[dependabot]

Bumps cloudflare/cloudflare from 5.23.0 to 5.28.0.

Release notes

Sourced from cloudflare/cloudflare's releases.

v5.28.0

Changelog

5.28.0 (2026-10-12)

⚠ BREAKING CHANGES

• api_shield_discovery_operation: operation_id has been renamed to discovery_id, zone_id is now required, and the computed id attribute has been removed. Update resource arguments and any expressions referencing id. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.
• email_security_trusted_domains: is_recent, is_regex, and is_similarity are now required instead of optional. Set all three explicitly, using false for protections that should not be bypassed.
• registrar_domain, registrar_domains: the cloudflare_registrar_domain resource and data source, and the cloudflare_registrar_domains list data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed word_list attribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nested word_list values in the zero_trust_dlp_custom_profile and zero_trust_dlp_predefined_profile data sources. Remove jsondecode(...) around these values and update expressions expecting a string. No new state upgrader is included for this type change.
• zero_trust_organization: mfa_ssh_piv_key_requirements has been replaced with mfa_piv_key_requirements on the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.

Notes

• pages_project: the API documentation now clarifies that build image version 1 is retired and affected projects are moved to version 3. Once a project's builds have moved, requests setting deployment_configs.preview.build_image_major_version or deployment_configs.production.build_image_major_version to 1 are rejected. Use version 3 for those projects.
• zero_trust_device_custom_profile: the read-only target_tests attribute is deprecated on the resource and its data sources.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed deprecated attribute no longer defaults to false.

Features

New Resources

• cloudflare_monetization_rules: manage a zone's Payment Required ruleset, including exact, upto, and origin_controlled payment schemes. Supports terraform import using the zone ID.

New Data Sources

• cloudflare_monetization_rules: read a zone's Payment Required ruleset.

New Attributes

• ai_search_instance, ai_search_instances: metadata.created_from_emdash_plugin, with type (native or rest) and version.
• pages_project, pages_projects: read-only build_image_auto_upgrade.from_version and build_image_auto_upgrade.to_version, identifying projects moved from a retired build image.
• worker_version, worker_versions, workers_script: Durable Object binding retry settings, bindings.retry.max_attempts and bindings.retry.timeout_ms. max_attempts counts retries after the initial request and accepts 0–10; zero disables retries. timeout_ms accepts 500–60000 and controls the retry window, not the initial-request timeout.
• workers_kv_namespace, workers_kv_namespaces: mode; set mode = "instant" when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.
• workers_script: bindings_inherit = "strict" makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.
• zero_trust_access_application, zero_trust_access_applications: target_criteria.include, target_criteria.require, and target_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requires include; require and exclude are optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacy target_criteria.target_attributes format remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.
• zero_trust_access_identity_provider, zero_trust_access_identity_providers: config.login_page_auto_prompt, defaulting to false on the resource, to automatically prompt for passkey authentication on the Access login page.
• zero_trust_gateway_certificate, zero_trust_gateway_certificates: read-only region, identifying where the certificate authority's key material is pinned.
• zero_trust_resource_library_application, zero_trust_resource_library_applications: lookup query support for finding complete application name mentions in a phrase. Use filter.lookup on the singular data source or lookup on the list data source. It cannot be combined with search.

New Accepted Values

• zero_trust_access_application: session_duration is now supported for infrastructure applications and defaults to 24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must use s, m, or h in whole seconds.
• zero_trust_access_identity_provider: type accepts passkeys.
• zero_trust_device_custom_profile: match expressions support device.tags.

Bug Fixes

... (truncated)

Changelog

Sourced from cloudflare/cloudflare's changelog.

5.28.0 (2026-10-12)

Full Changelog: v5.27.0...v5.28.0

⚠ BREAKING CHANGES

• api_shield_discovery_operation: operation_id has been renamed to discovery_id, zone_id is now required, and the computed id attribute has been removed. Update resource arguments and any expressions referencing id. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.
• email_security_trusted_domains: is_recent, is_regex, and is_similarity are now required instead of optional. Set all three explicitly, using false for protections that should not be bypassed.
• registrar_domain, registrar_domains: the cloudflare_registrar_domain resource and data source, and the cloudflare_registrar_domains list data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed word_list attribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nested word_list values in the zero_trust_dlp_custom_profile and zero_trust_dlp_predefined_profile data sources. Remove jsondecode(...) around these values and update expressions expecting a string. No new state upgrader is included for this type change.
• zero_trust_organization: mfa_ssh_piv_key_requirements has been replaced with mfa_piv_key_requirements on the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.

Notes

• pages_project: the API documentation now clarifies that build image version 1 is retired and affected projects are moved to version 3. Once a project's builds have moved, requests setting deployment_configs.preview.build_image_major_version or deployment_configs.production.build_image_major_version to 1 are rejected. Use version 3 for those projects.
• zero_trust_device_custom_profile: the read-only target_tests attribute is deprecated on the resource and its data sources.
• zero_trust_dlp_custom_entry, zero_trust_dlp_entry, zero_trust_dlp_integration_entry, zero_trust_dlp_predefined_entry: the computed deprecated attribute no longer defaults to false.

Features

New Resources

• cloudflare_monetization_rules: manage a zone's Payment Required ruleset, including exact, upto, and origin_controlled payment schemes. Supports terraform import using the zone ID.

New Data Sources

• cloudflare_monetization_rules: read a zone's Payment Required ruleset.

New Attributes

• ai_search_instance, ai_search_instances: metadata.created_from_emdash_plugin, with type (native or rest) and version.
• pages_project, pages_projects: read-only build_image_auto_upgrade.from_version and build_image_auto_upgrade.to_version, identifying projects moved from a retired build image.
• worker_version, worker_versions, workers_script: Durable Object binding retry settings, bindings.retry.max_attempts and bindings.retry.timeout_ms. max_attempts counts retries after the initial request and accepts 0–10; zero disables retries. timeout_ms accepts 500–60000 and controls the retry window, not the initial-request timeout.
• workers_kv_namespace, workers_kv_namespaces: mode; set mode = "instant" when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.
• workers_script: bindings_inherit = "strict" makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.
• zero_trust_access_application, zero_trust_access_applications: target_criteria.include, target_criteria.require, and target_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requires include; require and exclude are optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacy target_criteria.target_attributes format remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.
• zero_trust_access_identity_provider, zero_trust_access_identity_providers: config.login_page_auto_prompt, defaulting to false on the resource, to automatically prompt for passkey authentication on the Access login page.
• zero_trust_gateway_certificate, zero_trust_gateway_certificates: read-only region, identifying where the certificate authority's key material is pinned.
• zero_trust_resource_library_application, zero_trust_resource_library_applications: lookup query support for finding complete application name mentions in a phrase. Use filter.lookup on the singular data source or lookup on the list data source. It cannot be combined with search.

New Accepted Values

• zero_trust_access_application: session_duration is now supported for infrastructure applications and defaults to 24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must use s, m, or h in whole seconds.
• zero_trust_access_identity_provider: type accepts passkeys.
• zero_trust_device_custom_profile: match expressions support device.tags.

Bug Fixes

• d1_database: make read_replication optional and computed with a nested custom type, allowing API-returned replication settings to populate state when the block is omitted.
• dns_record: default missing include_shadow_metadata to false during refresh and v4 to v5 migration, avoiding spurious updates for older state. Allow modified_on to change when private_routing or include_shadow_metadata changes, preventing inconsistent-result errors after updates.

... (truncated)

Commits

• fa63eba Merge pull request #7410 from cloudflare/release-tf-5.28.0
• 3171731 fix: resolve Workers and Access acceptance failures
• 5d6fb98 chore(release): 5.28.0
• fbd26da Merge GitLab main (!144) into release-tf-5.28.0
• e83d2f4 Merge branch 'release/5-28' into 'main'
• 379f67b chore: update terraform docs
• 3282ea1 chore: add changelog and fix unit test
• 2f40d79 fix: fix failing tests
• 6c49000 fix: remove duplicate registration of hostname_tls_setting
• 8d9a358 fix: add missing required field in cloudflare_hostname_tls_setting
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #94.