Cloudflare Release Notes

Access for SaaS applications now include more configuration options to support a wider array of SaaS applications.

SAML and OIDC Field Additions

OIDC apps now include:

• Group Filtering via RegEx
• OIDC Claim mapping from an IdP
• OIDC token lifetime control
• Advanced OIDC auth flows including hybrid and implicit flows

OIDC field additions

SAML apps now include improved SAML attribute mapping from an IdP.

SAML field additions

SAML transformations

SAML identities sent to Access applications can be fully customized using JSONata expressions. This allows admins to configure the precise identity SAML statement sent to a SaaS application.

Configured SAML statement sent to application

You can now send detection logs to an endpoint of your choice with Cloudflare Logpush.

Filter logs matching specific criteria you have set and select from over 25 fields you want to send. When creating a new Logpush job, remember to select Email security alerts as the dataset.

logpush-detections

For more information, refer to Enable detection logs.

This feature is available across these Email security packages:

• Enterprise
• Enterprise + PhishGuard

We've released a release candidate of the next major version of Wrangler, the CLI for Cloudflare Workers — wrangler@4.0.0-rc.0.

You can run the following command to install it and be one of the first to try it out:

npmyarnpnpmbun

npm i wrangler@v4-rc

yarn add wrangler@v4-rc

pnpm add wrangler@v4-rc

bun add wrangler@v4-rc

Unlike previous major versions of Wrangler, which were foundational rewrites ↗︎ and rearchitectures ↗︎ — Version 4 of Wrangler includes a much smaller set of changes. If you use Wrangler today, your workflow is very unlikely to change. Before we release Wrangler v4 and advance past the release candidate stage, we'll share a detailed migration guide in the Workers developer docs. But for the vast majority of cases, you won't need to do anything to migrate — things will just work as they do today. We are sharing this release candidate in advance of the official release of v4, so that you can try it out early and share feedback.

New JavaScript language features that you can now use with Wrangler v4

Version 4 of Wrangler updates the version of esbuild ↗︎ that Wrangler uses internally, allowing you to use modern JavaScript language features, including: …

Concerns about performance for Email security or Area 1? You can now check the operational status of both on the Cloudflare Status page ↗︎.

For Email security, look under Cloudflare Sites and Services.

• Dashboard is the dashboard for Cloudflare, including Email security
• Email security (Zero Trust) is the processing of email
• API are the Cloudflare endpoints, including the ones for Email security

For Area 1, under Cloudflare Sites and Services:

• Area 1 - Dash is the dashboard for Cloudflare, including Email security
• Email security (Area1) is the processing of email
• Area 1 - API are the Area 1 endpoints

Status-page

This feature is available across these Email security packages:

• Advantage
• Enterprise
• Enterprise + PhishGuard

We've released a new REST API for Browser Rendering in open beta, making interacting with browsers easier than ever. This new API provides endpoints for common browser actions, with more to be added in the future.

With the REST API you can:

• Capture screenshots – Use /screenshot to take a screenshot of a webpage from provided URL or HTML.
• Generate PDFs – Use /pdf to convert web pages into PDFs.
• Extract HTML content – Use /content to retrieve the full HTML from a page. Snapshot (HTML + Screenshot) – Use /snapshot to capture both the page's HTML and a screenshot in one request
• Scrape Web Elements – Use /scrape to extract specific elements from a page.

For example, to capture a screenshot:

Screenshot examplebash

curl -X POST 'https://api.cloudflare.com/client/v4/accounts/<accountId>/browser-rendering/screenshot' \
  -H 'Authorization: Bearer <apiToken>' \
  -H 'Content-Type: application/json' \
  -d '{
    "html": "Hello World!",
    "screenshotOptions": {
      "type": "webp",
      "omitBackground": true
    }
  }' \
  --output "screenshot.webp"

Learn more in our documentation.

AI Gateway now includes Guardrails, to help you monitor your AI apps for harmful or inappropriate content and deploy safely.

Within the AI Gateway settings, you can configure:

• Guardrails: Enable or disable content moderation as needed.
• Evaluation scope: Select whether to moderate user prompts, model responses, or both.
• Hazard categories: Specify which categories to monitor and determine whether detected inappropriate content should be blocked or flagged.

Guardrails in AI Gateway

Learn more in the blog ↗︎ or our documentation.

AI Gateway now includes Guardrails, to help you monitor your AI apps for harmful or inappropriate content and deploy safely.

Within the AI Gateway settings, you can configure:

• Guardrails: Enable or disable content moderation as needed.
• Evaluation scope: Select whether to moderate user prompts, model responses, or both.
• Hazard categories: Specify which categories to monitor and determine whether detected inappropriate content should be blocked or flagged.

Guardrails in AI Gateway

Learn more in the blog ↗︎ or our documentation.

Cloudflare Email security customers who have Microsoft 365 environments can quickly deploy an Email DLP (Data Loss Prevention) solution for free.

Simply deploy our add-in, create a DLP policy in Cloudflare, and configure Outlook to trigger behaviors like displaying a banner, alerting end users before sending, or preventing delivery entirely.

Refer to Outbound Data Loss Prevention to learn more about this feature.

In GUI alert:

DLP-Alert

Alert before sending:

DLP-Pop-up

Prevent delivery:

DLP-Blocked

This feature is available across these Email security packages:

• Enterprise
• Enterprise + PhishGuard

We've released the Agents SDK ↗︎, a package and set of tools that help you build and ship AI Agents.

You can get up and running with a chat-based AI Agent ↗︎ (and deploy it to Workers) that uses the Agents SDK, tool calling, and state syncing with a React-based front-end by running the following command:

npm create cloudflare@latest agents-starter -- --template="cloudflare/agents-starter"
# open up README.md and follow the instructions

You can also add an Agent to any existing Workers application by installing the agents package directly

npm i agents

... and then define your first Agent:

import { Agent } from "agents";

export class YourAgent extends Agent<Env> {
	// Build it out
	// Access state on this.state or query the Agent's database via this.sql
	// Handle WebSocket events with onConnect and onMessage
	// Run tasks on a schedule with this.schedule
	// Call AI models
	// ... and/or call other Agents.
}

Head over to the Agents documentation to learn more about the Agents SDK, the SDK APIs, as well as how to test and deploying agents to production.

Workers AI now supports structured JSON outputs with JSON mode, which allows you to request a structured output response when interacting with AI models.

This makes it much easier to retrieve structured data from your AI models, and avoids the (error prone!) need to parse large unstructured text responses to extract your data.

JSON mode in Workers AI is compatible with the OpenAI SDK's structured outputs ↗︎ response_format API, which can be used directly in a Worker:

import { OpenAI } from "openai";

// Define your JSON schema for a calendar event
const CalendarEventSchema = {
	type: "object",
	properties: {
		name: { type: "string" },
		date: { type: "string" },
		participants: { type: "array", items: { type: "string" } },
	},
	required: ["name", "date", "participants"],
};

export default {
	async fetch(request, env) {
		const client = new OpenAI({
			apiKey: env.OPENAI_API_KEY,
			// Optional: use AI Gateway to bring logs, evals & caching to your AI requests
			// https://developers.cloudflare.com/ai-gateway/usage/providers/openai/
			// baseUrl: "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai"
		});

		const response = await client.chat.completions.create({
			model: "gpt-4o-2024-08-06",
			messages: [
				{ role: "system", content: "Extract the event information." },
				{
					role: "user", …

You can now interact with the Images API directly in your Worker.

This allows more fine-grained control over transformation request flows and cache behavior. For example, you can resize, manipulate, and overlay images without requiring them to be accessible through a URL.

The Images binding can be configured in the Cloudflare dashboard for your Worker or in the Wrangler configuration file in your project's directory:

{
	"images": {
		"binding": "IMAGES", // i.e. available in your Worker on env.IMAGES
	},
}

[images]
binding = "IMAGES"

Within your Worker code, you can interact with this binding by using env.IMAGES.

Here's how you can rotate, resize, and blur an image, then output the image as AVIF:

const info = await env.IMAGES.info(stream);
// stream contains a valid image, and width/height is available on the info object

const response = (
	await env.IMAGES.input(stream)
		.transform({ rotate: 90 })
		.transform({ width: 128 })
		.transform({ blur: 20 })
		.output({ format: "image/avif" })
).response();

return response;

For more information, refer to Images Bindings.

Zaraz at zone level to Tag management at account level

Previously, you could only configure Zaraz by going to each individual zone under your Cloudflare account. Now, if you’d like to get started with Zaraz or manage your existing configuration, you can navigate to the Tag Management ↗︎ section on the Cloudflare dashboard – this will make it easier to compare and configure the same settings across multiple zones.

These changes will not alter any existing configuration or entitlements for zones you already have Zaraz enabled on. If you’d like to edit existing configurations, you can go to the Tag Setup ↗︎ section of the dashboard, and select the zone you'd like to edit.

Cloudflare Images

You can now interact with the Images API directly in your Worker.

This allows more fine-grained control over transformation request flows and cache behavior. For example, you can resize, manipulate, and overlay images without requiring them to be accessible through a URL.

The Images binding can be configured in the Cloudflare dashboard for your Worker or in the Wrangler configuration file in your project's directory:

{
	"images": {
		"binding": "IMAGES", // i.e. available in your Worker on env.IMAGES
	},
}

[images]
binding = "IMAGES"

Within your Worker code, you can interact with this binding by using env.IMAGES.

Here's how you can rotate, resize, and blur an image, then output the image as AVIF:

const info = await env.IMAGES.info(stream);
// stream contains a valid image, and width/height is available on the info object

const response = (
	await env.IMAGES.input(stream)
		.transform({ rotate: 90 })
		.transform({ width: 128 })
		.transform({ blur: 20 })
		.output({ format: "image/avif" })
).response();

return response;

For more information, refer to Images Bindings.

Workers for Platforms ↗︎ is an architecture wherein a centralized dispatch Worker processes incoming requests and routes them to isolated sub-Workers, called User Workers.

Workers for Platforms Requests

Previously, when a new User Worker was uploaded, there was a short delay before it became available for dispatch. This meant that even though an API request could return a 200 OK response, the script might not yet be ready to handle requests, causing unexpected failures for platforms that immediately dispatch to new Workers.

With this update, first-time uploads of User Workers are now deployed synchronously. A 200 OK response guarantees the script is fully provisioned and ready to handle traffic immediately, ensuring more predictable deployments and reducing errors.

We've updated the Workers AI pricing to include the latest models and how model usage maps to Neurons.

• Each model's core input format(s) (tokens, audio seconds, images, etc) now include mappings to Neurons, making it easier to understand how your included Neuron volume is consumed and how you are charged at scale
• Per-model pricing, instead of the previous bucket approach, allows us to be more flexible on how models are charged based on their size, performance and capabilities. As we optimize each model, we can then pass on savings for that model.
• You will still only pay for what you consume: Workers AI inference is serverless, and not billed by the hour.

Going forward, models will be launched with their associated Neuron costs, and we'll be updating the Workers AI dashboard and API to reflect consumption in both raw units and Neurons. Visit the Workers AI pricing page to learn more about Workers AI pricing.