Cloudflare Release Notes

Welcome to your new home for product updates on Cloudflare One.

Our new changelog lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs.

If you are looking for older product updates, refer to the following locations.

Older product updates

• Access
• Browser Isolation
• CASB
• Cloudflare Tunnel
• Data Loss Prevention
• Digital Experience Monitoring
• Email security
• Gateway
• Multi-Cloud Networking
• Cloudflare Network Firewall
• Magic Network Monitoring …

You can now easily enable Real User Monitoring (RUM) monitoring for your hostnames, while safely dropping requests from visitors in the European Union to comply with GDPR and CCPA.

RUM Enablement UI

Our Web Analytics product has always been centered on giving you insights into your users' experience that you need to provide the best quality experience, without sacrificing user privacy in the process.

To help with that aim, you can now selectively enable RUM monitoring for your hostname and exclude EU visitor data in a single click. If you opt for this option, we will drop all metrics collected by our EU data centers automatically.

You can learn more about what metrics are reported by Web Analytics and how it is collected in the Web Analytics documentation. You can enable Web Analytics on any hostname by going to the Web Analytics ↗︎ section of the dashboard, selecting "Manage Site" for the hostname you want to monitor, and choosing the appropriate enablement option.

On Typesafe's own workflow evals, Clef beats Jev in 3 of 4 areas: invoice processing, customer service, and security incidents. The full results are on the Hugging Face model card ↗︎.

Drop-in compatible with Jev

Model	Size	Best for	Context window
@cf/cloudflare/clef	27B	Highest-precision decisions	64K tokens
@cf/cloudflare/clef-flash	9B	Latency-critical, hot-path decisions	64K tokens

Clef follows the System One API, so you can switch an existing Jev integration to Clef by changing the endpoint and model. Ask up to 64 questions per request, in three types:

• noul: A yes/no question. Returns the probability that the answer is yes.
• choice: Pick one option from a set you define. Returns the chosen option, a probability per option, and a confidence value.
• score: Rate against an ordered rubric. Returns a probability-weighted score and a probability per level.

const response = await env.AI.run("@cf/cloudflare/clef", {
	model: "clef",
	state: "Checkout has been failing for every customer for the last hour.",
	questions: {
		urgent: {
			type: "noul",
			instructions: "Is this support request urgent?",
		},
		team: {
			type: "choice",
			instructions: "Which team should handle this request?",
			criteria: { …

Note

These are breaking changes. The DoH JSON format has no formal RFC and its schema is not guaranteed to be stable. If you need a stable format, use the DoH wireformat instead.

Human-readable display for additional record types

Several record types previously returned their data field in RFC 3597 ↗︎ generic hex encoding (\# <length> <hex>). These now use standard presentation format:

CAA:        0 issue "letsencrypt.org"
NAPTR:      100 10 "s" "SIP+D2U" "" _sip._udp.example.com.
RP:         admin.example.com. txt.example.com.

• Choose the image and instance size each time it starts a sandbox. One class can run sandboxes on different images, and a deploy does not restart sandboxes that are running.
• Save the files of a sandbox as a snapshot, in public beta, and start the same sandbox or a new one from it.
• Decide when each sandbox stops, for example when a task finishes, when its user goes idle, or after it saves a snapshot.
• Run commands with streamed input and output, send them signals, and open terminals.
• Serve previews from ports in the sandbox, with your own hostnames and authentication.
• Handle outbound requests for each hostname in Worker code, so credentials and bindings stay in your Worker.
• Expose only the methods that you want callers to use.
• Run an agent in the same Durable Object, and give the model a tool that runs commands in the sandbox.

src/index.jsjs

import { Files } from "@cloudflare/sandbox";
import { DurableObject } from "cloudflare:workers";

export class MySandbox extends DurableObject {
	container;
	files;

	constructor(ctx, env) {
		super(ctx, env);
		if (!ctx.container) { …

SVCB: 1 target.example.com. alpn=h2 HTTPS: 1 . alpn=h3,h2 ipv4hint=192.0.2.1 TLSA: 3 1 1 aabbccdd... SSHFP: 1 2 aabbccdd... OPENPGPKEY: AwEA...

#### Numeric DNSSEC algorithm identifiers

DNSSEC-related records now use numeric algorithm identifiers as defined in [RFC 4034 ↗︎](https://datatracker.ietf.org/doc/html/rfc4034) instead of mnemonic names. This affects `RRSIG`, `DS`, `CDS`, `DNSKEY`, and `CDNSKEY` records. For example, `RSASHA256` becomes `8`, `ECDSAP256SHA256` becomes `13`, and `ED25519` becomes `15`. DS digest types also change from mnemonic to numeric: `SHA-256` becomes `2`.

*Beforetxt*

```txt
RRSIG:  A RSASHA256 2 300 ...
DS:     12345 RSASHA256 SHA-256 aabb...
DNSKEY: 257 3 RSASHA256 AwEA...

Aftertxt

RRSIG:  A 8 2 300 ...
DS:     12345 8 2 aabb...
DNSKEY: 257 3 8 AwEA...

Other formatting changes

HINFO character-strings are now individually quoted to remove ambiguity when values contain spaces:

Beforetxt

"data": "Intel Xeon Linux"

Aftertxt

"data": "\"Intel Xeon\" \"Linux\""

New widgets on TLD detail pages ↗︎:

• Aggregate nameserver latency ↗︎: Response time percentiles (p25/p50/p75) for all authoritative nameservers of the selected TLD.
• Latency per nameserver ↗︎: Median response time (p50) broken down by each authoritative nameserver over time.

Latency per nameserver chart

• Median latency geographic distribution ↗︎: p50 response time by Cloudflare data center country, displayed on a choropleth map.
• TLD ranking over time ↗︎: Daily DNS magnitude rank and magnitude value with a Rank/Magnitude toggle.
• Rank change deltas ↗︎: 1 week, 4 weeks, and 3 months rank changes added to the TLD magnitude table and the TLD detail info panel.

TLD Rankings by DNS Magnitude table with rank change deltas …

client.addEventListener("turnmetrics", (turn) => {
	console.log(turn.outcome, turn.turnTotalMs);
});

About the Voice package

The @cloudflare/voice package lets you build real-time voice agents with Cloudflare Agents. It streams microphone audio to an Agent over WebSocket, transcribes speech, runs your model through onTurn(), converts the response to speech, and streams audio back to the caller.

A turn moves through several stages:

User speaks -> speech-to-text -> model -> text-to-speech -> audio

Previously, the package's four aggregate metrics covered successful, non-empty speech turns. They did not show how failed, aborted, empty, or text turns ended.

Turn metrics

Each speech or text turn now produces a typed VoiceTurnMetrics summary with:

• A turnId for correlating events from the same turn.
• A terminal outcome such as completed, no_output, output_limit, content_filtered, model_error, tts_error, or aborted.
• Timings for important stages, including speech-to-final-transcript, model-to-first-text, TTS-to-first-audio, and total turn duration.

These timings can overlap and are not additive. Timings for stages that a turn did not reach are omitted.

The latest summary is available through VoiceClient, useVoiceAgent(), and useVoiceInput(). Voice input includes only the speech and transcription timings it can measure. …

Screenshot of the origin post-quantum support graph on Radar

A host test tool allows checking any publicly accessible website for post-quantum encryption compatibility. Enter a hostname and optional port to see whether the server negotiates a post-quantum key exchange algorithm.

Screenshot of the post-quantum host test tool on Radar

Key Transparency

A new Key Transparency ↗︎ section displays the audit status of Key Transparency logs for end-to-end encrypted messaging services. The page launches with two monitored logs: WhatsApp and Facebook Messenger Transport.

Each log card shows the current status, last signed epoch, last verified epoch, and the root hash of the Auditable Key Directory tree. The data is also available through the Key Transparency Auditor API.

Screenshot of the Key Transparency dashboard on Radar …