Driftwatch

Cloudflare / Cloudflare API /

Breakingdirection flip: their tools call this safe

value can now return "forward"

What changed

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

Affects this value on zero-trust-gateway_action reachable from 8 operations.

New value: forward.

can now return "forward"

Who is affected

Code that reads Cloudflare's zero-trust-gateway_action objects, used by 8 Cloudflare operations.

Before and after

WhereBeforeAfter
zero-trust-gateway_action"allow", "block", "egress", "isolate", "l4_override", "noisolate", "noscan", "off", "on", "override", "quarantine", "redirect", "resolve", "safesearch", "scan", "ytrestricted""allow", "block", "egress", "forward", "isolate", "l4_override", "noisolate", "noscan", "off", "on", "override", "quarantine", "redirect", "resolve", "safesearch", "scan", "ytrestricted"

Code that breaks

switch (response) {
  // existing branches …
  // no branch for "forward"
  default:
    throw new Error("unexpected value");
}

Based on Cloudflare’s published API specification. How severity is decided.