[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cloudflare (source)	required_provider	major	~> 4.0 → ~> 5.0

---

Release Notes

cloudflare/terraform-provider-cloudflare (cloudflare)

v5.28.1

Compare Source

Full Changelog: v5.28.0...v5.28.1

Changes

• the provider is now built with Go 1.27.3, which distrusts a set of intermediate certificate authorities that have been revoked for CA compromise. The distrust list is compiled into the provider binary, so affected chains are rejected regardless of the host's system trust store. Upgrade to this release to pick up the change; no configuration changes are required.
• cloudflare-go: the Go SDK dependency is updated to v7.13.1.
• cloudflare-go: the unused v6 Go SDK dependency is removed. The api_shield_discovery_operation list data source now uses v7.

v5.28.0

Compare Source

Full Changelog: v5.27.0...v5.28.0

⚠ BREAKING CHANGES

• api_shield_discovery_operation: operation_id has been renamed to discovery_id, zone_id is now required, and the computed id attribute has been removed. Update resource arguments and any expressions referencing id. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.
• email_security_trusted_domains: is_recent, is_regex, and is_similarity are now required instead of optional. Set all three explicitly, using false for protections that should not be bypassed.
• registrar_domain, registrar_domains: the cloudflare_registrar_domain resource and data source, and the cloudflare_registrar_domains list data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed word_list attribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nested word_list values in the zero_trust_dlp_custom_profile and zero_trust_dlp_predefined_profile data sources. Remove jsondecode(...) around these values and update expressions expecting a string. No new state upgrader is included for this type change.
• zero_trust_organization: mfa_ssh_piv_key_requirements has been replaced with mfa_piv_key_requirements on the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.

Notes

• pages_project: the API documentation now clarifies that build image version 1 is retired and affected projects are moved to version 3. Once a project's builds have moved, requests setting deployment_configs.preview.build_image_major_version or deployment_configs.production.build_image_major_version to 1 are rejected. Use version 3 for those projects.
• zero_trust_device_custom_profile: the read-only target_tests attribute is deprecated on the resource and its data sources.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed deprecated attribute no longer defaults to false.

Features

New Resources

• cloudflare_monetization_rules: manage a zone's Payment Required ruleset, including exact, upto, and origin_controlled payment schemes. Supports terraform import using the zone ID.

New Data Sources

• cloudflare_monetization_rules: read a zone's Payment Required ruleset.

New Attributes

• ai_search_instance, ai_search_instances: metadata.created_from_emdash_plugin, with type (native or rest) and version.
• pages_project, pages_projects: read-only build_image_auto_upgrade.from_version and build_image_auto_upgrade.to_version, identifying projects moved from a retired build image.
• worker_version, worker_versions, workers_script: Durable Object binding retry settings, bindings.retry.max_attempts and bindings.retry.timeout_ms. max_attempts counts retries after the initial request and accepts 0–10; zero disables retries. timeout_ms accepts 500–60000 and controls the retry window, not the initial-request timeout.
• workers_kv_namespace, workers_kv_namespaces: mode; set mode = "instant" when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.
• workers_script: bindings_inherit = "strict" makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.
• zero_trust_access_application, zero_trust_access_applications: target_criteria.include, target_criteria.require, and target_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requires include; require and exclude are optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacy target_criteria.target_attributes format remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.
• zero_trust_access_identity_provider, zero_trust_access_identity_providers: config.login_page_auto_prompt, defaulting to false on the resource, to automatically prompt for passkey authentication on the Access login page.
• zero_trust_gateway_certificate, zero_trust_gateway_certificates: read-only region, identifying where the certificate authority's key material is pinned.
• zero_trust_resource_library_application, zero_trust_resource_library_applications: lookup query support for finding complete application name mentions in a phrase. Use filter.lookup on the singular data source or lookup on the list data source. It cannot be combined with search.

New Accepted Values

• zero_trust_access_application: session_duration is now supported for infrastructure applications and defaults to 24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must use s, m, or h in whole seconds.
• zero_trust_access_identity_provider: type accepts passkeys.
• zero_trust_device_custom_profile: match expressions support device.tags.

Bug Fixes

• d1_database: make read_replication optional and computed with a nested custom type, allowing API-returned replication settings to populate state when the block is omitted.
• dns_record: default missing include_shadow_metadata to false during refresh and v4 to v5 migration, avoiding spurious updates for older state. Allow modified_on to change when private_routing or include_shadow_metadata changes, preventing inconsistent-result errors after updates.
• hostname_tls_setting: populate the required setting_id during import, so imported hostname TLS settings can be refreshed and managed.
• pages_domain, r2_data_catalog, stream_caption_language, stream_download, stream_key, zero_trust_access_short_lived_certificate: stop sending JSON request bodies to API operations that do not accept a body.
• pages_project, workers_kv_namespace, workers_script, zero_trust_access_application, zero_trust_access_identity_provider, zero_trust_gateway_certificate: add newly introduced attributes to the v500 migration target models so existing state upgraders match the current schemas.
• ruleset: improve legacy v4 state detection and migration at schema versions 0 and 1, including nested blocks, retired metadata, and v4.52.9 content_converter fields. Preserve configured content_converter values and existing v5 state, including rules managed with lifecycle.ignore_changes.
• worker: preserve changes made only to previews_base_config, including configuration-derived unknown values, so preview-only updates do not incorrectly retain the previous updated_on value or suppress the planned change.
• workers_script: prefer the API's CF-Entrypoint header when refreshing multipart script content, allowing renamed entrypoints to surface as drift instead of failing to find a stale module name. Preserve service-worker body_part format during refresh.
• zero_trust_access_application: clear prior target criteria before decoding refresh responses, so removed rules and selectors become null instead of retaining stale objects in state.

v5.27.0

Compare Source

Full Changelog: v5.26.0...v5.27.0

⚠ BREAKING CHANGES

One change requires a configuration edit. The rest of this release's schema movement is read-only reshaping with no action required — see Schema Changes at the end.

• api_shield_operation: the feature and with_schemas attributes have been removed from the resource. They were never resource state — both are read-shaping query parameters on the list/get endpoints, and there is no create or update endpoint that accepts them. Remove them from any cloudflare_api_shield_operation block; leaving them in place produces an "Unsupported argument" error. The schema version moves from 500 to 501 and an automatic state upgrader strips both fields from existing state, so no manual state editing is required. This also fixes the .with_schemas: was cty.False, but now null error raised when upgrading from v5.26.0.

Notes

• magic_transit_site: changing ha_mode no longer forces replacement. The upstream API added update support, so the site is modified in place.
• magic_transit_site_lan: changing ha_link no longer forces replacement, for the same reason.
• magic_transit_site_wan: health_check_rate is now configurable (previously read-only).
• ai_search_instance: hybrid_search_enabled now reflects the API default of true for newly created instances. Existing instances keep the value already in state, so upgrading does not plan a change.
• zone_dns_settings: nameservers.ns_set is now computed. It applies only to custom nameserver types and is preserved from state when the API does not return it.
• zone_dns_settings: foundation_dns is deprecated and will be removed in a future API version. Set nameservers.type to cloudflare.advanced to turn Advanced Nameservers on, or cloudflare.standard to turn it off.
• ai_gateway: the default for spend_limits.rules.id changed from 865b4d33 to 00000000. Configurations that do not set id explicitly will show a one-time diff on the next plan.
• zero_trust_device_custom_profile: changing an explicitly configured profile_type now forces replacement. The field is set when the profile is created and cannot be changed, so an in-place update was never possible. Configurations that omit profile_type are unaffected.

Features

New Resources

• cloudflare_zero_trust_casb_integration: Zero Trust CASB Integration

New Data Sources

• cloudflare_zero_trust_casb_integration: Zero Trust CASB Integration
• cloudflare_zero_trust_casb_integrations: Zero Trust CASB Integrations (list)

New Attributes

• magic_transit_site_wan: load_balance_inner_flows
• zero_trust_organization: strict_service_token_auth
• zone_dns_settings: nameservers.nameserver_set_id
• ai_search_instance, ai_search_instances: hostname filter
• account_api_token_permission_groups, account_api_token_permission_groups_list, api_token_permission_groups_list: category and is_selectable

New Accepted Values

• flagship_flag: rules.conditions[...].operator accepts has and not_has
• pipeline_sink: type accepts basin_catalog
• worker_version: bindings.type accepts artifacts
• workers_script: bindings.type accepts artifacts, flagship, k2 and messaging
• zone_dns_settings: nameservers.type accepts cloudflare.advanced and custom

Other

• bump cloudflare-go to v7.12.0
• calls_turn_app: add support for terraform import
• zero_trust_casb_policy: reject at plan time configurations where applies_to_all_integrations is false and no integration IDs resolve. Existing policies that omit integration_ids and retain IDs in state continue to plan normally.

Bug Fixes

• api_shield: add missing normalize field to v500 migration target model
• bot_management: wire up AI Crawl Control fields in hand-maintained API plumbing
• bot_management: wire ai_bots_migration_opt_out into the API model
• calls_turn_app: populate key_id from the API's uid after create, so plan, refresh, update and destroy no longer fail with "missing required key_id parameter"
• d1_database: add missing fields to the v500 migration target model
• dns_record: default include_shadow_metadata to false on import
• logpush_dataset_field: deserialize the fields result map
• logpush_job: add decode_null_to_zero to filter_attack_traffic
• notification_policy: add missing token_id to the v500 migration target model
• observatory_scheduled_test: require replacement when frequency or region change, as the API has no update endpoint for scheduled tests
• page_rule: send the API's query_string wildcard
• schema_validation_schemas: default omit_source to false on import
• snippet_rules: remove stale and spurious top-level fields from the migration target model
• turnstile_widget: default page/per_page to their spec values on import
• worker: remove observability.redact_query_string
• worker, worker_version: backfill author fields on create
• worker_version: exclude exports_reconciliation from the v0 legacy schema
• worker_version: add missing V0 fields to fix a migration test panic
• workers_kv: add missing expiration/expiration_ttl to the v500 migration target model
• workers_script: add missing base_path and observability.issues attributes
• workers_script: add missing stream attribute to the bindings schema
• workers_script: add missing force field to the legacy V0 migration struct
• zero_trust_access_ai_controls_mcp_server: only send changed fields on update, so unrelated changes no longer resend and rotate client_secret; redact auth_credentials and client_secret from debug logs
• zero_trust_access_mtls_hostname_settings: import now takes an explicit accounts/<account_id> or zones/<zone_id> prefix. Account and zone IDs are both 32-character hex, so the previous length-based detection always resolved to account scope and zone-scoped resources could not be imported.
• zero_trust_device_custom_profile: stop split tunnel entries inheriting a mutually exclusive field from state, which caused "host and Address both cannot be present" API errors
• zero_trust_organization: add warp_auth_non_browser_401 to the v4 source model, unblocking v4 to v5 migration
• zero_trust_organization: ignore mfa_configuration_allowed/service_token_inactivity on import
• zero_trust_organization: normalize mfa_configuration_allowed, service_token_inactivity, trusted_accounts
• zero_trust_organization: fix refresh-plan instability for 4 attributes
• zero_trust_tunnel_warp_connector: restore ha from metadata.ha on import and read

Schema Changes (no action required)

Upstream Cloudflare API schema changes picked up via the cloudflare-go v7.12.0 bump. These are listed for completeness; none require a change to a working configuration.

Of the 54 removed attributes, 52 are read-only (computed): existing state files load without user action and plans are unaffected, so only configurations that reference them — in an output block or an expression — need updating. The two attributes that become Required were already mandatory server-side, so a request omitting them was always rejected; the failure simply moves from apply time to plan time. The one type change is on data sources only, and HCL converts numeric strings automatically.

• account_member, account_members, account_permission_group, account_permission_groups, account_token, account_tokens, api_token, api_tokens, user_group, user_groups: the generic policies.permission_groups.meta.key / .value pair has been replaced with typed fields — category, deprecated, description, editable, eol_at, label, scopes, visibility. Expressions reading meta.key/meta.value must move to the named field.
• hyperdrive_config, hyperdrive_configs: integration.integration has been renamed to integration.hyperdrive_config_provider.
• queue, queues, queue_consumer, queue_consumers: the read-only settings.email, settings.pagerduty and settings.webhooks detail attributes are no longer surfaced on the cloudflare_queue resource or the queue data sources. Relatedly, notification is no longer an accepted value for the read-only consumers.type attribute on those surfaces. Queue configuration is unaffected — the cloudflare_queue_consumer resource is unchanged and still accepts and manages all three settings blocks.
• cloud_connector_rules: rules is now Required instead of Optional. The API already rejects a request that omits it, so this moves the failure from apply time to plan time rather than breaking a working configuration.
• zone_dns_settings: nameservers.type is now Required instead of Optional. nameservers became a discriminated union upstream and type is its discriminator, so it was already mandatory in practice.
• flagship_flag, flagship_flags: limit changed from String to Int64 and is now constrained to between 1 and 200. These are data sources only, so there is no state to migrate, and HCL converts numeric strings automatically — limit = "10" continues to work.

v5.26.0

Compare Source

Full Changelog: v5.25.0...v5.26.0

Features

New Resources

• cloudflare_field_extractor: Field Extractor
• cloudflare_magic_wan_bgp_filter_profile: Magic WAN BGP Filter Profile
• cloudflare_zero_trust_casb_policy: Zero Trust CASB Policy
• cloudflare_zero_trust_casb_webhook: Zero Trust CASB Webhook
• cloudflare_zero_trust_connectivity_settings: Zero Trust Connectivity Settings
• cloudflare_zone_tracing: Zone Tracing
• cloudflare_zone_tracing_rules: Zone Tracing Rules

New Data Sources

• cloudflare_field_extractor: Field Extractor
• cloudflare_magic_wan_bgp_filter_profile: Magic WAN BGP Filter Profile
• cloudflare_magic_wan_bgp_filter_profiles: Magic WAN BGP Filter Profiles (list)
• cloudflare_zero_trust_casb_policy: Zero Trust CASB Policy
• cloudflare_zero_trust_casb_policies: Zero Trust CASB Policies (list)
• cloudflare_zero_trust_casb_webhook: Zero Trust CASB Webhook
• cloudflare_zero_trust_casb_webhooks: Zero Trust CASB Webhooks (list)
• cloudflare_zero_trust_connectivity_settings: Zero Trust Connectivity Settings
• cloudflare_zone_tracing: Zone Tracing
• cloudflare_zone_tracing_rules: Zone Tracing Rules

New Attributes

• cloudflare_magic_wan_gre_tunnel, cloudflare_magic_wan_ipsec_tunnel
  • bgp.import_filter_id: ID of the BGP filter profile applied to routes received from the customer
  • bgp.export_filter_id: ID of the BGP filter profile applied to routes advertised to the customer

Bug Fixes

• custom_ssl: mark private_key optional to unblock setting custom_csr_id
• email_routing_settings: add missing support_subaddress to resource schema
• load_balancer_monitor: correctly resolve ambiguous version-zero state during v4 to v5 migration
• page_rule: raise edge_cache_ttl maximum to allow one-year values
• provider: send user_agent_operator_suffix unquoted and read fallback from environment variable
• ruleset: normalize legacy query string wildcards during v4 to v5 migration
• zone_lockdown: drop UseNonNullStateForUnknown on created_on to prevent perpetual diff

v5.25.0

Compare Source

Full Changelog: v5.24.0...v5.25.0

Features

New Resources

• cloudflare_email_security_allow_policy: Cloud Email Security Allow Policy
• cloudflare_email_security_domain: Cloud Email Security Domain
• cloudflare_email_sending_subdomain: Email Sending Subdomain
• cloudflare_nel_setting: Network Error Logging Zone Setting
• cloudflare_zero_trust_resource_library_application: Zero Trust Resource Library Application

New Data Sources

• cloudflare_email_security_allow_policy: Cloud Email Security Allow Policy
• cloudflare_email_security_allow_policies: Cloud Email Security Allow Policies (list)
• cloudflare_email_security_domain: Cloud Email Security Domain
• cloudflare_email_security_domains: Cloud Email Security Domains (list)
• cloudflare_email_sending_subdomain: Email Sending Subdomain
• cloudflare_email_sending_subdomains: Email Sending Subdomains (list)
• cloudflare_nel_setting: Network Error Logging Zone Setting
• cloudflare_spectrum_protocols: Spectrum Protocols (list)

New Attributes

• cloudflare_ai_search_instance
  • aisearch_model: Workers AI model for AI search queries
  • embedding_model: Model used to generate text embeddings
  • reranking_model: Model used to rerank search results
  • rewrite_model: Workers AI model for query rewriting
  • summarization_model: Model used to summarize search results
• cloudflare_bot_management
  • bot_preference_sync_enabled: Sync bot preferences from AI Search, AI User, and AI Training zone settings
• cloudflare_content_scanning_expression
  • payload: Custom content extraction expression to locate content objects in requests
• cloudflare_email_routing_dns
  • support_subaddress: Whether plus-addressing is honored when matching routing rules
• cloudflare_magic_transit_connector
  • primary: Whether this connector is the primary connector for the site
  • site_id: Identifier of the Magic Transit site this connector belongs to
• cloudflare_oauth_client
  • optional_scopes: Scopes a user may decline during OAuth consent
• cloudflare_organization
  • account_creation_applies_tenant_defaults: Whether tenant defaults apply to newly created accounts
• cloudflare_pipeline_sink
  • format: Output data format configuration for the sink
  • schema: Schema definition for events in the data stream
• cloudflare_pipeline_stream
  • format: Data format configuration for stream events
  • schema: Schema definition for events in the data stream
• cloudflare_ruleset
  • origin_range_requests: Fetch large origin assets as a series of range requests
  • vary: Cache variation key configuration for set_cache_settings action
• cloudflare_stream_live_input
  • playback: HLS and DASH manifest URLs for live stream playback
• cloudflare_worker_version
  • identity: Enables Gateway identity for network bindings
• cloudflare_workers_kv_namespace
  • jurisdiction: Restrict KV data storage to a specific jurisdiction at creation time
• cloudflare_workers_script
  • files: Multipart WASM modules and binary files included in the Worker upload
• cloudflare_workflow
  • concurrency: Concurrency limit and active instance count for the workflow
• cloudflare_zero_trust_access_group
  • account_id: Account that owns the device posture integration (in posture sub-rules)
• cloudflare_zero_trust_access_identity_provider
  • force_authn: Asks the IdP to reauthenticate on each SAML request
  • max_sso_url_length: Maximum URL length accepted for SSO redirect

Bug Fixes

• bot_management: mark bot_preference_sync_enabled optional-only; Computed caused "unknown after apply" errors
• custom_pages: Update causing inconsistent apply results
• email_routing_dns: data source not returning any data (#​7130)
• email_security_block_sender: mark account_id as required in data sources
• image: fix create/update marshaling errors
• magic_transit_connector: add missing primary and site_id fields; mark account_id as required in data sources
• registrar_domain: mark account_id as required in list data source
• worker_version: correct response binding order to prevent plan drift (#​7115)
• set schema Version: 500 on new resources to enable correct state upgrade path

v5.24.0

Compare Source

Full Changelog: v5.23.0...v5.24.0

BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• hostname_tls_setting: the cloudflare_hostname_tls_setting data source now requires hostname as an input parameter instead of returning it as a computed attribute. The computed id attribute has been removed; use setting_id instead. (ece27fe)
• image_variant: the computed variant nested attribute has been removed. The API no longer returns this wrapper object; the id, options, and never_require_signed_urls fields remain available at the top level. Remove any references to cloudflare_image_variant.<name>.variant from your configurations. (738bd28)
• organization: the computed meta.flags nested attribute has been renamed to meta.tenant_flags. Two new computed sub-attributes (enterprise_capability, member_management) have been added. Update any references from .meta.flags to .meta.tenant_flags. (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: the allow_code_mode attribute is now deprecated and no longer computed with a default of true. Use the new code_mode attribute ("off", "opt_in", "default_on", "enforced") instead. Configurations that relied on the computed default must explicitly set code_mode or allow_code_mode. (ece27fe)
• zero_trust_access_policy: the session_duration attribute is no longer computed with a default of "24h". It is now optional-only. Existing configurations that omitted session_duration and relied on the provider default will see a plan diff; explicitly set session_duration = "24h" to preserve the previous behavior. (ae4f5a1)
• zero_trust_organization: the allowed_authenticators enum value ssh_piv_key has been renamed to piv_key, and a new value ssh_fido2_key has been added. Configurations using "ssh_piv_key" must be updated to "piv_key". (ece27fe)
• zero_trust_resource_library_application: the id attribute type changed from String to Int64. The computed intel_id attribute has been removed. The hostnames, ip_subnets, port_protocols, support_domains, and supported attributes changed from List to Set (element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)
• zero_trust_resource_library_category: the id attribute type changed from String to Int64 on both the data source and list data source. (ece27fe)
• zero_trust_tunnel_cloudflared: the computed is_pending_reconnect attribute has been removed from connections. The upstream API no longer returns this field. Remove any references to connections[*].is_pending_reconnect from your configurations. (ece27fe)
• zero_trust_tunnel_warp_connector: the computed is_pending_reconnect attribute has been removed from connections, matching the zero_trust_tunnel_cloudflared change above. (ece27fe)

New Resources

• cloudflare_ct_alerting: onboard new Terraform resource for Certificate Transparency alerting (ece27fe)
• cloudflare_precursor: onboard new Terraform resource for Precursor (ece27fe)

New Data Sources

• cloudflare_hostname_tls_settings: add list data source for hostname TLS settings (ece27fe)

Features

• bump Go SDK version to v7.9.0 (79c7d4f)
• ai_gateway: add log_classification attribute and unified billing mode (ece27fe)
• ai_search_instance: add discover_options for link-following web crawler configuration (ece27fe)
• ai_search_namespace: add public_endpoint_params with MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)
• cloud_connector_rules: add oci_storage cloud provider type (ece27fe)
• d1_database: add us location restriction value (ece27fe)
• load_balancer_pool: add health_sources attribute for regional health steering (ece27fe)
• ruleset: add vary parameter to set_cache_settings action (e9cdc20)
• waiting_room: add Latvian (lv-LV) language support (ece27fe)
• worker: add preview_url_suffix and url computed attributes to subdomain block (ece27fe)
• worker_version: add messaging binding type (ece27fe)
• zero_trust_access_ai_controls_mcp_portal: add code_mode attribute for granular Code Mode policy control (ece27fe)
• zero_trust_access_ai_controls_mcp_server: add authentication_status computed attribute (ece27fe)
• zero_trust_access_application: add worker destination types for Access (118fe39)
• zero_trust_access_custom_page: add contract_version, warnings, and new type values (login, interstitial) (ece27fe)
• zero_trust_access_service_token: add enabled attribute to control service token activation (ece27fe)
• zero_trust_dlp_*_entry: add computed deprecated attribute to all DLP entry resources and data sources (ece27fe)
• zero_trust_organization: add warp_auth_non_browser_401 attribute for non-browser 401 responses (ece27fe)
• zone_setting: add webmcp_enabled and webmcp_packs setting IDs (ece27fe)

Bug Fixes

• guard against nil pointer dereference in dynamic semantic equality (d82bbd5)
• image_variant: fix nested variant response deserialization (738bd28)
• port v5.23.0 regression fixes from GitHub main (ae4f5a1)
• remove duplicate declarations causing build failures (dc360d2)

Documentation

• image_variant: update resource documentation (bab4b71)
• regenerate provider documentation (79c7d4f)
• restore .md extensions on internal guide cross-links (f51c9d6)

v5.23.0

Compare Source

Full Changelog: v5.22.0...v5.23.0

New Data Sources

• cloudflare_zero_trust_dlp_custom_prompt_topic: add data source for DLP custom prompt topics (ae6a505)
• cloudflare_zero_trust_dlp_custom_prompt_topics: add list data source for DLP custom prompt topics (ae6a505)

Features

• bump Go SDK version to v7.8.0 (ae6a505)
• hyperdrive_config: add v4 to v5 state migration (cdd5ca6)
• turnstile_widget: add deployed_via and last_modified_via computed fields, and default offlabel to false (5952e95)
• zero_trust_device_default_profile: add global_acceleration block for configuring custom tunnel and API endpoints (5952e95)
• zero_trust_gateway_policy: add delete_headers support in request header modification settings (5952e95)

Bug Fixes

• d1_database: initialize read_replication in state upgrader to prevent 400 error (298799b)
• load_balancer_pool: preserve origins order to prevent perpetual drift (aad09cc)
• zero_trust_access_ai_controls_mcp_portal: migrate servers state from list to set (9766b3a)
• zero_trust_access_policy: resolve perpetual diff by calling normalization in CRUD (497f06b)
• zero_trust_device_custom_profile: resolve perpetual drift on default, include, target_tests, and exclude nested attributes (f74cecf)
• zero_trust_device_custom_profile: address review feedback on normalization (969b35d)
• zero_trust_dex_test: remove stale model fields that caused value conversion panics during resource operations (fd43d83)
• zero_trust_organization: normalize mfa_required_for_all_apps to prevent perpetual diff (001c28e)
• workers_custom_domain: populate computed fields from a post-create read to prevent import drift (fd43d83)
• pages_project: fix source.config drift for API-populated fields by preserving computed state values (c63f15e)

Chores

• add .terraform-registry for ownership transfer (d33bc90)
• internal: codegen related update (ae6a505)

Documentation

• add workers_secret migration guidance with tf-migrate support (524b26a)
• fix account_subscription examples (2ebc7db)
• migration-guide: add table of contents to v5 migration guide (e11e8a4)
• regenerate provider documentation (4656c9f)
• resolve AI review doc warnings (691131e)

v5.22.0

Compare Source

Full Changelog: v5.21.1...v5.22.0

⚠ BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• ai_search_instance: the source_params.web_crawler.crawl_options block has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove any crawl_options { ... } block from your cloudflare_ai_search_instance configurations. (0843c7f)
• zero_trust_access_ai_controls_mcp_portal: the servers attribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order of servers entries differs, and any code that relied on stable list ordering (e.g. element(..., 0)) may need to be updated. (099fc24)

Notes

• managed_transforms: managed_request_headers and managed_response_headers are now Optional instead of Required. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)

New Resources

• cloudflare_moq_relay: onboard new Terraform resource for Media over QUIC (MoQ) relays (9f2678c)

Features

• d1_database: add v4-to-v5 state upgrader (32f42b1)
• d1_database: add CRUD acceptance tests (3491e69)
• hyperdrive_config: add comprehensive acceptance tests (59399bb)
• oauth: add oauth_client resource CRUD support (154668f)
• workers_custom_domain: add acceptance tests for resource, data sources, and import (26e0092)
• workers_script: add exports and package_dependencies to schema (c15cef1)
• zero_trust_access_application: add file as valid RDP connection_rules value (2659e30)
• zero_trust_access_short_lived_certificate: add MoveState handler for access_ca_certificate rename (v4 -> v5 auto-migration) (90f3324)

Bug Fixes

• dns_record: dedupe schema key and drop unused import (8faa422)
• dns_record: revert Meta model to jsontypes.Normalized to match schema (c0eea18)
• docs: add .md extension to migration guide links (7546f3e)
• hyperdrive_config: address review feedback (92ce892)
• load_balancer_pool: remove phantom flatten_cname from v4 source model (baa1b92)
• migration: correct v4 test configs and migration test harness for access_ca_certificate (2c47cf7)
• moq_relay: add schema Version: 500 (890b9f9)
• oauth: remove custom oauth visibility change (6b4a0ed)
• ruleset: add asset_name to v4 source schema so v4->v5 state upgrader parses correctly (baa1b92)
• worker_version: add CustomType to assets schema to match model (7e7e0d3)
• worker_version: use NestedObject accessors for Assets field (78d419f)
• workers_custom_domain: address review feedback (3271949)
• workers_script: resolve duplicate cache_options tag (c15cef1)
• zero_trust_list: handle ambiguous schema_version=0 state (v4 vs v5) (c010f78)

Chores

• api: force regen of moq_relay and email_routing_rule (a9e500a)
• ci: add 30m timeout to unit test shards (635637b)
• ci: trigger acceptance tests on release-tf-* branches (5921d00)
• go.mod: pin cloudflare-go to release-770 branch head for v5.22.0 (05272f3)
• internal: codegen related update (c7a96ca)
• use 'next' for Terraform builds (30c04e6)

Documentation

• list: fix missing comma in resource and data source examples (bfe1c34)
• regenerate provider docs; fix provider address and .stats.yml (cbde062)
• update documentation for moved blocks to Terraform 1.8 (d93208d)
• v5-migration: document session_duration behavior change for access policies (90c58a7)
• v5-upgrade: add destructive-behavior warning for app-scoped policy migration (1e832d6)
• v5-upgrade: document zone_id removal for access policies (831f0bb)

v5.21.1

Compare Source

Full Changelog: v5.21.0...v5.21.1

Bug Fixes

• worker: stop sending propagation_policy when not configured (#​7192) (31d9a31)

v5.21.0

Compare Source

Full Changelog: v5.20.0...v5.21.0

Features

• add new resources from staging-next (e104922)

Bug Fixes

• add missing no-op state upgraders for version 0 -> 500 (692a0c6), closes #​7181
• restore account_id and zone_id as required on 156 resources (62024cf)
• workers_script: add missing propagation_policy to observability traces schema (78448d8)
• zone: only sweep zones containing the cftftest prefix (293ab21)

Chores

• Add acceptance tests for DLP data classification resources (b85f20c)
• ci: optimize CI workflow runtime (7aa373f)
• clean up (e36c8a3)

Documentation

• add docs for v5.20.1 release (712db1d)

v5.20.0

Compare Source

Full Changelog: v5.19.1...v5.20.0

Features

• add 11 new resources/data-sources from staging-next (faab405)
• add acceptance tests for google_tag_gateway resource (f89e15f)
• add acceptance tests for virtual_networks on zero_trust_device_custom_profile (0625153)
• add state upgraders for email_security_block_sender + impersonation_registry (bc22174)
• chore: skip failing deployment_groups tests (614c726)
• chore: skip failing Go SDK tests for workers bulk secret update (69d2591)
• chore: use cloudflare-go v7.5.0 in Terraform build (fd1ab3e)
• chore: use released Go SDK for Terraform build (e31d0f5)
• chore: use released Go SDK for Terraform build (858be78)
• feat: add custom_csrs Stainless config (zone + account) (0c37d4f)
• feat: add custom_csrs Stainless config (zone + account) (408836e)
• feat: add resource library endpoints inside zero trust (8f71612)
• feat: move google_tag_gateway terraform resource from staging to production (b4f6126)
• feat(api): add zero_trust_device_deployment_groups resource (3de6e62)
• feat(api): add zero_trust_device_deployment_groups resource (c852320)
• feat(cache): add create (POST) method for smart_tiered_cache (26568ea)
• feat(cache): Update OPCR config to v2 endpoints (CACHE-13523) (278c81f)
• feat(dex): add device ISPs endpoint mapping ([4c7ad2c](https://redirect.github.com/cloudflare/terraform-pr

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.