Bump cloudflare/cloudflare from 5.21.1 to 5.22.0 in /deploy/terraform/cloudflare

[dependabot]

Bumps cloudflare/cloudflare from 5.21.1 to 5.22.0.

Release notes

Sourced from cloudflare/cloudflare's releases.

v5.22.0

5.22.0 (2026-07-09)

Full Changelog: v5.21.1...v5.22.0

⚠ BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• ai_search_instance: the source_params.web_crawler.crawl_options block has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove any crawl_options { ... } block from your cloudflare_ai_search_instance configurations. (0843c7f)
• zero_trust_access_ai_controls_mcp_portal: the servers attribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order of servers entries differs, and any code that relied on stable list ordering (e.g. element(..., 0)) may need to be updated. (099fc24)

Notes

• managed_transforms: managed_request_headers and managed_response_headers are now Optional instead of Required. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)

New Resources

• cloudflare_moq_relay: onboard new Terraform resource for Media over QUIC (MoQ) relays (9f2678c)

Features

• d1_database: add v4-to-v5 state upgrader (32f42b1)
• d1_database: add CRUD acceptance tests (3491e69)
• hyperdrive_config: add comprehensive acceptance tests (59399bb)
• oauth: add oauth_client resource CRUD support (154668f)
• workers_custom_domain: add acceptance tests for resource, data sources, and import (26e0092)
• workers_script: add exports and package_dependencies to schema (c15cef1)
• zero_trust_access_application: add file as valid RDP connection_rules value (2659e30)
• zero_trust_access_short_lived_certificate: add MoveState handler for access_ca_certificate rename (v4 -> v5 auto-migration) (90f3324)

Bug Fixes

• dns_record: dedupe schema key and drop unused import (8faa422)
• dns_record: revert Meta model to jsontypes.Normalized to match schema (c0eea18)
• docs: add .md extension to migration guide links (7546f3e)
• hyperdrive_config: address review feedback (92ce892)
• load_balancer_pool: remove phantom flatten_cname from v4 source model (baa1b92)
• migration: correct v4 test configs and migration test harness for access_ca_certificate (2c47cf7)
• moq_relay: add schema Version: 500 (890b9f9)
• oauth: remove custom oauth visibility change (6b4a0ed)
• ruleset: add asset_name to v4 source schema so v4->v5 state upgrader parses correctly (baa1b92)
• worker_version: add CustomType to assets schema to match model (7e7e0d3)
• worker_version: use NestedObject accessors for Assets field (78d419f)
• workers_custom_domain: address review feedback (3271949)
• workers_script: resolve duplicate cache_options tag (c15cef1)

... (truncated)

Changelog

Sourced from cloudflare/cloudflare's changelog.

5.22.0 (2026-07-09)

Full Changelog: v5.21.1...v5.22.0

⚠ BREAKING CHANGES

The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before terraform plan will succeed.

• ai_search_instance: the source_params.web_crawler.crawl_options block has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove any crawl_options { ... } block from your cloudflare_ai_search_instance configurations. (0843c7f)
• zero_trust_access_ai_controls_mcp_portal: the servers attribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order of servers entries differs, and any code that relied on stable list ordering (e.g. element(..., 0)) may need to be updated. (099fc24)

Notes

• managed_transforms: managed_request_headers and managed_response_headers are now Optional instead of Required. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)

New Resources

• cloudflare_moq_relay: onboard new Terraform resource for Media over QUIC (MoQ) relays (9f2678c)

Features

• d1_database: add v4-to-v5 state upgrader (32f42b1)
• d1_database: add CRUD acceptance tests (3491e69)
• hyperdrive_config: add comprehensive acceptance tests (59399bb)
• oauth: add oauth_client resource CRUD support (154668f)
• workers_custom_domain: add acceptance tests for resource, data sources, and import (26e0092)
• workers_script: add exports and package_dependencies to schema (c15cef1)
• zero_trust_access_application: add file as valid RDP connection_rules value (2659e30)
• zero_trust_access_short_lived_certificate: add MoveState handler for access_ca_certificate rename (v4 -> v5 auto-migration) (90f3324)

Bug Fixes

• dns_record: dedupe schema key and drop unused import (8faa422)
• dns_record: revert Meta model to jsontypes.Normalized to match schema (c0eea18)
• docs: add .md extension to migration guide links (7546f3e)
• hyperdrive_config: address review feedback (92ce892)
• load_balancer_pool: remove phantom flatten_cname from v4 source model (baa1b92)
• migration: correct v4 test configs and migration test harness for access_ca_certificate (2c47cf7)
• moq_relay: add schema Version: 500 (890b9f9)
• oauth: remove custom oauth visibility change (6b4a0ed)
• ruleset: add asset_name to v4 source schema so v4->v5 state upgrader parses correctly (baa1b92)
• worker_version: add CustomType to assets schema to match model (7e7e0d3)
• worker_version: use NestedObject accessors for Assets field (78d419f)
• workers_custom_domain: address review feedback (3271949)
• workers_script: resolve duplicate cache_options tag (c15cef1)
• zero_trust_list: handle ambiguous schema_version=0 state (v4 vs v5) (c010f78)

... (truncated)

Commits

• a2efdc5 Merge pull request #7253 from cloudflare/release-tf-v5.22.0
• 4158f49 ci: retrigger acceptance tests
• fe9c93f docs(changelog): add breaking-change and note entries for v5.22.0
• ee40a70 fix(migration): detect v4 vs v5.16.0 state on zero_trust_access_short_lived_c...
• ebcc5c7 chore(deps): bump cloudflare-go to v7.7.0
• 85d66d0 fix: resolve unit test failures for 5.22.0 release
• 63df8bd chore(docs): regen docs
• 443638b chore(release): 5.22.0
• 6b4a0ed fix(oauth): Removing custom oauth visibility change
• 154668f feat(oauth): Adding oauth client resource
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)