Update Terraform cloudflare to v5.22.0

[renovate]

This PR contains the following updates:

Package	Type	Change
cloudflare (source)	required_provider	5.20.0 → 5.22.0

---

Release Notes

cloudflare/terraform-provider-cloudflare (cloudflare)

v5.22.0

Compare Source

Full Changelog: v5.21.1...v5.22.0

⚠ BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• ai_search_instance: the source_params.web_crawler.crawl_options block has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove any crawl_options { ... } block from your cloudflare_ai_search_instance configurations. (0843c7f)
• zero_trust_access_ai_controls_mcp_portal: the servers attribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order of servers entries differs, and any code that relied on stable list ordering (e.g. element(..., 0)) may need to be updated. (099fc24)

Notes

• managed_transforms: managed_request_headers and managed_response_headers are now Optional instead of Required. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)

New Resources

• cloudflare_moq_relay: onboard new Terraform resource for Media over QUIC (MoQ) relays (9f2678c)

Features

• d1_database: add v4-to-v5 state upgrader (32f42b1)
• d1_database: add CRUD acceptance tests (3491e69)
• hyperdrive_config: add comprehensive acceptance tests (59399bb)
• oauth: add oauth_client resource CRUD support (154668f)
• workers_custom_domain: add acceptance tests for resource, data sources, and import (26e0092)
• workers_script: add exports and package_dependencies to schema (c15cef1)
• zero_trust_access_application: add file as valid RDP connection_rules value (2659e30)
• zero_trust_access_short_lived_certificate: add MoveState handler for access_ca_certificate rename (v4 -> v5 auto-migration) (90f3324)

Bug Fixes

• dns_record: dedupe schema key and drop unused import (8faa422)
• dns_record: revert Meta model to jsontypes.Normalized to match schema (c0eea18)
• docs: add .md extension to migration guide links (7546f3e)
• hyperdrive_config: address review feedback (92ce892)
• load_balancer_pool: remove phantom flatten_cname from v4 source model (baa1b92)
• migration: correct v4 test configs and migration test harness for access_ca_certificate (2c47cf7)
• moq_relay: add schema Version: 500 (890b9f9)
• oauth: remove custom oauth visibility change (6b4a0ed)
• ruleset: add asset_name to v4 source schema so v4->v5 state upgrader parses correctly (baa1b92)
• worker_version: add CustomType to assets schema to match model (7e7e0d3)
• worker_version: use NestedObject accessors for Assets field (78d419f)
• workers_custom_domain: address review feedback (3271949)
• workers_script: resolve duplicate cache_options tag (c15cef1)
• zero_trust_list: handle ambiguous schema_version=0 state (v4 vs v5) (c010f78)

Chores

• api: force regen of moq_relay and email_routing_rule (a9e500a)
• ci: add 30m timeout to unit test shards (635637b)
• ci: trigger acceptance tests on release-tf-* branches (5921d00)
• go.mod: pin cloudflare-go to release-770 branch head for v5.22.0 (05272f3)
• internal: codegen related update (c7a96ca)
• use 'next' for Terraform builds (30c04e6)

Documentation

• list: fix missing comma in resource and data source examples (bfe1c34)
• regenerate provider docs; fix provider address and .stats.yml (cbde062)
• update documentation for moved blocks to Terraform 1.8 (d93208d)
• v5-migration: document session_duration behavior change for access policies (90c58a7)
• v5-upgrade: add destructive-behavior warning for app-scoped policy migration (1e832d6)
• v5-upgrade: document zone_id removal for access policies (831f0bb)

v5.21.1

Compare Source

Full Changelog: v5.21.0...v5.21.1

Bug Fixes

• worker: stop sending propagation_policy when not configured (#​7192) (31d9a31)

v5.21.0

Compare Source

Full Changelog: v5.20.0...v5.21.0

Features

• add new resources from staging-next (e104922)

Bug Fixes

• add missing no-op state upgraders for version 0 -> 500 (692a0c6), closes #​7181
• restore account_id and zone_id as required on 156 resources (62024cf)
• workers_script: add missing propagation_policy to observability traces schema (78448d8)
• zone: only sweep zones containing the cftftest prefix (293ab21)

Chores

• Add acceptance tests for DLP data classification resources (b85f20c)
• ci: optimize CI workflow runtime (7aa373f)
• clean up (e36c8a3)

Documentation

• add docs for v5.20.1 release (712db1d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

GitLab Pipeline Action

General information

Link to pipeline: https://gitlab.com/code0-tech/infrastructure/mensa/-/pipelines/2685544447

Status: Passed
Duration: 2 minutes

Job summaries

tf-plan:server_production

No changes. Your infrastructure matches the configuration.

tf-plan:server_administration

No changes. Your infrastructure matches the configuration.

tf-plan:github

No changes. Your infrastructure matches the configuration.

tf-plan:main

No changes. Your infrastructure matches the configuration.