0.30.0 (October 22nd, 2026)

• deps: build with Go 1.27.3, which distrusts a set of intermediate certificate authorities that have been revoked for CA compromise. The distrust list is compiled into the binary, so affected chains are rejected regardless of the host's system trust store.
• generate: emit discovery_id instead of operation_id for cloudflare_api_shield_discovery_operation, matching the attribute rename in provider v5.28.0. Generated configuration for this resource was rejected by terraform validate against provider v5.28.0 and later.
• generate: drop v5 support for cloudflare_registrar_domain. Provider v5.28.0 removed the resource, so there is no schema to generate against. v4 output is unaffected.

What's Changed

• fix(ci): bump homebrew formula action to v4 by @ssicard in #992
• chore: bump cloudflare-go to v0.118.0 by @musa-cf in #996
• feat: preserve content_converter in v4 rulesets by @jafowler in #995
• docs(changelog): add v0.29.0 release notes by @musa-cf in #997

Full Changelog: v0.28.0...v0.29.0

Features

• User-Agent identification: cf-terraforming/ is now appended to the User-Agent header on all outgoing Cloudflare API requests, enabling identification of tool-generated traffic in API logs. (#967 (#967))

Bug Fixes

• cloudflare_ruleset: Fixed a validation error that occurred when generating rulesets containing skip rules with empty rules lists. (#957 (#957))
• cloudflare_filter (v5): Fixed incorrect HCL output by restructuring the flat API response into the nested body block required by the v5 provider schema. (#958 (#958))
• cloudflare_account_subscription (v5): Fixed extraneous fields being included in the rate_plan block; only id and scope are now emitted. (#958 (#958))
• cloudflare_snippet_rules (v5): Fixed generation by collapsing the multiple per-rule API responses into a single resource containing a rules array, matching the v5 provider's expected schema. (#958 (#958))
• cloudflare_snippets (v5): Fixed generation by promoting the main_module field into a metadata block as required by the v5 provider schema. (#958 (#958))

Full Changelog: v0.24.0...v0.25.0

What's Changed

• Support for terraform v5 provider resources
• build(deps): bump github.com/cloudflare/cloudflare-go/v4 from 4.0.0 to 4.1.0 by @dependabot[bot] in #794
• build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot[bot] in #799
• First pass for adding v5 provider support by @musa-cf in #802
• fix: api shield testdata and test by @vaishakdinesh in #805
• fix: custom hostnames for v5 by @vaishakdinesh in #806
• fix: deeply nested structure by @vaishakdinesh in #808
• fix: accounts for v5 by @vaishakdinesh in #807
• Add custom response processing for V5 resources by @musa-cf in #811
• fix: default to env variable by @vaishakdinesh in #814
• fix: turnstile widgets by @vaishakdinesh in #822
• Fix: waiting rooms by @vaishakdinesh in #821
• fix: dns zone transfers by @vaishakdinesh in #819
• fix: update testdata by @vaishakdinesh in #818
• fix: account subscriptions by @vaishakdinesh in #815
• fix: url snippets web3 by @vaishakdinesh in #823
• fix: notification policies by @vaishakdinesh in #825
• fix: healthcheck transforms lockdown by @vaishakdinesh in #826
• build(deps): bump golang.org/x/net from 0.34.0 to 0.36.0 by @dependabot[bot] in #827
• fix: d1 database by @vaishakdinesh in #828
• fix: workers, regional queue by @vaishakdinesh in #830
• fix: address content creds log pages by @vaishakdinesh in #831
• Fix: stream tieredcache snippets by @vaishakdinesh in #829
• fix: email security block sender by @vaishakdinesh in #820
• fix: content scanning expression by @vaishakdinesh in #834
• fix: account member for v5 by @vaishakdinesh in #812
• fix: r2 bucket by @vaishakdinesh in #835
• build(deps): bump github.com/spf13/viper from 1.19.0 to 1.20.0 by @dependabot[bot] in #836
• chore: update mapping by @vaishakdinesh in #833
• fix: zero trust device resources by @vaishakdinesh in #837
• build(deps): bump github.com/cloudflare/cloudflare-go/v4 from 4.1.0 to 4.2.0 by @dependabot[bot] in #839
• fix: zero trust 3 by @vaishakdinesh in #840
• fix: zero trust 2 by @vaishakdinesh in #838
• fix: zt gateway settings by @vaishakdinesh in #843
• fix: page rule filters by @vaishakdinesh in #845
• fix: bot mananagement by @vaishakdinesh in #846
• fix: zero trust by @vaishakdinesh in #844
• build(deps): bump golangci/golangci-lint-action from 6 to 7 by @dependabot[bot] in #848
• fix: zone settings by @vaishakdinesh in #847
• fix: hostname_tls_setting for v5 provider by @musa-cf in #850
• migrate golangci-lint config by @jacobbednarz in #853
• build(deps): bump github.com/spf13/viper from 1.20.0 to 1.20.1 by @dependabot[bot] in #852
• chore: handle non-standard registries more automatically by @jacobbednarz in #854
• Add tests for load balancer resources by @musa-cf in #816
• Fix ruleset for the v5 provider by @musa-cf in #851
• build(deps): bump actions/stale from 5 to 9 by @dependabot[bot] in #858
• fix: cli flags by @vaishakdinesh in #859
• fix: registrar emailsec ratelimit by @vaishakdinesh in #862
• fix: more path param resources by @vaishakdinesh in #863
• fix: api calls specturm by @vaishakdinesh in #864
• chore: warn deprecation by @vaishakdinesh in #865
• fix: zt dlp predefined profile by @vaishakdinesh in #871
• fix: zt access idp and custom pages by @vaishakdinesh in #870
• fix: Clarify that the tool is not meant for use in CI by @musa-cf in #872
• fix: web analytics by @vaishakdinesh in #873
• fix: waiting room events by @vaishakdinesh in #874
• build(deps): bump github.com/cloudflare/cloudflare-go/v4 from 4.2.0 to 4.3.0 by @dependabot[bot] in #876
• build(deps): bump golangci/golangci-lint-action from 7 to 8 by @dependabot[bot] in #875
• build(deps): bump github.com/hashicorp/hc-install from 0.9.1 to 0.9.2 by @dependabot[bot] in #861
• build(deps): bump github.com/hashicorp/terraform-exec from 0.22.0 to 0.23.0 by @dependabot[bot] in #860
• build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 by @dependabot[bot] in #866
• build(deps): bump github.com/hashicorp/terraform-json from 0.24.0 to 0.25.0 by @dependabot[bot] in #877
• build(deps): bump github.com/cloudflare/cloudflare-go/v4 from 4.3.0 to 4.4.0 by @dependabot[bot] in #879
• build(deps): bump github.com/zclconf/go-cty from 1.16.2 to 1.16.3 by @dependabot[bot] in #880
• fix: certs and file by @vaishakdinesh in #882
• fix: tests for resources and refactor by @vaishakdinesh in #887
• fix: zt dlp custom profile by @vaishakdinesh in #889
• fix: magic wan static route by @vaishakdinesh in #890
• fix: imports by @vaishakdinesh in #895
• chore: release prep by @vaishakdinesh in #896
• fix: pagination by @vaishakdinesh in #897
• fix: update readme for path params by @vaishakdinesh in #900
• Fix: empty hcl generated by rulesets by @vaishakdinesh in #899
• fix: doc and import by @vaishakdinesh in #902
• chore: build instructions by @vaishakdinesh in #903
• fix: unique names by @vaishakdinesh in #905
• cloudflare_managed_headers supported since #446 by @hulet in #752
• fix: content and data by @vaishakdinesh in #907
• fix: minor updates to testdata and enahcements by @vaishakdinesh in #910
• Add triage workflow by @jhutchings1 in #912
• chore: quality of service by @vaishakdinesh in #915

Full Changelog: v0.23.3...v0.24.0

What's Changed

• build(deps): bump github.com/cloudflare/cloudflare-go from 0.114.0 to 0.115.0 by @dependabot in #788
• internal: handle explicitly provided credentials by @jacobbednarz in #791

Full Changelog: v0.23.2...v0.23.3

What's Changed

• fix: handle failure to fetch versions gracefully by @jacobbednarz in #786
• fix: handle singular endpoints that behave as lists by @jacobbednarz in #787

Full Changelog: v0.23.1...v0.23.2

What's Changed

• fix(generate): skip some known problematic resources by @jacobbednarz in #785

Full Changelog: v0.23.0...v0.23.1