---
name: salesforce-winter-27
description: Use for any Salesforce metadata authored or reviewed at API v68.0 or higher (Winter '27). Encodes the version-gated behavior changes plus the core admin, development, and security changes in Winter '27. Verify against the ForceNotes MCP server (get_release_summary) before finalizing.
---

# Winter '27 (API v68.0) — agent rules

Release status: preview. Source: https://help.salesforce.com/s/articleView?id=release-notes.salesforce_release_notes.htm&language=en_US&release=264&type=5
Live data: https://forcenotes.app/mcp (`get_release_summary` with `release: "Winter '27"`).

## The API version rule

Check the component's API version first:

1. Apex class or trigger → the `apiVersion` in its `*.cls-meta.xml` / `*.trigger-meta.xml`.
2. LWC or Aura → `apiVersion` in `*.js-meta.xml`, else `sourceApiVersion` in `sfdx-project.json`.
3. Nothing declared → assume the org's current release; ask before guessing.

**If that version is `apiVersion` (Apex classes/triggers) or `sourceApiVersion` (LWC, sfdx-project.json) >= 68.0, the rules in this file apply.** They are version-gated: Salesforce keeps older behavior for code on earlier API versions, so do not apply them to a class pinned below 68.0 — and never silently bump a class's `apiVersion` to "fix" a compile or test failure. Raising the version opts that file into every change below at once.

When a change below conflicts with existing code in the repo, say so and stop rather than rewriting behavior the user did not ask you to change.

## Needs attention before you ship

- **Work Summaries for Case (Beta) Is Being Retired** — retirement. Work Summaries for Case (beta) is in maintenance mode and is removed on September 30, 2026, after which Case Summaries are unavailable. Transition to Enhanced Summaries, which offers role-specific summaries and more features. _(AI Solutions for Service · deadline 2026-09-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_service.htm&release=264&type=5
- **Legacy Snowflake Data Share Target Retirement — Migrate to Snowflake Zero-Copy V2** — retirement. Data 360 no longer lets you create a legacy Snowflake data share target, and existing data shares that use one must move to a Snowflake V2 data share target by October 31, 2026. The V2 zero-copy connector authenticates with OIDC instead of username/password OAuth and supports acting on change data with Snowflake streams and tasks. Create and link a V2 target, confirm data shares work against it, then unlink the legacy target so downstream pipelines and dashboards keep receiving data. _(Data 360 · deadline 2026-10-31)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_c360_truth.htm&release=264&type=5
- **Restrict the OAuth 2.0 Device Flow to Local External Client Apps** — release_update. Salesforce is restricting the OAuth 2.0 device flow to local external client apps with a localhost callback URL, requiring connected apps to migrate. _(Security / Identity · deadline 2026-11-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Maintain Your Email Verification Exception** — release_update. Organizations that previously disabled user email verifications via Support must configure authorized email domain settings to preserve user email sending capabilities. _(Email Integration · deadline 2026-12-01)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Standard Volume Platform Events End of Life** — retirement. Standard volume platform events are retired on December 15, 2026. Before then, stop all publishing and let subscribers (triggers and flows) finish, then use the migration button on Setup > Platform Events to convert all standard volume platform events to high volume platform events. Each event takes roughly 15 minutes (up to 24 hours in rare cases); during migration publishes fail and you cannot create new triggers or flows. _(Enterprise Messaging · deadline 2026-12-15)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Retirement of OAuth 2.0 Username-Password Flow for Connected Apps** — retirement. Salesforce is ending support for the OAuth 2.0 username-password flow for connected apps, breaking integrations that rely on this authentication method. _(Security / Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)** — retirement. Retires the OAuth user-agent and hybrid user-agent flows, requiring integrations to migrate to the OAuth web-server flow or hybrid web-server flow with PKCE. _(Security & Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Agentforce Voice Now Enforces the Limit on Procured Phone Numbers** — breaking. Limits on procured phone numbers are now enforced for Agentforce Voice, setting a maximum of 10 phone numbers for sandbox and trial orgs and license-based limits for production orgs. _(Agentforce Voice)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&language=en_US&release=264&type=5
- **Assign Use Any API Auth Permission for SOAP login()** — release_update. To authenticate with the SOAP API login() operation, users must be assigned the Use Any API Auth user permission, or authentication will fail. _(Security / API)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Block Apex Anonymous Code Execution from Managed Packages** — release_update. A release update prevents anonymous Apex code execution coming from managed packages. _(Apex)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Block Apex Anonymous Code Execution from Managed Packages (Release Update)** — release_update. Prevents installed managed package session IDs from authenticating and executing anonymous Apex code. _(Apex)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Conceal Personal Information Fields from Guest Users (Release Update)** — release_update. This Release Update decouples guest-user field masking from portal-user masking: turning on Independent Guest Field Masking makes the PII that unauthenticated guest users see governed by a new Guest_PersonalInfo_EPIM field set, while portal users stay governed by PersonalInfo_EPIM. Enforced in Spring '27; review and activate from Setup > Release Updates. _(Experience Cloud)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Domains Redirections and Host Name Updates** — breaking. Redirections end in sandboxes for instanced URLs in API traffic, and orgs using third-party services for custom domains must update their target host names. _(Domains)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Einstein Quick Quote for Enterprise Sales Management Is Retired** — retirement. Einstein Quick Quote for Enterprise Sales Management is retired in Winter '27. Along with it, the Contract Option in Custom Discount Allocation Type settings and the sort functionality on the Product Catalog are also retired. _(Industries Common Features)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_industries.htm&release=264&type=5
- **Enable Accessibility Enhancements for Cards, Docked Containers, Menu Lists, and Panels (Release Update)** — release_update. A WCAG 2.2 Resize and Reflow Release Update that keeps cards, docked containers, menu lists, and panels readable at 400% magnification and 1280px width by wrapping header content instead of clipping it. It depends on the Page Headers and Modal Windows accessibility Release Update being enabled first. Enforced in Winter '27; test and activate from Setup > Release Updates. _(Lightning Experience Accessibility)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Enable Accessibility Enhancements for Date Pickers, Popovers, Bottom Utility Bars, Record Headers (Release Update)** — release_update. A WCAG 2.2 Resize and Reflow Release Update that adjusts date pickers, popovers, bottom utility bars, and record list-view headers so they stay usable at 400% magnification and 1280px width; truncated utility-bar button labels reveal their full text on hover or keyboard focus. It depends on the Page Headers and Modal Windows accessibility Release Update, which must be enabled first. First available in Winter '26, with enforcement moved from Summer '26 to Winter '27. Activate from Setup > Release Updates. _(Lightning Experience Accessibility)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200% (Release Update)** — release_update. This Release Update makes Lightning Experience adapt page headers and modal windows for users viewing the browser above 200% zoom, as part of Salesforce's WCAG 2.2 Resize and Reflow effort: the page header scrolls with the page instead of covering content, and modal buttons and content stay inside the viewport. It was first offered in Summer '25 with enforcement postponed from Summer '26 to Winter '27, and the other Winter '27 accessibility Release Updates depend on this one being enabled first. Test and activate it from Setup > Release Updates before the enforcement date. _(Lightning Experience Accessibility)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Enable Accessibility Enhancements for To Do Lists and Lightning Dual Listboxes When Zoom Is Greater Than 200% (Release Update)** — release_update. A WCAG 2.2 Resize and Reflow Release Update that keeps To Do lists and Lightning dual listboxes usable at 400% magnification (1366px width) by wrapping content rather than clipping it. Unlike the other Winter '27 accessibility Release Updates, this one is scheduled for enforcement in Spring '27. Activate from Setup > Release Updates. _(Lightning Experience Accessibility)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Enable Profile Filtering (Release Update)** — release_update. Profile filtering is enabled by default to prevent users from viewing profile names other than their own unless they are assigned the View All Profiles permission. _(Security & Identity)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **End of Instanced URL Redirections in Sandboxes for API Traffic** — breaking. Redirections for instanced URLs in API traffic are ending in sandboxes. Third-party served custom domains must also update their target host name. _(Domains)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Experience Delivery (Beta) for LWR Sites Is Discontinued** — retirement. The Experience Delivery infrastructure for LWR sites, a beta feature, is discontinued as of Winter '27 (October 2026). Republish any site still hosted on Experience Delivery so it migrates to standard LWR infrastructure; sites that aren't republished keep working but can degrade over time. _(Experience Cloud)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Get Compiler Warnings for Apex API Versions 9.0 Through 19.0** — retirement. Apex classes and triggers saved at API versions 9.0 through 19.0 will be retired in a future release, and the Apex compiler now warns when you compile or deploy code at those versions (in Setup, Salesforce CLI, VS Code extensions, Web Console, and Tooling API). Update affected classes and triggers to API version 20.0 or later; managed package code at these versions must be fixed by the package developer. This retirement is unrelated to the Salesforce Platform API retirement and does not affect Visualforce, Flow, or Process Builder versions. _(Apex)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Migrate All Connected Apps to External Client Apps (Release Update)** — release_update. Salesforce is ending support and bug fixes for connected apps in Summer '27, requiring migration of integrations to external client apps. _(Security & Identity)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Migrate to the Data 360 Engagement Timeline** — retirement. The Data Cloud Profile Engagements widget has reached end of life and is replaced by the Data 360 Engagement Timeline, a Lightning App Builder component that shows engagement data in chronological order on Account, Contact, Lead, Person Account, and Prospect records and can surface up to 10 engagement types. Rebuild affected record pages on the new component: configuring it needs Data 360 access plus the Customize Application permission, and viewers need a Data 360 license, access to the configured data space, and explicit object-level access to each engagement object (control-by-parent is not supported). _(Data 360)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_c360_truth.htm&release=264&type=5
- **Optimize Performance for Revenue Management (Release Update)** — release_update. This Release Update optimizes the Configuration API to reduce configuration processing times when using Product Configurator. It's available starting in Winter '27; enable the test run in a sandbox to confirm the optimizations work with your setup before enforcement. _(Revenue Management)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_release_updates.htm&release=264&type=5

## Version-gated behavior (API v68.0+)

- **Apex: New and Changed Items in API Version 68.0** — feature. API version 68.0 adds and changes Apex classes, enums, interfaces, and Connect in Apex (ConnectApi) classes, including a new SF_Archive namespace with methods for testing Apex against archived data without live callouts. Review the Apex New and Changed Items list before compiling code at API 68.0. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **API: New and Changed Items in API Version 68.0** — feature. API version 68.0 adds new and changed standard objects, Metadata API types, and Tooling API objects. Notable additions: a FlowSettings field to control the Enable the Automation Lightning App preference via Metadata API, admin control over guest user access to GraphQL API, running a flow explicitly in user context, and accessing related Data Model Object records in a Record Query Flow. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Build and Use Richer Development Tools with the Apex Symbol API (Beta)** — feature. The Apex Symbol API (beta), a Tooling API REST resource at /tooling/symbols, returns detailed type metadata for built-in, custom, and dynamic Apex types (classes, interfaces, methods, triggers) using the same type information the Apex compiler uses. It is meant to power IDE code completion and to give AI agents accurate context when generating Apex. The endpoint requires a category parameter (builtin, database, or dynamic), supports optional namespace and name filters, and allows only one concurrent caller per org. Available in API version 68.0 and later. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Compare Values Between Fields in SOQL (Beta)** — feature. A new FORMULA() function lets a SOQL WHERE clause do arithmetic and compare values between fields directly, without a formula field or post-processing. Beta, available only in sandbox, Developer Edition, and scratch orgs in API version 68.0 and later; not available in production. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enable ICU Locale Formats (Release Update)** — release_update. This Release Update replaces JDK locale formats with ICU locale formats for dates, times, currencies, addresses, names, numbers, and week start. It has been available since Winter '20 and is not enforced in Winter '27, but orgs still on JDK are encouraged to switch manually. To use ICU formats in customizations, all Apex classes, Apex triggers, and Visualforce pages must be on API version 45.0 or later; en_CA requires separate activation in User Interface settings. _(Globalization · applies from API v45)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enforce User Permissions No Matter How a Flow Runs** — feature. A new run context, User Context - Enforces User Permissions, guarantees that a screen flow or autolaunched flow always executes with the running user's access level even when it is invoked by Apex, another flow, or automation running in system context. Previously a user-context flow could inherit elevated permissions from a system-context caller. This option applies only to flows running on API version 68.0 or later and is set under Show Advanced > How to Run the Flow. _(Flow Builder · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Filter Test Discovery API Results with the testLevel Parameter** — feature. The Test Discovery API (GET /tooling/tests) gains a testLevel query parameter that replaces the deprecated showAllMethods parameter in API version 68.0 and later; showAllMethods still works in 67.0 and earlier. testLevel accepts RunAllTestsInOrg (default) or RunLocalTests (org namespace plus flow tests, excluding installed managed packages), aligning with the Test Runner API request body. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Flow and Process Run-Time Changes in API Version 68.0** — feature. Winter '27 introduces run-time behavior changes that apply only to flows and processes configured to run on API version 68.0 or later, delivered as versioned updates you adopt per flow. Set a flow's run version in Flow Builder version properties, or a process's in Process Builder properties, so you can test and roll out behavior changes on your own schedule rather than all at once. When an agent generates a flow against the Winter '27 API version, it should account for the 68.0 run-time semantics, including the new User Context enforcement option. _(Flow Runtime · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Get the Latest LWC Changes with LWC API Version 68.0** — feature. Set apiVersion 68.0 in a component's .js-meta.xml to pick up the latest LWC framework features and fixes; components on API 58.0 or earlier stay on Summer '23 framework behavior. LWC API 68.0 itself has no version-specific behavior changes, making it a low-risk version to bump existing components to. Upgrade one API version at a time, fixing warnings between steps. _(Lightning Components · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Move Agents Between Orgs More Easily with Simplified Agent Metadata Types** — feature. From API version 68.0, Agentforce agents are represented by two metadata types, AiAgentDefinition and AiAgentDefinitionVersion, and Salesforce CLI retrieves an agent with all its dependent Apex classes, flows, and prompt templates automatically. Previously a sandbox-to-production move needed at least three metadata types and manual assembly of every related component at the right agent version. Both orgs must be on API 68.0 to use the new types; while production is still on Summer '26, keep using AiAuthoringBundle, Bot, and BotVersion by pinning API 67.0 in the manifest. _(Agentforce Development · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&release=264&type=5
- **Process Data 360 Data Model Objects with Apex Cursors (Beta)** — feature. Apex cursors now work with Data 360 data model objects (DMOs): create one with Database.getCursor() against a DMO SOQL query, page through results with Cursor.fetch(position, size), and get the total with Cursor.getNumRecords(). Cursors expire 24 hours after creation and throw System.InvalidQueryLocatorException if they expire mid-run; SOQL against DMOs consumes Data Services credits, and Data 360 cursor rows, cursor instances, and Flex Credit limits are exposed on the Limits class. Available in API version 68.0 and later. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Reduce Overhead by Recompiling Only Invalid Apex Classes and Triggers** — feature. Salesforce can now return compilation results for only the Apex classes and triggers with validation errors instead of recompiling the whole org, via the new Tooling API endpoint /tooling/apexCompileResults (POST an empty body) or the 'Compile only invalid classes/triggers' buttons in Setup. Available in API version 68.0 and later. Note: a successful targeted recompile does not flip the affected metadata's isValid field to true. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Salesforce Platform API Versions 31.0 Through 40.0 Are Being Retired** — retirement. Bulk API, SOAP API, REST API, and every REST API under /services/data/vXX.X/ (Connect REST API, Metadata API, Tooling API, Place Order, Reports and Dashboards, and more) at versions 31.0 through 40.0 are being deprecated in Summer '27 and retired in Summer '28. After deprecation these versions get no security or bug fixes; after retirement calls to them fail. Move all integrations to API version 41.0 or later. _(API · applies from API v41)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Streaming API Replay Tightening** — feature. Starting in API version 68.0, the Streaming API server returns a per-channel replay watermark in ext.replay on every successful /meta/connect response, so clients can advance their replay ID on resubscription without waiting for events to be redelivered, speeding up resync. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Streamline Flow Integrations with External Services Support for Any Type** — feature. An external service can now be created from an OpenAPI schema that uses an empty schema object (any shape), so calling it from a Flow needs no Apex class and no Transform element: Flow serializes the record variable to JSON and sends it straight to the endpoint, and flows keep working when the data schema changes. You can mix typed query/path/header parameters with an any-type body. Requires Data 360 provisioned and API version 68.0 or later; the external API must handle its own validation. _(External Services · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Update Existing Flow Approval Processes to Run Background Steps Synchronously When Actions Support It** — feature. Background steps that call synchronous actions now run synchronously instead of always asynchronously, cutting end-to-end latency in flow approval processes. To get the behavior in an existing flow approval process, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier API versions keep the previous asynchronous behavior. _(Flow Approval Processes · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Update Existing Orchestrations to Run Background Steps Synchronously When Actions Support It** — feature. Orchestration background steps that call synchronous actions now run synchronously rather than always asynchronously, reducing end-to-end latency. To adopt it in an existing orchestration, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier versions keep the asynchronous behavior. _(Flow Orchestration · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5

## Admin & configuration

- **Work Summaries for Case (Beta) Is Being Retired** — retirement. Work Summaries for Case (beta) is in maintenance mode and is removed on September 30, 2026, after which Case Summaries are unavailable. Transition to Enhanced Summaries, which offers role-specific summaries and more features. _(AI Solutions for Service · deadline 2026-09-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_service.htm&release=264&type=5
- **Gemini 2.5 Model Request Rerouting to Gemini 3.5** — feature. Gemini 2.5 Pro, Flash, and Flash-Lite requests will be rerouted to Gemini 3.5 Pro, Flash, and Flash-Lite starting October 20, 2026. Prompts and applications should be tested early as expected responses may change. _(Agentforce & Generative AI · deadline 2026-10-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&language=en_US&release=264&type=5
- **Legacy Snowflake Data Share Target Retirement — Migrate to Snowflake Zero-Copy V2** — retirement. Data 360 no longer lets you create a legacy Snowflake data share target, and existing data shares that use one must move to a Snowflake V2 data share target by October 31, 2026. The V2 zero-copy connector authenticates with OIDC instead of username/password OAuth and supports acting on change data with Snowflake streams and tasks. Create and link a V2 target, confirm data shares work against it, then unlink the legacy target so downstream pipelines and dashboards keep receiving data. _(Data 360 · deadline 2026-10-31)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_c360_truth.htm&release=264&type=5
- **Restrict the OAuth 2.0 Device Flow to Local External Client Apps** — release_update. Salesforce is restricting the OAuth 2.0 device flow to local external client apps with a localhost callback URL, requiring connected apps to migrate. _(Security / Identity · deadline 2026-11-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Maintain Your Email Verification Exception** — release_update. Organizations that previously disabled user email verifications via Support must configure authorized email domain settings to preserve user email sending capabilities. _(Email Integration · deadline 2026-12-01)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Standard Volume Platform Events End of Life** — retirement. Standard volume platform events are retired on December 15, 2026. Before then, stop all publishing and let subscribers (triggers and flows) finish, then use the migration button on Setup > Platform Events to convert all standard volume platform events to high volume platform events. Each event takes roughly 15 minutes (up to 24 hours in rare cases); during migration publishes fail and you cannot create new triggers or flows. _(Enterprise Messaging · deadline 2026-12-15)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enable ICU Locale Formats (Release Update)** — release_update. This Release Update replaces JDK locale formats with ICU locale formats for dates, times, currencies, addresses, names, numbers, and week start. It has been available since Winter '20 and is not enforced in Winter '27, but orgs still on JDK are encouraged to switch manually. To use ICU formats in customizations, all Apex classes, Apex triggers, and Visualforce pages must be on API version 45.0 or later; en_CA requires separate activation in User Interface settings. _(Globalization · applies from API v45)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enforce User Permissions No Matter How a Flow Runs** — feature. A new run context, User Context - Enforces User Permissions, guarantees that a screen flow or autolaunched flow always executes with the running user's access level even when it is invoked by Apex, another flow, or automation running in system context. Previously a user-context flow could inherit elevated permissions from a system-context caller. This option applies only to flows running on API version 68.0 or later and is set under Show Advanced > How to Run the Flow. _(Flow Builder · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Flow and Process Run-Time Changes in API Version 68.0** — feature. Winter '27 introduces run-time behavior changes that apply only to flows and processes configured to run on API version 68.0 or later, delivered as versioned updates you adopt per flow. Set a flow's run version in Flow Builder version properties, or a process's in Process Builder properties, so you can test and roll out behavior changes on your own schedule rather than all at once. When an agent generates a flow against the Winter '27 API version, it should account for the 68.0 run-time semantics, including the new User Context enforcement option. _(Flow Runtime · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Move Agents Between Orgs More Easily with Simplified Agent Metadata Types** — feature. From API version 68.0, Agentforce agents are represented by two metadata types, AiAgentDefinition and AiAgentDefinitionVersion, and Salesforce CLI retrieves an agent with all its dependent Apex classes, flows, and prompt templates automatically. Previously a sandbox-to-production move needed at least three metadata types and manual assembly of every related component at the right agent version. Both orgs must be on API 68.0 to use the new types; while production is still on Summer '26, keep using AiAuthoringBundle, Bot, and BotVersion by pinning API 67.0 in the manifest. _(Agentforce Development · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&release=264&type=5
- **Salesforce Platform API Versions 31.0 Through 40.0 Are Being Retired** — retirement. Bulk API, SOAP API, REST API, and every REST API under /services/data/vXX.X/ (Connect REST API, Metadata API, Tooling API, Place Order, Reports and Dashboards, and more) at versions 31.0 through 40.0 are being deprecated in Summer '27 and retired in Summer '28. After deprecation these versions get no security or bug fixes; after retirement calls to them fail. Move all integrations to API version 41.0 or later. _(API · applies from API v41)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Streamline Flow Integrations with External Services Support for Any Type** — feature. An external service can now be created from an OpenAPI schema that uses an empty schema object (any shape), so calling it from a Flow needs no Apex class and no Transform element: Flow serializes the record variable to JSON and sends it straight to the endpoint, and flows keep working when the data schema changes. You can mix typed query/path/header parameters with an any-type body. Requires Data 360 provisioned and API version 68.0 or later; the external API must handle its own validation. _(External Services · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Update Existing Flow Approval Processes to Run Background Steps Synchronously When Actions Support It** — feature. Background steps that call synchronous actions now run synchronously instead of always asynchronously, cutting end-to-end latency in flow approval processes. To get the behavior in an existing flow approval process, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier API versions keep the previous asynchronous behavior. _(Flow Approval Processes · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Update Existing Orchestrations to Run Background Steps Synchronously When Actions Support It** — feature. Orchestration background steps that call synchronous actions now run synchronously rather than always asynchronously, reducing end-to-end latency. To adopt it in an existing orchestration, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier versions keep the asynchronous behavior. _(Flow Orchestration · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Add the Follow Button to the Dynamic Highlights Panel** — feature. You can now expose the standard Follow button on a Dynamic Highlights Panel from Lightning App Builder so users can subscribe to updates on key records; the button is hidden by default and controlled by the 'Hide Follow/Unfollow button' property. _(Lightning App Builder)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Advisements (Beta)** — feature. Delivers org-specific implementation recommendations and step-by-step guidance directly to admins with automated completion tracking. _(Org Health)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_general.htm&language=en_US&release=264&type=5
- **API Catalog and MCP Server Integration** — feature. API Catalog allows centralizing services like APIs and MCP servers from MuleSoft, Heroku, and Apex to activate for Agentforce agents, flows, and external MCP clients. _(API Catalog)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Assign Use Any API Auth Permission for SOAP login()** — release_update. To authenticate with the SOAP API login() operation, users must be assigned the Use Any API Auth user permission, or authentication will fail. _(Security / API)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Automation for Customer 360 Apps and Industries** — feature. Automate end-to-end cross-departmental and industry-specific workflows across sales, service, marketing, commerce, and revenue teams. _(Automation for Customer 360 Apps and Industries)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&language=en_US&release=264&type=5
- **Backup and Recover Next Improvements** — feature. Locate and recover backup data with granular control, search backup history for specific records, download metadata, and reload child objects that fail during preview restore. _(Backup and Recover Next)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Block Apex Anonymous Code Execution from Managed Packages** — release_update. A release update prevents anonymous Apex code execution coming from managed packages. _(Apex)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Build Flows Faster with Auto-Generated Element Labels** — feature. Flow Builder auto-generates element labels from the properties you configure and keeps them updated as you build, while preserving any label you edit manually. This behavior is on by default when you open Flow Builder and requires an Agentforce license. _(Flow Builder)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Call Decision Tables from Omniscripts** — feature. An Omniscript or Integration Procedure can call an activated decision table directly through a Decision Table action, without Apex controllers or workarounds. Map incoming JSON to the table's inputs with Omnistudio merge-field syntax; results merge back into the JSON. Available where Business Rules Engine is enabled. _(Business Rules Engine)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Catch Field Length Violations When You Save a Flow** — feature. Flow Builder now warns at save time when an Assignment element sets a record field to a fixed text value longer than the field's maximum length, naming the field and value so you can fix it before a run-time failure. The check covers only Assignment elements with fixed text values, not variable references. _(Flow Error Handling)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Catch Missing Required Fields When You Save a Flow** — feature. Flow Builder now warns at save time when a Create Records element that uses a record variable is missing an assignment for a required field, instead of surfacing the problem only at run time. The check runs only for values it can determine at design time, not values supplied by input variables or subflows. _(Flow Error Handling)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Catch More Org Risks with an Expanded Advisements Library and In-App Notifications (Beta)** — feature. Advisements (beta) now checks for up to 21 implementation risks, up from 14, adding detection for Content Security Policy violations, outdated Salesforce API versions, and unused Data Detect scans. Admins are alerted in the notification tray when an advisement is generated, completed, or needs attention, rather than checking for recommendations manually. _(Advisements (Beta))_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Check Partner Calendar Availability Before Booking** — feature. Salesforce Scheduler now reads a partner user's connected external calendar for busy and free time, so self-service booking flows only offer slots when the partner is genuinely available. Previously, partner users managed availability in personal tools and meetings booked outside Salesforce could cause double-bookings. _(Salesforce Scheduler)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_overall.htm&release=264&type=5
- **Classify and Discover Flows with Flow Tags** — feature. Flow Tags add a structured classification layer to the flow list: create tags and tag groups in the Automation App's Tags tab, then assign tags per flow or in bulk and filter the Flows list by one or more tags. You can also set tags from the Save As modal in Flow Builder. _(Flow Management)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Clean up Flows Faster with the Unused Resources Filter** — feature. A new Unused filter in the Flow Builder Toolbox narrows the resource list to items with no recorded usage, making it faster to spot and delete leftover resources in large flows. Available only in auto-layout; the filter clears when you close Flow Builder. _(Flow Builder)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Compare Versions of Data 360 and Agentforce Marketing Flows** — feature. Flow Version Comparison now supports Data 360-triggered flows and Agentforce Marketing flow types (segment-triggered, automation event-triggered, and API event-triggered), works across all audience sources in segment-triggered flows, and shows changes in both table and canvas views. _(Flow Builder)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5

## Development

- **Gemini 2.5 Model Request Rerouting to Gemini 3.5** — feature. Gemini 2.5 Pro, Flash, and Flash-Lite requests will be rerouted to Gemini 3.5 Pro, Flash, and Flash-Lite starting October 20, 2026. Prompts and applications should be tested early as expected responses may change. _(Agentforce & Generative AI · deadline 2026-10-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&language=en_US&release=264&type=5
- **Legacy Snowflake Data Share Target Retirement — Migrate to Snowflake Zero-Copy V2** — retirement. Data 360 no longer lets you create a legacy Snowflake data share target, and existing data shares that use one must move to a Snowflake V2 data share target by October 31, 2026. The V2 zero-copy connector authenticates with OIDC instead of username/password OAuth and supports acting on change data with Snowflake streams and tasks. Create and link a V2 target, confirm data shares work against it, then unlink the legacy target so downstream pipelines and dashboards keep receiving data. _(Data 360 · deadline 2026-10-31)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_c360_truth.htm&release=264&type=5
- **Restrict the OAuth 2.0 Device Flow to Local External Client Apps** — release_update. Salesforce is restricting the OAuth 2.0 device flow to local external client apps with a localhost callback URL, requiring connected apps to migrate. _(Security / Identity · deadline 2026-11-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Standard Volume Platform Events End of Life** — retirement. Standard volume platform events are retired on December 15, 2026. Before then, stop all publishing and let subscribers (triggers and flows) finish, then use the migration button on Setup > Platform Events to convert all standard volume platform events to high volume platform events. Each event takes roughly 15 minutes (up to 24 hours in rare cases); during migration publishes fail and you cannot create new triggers or flows. _(Enterprise Messaging · deadline 2026-12-15)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)** — retirement. Retires the OAuth user-agent and hybrid user-agent flows, requiring integrations to migrate to the OAuth web-server flow or hybrid web-server flow with PKCE. _(Security & Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Retirement of OAuth 2.0 Username-Password Flow for Connected Apps** — retirement. Salesforce is ending support for the OAuth 2.0 username-password flow for connected apps, breaking integrations that rely on this authentication method. _(Security / Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Apex: New and Changed Items in API Version 68.0** — feature. API version 68.0 adds and changes Apex classes, enums, interfaces, and Connect in Apex (ConnectApi) classes, including a new SF_Archive namespace with methods for testing Apex against archived data without live callouts. Review the Apex New and Changed Items list before compiling code at API 68.0. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **API: New and Changed Items in API Version 68.0** — feature. API version 68.0 adds new and changed standard objects, Metadata API types, and Tooling API objects. Notable additions: a FlowSettings field to control the Enable the Automation Lightning App preference via Metadata API, admin control over guest user access to GraphQL API, running a flow explicitly in user context, and accessing related Data Model Object records in a Record Query Flow. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Build and Use Richer Development Tools with the Apex Symbol API (Beta)** — feature. The Apex Symbol API (beta), a Tooling API REST resource at /tooling/symbols, returns detailed type metadata for built-in, custom, and dynamic Apex types (classes, interfaces, methods, triggers) using the same type information the Apex compiler uses. It is meant to power IDE code completion and to give AI agents accurate context when generating Apex. The endpoint requires a category parameter (builtin, database, or dynamic), supports optional namespace and name filters, and allows only one concurrent caller per org. Available in API version 68.0 and later. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Compare Values Between Fields in SOQL (Beta)** — feature. A new FORMULA() function lets a SOQL WHERE clause do arithmetic and compare values between fields directly, without a formula field or post-processing. Beta, available only in sandbox, Developer Edition, and scratch orgs in API version 68.0 and later; not available in production. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enable ICU Locale Formats (Release Update)** — release_update. This Release Update replaces JDK locale formats with ICU locale formats for dates, times, currencies, addresses, names, numbers, and week start. It has been available since Winter '20 and is not enforced in Winter '27, but orgs still on JDK are encouraged to switch manually. To use ICU formats in customizations, all Apex classes, Apex triggers, and Visualforce pages must be on API version 45.0 or later; en_CA requires separate activation in User Interface settings. _(Globalization · applies from API v45)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Enforce User Permissions No Matter How a Flow Runs** — feature. A new run context, User Context - Enforces User Permissions, guarantees that a screen flow or autolaunched flow always executes with the running user's access level even when it is invoked by Apex, another flow, or automation running in system context. Previously a user-context flow could inherit elevated permissions from a system-context caller. This option applies only to flows running on API version 68.0 or later and is set under Show Advanced > How to Run the Flow. _(Flow Builder · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Filter Test Discovery API Results with the testLevel Parameter** — feature. The Test Discovery API (GET /tooling/tests) gains a testLevel query parameter that replaces the deprecated showAllMethods parameter in API version 68.0 and later; showAllMethods still works in 67.0 and earlier. testLevel accepts RunAllTestsInOrg (default) or RunLocalTests (org namespace plus flow tests, excluding installed managed packages), aligning with the Test Runner API request body. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Flow and Process Run-Time Changes in API Version 68.0** — feature. Winter '27 introduces run-time behavior changes that apply only to flows and processes configured to run on API version 68.0 or later, delivered as versioned updates you adopt per flow. Set a flow's run version in Flow Builder version properties, or a process's in Process Builder properties, so you can test and roll out behavior changes on your own schedule rather than all at once. When an agent generates a flow against the Winter '27 API version, it should account for the 68.0 run-time semantics, including the new User Context enforcement option. _(Flow Runtime · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Get the Latest LWC Changes with LWC API Version 68.0** — feature. Set apiVersion 68.0 in a component's .js-meta.xml to pick up the latest LWC framework features and fixes; components on API 58.0 or earlier stay on Summer '23 framework behavior. LWC API 68.0 itself has no version-specific behavior changes, making it a low-risk version to bump existing components to. Upgrade one API version at a time, fixing warnings between steps. _(Lightning Components · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Move Agents Between Orgs More Easily with Simplified Agent Metadata Types** — feature. From API version 68.0, Agentforce agents are represented by two metadata types, AiAgentDefinition and AiAgentDefinitionVersion, and Salesforce CLI retrieves an agent with all its dependent Apex classes, flows, and prompt templates automatically. Previously a sandbox-to-production move needed at least three metadata types and manual assembly of every related component at the right agent version. Both orgs must be on API 68.0 to use the new types; while production is still on Summer '26, keep using AiAuthoringBundle, Bot, and BotVersion by pinning API 67.0 in the manifest. _(Agentforce Development · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein.htm&release=264&type=5
- **Process Data 360 Data Model Objects with Apex Cursors (Beta)** — feature. Apex cursors now work with Data 360 data model objects (DMOs): create one with Database.getCursor() against a DMO SOQL query, page through results with Cursor.fetch(position, size), and get the total with Cursor.getNumRecords(). Cursors expire 24 hours after creation and throw System.InvalidQueryLocatorException if they expire mid-run; SOQL against DMOs consumes Data Services credits, and Data 360 cursor rows, cursor instances, and Flex Credit limits are exposed on the Limits class. Available in API version 68.0 and later. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Reduce Overhead by Recompiling Only Invalid Apex Classes and Triggers** — feature. Salesforce can now return compilation results for only the Apex classes and triggers with validation errors instead of recompiling the whole org, via the new Tooling API endpoint /tooling/apexCompileResults (POST an empty body) or the 'Compile only invalid classes/triggers' buttons in Setup. Available in API version 68.0 and later. Note: a successful targeted recompile does not flip the affected metadata's isValid field to true. _(Apex · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Salesforce Platform API Versions 31.0 Through 40.0 Are Being Retired** — retirement. Bulk API, SOAP API, REST API, and every REST API under /services/data/vXX.X/ (Connect REST API, Metadata API, Tooling API, Place Order, Reports and Dashboards, and more) at versions 31.0 through 40.0 are being deprecated in Summer '27 and retired in Summer '28. After deprecation these versions get no security or bug fixes; after retirement calls to them fail. Move all integrations to API version 41.0 or later. _(API · applies from API v41)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Streaming API Replay Tightening** — feature. Starting in API version 68.0, the Streaming API server returns a per-channel replay watermark in ext.replay on every successful /meta/connect response, so clients can advance their replay ID on resubscription without waiting for events to be redelivered, speeding up resync. _(API · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Streamline Flow Integrations with External Services Support for Any Type** — feature. An external service can now be created from an OpenAPI schema that uses an empty schema object (any shape), so calling it from a Flow needs no Apex class and no Transform element: Flow serializes the record variable to JSON and sends it straight to the endpoint, and flows keep working when the data schema changes. You can mix typed query/path/header parameters with an any-type body. Requires Data 360 provisioned and API version 68.0 or later; the external API must handle its own validation. _(External Services · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Update Existing Flow Approval Processes to Run Background Steps Synchronously When Actions Support It** — feature. Background steps that call synchronous actions now run synchronously instead of always asynchronously, cutting end-to-end latency in flow approval processes. To get the behavior in an existing flow approval process, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier API versions keep the previous asynchronous behavior. _(Flow Approval Processes · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Update Existing Orchestrations to Run Background Steps Synchronously When Actions Support It** — feature. Orchestration background steps that call synchronous actions now run synchronously rather than always asynchronously, reducing end-to-end latency. To adopt it in an existing orchestration, set its run-time API version to 68.0 or later in Flow Builder version properties; earlier versions keep the asynchronous behavior. _(Flow Orchestration · applies from API v68)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&release=264&type=5
- **Accelerate Lightning Development with LWC Skills** — feature. A set of LWC development skills covering accessibility, data, design, dev, docs, migration, testing, and security is published in the forcedotcom/sf-skills GitHub repo and works with AI tools that support agent skills, including Agentforce Vibes and Claude Code; each skill auto-activates when a task matches. Examples: experience-lwc-generate, experience-lwc-design-generate, experience-aura-lwc-migrate, experience-lwc-accessibility-validate, experience-lwc-security-validate, experience-lds-graphql-generate. Available since the week of August 17, 2026. _(Lightning Components)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Accelerate Lightning Development with SLDS AI Skills** — feature. Three SLDS AI skills, available through the forcedotcom/sf-skills GitHub repo for tools that support agent skills (including Agentforce Vibes and Claude Code), help apply SLDS 2 code (design-systems-slds-apply), validate compliance (design-systems-slds-validate), and migrate SLDS 1 to SLDS 2 (design-systems-slds2-migrate). They activate automatically when you work on LWC or SLDS code. _(Salesforce Lightning Design System)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **Agentforce DX** — feature. Agentforce DX brings pro-code tools for creating, previewing, and testing agents directly in a Salesforce DX project using Salesforce CLI agent commands and VS Code. Updates ship on the weekly Salesforce CLI release cadence. _(Platform Development Tools)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5
- **API Catalog and MCP Server Integration** — feature. API Catalog allows centralizing services like APIs and MCP servers from MuleSoft, Heroku, and Apex to activate for Agentforce agents, flows, and external MCP clients. _(API Catalog)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Assign Use Any API Auth Permission for SOAP login()** — release_update. To authenticate with the SOAP API login() operation, users must be assigned the Use Any API Auth user permission, or authentication will fail. _(Security / API)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Automation for Customer 360 Apps and Industries** — feature. Automate end-to-end cross-departmental and industry-specific workflows across sales, service, marketing, commerce, and revenue teams. _(Automation for Customer 360 Apps and Industries)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_automate.htm&language=en_US&release=264&type=5
- **Avoid Workflow Disruptions by Enabling Elastic Limits for Batch Jobs (Beta)** — feature. Elastic limits (beta) now extend to Batch Apex, alongside future methods and Queueable jobs, so an org exceeding its rolling 24-hour asynchronous job limit can keep enqueuing up to a higher elastic limit; past the standard limit the system throttles in-flight Batch job processing and caps new Batch jobs at one active job. A production org's elastic headroom is now capped at its licensed async limit or 2 million jobs, whichever is lower (was 10 million). Turn on 'Use elastic limits for asynchronous Apex jobs (beta)' in Apex Settings and check usage with the OrgLimits class. _(Apex)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&release=264&type=5

## Security & identity

- **Restrict the OAuth 2.0 Device Flow to Local External Client Apps** — release_update. Salesforce is restricting the OAuth 2.0 device flow to local external client apps with a localhost callback URL, requiring connected apps to migrate. _(Security / Identity · deadline 2026-11-30)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)** — retirement. Retires the OAuth user-agent and hybrid user-agent flows, requiring integrations to migrate to the OAuth web-server flow or hybrid web-server flow with PKCE. _(Security & Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Retirement of OAuth 2.0 Username-Password Flow for Connected Apps** — retirement. Salesforce is ending support for the OAuth 2.0 username-password flow for connected apps, breaking integrations that rely on this authentication method. _(Security / Identity · deadline 2027-02-20)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Assign Use Any API Auth Permission for SOAP login()** — release_update. To authenticate with the SOAP API login() operation, users must be assigned the Use Any API Auth user permission, or authentication will fail. _(Security / API)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Backup and Recover Next Improvements** — feature. Locate and recover backup data with granular control, search backup history for specific records, download metadata, and reload child objects that fail during preview restore. _(Backup and Recover Next)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Create Data Detect Policies More Easily with a Guided Flow** — feature. Data Detect policy creation and editing is now a single guided flow where you enter policy details, select objects individually or in bulk, and define scan criteria on one screen while seeing how filters affect the object list and field counts, instead of creating the policy first and adding objects and criteria in separate steps. Requires the Salesforce Shield or Data Detect license. _(Salesforce Shield)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&release=264&type=5
- **Custom CA Certificate Support for Named Credentials** — feature. Named credentials now support custom Certificate Authority (CA) certificates for outbound authentication. _(Named Credentials)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Data Detect for Data 360 Data Lake Objects** — feature. Data Detect in Salesforce Shield can now scan Data 360 data lake objects (DLOs) and features an improved guided flow for policy creation. _(Salesforce Shield)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Domains Redirections and Host Name Updates** — breaking. Redirections end in sandboxes for instanced URLs in API traffic, and orgs using third-party services for custom domains must update their target host names. _(Domains)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Download Metadata from Backup Snapshot** — feature. You can now download the metadata from a backup as a ZIP file containing an unmanaged package in XML format, and use it with your normal deployment tools to recover deleted or corrupted components instead of rebuilding them by hand. Package metadata can also be retrieved with the Metadata API or Salesforce CLI. In the Backup and Recover Next app, open the Backups tab, select the metadata backup, and click Download ZIP File. _(Backup and Recover Next)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&release=264&type=5
- **Enable Profile Filtering (Release Update)** — release_update. Profile filtering is enabled by default to prevent users from viewing profile names other than their own unless they are assigned the View All Profiles permission. _(Security & Identity)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **End of Instanced URL Redirections in Sandboxes for API Traffic** — breaking. Redirections for instanced URLs in API traffic are ending in sandboxes. Third-party served custom domains must also update their target host name. _(Domains)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Find Specific Records Across Your Backup History** — feature. Backup and Recover Next can now search backup data for records containing a keyword or phrase, narrowed by object, backup date range, and field conditions, and optionally including associated Share, History, and Feed objects. Each result identifies a record version and the backup dates it was found in, so you can locate the exact data to restore. Start from Activities > Search Data, or from a backup's list or details page to prepopulate the scope. _(Backup and Recover Next)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&release=264&type=5
- **Identity and Access Management** — feature. Migrate packaged and distributed connected apps to packaged external client apps to reduce security risks. _(Identity and Access Management)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Interactive Security Health Review in Setup** — feature. Security Health Review replaces the PDF-only format with an interactive report viewer directly in Setup, providing findings management, remediation tracking, disposition workflows, and an audit trail. _(Security Health Review)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Manage Custom Root Certificates and Experience Cloud Trusted URLs** — feature. Organizations can manage their own root certificates instead of relying on a shared global trust store and can add Chrome extensions as trusted URLs/URIs for Experience Cloud sites. _(Security Enhancements)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Manual Share Retention and Sharing Updates** — feature. Optionally retain manual shares when changing record ownership, and review release updates for profile filtering and sharing recalculations. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Manual Share Retention on Ownership Transfer** — feature. Admins and users can choose whether to keep existing manual shares when changing a record's ownership. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Migrate All Connected Apps to External Client Apps (Release Update)** — release_update. Salesforce is ending support and bug fixes for connected apps in Summer '27, requiring migration of integrations to external client apps. _(Security & Identity)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5
- **Migrate Packaged Connected Apps to External Client Apps** — feature. Packaged and distributed connected apps should be migrated to packaged external client apps to reduce security risks. _(Identity and Access Management)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Permissions and Record Ownership Transfer** — feature. Administrators can choose whether to retain manual shares when transferring record ownership, alongside review of profile filtering release updates. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Profile Filtering and Sharing Recalculation Release Updates** — release_update. Release updates turn on profile filtering by default and introduce updated behavior during sharing recalculation. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Profile Filtering Enabled by Default Release Update** — release_update. Turn on profile filtering by default and address changes in sharing recalculation behavior. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Reload Failed Child Objects Before Running a Restore** — feature. When a restore includes child objects and some fail to load during preview, you can now reload just the failed child objects and include them in the restore without restarting the restore activity. Previously, objects that failed to load were dropped from the restore. In the preview restore, select a failed object and click Reload Objects. _(Backup and Recover Next)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&release=264&type=5
- **Retain Manual Shares on Ownership Transfer** — feature. Admins can choose whether to keep manual record shares when transferring record ownership. _(Permissions and Sharing)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_platform.htm&language=en_US&release=264&type=5
- **Sandbox Instanced URL Redirections and Domain Target Updates** — breaking. Redirections end in sandboxes for instanced URLs in API traffic, and target host names must be updated if custom domains are served by a third party. _(Domains)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Trust Store Management and Trusted Chrome Extension URLs** — feature. Add Chrome extensions as trusted URLs/URIs for Experience Cloud sites and manage org root certificates directly instead of relying on a shared global trust store. _(Security, Identity, and Privacy)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Trusted URLs and Root Certificate Management** — feature. Add Chrome extensions as trusted URLs/URIs for Experience Cloud sites, and manage your own root certificates instead of depending on a shared global trust store. _(Security, Identity, and Privacy)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&language=en_US&release=264&type=5
- **Upcoming Security Requirements and Email Default Login Experience** — release_update. Prepares orgs for email becoming the default login experience alongside new security requirements taking effect in Summer 2026. _(Security & Identity)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_general.htm&language=en_US&release=264&type=5
- **Update Instanced URLs in API Traffic** — release_update. API traffic relying on instanced URLs must be updated to use the organization's My Domain login URL to maintain uninterrupted API access. _(API / Security)_
  https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&language=en_US&release=264&type=5

## Workflow

1. Determine the API version of every file you will touch.
2. If it is at or above 68.0, apply this file's rules.
3. Call `get_release_summary` (release `Winter '27`) for live counts and the current needs-action list — this file is a snapshot.
4. Check the `freshness` field on the summary; during the preview window Salesforce revises and pulls items.
5. Cite the `source_url` of any item you act on.

Not affiliated with Salesforce. Summaries are derived; the linked release notes are authoritative.