Cloudflare One Client - Cloudflare One Client for macOS (version 2026.8.2100.0)

<p>A new GA release for the macOS Cloudflare One Client is now available on the <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/">stable releases downloads page</a>.</p> <p>This release includes the following highlights:</p> <ul> <li>Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects.</li> <li>Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM.</li> <li>Faster connects and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one.</li> </ul> <p><strong>Additional changes and improvements</strong></p> <ul> <li>Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration.</li> <li>Improved client reaction to the current network lowering its MTU.</li> <li>Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel.</li> <li>Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding.</li> <li>Improved API reliability by retrying requests dropped when reusing pooled connections.</li> <li>Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default.</li> <li>Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering.</li> <li>Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration.</li> <li>Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep.</li> <li>Fixed Extra Logging failing to capture packets across all interfaces.</li> <li>Fixed an issue that could prevent remote diagnostics from completing.</li> <li>Fixed DNS connectivity checks failing on IPv6-only networks.</li> <li>Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake.</li> <li>Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables.</li> <li>Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting.</li> <li>Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting.</li> <li>Fixed the client continuing to report “No network” after a successful manual disconnect.</li> <li>Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request.</li> <li>Fixed a startup crash when date formatting data for the system locale had not yet loaded.</li> </ul> <p><strong>Known issues</strong></p> <ul> <li>None</li> </ul>