Cloudflare Release Notes

Minor Changes

• #15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }
  

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

  Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

• #15330 f8cdcb9 Thanks @akshitsinha! - Manage local Flagship flags in Local Explorer …

Patch Changes

• #16016 f025bbf Thanks @Ankcorn! - Add bindings.analytics() as the preferred name for Analytics SQL bindings and deprecate bindings.analyticsSQL().

• #15991 b4f6054 Thanks @NuroDev! - Use the default type generation behavior in projects migrated by cf migrate.

  Wrangler projects without dev.generate_types: false no longer get a wrangler.config.ts solely for a redundant type setting. An explicit opt-out still emits types.generate: false, and other Wrangler tooling still produces a config when needed.

• #15946 1d38b36 Thanks @NuroDev! - Upgrade Wrangler dependencies to a version supported by cf dev when Wrangler-to-cf migration generates wrangler.config.ts. …

Minor Changes

• #16016 f025bbf Thanks @Ankcorn! - Add bindings.analytics() as the preferred name for Analytics SQL bindings and deprecate bindings.analyticsSQL().

• #15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }
  

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior. …

Minor Changes

• #15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }
  

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

  Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

Patch Changes …

Minor Changes

• #16030 aa2f9b7 Thanks @edmundhung! - Add email-protected Quick Tunnels to the Cloudflare Vite plugin

  Set tunnel.allowedMail to a list of email addresses or domain patterns to require email authentication when exposing a Vite development or preview server through a Quick Tunnel.

Patch Changes

• Updated dependencies [b4e1299, b75421f, 0ec13b7, 2b1a0ca, c492d63, ba52118, 946aaa7, 48f3c04, 14f0339, [5606a74](https://github.com/…

Minor Changes

• #16068 26e03e2 Thanks @edevil! - Add a temporaryAccountLogger option for temporary-account notices

  AuthContext.temporaryAccountLogger receives the terms notice, the proof-of-work message, and the "Temporary account ready" claim details. A CLI whose commands write parseable output to stdout can route these messages to stderr. When it is not set, the messages go to logger as before.

Patch Changes

• Updated dependencies [b75421f, 2b1a0ca, aa2f9b7]:
  • @cloudflare/workers-utils@0.47.0

Minor Changes

• #15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }
  

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

  Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

Patch Changes …

Patch Changes

• #16057 ad54578 Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  create-next-app	16.3.6	16.3.8

• #16058 f67fb2b Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  create-analog	2.7.5	2.8.0

• #16060 17c6c0d Thanks @dependabot! - Update dependencies of "create-cloudflare"

  The following dependency versions have been updated:

  Dependency	From	To
  @angular/create	22.2.0	22.2.1

Minor Changes

• #16051 b4e1299 Thanks @devteamaegis! - Add --source-namespace and --source-repo-name to wrangler queues subscription create for the artifacts.repo source

  The Event Subscriptions API requires source.namespace and source.repo_name for artifacts.repo subscriptions, but Wrangler had no way to pass them, so --source artifacts.repo always failed with a validation error. Both flags are now required for this source, and wrangler queues subscription get shows the subscription's resource as <namespace>/<repo-name>.

• #15998 b75421f Thanks @dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }
  ``` …
  

AI Gateway's REST API now returns consistent responses when an AI provider rejects credentials. The change applies to POST /ai/run ↗︎.

Scenario

Previous AI Gateway response

New AI Gateway response

ElevenLabs

Provider-specific UserCredentialsError with HTTP 403

HTTP 401 with error code 2009

Google Vertex

HTTP 500 for rejected credentials, with upstream retries

HTTP 401 with error code 2009; the request fails without retrying the provider

All other providers

HTTP 402 or another provider-specific status for rejected credentials

HTTP 401 with error code 2009

When using Unified Billing, the provider rejects the credentials

Provider-specific authentication error

HTTP 503

Update applications that handle AI Gateway REST API errors to treat HTTP 401 as an invalid or rejected provider credential.

For details about providing provider credentials, refer to Bring your own provider keys.

AI Gateway's REST API now returns consistent responses when an AI provider rejects credentials. The change applies to POST /ai/run ↗︎.

Scenario

Previous AI Gateway response

New AI Gateway response

ElevenLabs

Provider-specific UserCredentialsError with HTTP 403

HTTP 401 with error code 2009

Google Vertex

HTTP 500 for rejected credentials, with upstream retries

HTTP 401 with error code 2009; the request fails without retrying the provider

All other providers

HTTP 402 or another provider-specific status for rejected credentials

HTTP 401 with error code 2009

When using Unified Billing, the provider rejects the credentials

Provider-specific authentication error

HTTP 503

Update applications that handle AI Gateway REST API errors to treat HTTP 401 as an invalid or rejected provider credential.

For details about providing provider credentials, refer to Bring your own provider keys.

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads.

BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes.

BGP over IPsec and GRE tunnels is available to all accounts that use Unified Routing. No enablement is required. BGP over CNI remains in closed beta.

For configuration details, refer to:

• Configure BGP routes for Cloudflare WAN
• Configure BGP routes for Magic Transit

Minor Changes

• #15928 7f57b1c Thanks @ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

  Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Minor Changes

• #16009 f23dcb3 Thanks @NuroDev! - Allow cf to request the zone observability OAuth scopes

  New cf OAuth logins request zone-observability.read and zone-observability.write. Existing sessions must authenticate again to receive them.

Patch Changes

• Updated dependencies [7f57b1c]:
  • @cloudflare/workers-utils@0.46.0

Minor Changes

• #15928 7f57b1c Thanks @ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

  Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Minor Changes

• #15928 7f57b1c Thanks @ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

  Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Patch Changes

• #15974 7f700ef Thanks @martinezjandrew! - Fix wrangler containers list to report live instances

  The LIVE INSTANCES column now reports each application's active runtime instances instead of its configured instance count, matching the Cloudflare dashboard. JSON output continues to expose the configured count through the existing instances field.

• #15980 90e6a1b Thanks @martinezjandrew! - Accept Durable Object application IDs in Containers commands …

KV

Jurisdictions for Workers KV namespaces are now generally available. When you create a namespace, you can set a jurisdiction to make sure the namespace's data is only durably stored within that region. Jurisdictions can help you comply with data localization regulations such as GDPR or FedRAMP. Supported jurisdictions are eu, us, and fedramp.

A jurisdiction can only be set when a namespace is created, using the Cloudflare dashboard, Wrangler, the cf CLI, or the REST API, and cannot be added or changed afterwards.

npx wrangler@latest kv namespace create <NAMESPACE_NAME> --jurisdiction=eu

cf kv namespaces create --title <NAMESPACE_NAME> --jurisdiction eu

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/storage/kv/namespaces" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "title": "<NAMESPACE_NAME>",
    "jurisdiction": "eu"
  }'

Workers can still access a namespace restricted to a jurisdiction from anywhere in the world, and KV data can be cached outside the jurisdiction on Cloudflare's network. The jurisdiction only controls where the namespace's data is durably stored.

To learn more, refer to Data location.