Salesforce Release Update enforcement calendar
A Release Update is a change Salesforce ships switched off, gives you one or more releases to test, and then enforces automatically on a fixed date. You find them in Setup under Release Updates. Miss the enforcement date and the change lands in production whether or not your Flows, Apex and integrations are ready. This page lists every release update we track, sorted by its enforcement deadline, with a live countdown.
Pending release updates
| Release update | Area | Available since | Enforced in | Status |
|---|---|---|---|---|
| Republish Your Marketing Cloud Next Landing Pages Landing pages published more than six months ago must be republished to move to supported infrastructure. docs | Marketing Cloud Next | Winter '27 | Winter '27 October 2026 in 36 days | Scheduled |
| Restrict the OAuth 2.0 Device Flow to Local External Client Apps The device flow only works for local External Client Apps with a localhost callback; connected apps using it must migrate. docs | OAuth, security | Summer '26 | Winter '27 Nov 30, 2026 in 66 days | Scheduled |
| Maintain Your Email Verification Exception Orgs whose email verification was disabled by Support must configure an authorized email domain; allowlists are removed at enforcement. Replaces the cancelled Adopt Authorized Email Domains update. docs | Email, security | Winter '27 | Winter '27 Dec 1, 2026 in 67 days | Scheduled |
| Assign Use Any API Auth Permission for SOAP login() Users authenticating through SOAP login() must hold the Use Any API Auth permission; enforced across all orgs from December 1, 2026. docs | API, security | Winter '27 | Winter '27 Dec 1, 2026 in 67 days | Scheduled |
| Update Instanced URLs in API Traffic API calls must use the My Domain login URL instead of instance URLs such as na139.salesforce.com. Postponed from Spring '26, Summer '26 and Winter '27. docs | API, My Domain | Summer '25 | Spring '27 Phased: sandboxes Oct 22 and Nov 3, 2026; production Jan 12, Jan 26, Mar 2 and Mar 23, 2027 in 109 days | Postponed |
| Update Apex Code and Flows for Changed Sharing Recalculation Behavior Some sharing recalculations after group or role changes run asynchronously; Apex and Flows that assume share records exist immediately can break. docs | Apex, Flow, sharing | Spring '26 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Remove Non-Public Fields from Custom Object Data in Aura Action Responses Internal system fields are stripped from custom object data returned by Aura server actions. docs | Lightning, Aura | Summer '26 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Enable Accessibility Enhancements for To Do Lists and Lightning Dual Listboxes When Zoom Is Greater Than 200% WCAG 2.2 reflow behavior for to do lists and dual listboxes at high zoom levels. docs | Lightning Experience UI | Summer '26 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Render Visualforce Pages as Accessible (Tagged) PDFs renderAs=pdf switches to the tagged PDF/UA rendering engine. docs | Visualforce | Winter '27 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Salesforce Connect Cross-Org Adapter Legacy Authentication Is Being Retired Password and legacy OAuth authentication for the cross-org adapter depend on SOAP login() and are retired; migrate to named credentials. docs | Salesforce Connect, integration | Winter '27 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Salesforce to Salesforce Is Being Retired Salesforce to Salesforce stops working; could not be enabled since Spring '26 and was unsupported from Summer '26. Replacements: Partner Cloud, Data Cloud One, MuleSoft. docs | Integration, Sales | Spring '26 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| View Setup Audit Trail Permission to Access Setup Audit Trail A dedicated permission gates Setup Audit Trail; it is granted automatically where View Setup and Configuration exists. docs | Permissions | Winter '27 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Conceal Personal Information Fields from Guest Users A new Guest_PersonalInfo_EPIM field set masks personal information for guest users independently of portal users. docs | Experience Cloud, security | Winter '27 | Spring '27 Spring '27 (first production weekend, est. Jan 16, 2027) in 113 days | Scheduled |
| Retirement of OAuth 2.0 Username-Password Flow for Connected Apps grant_type=password stops issuing tokens for connected apps; use the web server or client credentials flow. Already blocked in orgs created since Summer '26. Moved from Winter '27 to February 20, 2027. docs | OAuth, API, security | Spring '26 | Spring '27 Feb 20, 2027 in 148 days | Postponed |
| OAuth User-Agent and Hybrid User-Agent Flows Retirement User-agent and hybrid user-agent flows are retired; move to the web server flow with PKCE. Blocked in orgs created since Winter '27. docs | OAuth, security | Summer '26 | Spring '27 Feb 20, 2027 in 148 days | Scheduled |
| SOAP API login() Call in SOAP API Versions 31.0 Through 64.0 Is Being Retired login() is removed for every SOAP API version; authenticate with OAuth through External Client Apps. A test run is available in Setup. docs | API, authentication | Winter '26 | Summer '27 Summer '27 (first production weekend, est. May 15, 2027) in 232 days | Scheduled |
| Migrate All Connected Apps to External Client Apps Connected apps keep working but lose support and bug fixes; migrate them from App Manager. docs | OAuth, integration | Winter '27 | Summer '27 Summer '27 (first production weekend, est. May 15, 2027) in 232 days | Scheduled |
| Block Apex Anonymous Code Execution from Managed Packages Session IDs obtained inside managed packages can no longer run executeAnonymous; namespaces created since Summer '26 are already blocked. docs | Apex, packaging, security | Summer '26 | Summer '27 Summer '27 (first production weekend, est. May 15, 2027) in 232 days | Scheduled |
| Optimize Performance for Revenue Management The Configuration API is optimized for Product Configurator processing time. docs | Revenue Cloud | Winter '27 | Summer '27 Summer '27 (first production weekend, est. May 15, 2027) in 232 days | Scheduled |
| Switch to a Single Domain Certificate for Your Salesforce Content Delivery Network Moves the Salesforce CDN to a single-domain certificate. docs | CDN, security | Summer '24 | Not scheduled Postponed indefinitely (was Spring '25, then Spring '26) | Postponed |
| Enforcing No-Argument Constructor on Apex Classes Used for Invocable Action Parameters Formerly Enforce Permission Requirements Defined on Built-In Apex Classes Used as Inputs. docs | Apex, Flow | Summer '24 | Not scheduled Enforcement dropped in Spring '26 (was Summer '26); still recommended | Postponed |
| Enable ICU Locale Formats Replaces Oracle JDK locale formats with ICU formats for dates, times, numbers and currencies. docs | Globalization | Winter '20 | Not scheduled No enforcement date announced | Postponed |
Dates are the enforcement dates Salesforce publishes in the release notes. Where Salesforce only names a release, the date shown is the first production weekend of that release; your org may be upgraded on a later weekend, see release dates and the instance lookup.
Already enforced
| Release update | Area | Available since | Enforced in | Status |
|---|---|---|---|---|
| Enable Accessibility Enhancements for Cards, Docked Containers, Menu Lists, and Panels WCAG 2.2 resize and reflow behavior above 200% zoom. docs | Lightning Experience UI | Summer '26 | Winter '27 Winter '27 | Enforced |
| Enable Accessibility Enhancements for Date Pickers, Popovers, Bottom Utility Bars, Record Headers WCAG 2.2 behavior at high zoom for date pickers, popovers, utility bars and record headers. docs | Lightning Experience UI | Winter '26 | Winter '27 Winter '27 (postponed from Summer '26) | Enforced |
| Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200% WCAG 2.2 behavior for page headers and modals. docs | Lightning Experience UI | Summer '25 | Winter '27 Winter '27 (postponed from Spring '26 and Summer '26) | Enforced |
| Enable Profile Filtering Users see only their own profile name unless they hold View All Profiles. docs | Permissions, security | Summer '26 | Winter '27 Winter '27 | Enforced |
| Migrate to a Multiple-Configuration SAML Framework Single-configuration SAML is removed; SSO breaks for orgs that did not migrate. docs | SSO, security | Spring '24 | Summer '26 Summer '26 (postponed from Spring '25 and Spring '26) | Enforced |
| Salesforce-Managed X (Formerly Twitter) Authentication Provider Retirement The Salesforce-managed X app is retired; create a custom X app for the auth provider. docs | Authentication providers | Spring '26 | Summer '26 Summer '26 | Enforced |
| Sort Apex Batch Action Results by Request Order Batch action results are returned in request order instead of errors first. docs | Apex, Flow actions | Spring '25 | Summer '26 Summer '26 | Enforced |
| Use Visualforce PDF Rendering Service with Apex Blob.toPdf() Blob.toPdf() uses the Visualforce PDF renderer, adding fonts and multibyte support. docs | Apex, Visualforce | Spring '26 | Summer '26 Summer '26 | Enforced |
| Escape the Label Attribute of apex:inputField Elements to Prevent Cross-Site Scripting The label attribute of apex:inputField is escaped to block XSS. docs | Visualforce, security | Spring '23 | Spring '26 Spring '26 | Enforced |
| Update References to Legacy Host Names Ends the temporary redirection of legacy, non-enhanced Salesforce host names. docs | My Domain, security | Spring '25 | Spring '26 Spring '26 (auto-enabled in Winter '26) | Enforced |
| Restrict User Access to Run Flows Users need the Run Flows permission or explicit flow access; the legacy behavior that let every user run every flow ends. docs | Flow, security | Winter '24 | Winter '26 Winter '26 (postponed from Winter '25) | Enforced |
Cancelled
| Release update | Area | Available since | Enforced in | Status |
|---|---|---|---|---|
| Adopt Authorized Email Domains | Email, security | Spring '26 | Was Winter '27 Cancelled in Winter '27, replaced by Maintain Your Email Verification Exception | Cancelled |
Test before the deadline. Every release update can be enabled early in a sandbox from Setup > Release Updates. Pair this calendar with the sandbox preview dates so each update gets a full preview cycle before it is enforced.
Frequently asked questions
What is a Salesforce Release Update?
A Release Update is a platform change Salesforce ships switched off so admins can test it before it takes effect. Each one has a release in which it becomes available and an enforcement date after which it is applied automatically. Release Updates live in Setup under Release Updates, with Needs Action, Due Soon and Overdue tabs.
Where do I find Release Updates in Setup?
In Lightning Experience open Setup and search for Release Updates. The page lists every update available to your org with its enforcement date, a Get Started button and, for most updates, a Test Run option to enable it temporarily in a sandbox.
What happens if I miss the enforcement date?
On the enforcement date Salesforce enables the update in every org that has not yet enabled it. Nothing is rolled back and there is no opt-out, so any Flow, Apex, integration or component that depends on the old behavior breaks in production. Test each update in a sandbox during the preview window and enable it early.
Can a Release Update be postponed?
Yes. Salesforce regularly moves enforcement dates by one or more releases when customers report blockers; the OAuth username-password flow retirement and the multiple-configuration SAML update were both postponed. This page marks postponed updates and shows the latest date.
How is a Release Update different from a retirement?
A Release Update changes how an existing feature behaves and is enforced on a date; a retirement removes a product or feature entirely, usually with a replacement. Retirement dates are on the retirements page.
Data: /release-updates/data.json, refreshed with every site build. Something missing or changed? info@sfupdates.com.