Repository navigation
Upgrade cloudflared to 2026.10.3 - #9017
Merged
Merged
Conversation
Cloudflare asks cloudflared users to upgrade after the private keys of eight eMudhra intermediate CA certificates were compromised. Upgrade the CLI pin and the download URL assertions. The existing installer replaces older binaries on the next tunnel start. Advisory: https://blog.cloudflare.com/emudhra-certificate-compromise
Contributor
Author
|
/snapit |
Contributor
|
🫰✨ Thanks @isaacroldan! Your snapshot has been published to npm. Built from Test the snapshot by installing your package globally: pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/[email protected]Caution After installing, validate the version by running |
1 of 4 tasks
gonzaloriestra
approved these changes
Oct 27, 2026
Contributor
There was a problem hiding this comment.
We should remove the changeset here if we are releasing a patch
github-actions
Bot
added
no-changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
The CLI pins cloudflared 2024.8.2. Cloudflare's eMudhra advisory asks users to upgrade to 2026.10.2 after eight intermediate CA private keys were compromised.
WHAT is this pull request doing?
Upgrade the pin to 2026.10.3, update the download URL assertions, and add a patch changeset. The existing installer upgrades older binaries on the next tunnel start.
Local validation on macOS arm64 passed: all 19 plugin tests, plugin lint through Nx, TypeScript checks, and the plugin build. A live smoke test confirmed a fresh install, reuse of the current binary, upgrade of a real 2024.8.2 binary, and an HTTPS request through the plugin's tunnel to a temporary local server. The tunnel and temporary files were removed after the test. A follow-up through the CLI's actual
tunnel_starthook also confirmed the upgrade and tunnel connection after replacing an old local CLI bundle. The repeat HTTPS request failed because the new tunnel hostname did not resolve (ENOTFOUND). All configured download assets exist in the release; Linux and Windows runtime tests remain unverified.How to manually test your changes?
From the PR checkout, force a source build to replace any older files in
packages/cli/dist. A previous bundle can otherwise keep its old embedded cloudflared version after an incremental build:Use
shopify:runhere to run this build directly without restoring Nx build cache output.Open the app preview and confirm it loads through the Cloudflare tunnel. Stop the development server, then run
"$tunnel_dir/cloudflared" --versionand confirm it reports2026.10.3.Start the command again and confirm the existing binary is reused. Repeat with a 2024.8.2 binary at the same path and confirm it is upgraded to 2026.10.3.
Remove the temporary directory when finished:
rm -r "$tunnel_dir".Checklist
patchfor bug fixes ·minorfor new features ·majorfor breaking changes) and added a changeset