Merge pull request #2728 from cloudflare/sync/staging-next-2026-06-03

Sync staged changes (curated) - 2026-06-03

Author: rotem-cloud

.github/workflows/ci.yml

@@ -26,10 +26,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/cloudflare-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -48,10 +48,10 @@ jobs:
       id-token: write
     runs-on: ${{ github.repository == 'stainless-sdks/cloudflare-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -66,7 +66,7 @@ jobs:
           github.repository == 'stainless-sdks/cloudflare-python' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -86,10 +86,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/cloudflare-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
 
@@ -110,10 +110,10 @@ jobs:
     if: github.repository == 'cloudflare/cloudflare-python' && (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
       - name: Install dependencies

.github/workflows/detect-breaking-changes.yml

@@ -16,13 +16,13 @@ jobs:
         run: |
           echo "FETCH_DEPTH=$(expr ${{ github.event.pull_request.commits }} + 1)" >> $GITHUB_ENV
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Ensure we can check out the pull request base in the script below.
           fetch-depth: ${{ env.FETCH_DEPTH }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.10.2'
       - name: Install dependencies

.github/workflows/publish-pypi.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: '0.9.13'
 

.github/workflows/release-doctor.yml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository == 'cloudflare/cloudflare-python' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 2277
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-a6c352830d1270d0abb5bb983058ea21815e1bb7d2e163965335dcb0e706f057.yml
-openapi_spec_hash: c0d553c22ef1e807dd815f71023050f4
-config_hash: 245f966442f3af14c23b79cbfdf06161
+configured_endpoints: 2304
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare/cloudflare-b841673c088e755bc04d2a0852e97ef3bb7d3c60d13bf9c0ac6f631d38fa5e5b.yml
+openapi_spec_hash: d9813b2d4243b7d9fa43c5c9e8bc996f
+config_hash: bbf9427136a35ea3704b605309480336

api.md

@@ -59,6 +59,8 @@ from cloudflare.types import (
 
 # [CustomCertificates](src/cloudflare/resources/custom_certificates/api.md)
 
+# [CustomCsrs](src/cloudflare/resources/custom_csrs/api.md)
+
 # [CustomHostnames](src/cloudflare/resources/custom_hostnames/api.md)
 
 # [CustomNameservers](src/cloudflare/resources/custom_nameservers/api.md)
@@ -117,6 +119,8 @@ from cloudflare.types import (
 
 # [Addressing](src/cloudflare/resources/addressing/api.md)
 
+# [DLS](src/cloudflare/resources/dls/api.md)
+
 # [AuditLogs](src/cloudflare/resources/audit_logs/api.md)
 
 # [Billing](src/cloudflare/resources/billing/api.md)
@@ -229,6 +233,8 @@ from cloudflare.types import (
 
 # [AI](src/cloudflare/resources/ai/api.md)
 
+# [AIAudit](src/cloudflare/resources/ai_audit/api.md)
+
 # [AISearch](src/cloudflare/resources/aisearch/api.md)
 
 # [SecurityCenter](src/cloudflare/resources/security_center/api.md)

pyproject.toml

@@ -155,7 +155,7 @@ show_error_codes = true
 #
 # We also exclude our `tests` as mypy doesn't always infer
 # types correctly and Pyright will still catch any type errors.
-exclude = ['src/cloudflare/_files.py', '_dev/.*.py', 'tests/.*', 'src/cloudflare/resources/zero_trust/identity_providers\.py', 'src/cloudflare/resources/zero_trust/access/applications/applications\.py', 'src/cloudflare/resources/workers/ai\.py', 'src/cloudflare/resources/magic_transit/apps\.py']
+exclude = ["src/cloudflare/_files.py", "_dev/.*.py", "tests/.*", "src/cloudflare/resources/zero_trust/identity_providers\\.py", "src/cloudflare/resources/zero_trust/access/applications/applications\\.py", "src/cloudflare/resources/workers/ai\\.py", "src/cloudflare/resources/magic_transit/apps\\.py"]
 
 strict_equality = true
 implicit_reexport = true

scripts/bootstrap

@@ -4,7 +4,7 @@ set -e
 
 cd "$(dirname "$0")/.."
 
-if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "$SKIP_BREW" != "1" ] && [ -t 0 ]; then
+if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "${SKIP_BREW:-}" != "1" ] && [ -t 0 ]; then
   brew bundle check >/dev/null 2>&1 || {
     echo -n "==> Install Homebrew dependencies? (y/N): "
     read -r response

src/cloudflare/_base_client.py

@@ -536,7 +536,7 @@ def _build_request(
                         f"Expected query input to be a dictionary for multipart requests but got {type(json_data)} instead."
                     )
 
-                if options.multipart_syntax == 'json':
+                if options.multipart_syntax == "json":
                     json_data = cast("Mapping[str, object]", json_data)
                     if is_mapping_t(files):
                         files = {