Recent releases from organizations and products in the Infrastructure category.
AI Gateway now integrates with Cloudflare Access, letting you protect gateway endpoints with Access policies and use the authenticated user's identity in logs, analytics, routing, and spend controls. The verified Access user ID is added to request metadata as cf.user_id.
AI Gateway now works with Cloudflare Access, letting you protect gateway endpoints behind Access policies and enabling identity-aware controls. Authenticated user IDs are added to request metadata as cf.user_id, supporting per-user spend limits, gateway access rules, log filtering, and policy building without client-side user ID passing.
Vectorize indexes now hold up to 20 million vectors, doubling the previous 10 million limit. The 1,536-dimension, 32-bit precision per-vector limit is unchanged.
Agent tracing is now available for applications built with the Agents SDK, showing each agent turn alongside model calls, tool runs, approvals, token usage, and Workers runtime operations. Think and Flue applications emit agent traces automatically; direct AI SDK calls require a one-time wrapAISDK() call.
Artifacts repos can now run CI/CD pipelines by defining a Workflow with the CI SDK, automatically triggered on push events. Pipelines support linting, testing, type checking, builds, and deployments with lockfile-based dependency caching.
Wrangler dev and vite dev now automatically capture structured OpenTelemetry traces and correlated console logs during local Worker invocations. AI agents can use the Local Explorer API to identify failing operations, fix code, and verify results without deployment or temporary logs.
A new Create Account button in the Cloudflare dashboard lets users create up to 5 standalone Free accounts, provided their account has at least 7 days of tenure. Enterprise account creation still requires contacting Support.
New rules block CVE-2026-50522 (SharePoint Server RCE) and update a rule for CVE-2026-66066 (Rails Active Storage RCE). Added SSRF detection for cloud-hosted applications with a new Block action, removing several older SSRF beta rules.
Pulumi Cloud now supports storing Terraform state as a remote backend, including remote execution with human approvals. A Terraform module registry lets users publish and share modules across language boundaries, and the Pulumi engine natively supports HCL as an authoring language.
Pulumi Cloud is now GA as a Terraform state backend, enabling organizations to manage existing Terraform and OpenTofu estates with remote runs, manual approvals, and access controls. HCL is now a first-class IaC language in Pulumi, fully OpenTofu-compatible, and Terraform modules can be imported into Pulumi programs and hosted in the private registry.
The core promise of Pulumi’s HCL support is that ...
An analysis of why prompt guardrails fail for autonomous coding agents, particularly in infrastructure contexts, and how Docker Sandboxes provide a practical alternative with a single command.
Billing is now enabled for R2 SQL on non-enterprise accounts, charging $0.0025/GB of compressed data scanned beyond the 10 GB monthly free tier. Pricing is additive to standard R2 storage and operations.
Billing is now enabled for R2 Data Catalog on non-enterprise accounts. Catalog operations cost $9.00/million and compaction costs $0.005/GB processed plus $2.00/million objects, each with a monthly free tier.
Billing is now active for Cloudflare Pipelines on non-enterprise accounts. Charges are based on SQL transforms ($0.04/GB) and sinks ($0.03/GB JSON, $0.06/GB Parquet or Iceberg), with 50 GB/month included on Workers Paid plans. Ingress remains free.
Python and JavaScript Workers can now call methods on each other using Workers RPC through Service bindings, without extra dependencies or serialization code. Exceptions propagate to the call site, and type conversion is handled automatically via Pyodide FFI.
@cloudflare/computer is an open-source agent runtime that gives each agent its own virtual filesystem backed by SQLite, with support for file operations, shell commands, and Git access. It dynamically orchestrates between fast isolate execution and full Linux containers, and includes an AI SDK-compatible toolkit.
Cloudflare Access administrators can now control whether a self-hosted application preemptively sets authorization cookies across its public hostnames, replacing the previous automatic behavior based on hostname count. The new Eager redirect cookie setting is on by default for new applications but can be turned off to avoid sign-in loops in browsers.
Connection reliability improved by swapping protocol order after repeated QUIC/HTTP/3 failures. Fixes include a MASQUE tunnel stall during high-rate upload, inability to switch organizations when stuck in "Device not in organization" state, orphaned credentials on multi-user uninstall, certificate errors on connection, and DNS search domain parsing failures. Post-re-authentication now re-evaluates device profiles.
