← All provider guides

Cloudflare API breaking changes (2025–2026): complete tracker and fixes

cloudflare 48 breaking / deprecation entries 2025–2026

Cloudflare ships API and SDK changes continuously. Most are additive — but the ones that are not can silently break integrations that worked yesterday. This page is the complete, continuously regenerated record of every Cloudflare breaking change and deprecation in the mendapi change database: 48 entries (45 breaking, 3 deprecation), each linked to its upstream source and, where possible, to a concrete fix.

How to read this page

Every entry carries a fixability verdict from the mendapi adjudication pipeline: code-fixable means a mechanical code change repairs the break (38 entries); not code-fixable means the change requires a business decision, credential provisioning, or upstream action that no codemod can produce (10 entries). Entries marked auto-fix pack have a deterministic, gold-tested migration pack that mendapi fix can apply locally.

Am I affected?

Reading a changelog tells you what changed — not whether your code uses the affected surface. The mendapi scanner answers that locally, in about 30 seconds, without any code leaving your machine:

npx mendapi sync
# -> one network call: pulls the change feed into a local database
npx mendapi scan
# -> N findings: file, line, provider, confidence
mendapi deps --match
# -> which of the changes below actually hit your endpoints

See Getting Started for the full workflow and the security model for why zero code upload is the default and only mode.

Complete Cloudflare breaking change timeline

Automated migration packs for Cloudflare

mendapi ships 6 deterministic migration packs for Cloudflare — verified, idempotent codemods you can apply locally with mendapi fix. Full details in the pack catalog.

• cloudflare-kv-legacy-routes — Cloudflare Workers KV legacy namespace routes -> storage/kv routes (upstream reference)
• cloudflare-secrets-store-and-ai-security-path-renames — Cloudflare REST API: legacy /system secrets-store alias removed and firewall-for-ai renamed to ai-security (OAS 2026-07-27) (upstream reference)
• cloudflare-typescript-v7-deterministic-renames — cloudflare-typescript v7.0.0: Id->ID method renames, DEXTest type renames, import-path moves, fileFromPath removal (upstream reference)
• cloudflare-typescript-v7-named-path-params — cloudflare-typescript v7.0.0: intermediate path parameters move into the options object (named path parameters) (upstream reference)
• cloudflare-account-roles-to-permission-groups — Cloudflare Account Roles API -> Permission Groups API (URL move + meta.label read remap) (upstream reference)
• cloudflare-workers-ai-model-slug-renames — Cloudflare Workers AI: omni-/ray- prefixed model slugs removed — rename to canonical successors (upstream reference)

Recent Cloudflare releases adjudicated non-breaking

Not paging you is the other half of the job. The same pipeline that produced the timeline above also cleared 51 Cloudflare changes as additive or fix-only — releases an integrator can upgrade through without a migration. The most recent:

Measured: 136 raw removals, and why only 17 made this page

Two of the corridors feeding the timeline above come from diffing Cloudflare's published OpenAPI schema (api-schemas) directly. The second corridor — 7abe88500e55 (2026-03-31) -> c92b9b0fde23 (2026-07-27) — is the interesting one, because the raw diff is a trap: it reports 136 path removals. Ingest that raw and this page would page you 136 times for one quarter of one provider.

What curation measured. Of those 136 raw removals, 119 were excluded with machine-checked evidence that the surface survives: 107 path-template consolidations (the endpoint moved under a generic parameterized route), 11 parameter renames that are byte-identical at runtime, and 1 method superset. Every exclusion is evidenced against both spec snapshots — 0 exclusions rest on judgment alone — and an audit ledger asserts the arithmetic conserves: 17 kept + 119 excluded = 136. The 17 real removals that survived (“path-removed: /accounts/{account_id}/billing/usage/paygo” among them), plus 14 from the earlier corridor, are the 31 spec-diff entries in the timeline above — all 31 adjudicated code-fixable, each with a token-verified successor analysis.

Why this matters beyond Cloudflare. A schema the size of Cloudflare's moves constantly for reasons that break nobody, and a diff engine that cannot prove which removals are real is just a louder changelog. Combined with the release-feed entries above (adjudicated 38 code-fixable, 10 not, across the full set), the timeline you are reading is what remains after both layers of filtering — which is the point of reading it at all.

Monitoring Cloudflare going forward

This page is regenerated from the change database, which is fed by release feeds, changelog capture and OpenAPI spec diffing — so it does not depend on Cloudflare writing a perfect changelog. mendapi monitors 84125 change records across 20 providers; hosted plans watch your repos continuously and open fix PRs when a change lands. See pricing.

Frequently asked questions

Related

• cloudflare-typescript v6 to v7 migration — the full migration guide with pack-backed fixes.
• 136 raw removals, 17 real ones: what a spec diff over-reports — the long-form methodology report behind this provider's tracked changes.
• API breaking change detection — how upstream breakage is caught before it ships, and why default severity gates stay silent.
• All breaking-change reports — per-change deep dives with migration guides.
• All monitored providers — live change counts.
• Migration pack catalog — every deterministic fix mendapi ships.