npm / cloudflare
cloudflare
What changed in cloudflare 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
42 breaking125 new APIs and options1 tooling1 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initcloudflare 7169 changes
Breaking changes 42
Removed this method and the ZoneDeleteResponse type.
Removed this method and the ZoneUpdateResponse type.
Now returns a V4PagePaginationArray instead of a SinglePage; code that reads page-level fields may need updating. Auto-pagination is unchanged.
update() and delete() now take the member account ID positionally and require address_map_id; update() no longer accepts body.
Placeholder body parameters are no longer accepted by the listed methods; remove body: {} from call sites.
The listed method parameters are now a union requiring exactly one of url or html.
Several tag attribution and confidence fields were removed from create() and edit() parameters and responses.
The legacy Firewall Rules API is deprecated and returns 410 Gone; bulkEdit() and bulkUpdate() no longer accept body and require id. Use rulesets instead.
The legacy WAF overrides API is end of life, responds with 410 Gone, and its methods return void. Migrate to rulesets.
Paginated list methods changed from SinglePage to V4PagePagination* now auto-paginate when iterated with for await.
primary and site_id were removed from create(), update(), and edit() parameters and all responses.
schema.format was removed from create() parameters and responses, and force was removed from delete() parameters.
schema.format was removed from create() parameters and responses, and force was removed from delete() parameters.
All bucket methods now name the jurisdiction header parameter cf-r2-jurisdiction; allowed values also include us and fedramp-high.
The legacy Rate Limiting API is end of life, responds with 410 Gone, and its methods return void. Migrate to rulesets.
Removed this method and its response type.
body is now required.
body is now required.
create() and get() now use an endpoint that accepts account or zone identifiers.
Removes AlertingEditResponse, replaced by CTAlertingSubscription.
Removes AlertingGetResponse, replaced by CTAlertingSubscription.
paygo() now requests the billable-usage endpoint.
Removes CertificateAuthority on acm.totalTLS.
Renames cloudforceOne.threatEvents.indicatorTypes to cloudforceOne.threatEvents.indicators.
Adds indicator sub-resources for aggregate, types, datasets, and dataset tags.
Removes the Host type on ssl.certificatePacks.
Removes HostnameAssociation on certificateAuthorities.hostnameAssociations.
get() now returns Setting instead of TLSGetResponsesSinglePage.
get() now includes the hostname in its endpoint path.
list() now returns HyperdrivesV4PagePaginationArray instead of HyperdrivesSinglePage.
Removes the dismiss() method and its IssueDismissResponse type.
Load balancer methods now use endpoints accepting account or zone identifiers.
Removes the rotate() method and its TokenRotateResponse type.
Removes MTLSCertificate in favor of per-method response types.
delete() now returns MTLSCertificateDeleteResponse instead of MTLSCertificate.
get() now returns MTLSCertificateGetResponse instead of MTLSCertificate.
list() now returns MTLSCertificateListResponsesSinglePage instead of MTLSCertificatesSinglePage.
Removes MTLSCertificatesSinglePage in favor of per-method response types.
Removes TLSGetResponse on hostnames.settings.tls.
Removes the ValidationMethod type on ssl.certificatePacks.
edit() now returns CTAlertingSubscription instead of AlertingEditResponse.
get() now returns CTAlertingSubscription instead of AlertingGetResponse.
New APIs and options 125
Adds a top-level R2 Data Catalog resource with catalog, credential, namespace, table, and maintenance configuration methods.
Adds a cache invalidation method.
Adds an environment-specific cache invalidation method.
Adds a Cloudforce One threat signals resource with search, article, category, feed, indicator, and skill methods.
Adds a top-level resource for managing container applications, instances, rollouts, versions, images, and registries.
Adds a registrar transfer check method.
Added methods to list and get submitted abuse reports.
Added a method to list submitted abuse report emails.
Added an API to create a client secret.
Added an API to list account entitlements.
Added invoice editing.
Added an API to pay bad debt.
Added an API to pay invoices.
Added payment method create, update, list, delete, get, and setAsDefault operations.
Added a method to retrieve receipt PDFs.
Added append() for subscription actions.
Added bulk subscription creation.
Added a method to cancel a subscription downgrade.
Added create() and get() methods for subscription cancellation reasons.
Added a method to retrieve a subscription by identifier.
Added a method to delete BGP prefixes.
Added billing address validation.
Added an API to get bad debt details.
Added an API to get billing credits.
Added an API to list billing history.
Added profile create, update, delete, and billing email update methods.
Added payment method creation for billing profiles.
Added an API to get rate plans.
Added an API to get unpaid invoice details.
Added a live view creation method for browser devtools.
Added a payload update method.
Added batch operations for allow policies.
Added batch operations for block senders.
Added content policy create, list, delete, batch, edit, and get methods.
Added domain create, update, and batch methods.
Added batch operations for trusted domains.
Added an email sending subdomain edit method.
Added suppression create, list, delete, edit, get, and import methods.
Added update(), delete(), and get() methods.
Added a pipeline type.
Added a method to restart Hyperdrive configurations.
Added a pipeline type.
Added transformer create, update, list, delete, get, and preview methods.
Added a method to get transformer content.
Added a method to list transformer versions.
Added BGP filter profile create, update, list, delete, and get methods.
Added a get() method for vulnerability discovery reports.
Added create(), list(), and get() methods for vulnerability discovery repositories.
Added create(), list(), get(), and getReport() methods for vulnerability discovery scans.
Added a deletion method for the R2 data catalog.
Added a method to replace a preset by ID.
Added a method to initiate a registrar transfer.
Added a method to get transfer-in status.
Added a pipeline type.
Added an API to list Spectrum protocols.
Added an API to get SSL recommendations.
Added a pipeline type.
Added an edit method for credential configuration.
Added an API to get Spectrum Analytics zone reports.
Added posture policy create, update, list, delete, and get methods.
Added application create, update, and delete methods for the resource library.
Added an API to list zone entitlements.
Added edit() and get() methods for NEL.
Added update(), delete(), and get() methods for tracing rules.
Added update(), delete(), and get() methods for tracing settings.
Adds get() for account speed settings transformations.
Adds validation for addressing prefixes.
Adds bulk retrieval of AI audit robot data.
Adds retrieval of AI audit robot data.
Adds analytics query methods summary(), timeseries(), and topN().
Adds the topN() analytics query for data security content findings.
Adds summary() and timeseries() analytics queries for data security findings.
Adds the V1 account billable usage information method.
Adds the V1 account billable usage method.
Adds the V2 account billable usage method.
Adds paygoInfo() for billable usage information.
Adds list() for threat event aggregates.
Adds bulk creation of threat event relationships.
Adds list() for threat event category catalog entries.
Adds deletion of threat event datasets.
Adds get() for threat event dataset events.
Adds list() for threat event graphs.
Adds create() for threat event GraphQL queries.
Adds create(), list(), delete(), edit(), and get() for threat event queries.
Adds list() for threat event relationships.
Adds tag deletion for threat events.
Adds tag editing for threat events.
Adds tag listing for threat events.
Adds tag sub-resources for categories, indicators, and dataset indicators.
Adds target industry sub-resources for datasets and catalog.
Adds get() for custom hostname quota.
Adds list() for DNSSEC ZSK resources.
Adds account email routing rules listing.
Adds edit() for email routing.
Adds listing of email routing rules for accounts or zones.
Adds update() for email routing.
Adds bulkDelete() for email security settings domains.
Adds list() for hostname TLS settings.
Adds CRUD methods for sinkholes.
Adds create(), update(), delete(), and get() for sinkhole ingresses.
Adds get() for intelligence URLs.
Adds deletion of log explorer datasets.
Adds create() and list() for connector interrupts.
Adds token creation for MOQ relays.
Adds token deletion for MOQ relays.
Adds token listing for MOQ relays.
Adds checkMissing(), upload(), and upsertHashes() for Pages assets.
Adds create() and delete() for deployment tails.
Adds a method to retrieve a Pages project upload token.
Adds update() and get() for precursor resources.
Adds peek() for queue messages.
Adds purge() for queue messages.
Adds list() for BGP route paths.
Adds timeseries() for BGP route upstreams.
Adds list() and get() for registrar extensions.
Adds sandbox check() and search() with registration, status, and extension sub-resources.
Adds retrieval of the account tag summary.
Adds list() for CASB application authentication methods.
Adds get() for CASB applications.
Adds list() for CASB applications.
Adds integration creation, updates, listing, deletion, pausing, and resuming.
Adds CASB posture resources for findings, exports, remediation, content, and webhooks.
Adds update() and get() for subnet initial resolved IP.
Adds edit() and get() for allowed transformation origins.
Adds edit() and get() for C2PA transformations.
Tooling 1
The migration tool now rewrites addressing.addressMaps.accounts call sites for the changed parameters.
Fixes and other changes 1
Added annotated value types for tag attribution and confidence fields.