release: v5.10.0

.gitlab-ci.yml

@@ -21,6 +21,13 @@ workflow:
 lint:
   stage: lint
   timeout: 20 minutes
+  # pyright peaks ~5.3GB RSS; default linux-x86-2cpu-4gb Pod runner OOMs. Bump to
+  # 8GB per Codex RFC 023 (gitlab-ci-runner-selection): Pod runner, one tag,
+  # below the 8cpu-16gb evidence threshold.
+  tags:
+    - linux-x86-4cpu-8gb
+  variables:
+    NODE_OPTIONS: "--max-old-space-size=6144"
   rules:
     - if: $CI_COMMIT_TITLE == "codegen metadata"
       when: never

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "5.9.0"
+  ".": "5.10.0"
 }

.stats.yml

@@ -1 +1 @@
-configured_endpoints: 2718
+configured_endpoints: 2790

CHANGELOG.md

@@ -1,5 +1,113 @@
 # Changelog
 
+## 5.10.0 (2026-11-05)
+
+Full Changelog: [v5.9.0...v5.10.0](https://github.com/cloudflare/cloudflare-python/compare/v5.9.0...v5.10.0)
+
+This release adds the K2 streaming, Monetization, Zero Trust CWS, and Billing
+Spend Policies APIs, plus Zero Trust Access user populations and MFA catalog
+resources. It also removes the Magic Cloud Networking and Tenant Custom
+Nameservers resources and changes several pagination and response types. Review
+the breaking changes before upgrading.
+
+See the [v5.10.0 Migration Guide](./docs/migration-guides/v5.10.0-migration-guide.md) for upgrade examples.
+
+### Breaking Changes
+
+* **magic_cloud_networking:** `client.magic_cloud_networking` has been removed entirely, including the `catalog_syncs`
+  (and `prebuilt_policies`), `on_ramps` (and `address_spaces`), `cloud_integrations`, and `resources` sub-resources
+  and all `cloudflare.types.magic_cloud_networking` exports.
+* **tenant_custom_nameservers:** `client.tenant_custom_nameservers` has been removed, along with its `create()`,
+  `delete()`, and `get()` methods and the `TenantCustomNameserverCreateResponse`, `TenantCustomNameserverDeleteResponse`,
+  and `TenantCustomNameserverGetResponse` types.
+* **tenants:** `client.tenants.get()` has been removed, along with the `account_types`, `entitlements`, and
+  `memberships` sub-resources and the `Tenant` and `TenantAccount` types. `client.tenants.accounts.list()` now returns
+  `SyncV4PagePaginationArray[AccountListResponse]` instead of `SyncSinglePage[TenantAccount]`.
+* **user:** `client.user.tenants.list()` now returns `SyncSinglePage[TenantListResponse]` instead of
+  `SyncSinglePage[Organization]`, and the `Organization` type was removed from `cloudflare.types.user`.
+* **accounts:** the `client.accounts.pay_bad_debt` sub-resource has been removed. `client.accounts.subscriptions.bulk.create()`
+  now returns `BulkCreateResponse` instead of `Optional[BulkCreateResponse]`.
+* **registrar:** the `client.registrar.domains` sub-resource has been removed.
+* **browser_rendering:** `client.browser_rendering.devtools.browser.connect()` and `launch()` have been removed, along
+  with the `devtools.browser.page` sub-resource.
+* **aisearch:** the instance path identifier was renamed from `name` to `namespace` across every
+  `client.aisearch.namespaces.instances` method and its `items` and `jobs` sub-resources. Callers passing `name=` must
+  switch to `namespace=`.
+* **rulesets:** `client.rulesets.list()` is no longer paginated and now returns `RulesetListResponse` directly (was
+  `SyncCursorPagination[RulesetListResponse]`). `client.rulesets.versions.list()` and
+  `client.rulesets.phases.versions.list()` likewise now return `VersionListResponse` instead of
+  `SyncSinglePage[VersionListResponse]`.
+* **pagination:** `client.zero_trust.resource_library.applications.list()` and `categories.list()` now return
+  `SyncCursorPaginationAfter` instead of `SyncSinglePage`. `client.diagnostics.endpoint_healthchecks.list()` now returns
+  `SyncSinglePage[EndpointHealthcheckListResponse]` instead of `Optional[EndpointHealthcheckListResponse]`.
+* **vectorize:** `client.vectorize.indexes.get_by_ids()` now uses `GET` and returns
+  `SyncSinglePage[IndexGetByIDsResponse]` instead of issuing `POST` and returning `object`.
+* **response models:** `client.zero_trust.access.users.last_seen_identity.get()` now returns
+  `Optional[LastSeenIdentityGetResponse]` and the `Identity` type was removed.
+  `client.workers_for_platforms.dispatch.namespaces.scripts.tags.delete()` now returns `TagDeleteResponse` instead of
+  `object`.
+* **removed types:** the shared `LoadBalancerPreview` type was removed, along with
+  `magic_transit.WANStaticAddressingParam`, `organizations.OrganizationProfileParam`, and
+  `precursor.EnforcementRuleParam`.
+
+### Features
+
+* **k2:** add top-level `client.k2` with `streams` and `streams.subscriptions` APIs
+* **monetization:** add top-level `client.monetization` with zone-level monetization `rules` APIs
+* **zero_trust:** add `client.zero_trust.cws` with `basic_auth_credentials` (and `secrets`), `deployments`,
+  `domain_acls`, `policies`, `policy_sets`, `rego_metadata`, `rego_modules`, `tenant_structures` (and `nodes`), and
+  `workloads` APIs
+* **billing:** add `client.billing.spend_policies` with `create()`, `update()`, `list()`, `delete()`, and `get()`,
+  plus `activity` and `audit` listing sub-resources
+* **zero_trust:** add `client.zero_trust.access.user_populations` (and its `users` sub-resource) with full CRUD
+* **zero_trust:** add `client.zero_trust.access.mfa.authenticator_catalog` and `client.zero_trust.access.logs.jit_requests`
+* **zero_trust:** add `mfa_authenticators` and `passkeys` delete sub-resources to `client.zero_trust.access.users`
+* **zero_trust:** add `client.zero_trust.casb.posture.asset_schemas`; add `create()`, `update()`, `delete()`, and
+  `validate()` to `client.zero_trust.casb.posture.finding_types`
+* **zero_trust:** add `client.zero_trust.dlp.validators` (and its `proximity_words` sub-resource)
+* **zero_trust:** add `client.zero_trust.gateway.dns_destination_ips`
+* **zero_trust:** add `delete()` and `get()` to `client.zero_trust.identity_providers.scim.groups` and `scim.users`
+* **dns:** add `client.dns.settings.account.nameserver_sets` with `create()`, `list()`, `delete()`, and `get()`
+* **r2:** add `client.r2.buckets.jobs` with `create()`, `list()`, and `get()`
+* **aisearch:** add `client.aisearch.namespaces.instances.move()`
+* **api_gateway:** add `client.api_gateway.discovery.operations.edit()`
+* **d1:** add `client.d1.database.undelete()`
+* **workers:** add `client.workers.beta.workers.versions.profile()`
+* **zero_trust:** add `client.zero_trust.access.custom_pages.validate()`
+
+#### New Resources
+
+**K2** (`client.k2`)
+
+- `streams.create()`, `streams.update()`, `streams.list()`, `streams.delete()`, and `streams.get()`
+- `streams.subscriptions.list()`
+
+**Monetization** (`client.monetization`)
+
+- `rules.update()`, `rules.delete()`, `rules.delete_rule()`, `rules.edit_rule()`, `rules.get()`, and `rules.get_rule()`
+
+**Zero Trust CWS** (`client.zero_trust.cws`)
+
+- `basic_auth_credentials.create()`, `list()`, `delete()`, `get()`, and `basic_auth_credentials.secrets.*`
+- `deployments.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `domain_acls.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `policies.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `policy_sets.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `rego_metadata.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `rego_modules.create()`, `update()`, `list()`, `delete()`, and `get()`
+- `tenant_structures.create()`, `update()`, `list()`, `delete()`, `get()`, and `tenant_structures.nodes.*`
+- `workloads.create()`, `update()`, `list()`, `delete()`, and `get()`
+
+**Billing Spend Policies** (`client.billing.spend_policies`)
+
+- `create()`, `update()`, `list()`, `delete()`, and `get()`
+- `activity.list()` and `audit.list()`
+
+**Zero Trust Access User Populations** (`client.zero_trust.access.user_populations`)
+
+- `create()`, `update()`, `list()`, `delete()`, and `get()`
+- `users.create()`, `users.update()`, `users.list()`, `users.delete()`, `users.get()`, and `users.replace()`
+
 ## 5.9.0 (2026-10-02)
 
 Full Changelog: [v5.8.0...v5.9.0](https://github.com/cloudflare/cloudflare-python/compare/v5.8.0...v5.9.0)

api.md

@@ -9,7 +9,6 @@ from cloudflare.types import (
     CloudflareTunnel,
     ErrorData,
     Identifier,
-    LoadBalancerPreview,
     Member,
     PaginationInfo,
     Permission,
@@ -195,7 +194,7 @@ Methods:
 
 # [MagicNetworkMonitoring](src/cloudflare/resources/magic_network_monitoring/api.md)
 
-# [MagicCloudNetworking](src/cloudflare/resources/magic_cloud_networking/api.md)
+# [Monetization](src/cloudflare/resources/monetization/api.md)
 
 # [NetworkInterconnects](src/cloudflare/resources/network_interconnects/api.md)
 
@@ -319,6 +318,8 @@ Methods:
 
 # [Pipelines](src/cloudflare/resources/pipelines/api.md)
 
+# [K2](src/cloudflare/resources/k2/api.md)
+
 # [SchemaValidation](src/cloudflare/resources/schema_validation/api.md)
 
 # [TokenValidation](src/cloudflare/resources/token_validation/api.md)

docs/migration-guides/v5.10.0-migration-guide.md

@@ -0,0 +1,187 @@
+# Migration Guide: v5.9.0 to v5.10.0
+
+This guide covers user-visible breaking changes in Cloudflare Python SDK v5.10.0.
+
+## Removed Magic Cloud Networking
+
+`client.magic_cloud_networking` has been removed entirely. Remove all usage of its sub-resources
+(`catalog_syncs` and `catalog_syncs.prebuilt_policies`, `on_ramps` and `on_ramps.address_spaces`,
+`cloud_integrations`, and `resources`) and drop any imports from `cloudflare.types.magic_cloud_networking`.
+There is no drop-in replacement; these endpoints are no longer exposed by the SDK.
+
+Before:
+
+```python
+syncs = client.magic_cloud_networking.catalog_syncs.list(account_id="account-id")
+```
+
+After:
+
+```python
+# No equivalent; remove the call and any magic_cloud_networking imports.
+```
+
+## Removed Tenant Custom Nameservers
+
+`client.tenant_custom_nameservers` has been removed, along with its `create()`, `delete()`, and `get()` methods
+and the `TenantCustomNameserverCreateResponse`, `TenantCustomNameserverDeleteResponse`, and
+`TenantCustomNameserverGetResponse` types.
+
+Before:
+
+```python
+client.tenant_custom_nameservers.get("tenant-tag")
+```
+
+After:
+
+```python
+# No equivalent; remove the call and any tenant_custom_nameservers imports.
+```
+
+## Tenants resource
+
+`client.tenants.get()` has been removed, along with the `account_types`, `entitlements`, and `memberships`
+sub-resources and the `Tenant` and `TenantAccount` types. `client.tenants.accounts.list()` now returns
+`SyncV4PagePaginationArray[AccountListResponse]` instead of `SyncSinglePage[TenantAccount]`.
+
+Before:
+
+```python
+from cloudflare.types.tenants import TenantAccount
+
+accounts: list[TenantAccount] = list(client.tenants.accounts.list())
+```
+
+After:
+
+```python
+from cloudflare.types.tenants import AccountListResponse
+
+accounts: list[AccountListResponse] = list(client.tenants.accounts.list())
+```
+
+## User tenants listing
+
+`client.user.tenants.list()` now returns `SyncSinglePage[TenantListResponse]` instead of
+`SyncSinglePage[Organization]`. The `Organization` export was removed from `cloudflare.types.user`.
+
+Before:
+
+```python
+from cloudflare.types.user import Organization
+
+orgs: list[Organization] = list(client.user.tenants.list())
+```
+
+After:
+
+```python
+from cloudflare.types.user import TenantListResponse
+
+tenants: list[TenantListResponse] = list(client.user.tenants.list())
+```
+
+## Accounts
+
+The `client.accounts.pay_bad_debt` sub-resource has been removed. Remove any calls to it.
+
+`client.accounts.subscriptions.bulk.create()` now returns `BulkCreateResponse` directly instead of
+`Optional[BulkCreateResponse]`; callers no longer need to handle `None`.
+
+## Registrar domains
+
+The `client.registrar.domains` sub-resource has been removed. Use the top-level registrar methods instead.
+
+## Browser Rendering DevTools
+
+`client.browser_rendering.devtools.browser.connect()` and `launch()` have been removed, along with the
+`devtools.browser.page` sub-resource. Remove these calls; the remaining DevTools endpoints are unaffected.
+
+## AI Search instance identifier
+
+The AI Search instance path identifier was renamed from `name` to `namespace` across every
+`client.aisearch.namespaces.instances` method and its `items` and `jobs` sub-resources.
+
+Before:
+
+```python
+client.aisearch.namespaces.instances.list(
+    name="my-namespace",
+    account_id="account-id",
+)
+```
+
+After:
+
+```python
+client.aisearch.namespaces.instances.list(
+    namespace="my-namespace",
+    account_id="account-id",
+)
+```
+
+A new `move()` method is also available to move an instance between namespaces.
+
+## Rulesets pagination removed
+
+`client.rulesets.list()` is no longer paginated and now returns `RulesetListResponse` directly instead of
+`SyncCursorPagination[RulesetListResponse]`. `client.rulesets.versions.list()` and
+`client.rulesets.phases.versions.list()` now return `VersionListResponse` instead of
+`SyncSinglePage[VersionListResponse]`. Stop iterating these as pages and read the returned object directly.
+
+Before:
+
+```python
+for ruleset in client.rulesets.list(zone_id="zone-id"):
+    print(ruleset.id)
+```
+
+After:
+
+```python
+rulesets = client.rulesets.list(zone_id="zone-id")
+for ruleset in rulesets.result:
+    print(ruleset.id)
+```
+
+## Additional pagination changes
+
+- `client.zero_trust.resource_library.applications.list()` and `categories.list()` now return
+  `SyncCursorPaginationAfter` instead of `SyncSinglePage`.
+- `client.diagnostics.endpoint_healthchecks.list()` now returns
+  `SyncSinglePage[EndpointHealthcheckListResponse]` instead of `Optional[EndpointHealthcheckListResponse]`.
+
+## Vectorize get_by_ids
+
+`client.vectorize.indexes.get_by_ids()` now issues a `GET` request and returns
+`SyncSinglePage[IndexGetByIDsResponse]` instead of issuing `POST` and returning `object`. Iterate the paged
+result instead of inspecting a raw object.
+
+## Response type replacements
+
+- `client.zero_trust.access.users.last_seen_identity.get()` now returns `Optional[LastSeenIdentityGetResponse]`;
+  the `Identity` type was removed.
+- `client.workers_for_platforms.dispatch.namespaces.scripts.tags.delete()` now returns `TagDeleteResponse`
+  instead of `object`.
+
+## Removed exports
+
+Remove or replace imports of:
+
+- `cloudflare.types.shared.LoadBalancerPreview`
+- `cloudflare.types.magic_transit.WANStaticAddressingParam`
+- `cloudflare.types.organizations.OrganizationProfileParam`
+- `cloudflare.types.precursor.EnforcementRuleParam`
+
+## Summary
+
+1. Remove all `magic_cloud_networking` and `tenant_custom_nameservers` usage and imports.
+2. Update Tenants and User tenant listings to the new response types and paginators.
+3. Remove the `accounts.pay_bad_debt`, `registrar.domains`, and `browser_rendering.devtools.browser.page`
+   sub-resources and the removed DevTools methods.
+4. Rename AI Search `name=` arguments to `namespace=`.
+5. Stop paginating `rulesets.list()`, `rulesets.versions.list()`, and `rulesets.phases.versions.list()`.
+6. Update changed pagination, verb, and response annotations for Resource Library, diagnostics, Vectorize,
+   last-seen identity, and dispatch script tags.
+7. Replace renamed or removed exported types.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cloudflare"
-version = "5.9.0"
+version = "5.10.0"
 description = "The official Python library for the cloudflare API"
 dynamic = ["readme"]
 license = "Apache-2.0"
@@ -56,7 +56,7 @@ conflicts = [
 [dependency-groups]
 # version pins are in uv.lock
 dev = [
-    "pyright==1.1.399",
+    "pyright[nodejs]==1.1.399",
     "mypy==1.17",
     "respx",
     "pytest",

requirements-dev.lock

@@ -56,6 +56,8 @@ mypy-extensions==1.1.0
     # via mypy
 nodeenv==1.10.0
     # via pyright
+nodejs-wheel-binaries==24.19.0
+    # via pyright
 packaging==25.0
     # via pytest
 pathspec==1.0.3