---
scope: org
organization: cloudflare
release_count: 463
last_release: 2026-10-12
generated: 2026-04-16
updated: 2026-10-13
canonical: https://releases.sh/cloudflare/overview.md
---

Recently shipped Clef-omni with native audio and video input, Sandbox SDK 1.0, and GA Cloudflare One Clients on desktop.

**Clef-omni reads audio and video directly.** It takes WAV or MP3 and MP4 or WebM alongside text and images in one request, aligning a video's soundtrack with its frames instead of chaining a transcriber to a text model. Clef-flash is now cheaper than Jev, and Clef is faster.

**Sandbox SDK 1.0 puts each sandbox under your own Durable Object.** A class picks the image and instance size per sandbox, snapshots and restores files (public beta), streams command I/O, and sets when each sandbox stops. Deploys no longer restart running sandboxes.

**Basin, AI Search, and agent tooling shipped.** Basin (formerly Data Platform) collects and queries events; Pipelines ingests from Workers, HTTP, and Logpush into Iceberg or R2. AI Search defaults to hybrid search, folding Workers AI embedding and reranking into its pricing; billing starts November 1, 2026. Artifacts is in open beta, deploying repos to Workers. `@cloudflare/workers-oauth-provider` v1 splits the authorization and resource servers. Durable Objects stay alive for pending I/O at compatibility date `2026-10-01`.

**Cache invalidation is new; purging got costlier.** The `invalidate_cache` endpoint marks content stale and revalidates with your origin, reusing cached bodies on `304`. Purge now forces a Cache Reserve miss, billed as a Class A operation.

**Cloudflare One Clients hit GA on desktop.** Split-tunnel excluded resources are no longer briefly blocked during reconnect, and connects are faster with lower memory use.

**Rules gained new controls, and unsafe-topic categories changed.** `hash_in_range()` is GA, and `cf.appsec.request.failed_detections` exposes detection failures to custom and rate limiting rules. Rules using removed `cf.llm.prompt.unsafe_topic_categories` values no longer match. WAF added blocking detections for F5 BIG-IP, Citrix NetScaler, GitLab, and WordPress flaws.