Release notes (7)

Last updated Apr 21, 2026

2026-04-27

• You can now empty a bucket or delete folders directly from the R2 dashboard without writing scripts or configuring lifecycle rules.

2025-09-23

• Fixed a bug where you could attempt to delete objects even if they had a bucket lock rule applied on the dashboard. Previously, they would momentarily vanish from the table but reappear after a page refresh. Now, the delete action is disabled on locked objects in the dashboard.

2025-09-22

• We’ve updated the R2 dashboard with a cleaner look to make it easier to find what you need and take action. You can find instructions for how you can use R2 with the various API interfaces in the side panel, and easily access documentation at the bottom.

2025-07-03

• The CRC-64/NVME Checksum algorithm is now supported for both single and multipart objects. This also brings support for the FULL_OBJECT Checksum Type on Multipart Uploads. See Checksum Type Compatibility here.

2024-12-03

• Server-side Encryption with Customer-Provided Keys is now available to all users via the Workers and S3-compatible APIs.

2024-11-21

• Sippy can now be enabled on buckets in jurisdictions (e.g., EU, FedRAMP).
• Fixed an issue with Sippy where GET/HEAD requests to objects with certain special characters would result in error responses.

2024-11-20

• Oceania (OC) is now available as an R2 region.
• The default maximum number of buckets per account is now 1 million. If you need more than 1 million buckets, contact Cloudflare Support.
• Public buckets accessible via custom domain now support Smart Tiered Cache.

2024-11-19

• R2 bucket lifecycle command added to Wrangler. Supports listing, adding, and removing object lifecycle rules.

2024-11-14

• R2 bucket info command added to Wrangler. Displays location of bucket and common metrics.

2024-11-08

• R2 bucket dev-url command added to Wrangler. Supports enabling, disabling, and getting status of bucket's r2.dev public access URL.

2024-11-06

• R2 bucket domain command added to Wrangler. Supports listing, adding, removing, and updating R2 bucket custom domains.

2024-11-01

• Add minTLS to response of list custom domains endpoint.

2024-10-28

• Add get custom domain endpoint.

2024-10-21

• Event notifications can now be configured for R2 buckets in jurisdictions (e.g., EU, FedRAMP).

2024-09-26

• Event notifications for R2 is now generally available. Event notifications now support higher throughput (up to 5,000 messages per second per Queue), can be configured in the dashboard and Wrangler, and support for lifecycle deletes.

2024-09-18

• Add the ability to set and update minimum TLS version for R2 bucket custom domains.

2024-08-26

• Added support for configuring R2 bucket custom domains via API.

2024-08-21

• Sippy is now generally available. Metrics for ongoing migrations can now be found in the dashboard or via the GraphQL analytics API.

2024-07-08

• Added migration log for Super Slurper to the migration summary in the dashboard.

2024-06-12

• Super Slurper now supports migrating objects up to 1TB in size.

2024-06-07

• Fixed an issue that prevented Sippy from copying over objects from S3 buckets with SSE set up.

2024-06-06

• R2 will now ignore the x-purpose request parameter.

2024-05-29

• Added support for Infrequent Access storage class (beta).

2024-05-24

• Added create temporary access tokens endpoint.

2024-04-03

• Event notifications for R2 is now available as an open beta.
• Super Slurper now supports migration from Google Cloud Storage.

2024-02-20

• When an OPTIONS request against the public entrypoint does not include an origin header, an HTTP 400 instead of an HTTP 401 is returned.

2024-02-06

• The response shape of GET /buckets/:bucket/sippy has changed.
• The /buckets/:bucket/sippy/validate endpoint is exposed over APIGW to validate Sippy's configuration.
• The shape of the configuration object when modifying Sippy's configuration has changed.

2024-02-02

• Updated GetBucket endpoint: Now fetches by bucket_name instead of bucket_id.

2024-01-30

• Fixed a bug where the API would accept empty strings in the AllowedHeaders property of PutBucketCors actions.

2024-01-26

• Parts are now automatically sorted in ascending order regardless of input during CompleteMultipartUpload.

2024-01-11

• Sippy is available for Google Cloud Storage (GCS) beta.

2023-12-11

• The x-id query param for S3 ListBuckets action is now ignored.
• The x-id query param is now ignored for all S3 actions.

2023-10-23

• PutBucketCors now only accepts valid origins.

2023-09-01

• Fixed an issue with ListBuckets where the name_contains parameter would also search over the jurisdiction name.

2023-08-23

• Config Audit Logs GA.

2023-08-11

• Users can now complete conditional multipart publish operations. When a condition failure occurs when publishing an upload, the upload is no longer available and is treated as aborted.

2023-07-05

• Improved performance for ranged reads on very large files. Previously ranged reads near the end of very large files would be noticeably slower than ranged reads on smaller files. Performance should now be consistently good independent of filesize.

2023-06-21

• Multipart ETags are now MD5 hashes.

2023-06-16

• Fixed a bug where calling GetBucket on a non-existent bucket would return a 500 instead of a 404.
• Improved S3 compatibility for ListObjectsV1, now nextmarker is only set when truncated is true.
• The R2 worker bindings now support parsing conditional headers with multiple etags. These etags can now be strong, weak or a wildcard. Previously the bindings only accepted headers containing a single strong etag.
• S3 putObject now supports sha256 and sha1 checksums. These were already supported by the R2 worker bindings.
• CopyObject in the S3 compatible api now supports Cloudflare specific headers which allow the copy operation to be conditional on the state of the destination object.

2023-04-01

• GetBucket is now available for use through the Cloudflare API.
• Location hints can now be set when creating a bucket, both through the S3 API, and the dashboard.

2023-03-16

• The ListParts API has been implemented and is available for use.
• HTTP2 is now enabled by default for new custom domains linked to R2 buckets.
• Object Lifecycles are now available for use.
• Bug fix: Requests to public buckets will now return the Content-Encoding header for gzip files when Accept-Encoding: gzip is used.

2023-01-27

• R2 authentication tokens created via the R2 token page are now scoped to a single account by default.

2022-12-07

• Fix CORS preflight requests for the S3 API, which allows using the S3 SDK in the browser.
• Passing a range header to the get operation in the R2 bindings API should now work as expected.

2022-11-30

• Requests with the header x-amz-acl: public-read are no longer rejected.
• Fixed issues with wildcard CORS rules and presigned URLs.
• Fixed an issue where ListObjects would time out during delimited listing of unicode-normalized keys.
• S3 API's PutBucketCors now rejects requests with unknown keys in the XML body.
• Signing additional headers no longer breaks CORS preflight requests for presigned URLs.

2022-11-21

• Fixed a bug in ListObjects where startAfter would skip over objects with keys that have numbers right after the startAfter prefix.
• Add worker bindings for multipart uploads.

2022-11-17

• Unconditionally return HTTP 206 on ranged requests to match behavior of other S3 compatible implementations.
• Fixed a CORS bug where AllowedHeaders in the CORS config were being treated case-sensitively.

2022-11-08

• Copying multipart objects via CopyObject is re-enabled.
• UploadPartCopy is re-enabled.

2022-10-28

• Multipart upload part sizes are always expected to be of the same size, but this enforcement is now done when you complete an upload instead of being done very time you upload a part.
• Fixed a performance issue where concurrent multipart part uploads would get rejected.

2022-10-26

• Fixed ranged reads for multipart objects with part sizes unaligned to 64KiB.

2022-10-19

• HeadBucket now sets x-amz-bucket-region to auto in the response.

2022-10-06

• Temporarily disabled UploadPartCopy while we investigate an issue.

2022-09-29

• Fixed a CORS issue where Access-Control-Allow-Headers was not being set for preflight requests.

2022-09-28

• Fixed a bug where CORS configuration was not being applied to S3 endpoint.
• No-longer render the Access-Control-Expose-Headers response header if ExposeHeader is not defined.
• Public buckets will no-longer return the Content-Range response header unless the response is partial.
• Fixed CORS rendering for the S3 HeadObject operation.
• Fixed a bug where no matching CORS configuration could result in a 403 response.
• Temporarily disable copying objects that were created with multipart uploads.
• Fixed a bug in the Workers bindings where an internal error was being returned for malformed ranged .get requests.

2022-09-27

• CORS preflight responses and adding CORS headers for other responses is now implemented for S3 and public buckets. Currently, the only way to configure CORS is via the S3 API.
• Fixup for bindings list truncation to work more correctly when listing keys with custom metadata that have " or when some keys/values contain certain multi-byte UTF-8 values.
• The S3 GetObject operation now only returns Content-Range in response to a ranged request.

2022-09-19

• The R2 put() binding options can now be given an onlyIf field, similar to get(), that performs a conditional upload.
• The R2 delete() binding now supports deleting multiple keys at once.
• The R2 put() binding now supports user-specified SHA-1, SHA-256, SHA-384, SHA-512 checksums in options.
• User-specified object checksums will now be available in the R2 get() and head() bindings response. MD5 is included by default for non-multipart uploaded objects.