FlareCostUsage costs, in the open
EN, EnglishES, Español

Issue 1: undelete now has a week, and a WAF rule can block image optimization

2026-10-25

Week of 25 October 2026. This draft was written from the changelog RSS and the GitHub releases fetched the same day. It is not an LLM summary. Nothing in this issue changes the Workers, KV, D1, R2, Queues, or Durable Objects rate card.

Your bill

No list-price change showed up in the items below. R2 still rounds operations up to the next million. D1 still bills rows scanned, and the Free quotas still reset at 00:00 UTC. If your invoice moves this week, it is because usage moved, not because these posts rewrote a rate.

What can break

D1 undelete now stops at 7 days

23 October 2026. The undelete API only accepts a database deleted in the last 7 days. Older deletes fail. Time Travel is a different feature: 7 days on Free, 30 days on Paid.

https://developers.cloudflare.com/changelog/post/2026-10-23-undelete-seven-day-window/

New WAF rules log Brotli request bodies and the Next.js image path

25 October 2026. Two Managed Rules for CVE-2026-111497 ship with a default action of Log. One matches `Content-Encoding: br` on requests. The other matches `/_next/image`. If you already override that ruleset to Block, both can block real traffic, including image optimization. Log mode itself does not block.

https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/

Workers Builds will install the npm version in packageManager

23 October 2026. Set `packageManager` to an exact version, such as `[email protected]`. Workers Builds installs that version before dependencies. It does not read `engines.npm`. A lockfile from a newer npm can start failing, or start succeeding, without a price change.

https://developers.cloudflare.com/changelog/post/2026-10-23-workers-builds-pin-npm-version/

Releases we recorded, not priced

Five projects for this issue

Archive