX","version":null,"type":"feature","title":"Data Localization Suite, Cloudflare WAN, Cloudflare One - Cloudflare WAN supports regional Gateway HTTP inspection","summary":"Cloudflare WAN traffic can now use a Gateway processing region with Regional Services, keeping HTTPS traffic encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. The feature requires unified routing, applies only to Gateway HTTP traffic rather than DNS or network policy processing, and is configured through your account team.","titleGenerated":"Cloudflare WAN supports regional Gateway HTTP inspection via Regional Services","titleShort":"WAN traffic can now be processed in a chosen region","breaking":"none","importance":3,"content":"Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data center (that may be outside the selected region) via an IPsec or GRE tunnel, or through Direct CNI, and remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. This feature gives organizations control over where their sensitive traffic is processed, supporting their data sovereignty goals.\n\nThis feature requires [unified routing](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/reference/traffic-steering/#unified-routing-mode). The processing region applies to Gateway HTTP traffic and does not apply to Gateway DNS or network policy processing.\n\nContact your account team to configure a processing region. For supported regions, configuration details, and limitations, refer to [Data residency for Cloudflare One](https://developers.cloudflare.com/data-localization/how-to/zero-trust/#processing-region-for-gateway).","publishedAt":"2026-10-30T00:00:00.000Z","fetchedAt":"2026-10-30T21:38:08.047Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-30-cloudflare-wan-regional-processing/","media":[],"coverageCount":0},{"id":"rel_Ftx2Kj8EGxcy-rsrdf2P8","version":null,"type":"feature","title":"Cloudflare One, Access - Inspect provisioned users and groups with the SCIM population viewer","summary":"The SCIM population viewer in Zero Trust > Integrations > Identity providers lets admins search provisioned users and groups, inspect attributes in formatted or JSON views, view group members, compare Cloudflare and IdP resource IDs against provisioning logs, and delete individual resources with edit permission. The viewer shows provisioned resources rather than provisioning event history; deprovisioning and policy behavior are unchanged.","titleGenerated":"Cloudflare One adds SCIM population viewer for inspecting provisioned users and groups","titleShort":"SCIM population viewer shows provisioned users and groups","breaking":"none","importance":2,"content":"The SCIM population viewer lets you inspect the users and groups provisioned to Cloudflare One by each identity provider. You can check which resources Cloudflare has received without making API requests or opening a support ticket.\n\nIn **Zero Trust** > **Integrations** > **Identity providers**, select a user or group count in **SCIM resources** to open the viewer. You can:\n\n- Search users by username, email, name, or resource ID, and groups by name or resource ID.\n- Inspect resource attributes in formatted or JSON views.\n- View group members and compare Cloudflare and IdP resource IDs with provisioning logs.\n- Delete individual resources from the Cloudflare SCIM population when you have edit permission.\n\n\n\nThe viewer shows provisioned resources rather than provisioning event history. Use [SCIM provisioning logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/scim-logs/) to investigate failed requests. Existing SCIM deprovisioning and policy behavior remain unchanged.\n\nFor dashboard instructions and API examples, refer to [View SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim-population-viewer/).","publishedAt":"2026-10-30T00:00:00.000Z","fetchedAt":"2026-10-30T21:38:08.047Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-30-scim-population-viewer/","media":[{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1132,height=960,format=webp/_astro/scim-population-viewer.CFxa6Ccp.png","alt":"SCIM users table with search controls and blurred personal information","r2Key":"releases/ee5872b9a8b364a9184b51aee9dedc4e01ad8052e96945630e74e9a053b784ef.png","r2Url":"https://media.releases.sh/releases/ee5872b9a8b364a9184b51aee9dedc4e01ad8052e96945630e74e9a053b784ef.png"}],"coverageCount":0},{"id":"rel_9_dAAYTbcx97q64yCALsf","version":null,"type":"feature","title":"Data Localization Suite, SSL/TLS - View your data localization settings in one dashboard page","summary":"A read-only Data Localization Suite Overview in the Cloudflare dashboard consolidates Regional Services, Customer Metadata Boundary, and Geo Key Manager settings in one place instead of across several pages and APIs. Each tab lists per-product items with their region and links to the page where the setting is changed.","titleGenerated":"Cloudflare One adds Data Localization Suite overview dashboard","titleShort":"Data Localization Suite gets single read-only overview","breaking":"none","importance":2,"content":"The Cloudflare dashboard now includes a **Data Localization Suite** Overview, a read-only view of the data localization settings on your account. It shows your Regional Services, Customer Metadata Boundary, and Geo Key Manager settings in one place, so you no longer need to check several dashboard pages and APIs to see where your traffic is processed and where your logs and private keys are stored.\n\nTo find it, go to **Application Security** > **Data Localization Suite**, or search for \"DLS\" in the dashboard.\n\nThe Overview has a tab for each product:\n\n- **Regional Services**: regionalized hostnames (filter by region or zone), regionalized IP bindings, and regionalized Spectrum applications, each with its region.\n- **Customer Metadata Boundary**: whether the boundary is on, the region (US or EU), and whether out-of-region access is allowed.\n- **Geo Key Manager**: every custom certificate with a geo policy, with its hostname, zone, region, and status.\n\nEach item links to the dashboard page where you change its setting, and each tab links to the product's documentation.\n\nTo learn more, refer to the [Data Localization Suite documentation](https://developers.cloudflare.com/data-localization/).","publishedAt":"2026-10-29T00:00:00.000Z","fetchedAt":"2026-10-30T21:38:08.047Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-29-dls-dashboard-overview/","media":[],"coverageCount":0},{"id":"rel_mhnra3u9I9UevQApvTd19","version":null,"type":"feature","title":"Access, Cloudflare One - Google Workspace SCIM user provisioning through generic SAML","summary":"Organizations in Google's custom SCIM profiles beta can send user updates and deprovisioning events to Cloudflare One, but must configure a generic SAML identity provider because the dedicated Google Workspace integration does not support SCIM. Group membership is not synchronized through SCIM scope and must be sent as a groups attribute from the Google SAML app.","titleGenerated":"Cloudflare One adds Google Workspace SCIM user provisioning via generic SAML","titleShort":"Google Workspace SCIM provisioning works through generic SAML","breaking":"none","importance":3,"content":"System for Cross-domain Identity Management (SCIM) is an open standard that synchronizes user identities between an identity provider and a service. For more information, refer to [SCIM provisioning](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/). Google Workspace is rolling out custom SCIM profiles in beta. Organizations with access to the feature can use Google's built-in provisioning service to send user updates and deprovisioning events to Cloudflare One.\n\n**You must use a generic SAML identity provider in Cloudflare One.** The dedicated Google Workspace integration does not support SCIM. Configure a SAML app in Google, then enter the Cloudflare SCIM endpoint and secret in the app's autoprovisioning settings. Turn on **Enable user deprovisioning** in Cloudflare One to revoke active Access sessions when Google deprovisions a user. Google's configured deprovisioning delay still applies. Support for the existing Google Workspace OIDC client will be added once Google adds support for OIDC + SCIM.\n\nGroup membership is configured separately. Have the Google SAML app send a `groups` attribute to include the user's selected Google groups during authentication. Selecting groups as a SCIM provisioning scope does not synchronize group membership, Google is still adding support for this in their SCIM provider.\n\nCloudflare One users must first authenticate to Access or register a device with the Cloudflare One Client before SCIM updates can apply. Availability of custom SCIM profiles depends on Google's beta rollout.\n\nFor setup instructions, refer to [Google Workspace (SAML/SCIM)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/google-workspace-saml/).","publishedAt":"2026-10-28T00:00:00.000Z","fetchedAt":"2026-10-30T21:38:08.479Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-28-google-workspace-scim/","media":[],"coverageCount":0},{"id":"rel_vjT4PDV9pobWt5JtKb96k","version":null,"type":"feature","title":"Access, Cloudflare One - Filter MCP tool-call analytics by response status","summary":"MCP tool-call analytics timeseries endpoints now accept a response_status query parameter taking success, error, cached, or all, and the default is success, so counts no longer include failed and cached calls unless response_status=all is set explicitly. Invalid or empty values return 400.","titleGenerated":"Cloudflare One MCP tool-call analytics defaults to success-only counts","titleShort":"MCP analytics counts default to success only","breaking":"major","importance":3,"content":"MCP tool-call analytics support a `response_status` query parameter on the account, portal, and server timeseries endpoints. Use `success`, `error`, or `cached` to count one status, or `all` to include every status.\n\nThe default is `success`. Previously, counts included failed and cached calls. If you need the previous all-status counts, set `response_status=all` explicitly:\n\n```\nGET /accounts/{account_id}/access/ai-controls/mcp/analytics/tool-calls/timeseries?response_status=all\n```\n\nThe response includes the selected `response_status`. Invalid values, including an empty value, return `400`.\n\nFor all query parameters and scoped endpoints, refer to [View tool-call analytics](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#view-tool-call-analytics).","publishedAt":"2026-10-28T00:00:00.000Z","fetchedAt":"2026-10-28T21:22:14.451Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-28-mcp-analytics-response-status/","media":[],"coverageCount":0},{"id":"rel_tmb8kIKOZ2uafU8A287mr","version":null,"type":"feature","title":"Cloudflare One, Access - Fully customize user-facing Access pages","summary":"Cloudflare Access now supports HTML and Liquid templates for login, identity-denied, forbidden, and command-line approval pages, with Liquid variables for custom instructions or block reasons. Templates are created and validated in the Cloudflare One dashboard, then assigned to applications or set as account defaults.","titleGenerated":"Cloudflare Access adds HTML and Liquid templates for login and denial pages","titleShort":"Access pages get HTML and Liquid customization","breaking":"none","importance":3,"content":"Cloudflare Access now supports HTML and Liquid templates for login, identity-denied, forbidden, and command-line approval pages. Custom templates allow you to control the branding and appearance of each supported page. Liquid variables allow you to provide custom instructions to users or provide a clear reason why they were blocked.\n\nCreate templates in the Cloudflare One dashboard, validate them in the editor, and assign them to applications or set account defaults.\n\n\n\nFor supported page types, template examples, and setup instructions, refer to [Access custom pages](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-custom-pages/).","publishedAt":"2026-10-27T00:00:00.000Z","fetchedAt":"2026-10-27T21:14:21.855Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-27-access-custom-pages/","media":[{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1140,height=919,format=webp/_astro/custom-denial-page-policy-evaluation.DnTXNqTw.png","alt":"Custom Access denial page showing failed policy checks and explanations for why access was denied","r2Key":"releases/471771caa73ae94f3c9e9714f0e8085c1c619806939ba527621bc9f736fca72f.png","r2Url":"https://media.releases.sh/releases/471771caa73ae94f3c9e9714f0e8085c1c619806939ba527621bc9f736fca72f.png"}],"coverageCount":0},{"id":"rel_aETY8p6A3bXmN5zps0N0g","version":"2026.9.1555","type":"feature","title":"Cloudflare One Client - Cloudflare One Client for Windows (version 2026.9.1555.1)","summary":"The Windows Cloudflare One Client beta now automatically selects Global Acceleration endpoints while the device is in the acceleration region and reconnects on network changes without user action, and can require an administrator-generated code to uninstall. Also applies measured tunnel MTUs between 1147 and 1199 bytes, sends proxy-mode hostnames to Cloudflare for resolution, and fixes split tunnel entries not applying until reconnect, blank UI after upgrade or wake, and stuck disconnected states on Windows on Arm.","titleGenerated":"Cloudflare One Client for Windows beta adds Global Acceleration endpoint selection and uninstall protection","titleShort":"Automatic Global Acceleration endpoints; uninstall now code-protected","breaking":"none","importance":3,"content":"A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).\n\nThis release includes the following highlights:\n\n- Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.\n- Added protection against unauthorized modification or uninstallation of the Cloudflare One Client. When enabled, the user will be asked to provide an administrator-generated code when trying to uninstall the client, which will otherwise be blocked.\n- The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.\n\n**Additional Changes and improvements**\n\n- The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.\n- When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.\n- Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.\n- For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.\n- warp-diag now includes redacted copies of the deployed MDM files and the names, but not the values, of stored registration secrets. It reports a QUIC path MTU only when one was measured.\n- Added the MDM parameters mdm\\_file\\_debounce\\_secs (1–60) and mdm\\_file\\_unavailable\\_debounce\\_secs (0–300), which set how long the client waits before applying a changed MDM file and before acting on a missing or unreadable one.\n- The consumer client home screen now shows when the connection is post-quantum encrypted.\n- The client UI no longer starts WMIC or PowerShell processes to collect memory information for crash reports.\n- Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.\n- Fixed the client window appearing blank or white after an upgrade, at sign-in, after waking from sleep, or after a display change.\n- Fixed the client service restarting when a firewall update for captive portal detection stalled while the device was asleep.\n- Fixed the client getting stuck in a disconnected state on Windows on Arm devices because leftover tunnel adapters were not removed.\n- Fixed the client being unable to connect after an upgrade, downgrade, and upgrade that switched between consumer and Zero Trust registrations. The client now clears the mismatched registration so the user can register again.\n- Fixed the client UI looking for one of its libraries in a directory that standard users can create before looking in the installation directory.\n- Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.\n- Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.\n- Added the MDM parameters managed\\_network\\_probe\\_interval\\_secs (30–300, default 30) and managed\\_network\\_probe\\_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.\n- In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution instead of resolving them on the device.\n- When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of \"IPC error\".\n- Fixed Windows resetting the Wi-Fi adapter after sign-in or a Wi-Fi restart when the client's firewall rules in Exclude split tunnel mode blocked Windows network connectivity checks. The client now allows those checks.\n- Fixed the installer asking the user to close running applications during an upgrade, downgrade or uninstall because other programs loaded the client's Visual C++ runtime libraries through the system PATH. The client now loads these libraries from a private folder so that closing other applications is unnecessary.\n\n**Known issues**\n\nA Windows DNS client regression may cause connectivity check failures on systems containing large hosts files. While our client includes a mitigation for this issue, users may still experience reduced DNS performance and connectivity check failures.\n\nFor Zero Trust documentation please see: [https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) For Consumer documentation please see: [https://developers.cloudflare.com/warp-client/](https://developers.cloudflare.com/warp-client/)","publishedAt":"2026-10-22T13:08:10.000Z","fetchedAt":"2026-10-22T16:26:43.053Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-warp-windows-beta/","media":[],"coverageCount":0},{"id":"rel_oBcpYRQP69fhCFEBk00NI","version":"2026.9.1555","type":"feature","title":"Cloudflare One Client - Cloudflare One Client for macOS (version 2026.9.1555.1)","summary":"The beta client now requires macOS 15.0, adds automatic endpoint selection for Global Acceleration that reconnects on network changes, and warns with a banner when the network limits tunnel MTU to a degraded or critically low value. Also fixes a managed registration being removed when the MDM configuration file was briefly missing, hostname-based split tunnel entries not applying until reconnect, and upgrades leaving the client without a running service.","titleGenerated":"Cloudflare One Client for macOS 2026.9.1555 beta drops macOS 14, adds Global Acceleration endpoint selection","titleShort":"macOS 14 support dropped; Global Acceleration endpoints auto-selected","breaking":"major","importance":4,"content":"A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/).\n\nThis release includes the following highlights:\n\n- macOS 15.0 is now the minimum supported version. This release does not run on macOS 14.\n- Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard anycast endpoints otherwise, and reconnects when a network change moves the device between them without requiring action from the user.. The Connectivity page shows which tunnel and API endpoints are in use, and users who are allowed to override the selection can choose endpoints in Settings.\n- The client now shows a banner when the network limits the tunnel MTU to a degraded or critically low value. The banner clears when the MTU recovers or the client disconnects.\n\n**Additional Changes and improvements**\n\n- The client now applies tunnel MTUs between 1147 and 1199 bytes measured by Path MTU Discovery. Previously the client ignored these values and kept a larger MTU, which could drop larger packets on networks such as mobile hotspots while the client showed as connected.\n- When Path MTU Discovery is enabled, the client now accepts larger packets from Cloudflare instead of limiting them to the size it uses for its own outbound packets.\n- Access reauthentication requests now trust certificates in the operating system's certificate store, so reauthentication works on networks that perform TLS inspection.\n- For Zero Trust deployments, the client now records a traceroute of the network path outside the tunnel when the tunnel degrades or fails to connect. warp-diag includes the same trace.\n- warp-diag now includes redacted copies of the deployed MDM files and reports a QUIC path MTU only when one was measured.\n- The consumer client home screen now shows when the connection is post-quantum encrypted.\n- Fixed a managed registration being removed when the MDM configuration file was briefly missing or unreadable. The client now keeps the last applied policy for 20 seconds after the file becomes unavailable. The new MDM parameters mdm\\_file\\_debounce\\_secs (1–60) and mdm\\_file\\_unavailable\\_debounce\\_secs (0–300) change how long the client waits before applying a changed file and before acting on a missing one.\n- Fixed a hostname-based split tunnel entry not taking effect until the next reconnect after its firewall rule failed to apply.\n- Fixed split tunnel updates for hostname-based entries failing when the client tried to remove a route that macOS had not installed.\n- Fixed the client UI not showing onboarding on first launch while a notification permission request was pending.\n- Fixed warp-cli registration license reporting an error on slow networks even though the license was applied, which left the client registered to a WARP+ account it did not recognize.\n- Fixed Digital Experience Monitoring (DEX) results being reported with timestamps offset from the actual time after the system clock was corrected.\n- Fixed an upgrade sometimes leaving the client without a running service when the previous service was slow to stop. The installer now waits up to 10 seconds for the old service to be removed before starting the new one.\n- Fixed the OS version detail stored for a device keeping an outdated value, including the text \"Usage: sw\\_vers…\" reported by client versions 2023.5.587.1 through 2024.12.760.0. The client now clears the value the next time it connects.\n- Added the MDM parameters managed\\_network\\_probe\\_interval\\_secs (30–300, default 30) and managed\\_network\\_probe\\_count (0 disables probing, 1–10, or -1 to keep probing until a managed network is found; default 1). After a registration or network change finds no managed network, the client now rechecks, so a device doesn't stay on the default profile because of a transient connection failure. Set the count to 0 to keep the previous behavior.\n- In proxy mode for Zero Trust, the client now sends hostnames from HTTP/HTTPS and SOCKS5 requests to Cloudflare for resolution, instead of resolving them on the device.\n- When the app cannot reach the client service, the home screen now says why (service not running, not accepting connections, not responding, or connection dropped and reconnecting). It shows an error code and a Learn more link instead of \"IPC error\".\n\n**Known issues**\n\nNone.\n\nFor Zero Trust documentation please see: [https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) For Consumer documentation please see: [https://developers.cloudflare.com/warp-client/](https://developers.cloudflare.com/warp-client/)","publishedAt":"2026-10-22T13:08:01.000Z","fetchedAt":"2026-10-22T16:26:43.053Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-warp-macos-beta/","media":[],"coverageCount":0},{"id":"rel_00fG2GY2HhD4YtNheQkEK","version":null,"type":"feature","title":"Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel - Granular Tunnel Read And Monitor role is generally available","summary":"The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is generally available, granting read access and remote log streaming for specific Tunnel instances without write access or account-wide Tunnel access. It matches the existing granular Read role and adds log streaming, which Read does not include.","titleGenerated":"Cloudflare One makes granular Tunnel read and monitor role generally available","titleShort":"Granular Tunnel read-and-monitor role GA","breaking":"none","importance":2,"content":"The **Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor** role is now generally available. You can grant a member read access and log streaming for specific [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) instances without granting write access or access to every Tunnel in your account.\n\nThis role includes the same access as **Cloudflare Tunnel - Granular Connector cloudflared Read**: viewing selected Tunnels, their IP and hostname routes, and connector host details. It also grants [remote log streaming](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming), so support operators can troubleshoot a Tunnel without changing its configuration. The existing **Read** role does not grant log streaming access.\n\nTo assign the role, follow [Grant a granular permission](https://developers.cloudflare.com/tunnel/guides/granular-permissions/#grant-a-granular-permission). For the available roles, refer to the [resource-scoped roles reference](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles).","publishedAt":"2026-10-22T00:00:00.000Z","fetchedAt":"2026-10-22T20:28:02.825Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-granular-read-and-monitor-ga/","media":[],"coverageCount":0},{"id":"rel_RMYnR5s4MTtbxJXgfh-A3","version":null,"type":"feature","title":"Cloudflare Tunnel, Cloudflare Tunnel for SASE - Cloudflare Tunnel supports URL normalization","summary":"From version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules, improving security for rules that require Cloudflare Access validation, with the path sent to the origin unchanged. The setting is off by default and will be turned on by default in new cloudflared releases starting 2027-01-25, so path-based routing should be tested before then.","titleGenerated":"Cloudflare Tunnel 2026.10.0 adds optional URL normalization for ingress matching","titleShort":"Optional URL normalization ships; default flips Jan 2027","breaking":"minor","importance":3,"content":"Starting from version `2026.10.0`, [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same.\n\nIn three months, starting 2027-01-25, new `cloudflared` releases will turn on URL normalization by default. Test your path-based routing before that date, as this change may affect which ingress rule matches a request. Configurations without rules requiring Access validation are unaffected.\n\nThis setting is currently off by default. To turn it on, run:\n\n```\ncloudflared tunnel --disable-path-normalization=false run <TUNNEL_NAME_OR_UUID>\n```\n\nAlternatively, set `TUNNEL_DISABLE_PATH_NORMALIZATION=false` on each `cloudflared` replica and restart it.\n\nFor more information, refer to [ingress matching](https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/configuration-file/#how-traffic-is-matched) and [Access validation at the origin](https://developers.cloudflare.com/tunnel/reference/origin-parameters/#access).","publishedAt":"2026-10-22T00:00:00.000Z","fetchedAt":"2026-10-22T20:28:02.453Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-cloudflared-path-normalization/","media":[],"coverageCount":0},{"id":"rel_youp3Tdmv7z_UfA-th-UF","version":"2026.8.2115","type":"feature","title":"Cloudflare One Client - Cloudflare One Client for Windows (version 2026.8.2115.0)","summary":"The GA Windows client release fixes an issue with building trusted certificate chains.","titleGenerated":"Cloudflare One Client for Windows 2026.8.2115 fixes trusted certificate chain building","titleShort":"Trusted certificate chain build issue fixed","breaking":"none","importance":2,"content":"A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).\n\nThis hotfix addresses an issue building trusted certificate chains.","publishedAt":"2026-10-20T01:21:08.000Z","fetchedAt":"2026-10-20T04:06:49.609Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-20-warp-windows-ga/","media":[],"coverageCount":1},{"id":"rel_HnbTD-oQw5uwGvJUI3c48","version":"2026.8.2115","type":"feature","title":"Cloudflare One Client - Cloudflare One Client for macOS (version 2026.8.2115.0)","summary":"The macOS Cloudflare One Client reaches general availability on the stable download page. The hotfix addresses an issue building trusted certificate chains.","titleGenerated":"Cloudflare One Client for macOS 2026.8.2115 reaches GA with certificate chain fix","titleShort":"macOS client GA; trusted certificate chain build fixed","breaking":"none","importance":3,"content":"A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).\n\nThis hotfix addresses an issue building trusted certificate chains.","publishedAt":"2026-10-20T01:20:49.000Z","fetchedAt":"2026-10-20T04:06:49.609Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-20-warp-macos-ga/","media":[],"coverageCount":1},{"id":"rel_nSw8CgQV6ofO2JwSWtWkz","version":"2026.8.2115","type":"feature","title":"Cloudflare One Client - Cloudflare One Client for Linux (version 2026.8.2115.0)","summary":"The GA Linux Cloudflare One Client build on the stable downloads page now fixes an issue with building trusted certificate chains.","titleGenerated":"Cloudflare One Client for Linux 2026.8.2115 fixes trusted certificate chain building","titleShort":"Linux client hotfix for trusted certificate chain building","breaking":"none","importance":2,"content":"A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).\n\nThis hotfix addresses an issue building trusted certificate chains.","publishedAt":"2026-10-20T00:55:37.000Z","fetchedAt":"2026-10-20T04:06:49.609Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-20-warp-linux-ga/","media":[],"coverageCount":0},{"id":"rel_hPWsDTAWpbDkgVZk8T6kx","version":null,"type":"feature","title":"Cloud Workload Security - Cloud Workload Security is now available in Beta","summary":"Cloud Workload Security is now available in beta, applying policy controls to cloud API requests before they reach the cloud provider. Policies use request filters and Rego checks — for example, blocking requests that would make an R2 bucket public — and are managed in the Cloudflare dashboard with the CWS proxy running in your environment. Requires a Zero Trust subscription; the Free plan is sufficient.","titleGenerated":"Cloudflare One launches Cloud Workload Security in beta","titleShort":"Cloud Workload Security enters beta","breaking":"none","importance":4,"content":"[Cloud Workload Security (CWS)](https://developers.cloudflare.com/cloudflare-one/cloud-workload-security/) is now available in Beta. Apply policy controls to cloud API requests before they reach your cloud provider.\n\nDefine policies with request filters and Rego checks. For example, block requests that would make an R2 bucket public. Use workloads and policy sets to target your cloud environments.\n\nManage your policies in the Cloudflare dashboard. Run the CWS proxy in your environment and route client requests through it to enforce your policies.\n\nCWS requires a Zero Trust subscription. The Zero Trust Free plan is sufficient.\n\nTo configure your first guardrail, follow [Get started with Cloud Workload Security](https://developers.cloudflare.com/cloudflare-one/cloud-workload-security/get-started/).","publishedAt":"2026-10-19T00:00:00.000Z","fetchedAt":"2026-10-19T08:00:11.800Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-19-cloud-workload-security-beta/","media":[],"coverageCount":0},{"id":"rel_5TUAGas1gCi8cS3j7RXwJ","version":null,"type":"feature","title":"Cloudflare Tunnel, Cloudflare Tunnel for SASE, Cloudflare Mesh, Cloudflare One - 50,000 routes per account and Tunnels for Platforms","summary":"The default route limit is now 50,000 per account, up from 1,000, applying automatically to CIDR and hostname routes for Cloudflare Tunnel and Cloudflare Mesh with no action required. Tunnels for Platforms lets accounts run more than the included 1,000 tunnels, billed at $4.50 per tunnel per month, with Enterprise customers able to contact their account team for committed or usage-based pricing.","titleGenerated":"Cloudflare One raises default Tunnel route limit to 50,000 and adds paid tunnels beyond 1,000","titleShort":"Tunnel routes jump to 50,000 per account; extra tunnels $4.50/mo","breaking":"none","importance":4,"content":"Two changes make it easier to run Cloudflare Tunnel at scale.\n\n#### 50,000 routes per account by default\n\nThe default limit for [routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) is now 50,000 per account, up from 1,000. This limit covers [CIDR routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/) and [hostname routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) for [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/). The new limit applies to every account automatically, with no action required.\n\nPublished applications (public hostnames) are not routes and are not affected by this limit. Each tunnel supports roughly 5,000–10,000 published applications, depending on the size of its configuration. For details, refer to [Published application limits](https://developers.cloudflare.com/tunnel/concepts/routing/#published-application-limits).\n\n#### Tunnels for Platforms\n\nEvery account includes 1,000 tunnels. With [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/), you can now run more than 1,000 tunnels in a single account — for example, one tunnel per device, per end customer, or per development environment.\n\n\n\nTo buy additional tunnels, go to **Networking** > **Tunnels** and select **Buy more tunnels** in the **Usage** card. Additional tunnels are billed at $4.50 per tunnel per month. Enterprise customers can contact their account team for committed or usage-based pricing.\n\n[Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels)\n\nFor pricing, limits, and best practices for managing large tunnel fleets, refer to [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/).","publishedAt":"2026-10-16T00:00:00.000Z","fetchedAt":"2026-10-16T11:37:47.915Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-16-tunnels-for-platforms-and-50k-routes/","media":[{"type":"gif","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1512,height=802,format=webp/_astro/tunnels-for-platforms.DuPYMNzo.gif","alt":"Buy additional tunnels from the Tunnels page in the Cloudflare dashboard","r2Key":"releases/79dafbdfdd98e72d70d81864b23a582208c39b56fa878d633260f7949a029043.mp4","r2Url":"https://media.releases.sh/releases/79dafbdfdd98e72d70d81864b23a582208c39b56fa878d633260f7949a029043.mp4"}],"coverageCount":0},{"id":"rel_FwiGIh4Lie2M-fT4ufdRJ","version":null,"type":"feature","title":"Cloudflare One, Workers, Gateway - Gateway and Workers integration is now in public beta","summary":"Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. The Forward action in Gateway HTTP policies runs your own code on matching permitted traffic, letting you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures.","titleGenerated":"Cloudflare One Gateway workers integration enters public beta","titleShort":"Gateway Forward action runs Workers on permitted traffic","breaking":"none","importance":3,"content":"Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. You can use the **Forward** action in [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to run your own code on matching, permitted traffic without managing a separate proxy.\n\nThe **Forward** action lets you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures. Your Worker receives the request and [Gateway context](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/available-context/), including connection metadata, user identity, and device posture when available.\n\n\n\nGateway handles the proxy connection, TLS decryption, and upstream routing. It evaluates HTTP request policies before Forward policies and inspects the final response before returning it to the user.\n\nGateway inspects the original request body before delivering it to your Worker. A body-inspection Block decision can interrupt the Worker.\n\nTo get started, [deploy a Worker and configure a Forward policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/forward-traffic/), or adapt one of the [Worker templates](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/).","publishedAt":"2026-10-15T00:00:00.000Z","fetchedAt":"2026-10-15T23:33:46.367Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-15-gateway-workers-public-beta/","media":[{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2048,height=1053,format=webp/_astro/gateway-workers-forward.CFUFJAE0.png","alt":"A matching Gateway Forward policy sends HTTP traffic to a Worker, which processes requests and responses for Internet or private-network upstream services.","r2Key":"releases/4914e979c1bc7a6a3a82cd6144b66a10bff4be1a02e4d70903eca1fc7d4ae5ea.png","r2Url":"https://media.releases.sh/releases/4914e979c1bc7a6a3a82cd6144b66a10bff4be1a02e4d70903eca1fc7d4ae5ea.png"}],"coverageCount":0},{"id":"rel_gxT7cK-nKJZNYbXZ7oevM","version":null,"type":"feature","title":"Cloudflare One - Validate data loss prevention matches with Cloudflare Workers","summary":"Data loss prevention custom pattern entries can call Cloudflare Workers in your account to validate matches with organization-specific logic, adjusting a match's confidence or rejecting it outright.","titleGenerated":"Cloudflare One lets Workers validate DLP custom pattern matches","titleShort":"Workers now validate DLP custom pattern matches","breaking":"none","importance":3,"content":"Data loss prevention (DLP) custom pattern entries can use Cloudflare Workers in your account to validate matches with organization-specific logic. Your Worker can adjust a match's confidence or reject the match.\n\nFor setup steps and the Worker contract, refer to [Validate data loss prevention matches with Cloudflare Workers](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/custom-validation-workers/).","publishedAt":"2026-10-15T00:00:00.000Z","fetchedAt":"2026-10-15T23:33:45.976Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-15-dlp-custom-validation-workers/","media":[],"coverageCount":0},{"id":"rel_PWyQt8nf3bK9dWXbwoihR","version":null,"type":"feature","title":"Cloudflare WAN, Magic Transit, Cloudflare One - BGP route filtering for IPsec and GRE tunnels","summary":"Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering, with reusable filter profiles specifying an allow or deny action and CIDR targets using exact, more-specific, or prefix-length matching. Each tunnel supports one import and one export filter, creatable via dashboard, API, or Terraform, and profile changes apply without resetting the BGP session.","titleGenerated":"Cloudflare One adds BGP route filtering for IPsec and GRE tunnels","titleShort":"BGP import/export filtering for IPsec and GRE tunnels","breaking":"none","importance":3,"content":"Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering.\n\nCreate reusable filter profiles that specify an `allow` or `deny` action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter.\n\nYou can create and assign profiles through the dashboard, API, or Terraform. Profile changes apply without resetting the BGP session.\n\nFor configuration details, refer to:\n\n- [Filter BGP routes for Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#filter-bgp-routes)\n- [Filter BGP routes for Magic Transit](https://developers.cloudflare.com/magic-transit/how-to/configure-routes/#filter-bgp-routes)","publishedAt":"2026-10-15T00:00:00.000Z","fetchedAt":"2026-10-15T23:33:45.976Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-15-bgp-filter-profiles/","media":[],"coverageCount":0},{"id":"rel_FZ92PL0SRoBXWSV2nd3zm","version":null,"type":"feature","title":"Cloudflare One, Gateway - Application Library now supports custom applications","summary":"Custom applications can now be created in the Application Library and referenced in Gateway DNS, Network, and HTTP policies, defined by hostnames, IP subnets, or both, with optional TCP or UDP ports or port ranges to restrict HTTP and Network matching. The release also improves search and filtering in the Application Library, updates the interfaces, data, and metrics used to review applications, and makes selecting and managing applications in the Gateway policy builder easier.","titleGenerated":"Cloudflare One Gateway Application Library now supports custom applications","titleShort":"Gateway Application Library supports custom applications","breaking":"none","importance":3,"content":"Starting today, you can create [custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) in the [Application Library](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/) and reference them in Gateway DNS, Network, and HTTP policies. You can define an application with hostnames, IP subnets, or both. Then, optionally add TCP or UDP ports or port ranges to restrict HTTP and Network matching.\n\n\n\nThis release also improves search and filtering in the Application Library, updates the interfaces, data, and metrics used to review applications, and makes it easier to select and manage applications in the Gateway policy builder.\n\n\n\nFor more information, refer to [Custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) and [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/).","publishedAt":"2026-10-15T00:00:00.000Z","fetchedAt":"2026-10-15T15:31:07.488Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-15-app-library-custom-applications/","media":[{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1928,height=1108,format=webp/_astro/custom-application-create.hLzR_NQZ.png","alt":"Custom application form with a name, application ID, category, two hostnames, and a TCP port 443 constraint","r2Key":"releases/3cb0bf813ea967d6fcb7efa2b8463f057dc0d70afdab05493bea248c609250de.png","r2Url":"https://media.releases.sh/releases/3cb0bf813ea967d6fcb7efa2b8463f057dc0d70afdab05493bea248c609250de.png"},{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1472,height=1324,format=webp/_astro/custom-application-gateway-policy-builder.DFnrNoHS.png","alt":"Gateway HTTP policy builder with a custom application selected in the Application selector under the Artificial Intelligence category","r2Key":"releases/20159c71aa5f7601e3241c507666401a07a0ff0327ed49fca2cb424fa61015ba.png","r2Url":"https://media.releases.sh/releases/20159c71aa5f7601e3241c507666401a07a0ff0327ed49fca2cb424fa61015ba.png"}],"coverageCount":0}],"pagination":{"nextCursor":"2026-10-15T00:00:00.000Z|2026-10-15T15:31:07.488Z|rel_FZ92PL0SRoBXWSV2nd3zm","limit":20},"summaries":{"rolling":null,"monthly":[]}}