← All breaking-change reports

Cloudflare breaking change: v5.2.0

cloudflare · breaking · 2025-10-02 · upstream source

What changed

Remove created_at and updated_at fields from Zero Trust organization

From the upstream announcement:

5.2.0 (2025-09-30) Full Changelog: v5.1.0...v5.2.0 Features Add load balancer monitor groups endpoints ( 5764b60 ) Add Radar AS-SET lookup endpoint ( e8480e8 ) Add to_markdown subresource to AI resource ( 770500f ) Rename duplicate parameter in the to_markdown subresource ( 98ccef7 ) Deprecate Radar AI inference and leaked credential endpoints ( 932e696 ) Remove created_at and updated_at fields from Zero Trust organization ( 4656a4e ) Performance Improvements faster formatting ( 17f6c4f ) Chores do not install brew dependencies in ./scripts/bootstrap by default ( 257ac1d ) improve example values ( 20f0585 ) internal: codegen related update ( 0448452 ) internal: fix incremental formatting in some cases ( 9abf5ab ) internal: ignore .eslintcache ( a80827e ) internal: remove deprecated compilerOptions.baseUrl from tsconfig.json ( ea38064 ) api: update composite API spec ( ab0bebd , 04d593f , […]

Who is affected

Delete reads of created_at / updated_at on Zero Trust organization objects (client.zeroTrust.organizations.*) and any downstream display or sorting logic keyed on them, or guard with optional chaining and a null fallback where the surrounding code must keep shape.

To find out whether your repo is hit — file and line number, no code leaving your machine:

npx mendapi scan --repo .

How to fix it

Migration path:

Delete reads of created_at / updated_at on Zero Trust organization objects (client.zeroTrust.organizations.*) and any downstream display or sorting logic keyed on them, or guard with optional chaining and a null fallback where the surrounding code must keep shape. This follows the remove-discontinued-field-read precedent (vercel dheCipherSuite): the fields were dropped from the spec with no replacement, so removing the read is the mechanically safe mend. Confidence medium because sort/display call sites may need a substitute ordering decision from the owner.

Before:

const age = Date.now() - Date.parse(org.created_at);

After:

const createdAt = org.created_at ?? null; // field removed upstream in v5.2.0; decide replacement ordering key

With your own LLM key configured (BYO compute — mendapi never proxies your credentials), npx mendapi llmfix turns this guide into a reviewable draft patch for your repo.

Detected and tracked by mendapi — Dependabot for every API you depend on. Scans run locally; your code never leaves your machine.

Related

Pre-release. Change data is recorded from upstream provider releases, changelogs and OpenAPI spec diffs; every article links its source.