Release Updates

Salesforce periodically provides release updates that improve the performance, logic, security, and usability of our products. The Release Updates page provides a list of updates that can be necessary for your organization to enable. Some release updates affect existing customizations.

Every time a release update is created, it gets scheduled to be enforced in a future release. We announce each update and its schedule here as soon as that schedule is known, but occasionally, updates are postponed or canceled. If that happens, we let you know in the section that describes that specific release update.

Often, release updates provide a Test Run option so you can enable an update and examine any changes to your org, including changes to customizations, before that update’s Complete Steps By date. You can view attachments in the Salesforce mobile app, but you can’t edit them.

To view release updates, from Setup, in the Quick Find box, enter Release Updates, and select Release Updates.

Enforced with This Release

These updates are scheduled to be enforced this release.

Assign Use Any API Auth Permission for SOAP login() (Release Update): To authenticate with the SOAP API login() operation, all users must have the Use Any API Auth user permission assigned to them. Users without the Use Any API Auth user permission can no longer authenticate with SOAP API login() and will encounter an error.

Enable Accessibility Enhancements for Cards, Docked Containers, Menu Lists, and Panels (Release Update): To help meet Web Content Accessibility Guidelines (WCAG) 2.2 for Resize and Reflow, enable Lightning Experience to adapt the behavior of cards, docked containers, menu lists, and panels when viewed at high magnification. This release update is dependent on the Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200% release update. This update was first available in Summer ’26 and is enforced in Winter ’27.

Enable Accessibility Enhancements for Date Pickers, Popovers, Bottom Utility Bars, Record Headers (Release Update): To help meet Web Content Accessibility Guidelines (WCAG) 2.2 for Resize and Reflow, enable Lightning Experience to adapt the behavior of date pickers, popovers, bottom utility bars, and record headers when viewed at high magnification. This release update is dependent on the Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200% release update. This update was first available in Winter ’26 and was scheduled to be enforced in Summer ’26, but we postponed the enforcement date to Winter ’27.

Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200% (Release Update): To help meet Web Content Accessibility Guidelines (WCAG) 2.2 for Resize and Reflow, enable Lightning Experience to adapt the behavior of page headers and modal windows when viewed at high magnification. This update was first available in Summer ’25 and was scheduled to be enforced in Summer ’26, but we postponed the enforcement date to Winter ’27.
Enable Profile Filtering (Release Update): To improve the security of your Salesforce org, the Profile Filtering setting is enabled by default. Profile filtering prevents users from viewing profile names other than their own unless they’re assigned the View All Profiles permission. If a user’s role requires them to see all profile names, assign them the View All Profiles permission before this release update is enforced. This update was first available in Summer ’26 and is enforced in Winter ’27.

Scheduled To Be Enforced Before Spring ’27

These updates are scheduled to be enforced before Spring ’27. The list can include new, previously announced, and previously postponed release updates.

Maintain Your Email Verification Exception (Release Update): If you previously disabled user email verifications through Salesforce Customer Support, configure an authorized email domain setting to maintain your exception and to preserve your users’ ability to send email. When this release update is enforced, Salesforce removes the existing domain allowlists that disable email verification. This update is available starting in Winter ’27 and is enforced on December 1, 2026.
Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update): To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available starting in late Summer ’26 and is enforced on November 30, 2026.

Scheduled to Be Enforced in Spring ’27

These updates are scheduled to be enforced in Spring ’27. The list can include new, previously announced, and previously postponed release updates.

Conceal Personal Information Fields from Guest Users (Release Update): Set field visibility for guest users without affecting your settings for other external users. Turn on Independent Guest Field Masking to hide certain fields specifically from guest users. This update adds a new Guest_PersonalInfo_EPIM field set so that you can secure guest-facing fields without changing what portal users see. This update was first available in Winter ’27 and is enforced in Spring ’27.

Enable Accessibility Enhancements for To Do Lists and Lightning Dual Listboxes When Zoom Is Greater Than 200% (Release Update): To help meet Web Content Accessibility Guidelines (WCAG) 2.2 for Resize and Reflow, enable Lightning Experience to adapt the behavior of To Do lists and Lightning dual listboxes when viewed at high magnification. This is part of our effort to comply with WCAG 2.2 Resize and Reflow guidelines. This update was first available in Summer ’26 and is enforced in Spring ’27.
OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update): Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension. This update was first available in late Summer ’26 and is enforced on February 20, 2027.
Remove Non-Public Fields from Custom Object Data in Aura Action Responses (Release Update): To improve security, Salesforce is removing non-public system fields from custom object data returned in Aura action responses. This update filters out internal system fields that aren’t part of the public Salesforce API. Review your Lightning components that process custom object data to avoid JavaScript errors or missing data. Use only API-supported fields in your components to ensure that your data displays correctly. This update was first available in Summer ’26 and is enforced in Spring ’27.
Render Visualforce Pages as Accessible (Tagged) PDFs (Beta) (Release Update): With this update enabled, Visualforce pages rendered with renderAs="pdf" use the accessible PDF rendering engine, which produces tagged PDF/UA output. Tagged PDFs include the document structure and metadata that assistive technologies such as screen readers rely on. This update is available starting in Winter ’27 and is enforced in Spring ’27.
Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update): When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027.
Roll Back Platform Event Trigger Transactions on Unhandled Exceptions: When this release update is enforced, transactions of a platform event Apex trigger are rolled back when the trigger throws an unhandled exception so that partially written records are no longer committed.
Salesforce Connect Cross-Org Adapter Legacy Authentication Is Being Retired (Release Update): The password and OAuth 2.0 authentication methods for the Salesforce Connect cross-org adapter are being retired in Spring ’27. Migrate any cross-org adapter external data sources to use named credentials, a more robust and secure authentication method.
Salesforce to Salesforce Is Being Retired (Release Update): Salesforce to Salesforce is being retired in Spring ’27. Salesforce has more powerful and integrated solutions that align with modern business needs. To prevent disruption when Salesforce ends support for the Salesforce to Salesforce product, make sure that you migrate your integrations to one of these recommended solutions: Partner Cloud, Data Cloud One, MuleSoft Anypoint, or MuleSoft for Flow.
SOAP API login() Call in SOAP API Versions 31.0 Through 64.0 Is Being Retired (Release Update): In Summer ‘27, the SOAP API login() call in SOAP API versions 31.0 through 64.0 will no longer be supported and no longer be available.
Update Apex Code and Flows for Changed Sharing Recalculation Behavior (Release Update): To optimize performance after large-scale updates to groups or roles, Salesforce now performs some sharing recalculations asynchronously. If Apex code and flows require that share records be updated immediately, the code and flows can break when this release update is enforced. Update Apex classes, tests, triggers, and flows that update group membership or roles if they rely on synchronous sharing recalculation. This update was first available in Spring ’26.

Update Instanced URLs in API Traffic (Release Update): To prevent disruption when Salesforce ends support for API traffic that uses an incorrect instanced URL, make sure that API traffic to your org uses the org’s My Domain login URL. First available in Summer ’25, this release update was scheduled to be enforced in Spring ’26, but we postponed enforcement to a phased schedule that starts in October 2026 in sandboxes and January 2027 in production.

View Setup Audit Trail Permission to Access Setup Audit Trail (Release Update): Control access to Setup Audit Trail with the dedicated View Setup Audit Trail permission. Admins can provide access without granting the broader View Setup permission, supporting the principle of least privilege. Existing access is preserved automatically. For new users who require Setup Audit Trail access, assign the permission through a profile or permission set. This update is enforced in Spring ’27.

Scheduled To Be Enforced Before Summer ’27

These updates are scheduled to be enforced before Summer ’27. The list can include new, previously announced, and previously postponed release updates.

Scheduled to Be Enforced in Summer ’27

These updates are scheduled to be enforced in Summer ’27. The list can include new, previously announced, and previously postponed release updates.

Block Apex Anonymous Code Execution from Managed Packages (Release Update): To strengthen subscriber org security, block managed package session IDs from authenticating anonymous Apex code. If you enable this update, installed managed packages can no longer use UserInfo.getSessionId() to obtain a session ID and then use the session ID to execute anonymous Apex. This update was first available in Summer ’26.
Migrate All Connected Apps to External Client Apps (Release Update): Keep your integrations supported by migrating to external client apps. In Summer '27, Salesforce is ending support for connected apps. Connected apps will keep working, but bug fixes, integrations, and authorization flows will no longer be supported. This update is available starting in Winter ’27 and is enforced for production instances in Summer ’27.
Optimize Performance for Revenue Management (Release Update): With this update, the Configuration API is optimized to reduce configuration processing times when using Product Configurator. Enable the test run in a sandbox environment to confirm that the optimizations work with your setup. This update is available starting in Winter ’27.

Canceled Updates

These updates were announced in a previous release but are now canceled. They were removed from the Release Updates node and aren’t enforced. The list can include previously announced and previously postponed release updates.

Adopt Authorized Email Domains (Release Update): This update has been canceled and replaced by the Maintain Your Email Verification Exception update.