$
npx @buildinternet/releases get cloudflareRecently Shipped463 releases · updated Oct 13, 2026
Recently shipped Clef-omni with native audio and video input, Sandbox SDK 1.0, and GA Cloudflare One Clients on desktop.
Clef-omni reads audio and video directly. It takes WAV or MP3 and MP4 or WebM alongside text and images in one request, aligning a video's soundtrack with its frames instead of chaining a transcriber to a text model. Clef-flash is now cheaper than Jev, and Clef is faster.
Sandbox SDK 1.0 puts each sandbox under your own Durable Object. A class picks the image and instance size per sandbox, snapshots and restores files (public beta), streams command I/O, and sets when each sandbox stops. Deploys no longer restart running sandboxes.
Basin, AI Search, and agent tooling shipped. Basin (formerly Data Platform) collects and queries events; Pipelines ingests from Workers, HTTP, and Logpush into Iceberg or R2. AI Search defaults to hybrid search, folding Workers AI embedding and reranking into its pricing; billing starts November 1, 2026. Artifacts is in open beta, deploying repos to Workers. @cloudflare/workers-oauth-provider v1 splits the authorization and resource servers. Durable Objects stay alive for pending I/O at compatibility date 2026-10-01.
Cache invalidation is new; purging got costlier. The invalidate_cache endpoint marks content stale and revalidates with your origin, reusing cached bodies on 304. Purge now forces a Cache Reserve miss, billed as a Class A operation.
Cloudflare One Clients hit GA on desktop. Split-tunnel excluded resources are no longer briefly blocked during reconnect, and connects are faster with lower memory use.
Rules gained new controls, and unsafe-topic categories changed. hash_in_range() is GA, and cf.appsec.request.failed_detections exposes detection failures to custom and rate limiting rules. Rules using removed cf.llm.prompt.unsafe_topic_categories values no longer match. WAF added blocking detections for F5 BIG-IP, Citrix NetScaler, GitLab, and WordPress flaws.
All releasesBy productWorkersDeveloper PlatformApplication PerformanceApplication SecurityCloudflare OneCore Platform
Rules language gains trim functions
This release1 featureNew capabilitiesAI-tallied from the release notesCloudflare Rules now supports trim(), trim_start(), and trim_end() for removing surrounding bytes, defaulting to ASCII whitespace with an optional custom byte set. The functions return nil for nil input and are available on all plans across all HTTP products.
Emergency WAF rule blocks active RCE exploitation
This release1 featureNew capabilitiesAI-tallied from the release notesAn emergency release adds a new Cloudflare Managed Ruleset rule (Generic Rules - Remote Code Execution, rule ID ending fd1bf420) set to Block, targeting active exploitation of a critical RCE vulnerability in popular web frameworks where malicious input with invalid path sequences lets attackers run system commands with web server privileges.
Nameserver sets beta for Advanced Custom Nameservers
This release1 featureNew capabilities5 enhancementsImprovements to existing featuresAI-tallied from the release notesNameserver sets are now in beta for Enterprise accounts, grouping two to five custom nameserver names with Cloudflare-assigned IP addresses that can be assigned to zones in the same account. Setting advanced to true allocates addresses from Advanced anycast network groups, and sets are immutable reusable objects that lift the legacy limit of 5 numbered sets; legacy custom_ns sets remain supported alongside them.