Skip to content

chore(deps): update terraform cloudflare to v5.24.0 - #413

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/cloudflare-5.x-lockfile
Sep 22, 2026
Merged

renovate[bot] merged 1 commit into
mainfrom
renovate/cloudflare-5.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
cloudflare (source) required_provider minor 5.21.1 → 5.24.0 5.25.0
cloudflare (source) required_provider minor 5.23.0 → 5.24.0 5.25.0

Release Notes

cloudflare/terraform-provider-cloudflare (cloudflare)

v5.24.0

Compare Source

Full Changelog: v5.23.0...v5.24.0

BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

  • hostname_tls_setting: the cloudflare_hostname_tls_setting data source now requires hostname as an input parameter instead of returning it as a computed attribute. The computed id attribute has been removed; use setting_id instead. (ece27fe)
  • image_variant: the computed variant nested attribute has been removed. The API no longer returns this wrapper object; the id, options, and never_require_signed_urls fields remain available at the top level. Remove any references to cloudflare_image_variant.<name>.variant from your configurations. (738bd28)
  • organization: the computed meta.flags nested attribute has been renamed to meta.tenant_flags. Two new computed sub-attributes (enterprise_capability, member_management) have been added. Update any references from .meta.flags to .meta.tenant_flags. (ece27fe)
  • zero_trust_access_ai_controls_mcp_portal: the allow_code_mode attribute is now deprecated and no longer computed with a default of true. Use the new code_mode attribute ("off", "opt_in", "default_on", "enforced") instead. Configurations that relied on the computed default must explicitly set code_mode or allow_code_mode. (ece27fe)
  • zero_trust_access_policy: the session_duration attribute is no longer computed with a default of "24h". It is now optional-only. Existing configurations that omitted session_duration and relied on the provider default will see a plan diff; explicitly set session_duration = "24h" to preserve the previous behavior. (ae4f5a1)
  • zero_trust_organization: the allowed_authenticators enum value ssh_piv_key has been renamed to piv_key, and a new value ssh_fido2_key has been added. Configurations using "ssh_piv_key" must be updated to "piv_key". (ece27fe)
  • zero_trust_resource_library_application: the id attribute type changed from String to Int64. The computed intel_id attribute has been removed. The hostnames, ip_subnets, port_protocols, support_domains, and supported attributes changed from List to Set (element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)
  • zero_trust_resource_library_category: the id attribute type changed from String to Int64 on both the data source and list data source. (ece27fe)
  • zero_trust_tunnel_cloudflared: the computed is_pending_reconnect attribute has been removed from connections. The upstream API no longer returns this field. Remove any references to connections[*].is_pending_reconnect from your configurations. (ece27fe)
  • zero_trust_tunnel_warp_connector: the computed is_pending_reconnect attribute has been removed from connections, matching the zero_trust_tunnel_cloudflared change above. (ece27fe)
New Resources
  • cloudflare_ct_alerting: onboard new Terraform resource for Certificate Transparency alerting (ece27fe)
  • cloudflare_precursor: onboard new Terraform resource for Precursor (ece27fe)
New Data Sources
  • cloudflare_hostname_tls_settings: add list data source for hostname TLS settings (ece27fe)
Features
  • bump Go SDK version to v7.9.0 (79c7d4f)
  • ai_gateway: add log_classification attribute and unified billing mode (ece27fe)
  • ai_search_instance: add discover_options for link-following web crawler configuration (ece27fe)
  • ai_search_namespace: add public_endpoint_params with MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)
  • cloud_connector_rules: add oci_storage cloud provider type (ece27fe)
  • d1_database: add us location restriction value (ece27fe)
  • load_balancer_pool: add health_sources attribute for regional health steering (ece27fe)
  • ruleset: add vary parameter to set_cache_settings action (e9cdc20)
  • waiting_room: add Latvian (lv-LV) language support (ece27fe)
  • worker: add preview_url_suffix and url computed attributes to subdomain block (ece27fe)
  • worker_version: add messaging binding type (ece27fe)
  • zero_trust_access_ai_controls_mcp_portal: add code_mode attribute for granular Code Mode policy control (ece27fe)
  • zero_trust_access_ai_controls_mcp_server: add authentication_status computed attribute (ece27fe)
  • zero_trust_access_application: add worker destination types for Access (118fe39)
  • zero_trust_access_custom_page: add contract_version, warnings, and new type values (login, interstitial) (ece27fe)
  • zero_trust_access_service_token: add enabled attribute to control service token activation (ece27fe)
  • zero_trust_dlp_*_entry: add computed deprecated attribute to all DLP entry resources and data sources (ece27fe)
  • zero_trust_organization: add warp_auth_non_browser_401 attribute for non-browser 401 responses (ece27fe)
  • zone_setting: add webmcp_enabled and webmcp_packs setting IDs (ece27fe)
Bug Fixes
  • guard against nil pointer dereference in dynamic semantic equality (d82bbd5)
  • image_variant: fix nested variant response deserialization (738bd28)
  • port v5.23.0 regression fixes from GitHub main (ae4f5a1)
  • remove duplicate declarations causing build failures (dc360d2)
Documentation
  • image_variant: update resource documentation (bab4b71)
  • regenerate provider documentation (79c7d4f)
  • restore .md extensions on internal guide cross-links (f51c9d6)

v5.23.0

Compare Source

Full Changelog: v5.22.0...v5.23.0

New Data Sources
  • cloudflare_zero_trust_dlp_custom_prompt_topic: add data source for DLP custom prompt topics (ae6a505)
  • cloudflare_zero_trust_dlp_custom_prompt_topics: add list data source for DLP custom prompt topics (ae6a505)
Features
  • bump Go SDK version to v7.8.0 (ae6a505)
  • hyperdrive_config: add v4 to v5 state migration (cdd5ca6)
  • turnstile_widget: add deployed_via and last_modified_via computed fields, and default offlabel to false (5952e95)
  • zero_trust_device_default_profile: add global_acceleration block for configuring custom tunnel and API endpoints (5952e95)
  • zero_trust_gateway_policy: add delete_headers support in request header modification settings (5952e95)
Bug Fixes
  • d1_database: initialize read_replication in state upgrader to prevent 400 error (298799b)
  • load_balancer_pool: preserve origins order to prevent perpetual drift (aad09cc)
  • zero_trust_access_ai_controls_mcp_portal: migrate servers state from list to set (9766b3a)
  • zero_trust_access_policy: resolve perpetual diff by calling normalization in CRUD (497f06b)
  • zero_trust_device_custom_profile: resolve perpetual drift on default, include, target_tests, and exclude nested attributes (f74cecf)
  • zero_trust_device_custom_profile: address review feedback on normalization (969b35d)
  • zero_trust_dex_test: remove stale model fields that caused value conversion panics during resource operations (fd43d83)
  • zero_trust_organization: normalize mfa_required_for_all_apps to prevent perpetual diff (001c28e)
  • workers_custom_domain: populate computed fields from a post-create read to prevent import drift (fd43d83)
  • pages_project: fix source.config drift for API-populated fields by preserving computed state values (c63f15e)
Chores
  • add .terraform-registry for ownership transfer (d33bc90)
  • internal: codegen related update (ae6a505)
Documentation
  • add workers_secret migration guidance with tf-migrate support (524b26a)
  • fix account_subscription examples (2ebc7db)
  • migration-guide: add table of contents to v5 migration guide (e11e8a4)
  • regenerate provider documentation (4656c9f)
  • resolve AI review doc warnings (691131e)

v5.22.0

Compare Source

Full Changelog: v5.21.1...v5.22.0

⚠ BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

  • ai_search_instance: the source_params.web_crawler.crawl_options block has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove any crawl_options { ... } block from your cloudflare_ai_search_instance configurations. (0843c7f)
  • zero_trust_access_ai_controls_mcp_portal: the servers attribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order of servers entries differs, and any code that relied on stable list ordering (e.g. element(..., 0)) may need to be updated. (099fc24)
Notes
  • managed_transforms: managed_request_headers and managed_response_headers are now Optional instead of Required. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)
New Resources
  • cloudflare_moq_relay: onboard new Terraform resource for Media over QUIC (MoQ) relays (9f2678c)
Features
  • d1_database: add v4-to-v5 state upgrader (32f42b1)
  • d1_database: add CRUD acceptance tests (3491e69)
  • hyperdrive_config: add comprehensive acceptance tests (59399bb)
  • oauth: add oauth_client resource CRUD support (154668f)
  • workers_custom_domain: add acceptance tests for resource, data sources, and import (26e0092)
  • workers_script: add exports and package_dependencies to schema (c15cef1)
  • zero_trust_access_application: add file as valid RDP connection_rules value (2659e30)
  • zero_trust_access_short_lived_certificate: add MoveState handler for access_ca_certificate rename (v4 -> v5 auto-migration) (90f3324)
Bug Fixes
  • dns_record: dedupe schema key and drop unused import (8faa422)
  • dns_record: revert Meta model to jsontypes.Normalized to match schema (c0eea18)
  • docs: add .md extension to migration guide links (7546f3e)
  • hyperdrive_config: address review feedback (92ce892)
  • load_balancer_pool: remove phantom flatten_cname from v4 source model (baa1b92)
  • migration: correct v4 test configs and migration test harness for access_ca_certificate (2c47cf7)
  • moq_relay: add schema Version: 500 (890b9f9)
  • oauth: remove custom oauth visibility change (6b4a0ed)
  • ruleset: add asset_name to v4 source schema so v4->v5 state upgrader parses correctly (baa1b92)
  • worker_version: add CustomType to assets schema to match model (7e7e0d3)
  • worker_version: use NestedObject accessors for Assets field (78d419f)
  • workers_custom_domain: address review feedback (3271949)
  • workers_script: resolve duplicate cache_options tag (c15cef1)
  • zero_trust_list: handle ambiguous schema_version=0 state (v4 vs v5) (c010f78)
Chores
  • api: force regen of moq_relay and email_routing_rule (a9e500a)
  • ci: add 30m timeout to unit test shards (635637b)
  • ci: trigger acceptance tests on release-tf-* branches (5921d00)
  • go.mod: pin cloudflare-go to release-770 branch head for v5.22.0 (05272f3)
  • internal: codegen related update (c7a96ca)
  • use 'next' for Terraform builds (30c04e6)
Documentation
  • list: fix missing comma in resource and data source examples (bfe1c34)
  • regenerate provider docs; fix provider address and .stats.yml (cbde062)
  • update documentation for moved blocks to Terraform 1.8 (d93208d)
  • v5-migration: document session_duration behavior change for access policies (90c58a7)
  • v5-upgrade: add destructive-behavior warning for app-scoped policy migration (1e832d6)
  • v5-upgrade: document zone_id removal for access policies (831f0bb)

Configuration

📅 Schedule: (in timezone Europe/Prague)

  • Branch creation
    • "after 5am and before 6am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot merged commit 0cac7a5 into main Sep 22, 2026
2 checks passed
@renovate
renovate Bot deleted the renovate/cloudflare-5.x-lockfile branch September 22, 2026 03:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants