Summer '26 Abridged

The Salesforce Discord Collective Presents:
THE SUMMER 26 RELEASE NOTES - ABRIDGED
Judging by the security releases, “Monthly Releases” was just an excuse for “Massive Shitshow”

CRITICAL STUFF

• Salesforce has fucked your Admin Login Experience, by improving your security so tight that up until a week for now the official guidance was “you’ll need per-device hardware or biometric authentication” before they finally remembered passkeys also work. And if your SSO provider isn’t secure enough according to Salesforce, you’ll get another MFA prompt. Yessir. They’ll also default to email-only logins unless you go to ?login=1…
• Salesforce has fucked your reporting experience (or will, for now), because slightly hindering ShinyHunters is worth alienating most your client base. OH WAIT, NOW IT’S ONLY ON EXPORTS, A FEW DAYS BEFORE ENFORCEMENT ! THANK FUCK FOR ENTERPRISE SOLUTIONS AND THEIR STABLE COMMUNICATION !. Let’s not version the page so people can’t see how bad it almost got :D
• Salesforce has fucked your security protocols by freezing users using non-enterprise VPNs, because if you’re an SMB working at an airport you either pay your yearly EBITDA to get Cisco VPN instead of your peasant NordVPN or you GTFO our cloud software, I guess ? Hey at least there’s a one stop shop for you to read their unupdated documentation
• [DEV] In API V67, Security changes a LOT. USER_MODE becomes standard instead of system mode for all Apex database calls, and changes the SOQL statement from “WITH SECURITY_ENFORCED” to “WITH USER_MODE” because renamings are fun. Classes also respect Sharing by default, which now means that Triggers now never do on the assumption you’ll re-assert those edge-case boundaries explicitly in the class layer. SOAP Login is now tied to a permission and also now handles JWT
• A Release Update Blocks Apex Anonymous Code from Managed Packages. This is a great thing security wise (there was no way to bound what the package could do in your org), but will probably break old packages that aren’t maintained anymore, and also some homebrewed apps that abused this.
• Certificate Changes industry-wide impact continue to impact Salesforce since last release, with more frequent rotations, more frequent validation, separation of authority, etc. At this point if you use Certificates for anything you should review if you’re impacted - check your certs in Salesforce, check your integrations, check the things.
• DKIM/SPF isn’t optional anymore (hasn’t been for a while tbh) and action is required if you use unverified domains(they’ll know) though sandboxes get a workaround.

GENERAL STUFF

• RIP Own Archive Package, and RIP Chatter, start planning migration I guess. Yes it’s not dead dead yet, but I’m generally right about calling SF tech murders. I also seem to remember some Experience Cloud image stuff leveraging Chatter APIs some 10 years ago…
• Profile Filtering means that in Winter 27, users won’t be able to view profile names other than their own unless they’re assigned the View All Profiles permission
• Permissions Management gets great updates with permission dependency display on edit, Sharing list views is now possible without access to manage them all, Field Access can now be viewed across Permission Sets, PSGs, and Profiles on a single screen, and Profile Changes can be tracked if you have Event Monitoring only. Still in Permissions world but different, you can now Choose Whether to Grant Access Using Role Hierarchies for Queues.
• Dashboards can now leverage LWCs to display information (now GA, required Support activation). Sounds powerful. For those of you with corporate branding dashboards also now have brand presets.
• DOUBLE YOUR SUCCESS WITH NOT ONE BUT TWOOOOOOO ROW LEVEL FORMULAS ! … for just the compute power of a third of a bad agent you could get ten, IDK.
• Report exports as Excel now, like CSV exports, support disabling the formulas by wrapping them in quotes
• For Deployments, Flows have fixed their Send Email Template reference
• The new Approval Processes based on Flows can now require unanimous approval from Groups in addition to the already existing “first approver” logic, and approval designers can see Flow dependencies without have access to a full Flow licence allowing split responsibilities betwixt pure automation and approvals.
• You can now create non-preview sandboxes during the Upgrade season without contacting Support
• In Service, you can Monitor how frequently and recently users apply specific email templates, and route work based on original request date, which I feel was already a thing… ?
• The Mobile App can now embed Tableau Next Dashboards, as well as React Apps (which include Agent SDKs). The Home Page can also be admin-customized instead of letting end users do it, and Actionable Notifications are now GA
• Foundations gets Lead Scoring
  which uses Marketing Cloud Next to score based on Rules and Models you set up. Also added via MCNext is Web Traffic Tracking (stored in Data Cloud)
• In Data Cloud, Time Tracking allows following user engagement metrics via the WebSDK. Lots of other updates are interesting if you use it, but this one is more a strategy-changing release, so I’m leaving it here.
• Experience Cloud Files malware scanning goes GA and you can upload up to 10GB to Aura/LWR sites, and the Files glow-up I flagged last release is now landing for real.
• In Field Service, a new Scheduling Console is based on LWCs, with optimization passes covering no-reschedule appointments, nearby appointments, and ways to manage slower vehicles for travel times. Appointment Insights expose which constraint in the rule set blocked the assignment, and is available via API, while Activity Reports surface why a given appointment was dropped from the schedule (spoiler: it’s usually an off-by-one in someone’s working hours).
• Slack “Salesforce channels” now default to ON in new Enterprise/Unlimited orgs, creating a Slack Workspace automatically for some reason. I’m not sure if I hate this or like it.
• I’m still not sure because the wording is weird, but it really looks like most of Scale Center is free now for most customers. Includes Org Overview, LEX Performance, Page Usage Insights, and Apex Auditing with ApexGuru
• Data Mask & Seed is a new Salesforce native app that allows masking sandbox data to avoid emails being sent to real customers or PII being leaked. Honestly a cool product. Seems to be free.
• Worth clocking the pattern this release: Scale Center, Flow Orchestration, Setup-with-Agentforce and Data Mask all quietly going free. That’s not generosity, it’s a loss-leader, as in “make the platform plumbing frictionless so you wander into the Agentforce and Data Cloud turnstiles, where the meter actually runs”.

FLOWS

• You can finally use Formulas as Action input parameters without creating it as a Resource (but still not entry conditions sadge)
• Show Toast surfaces non-blocking notifications across screen transitions, while Open a Page is clearly targeting the NavigateAnywhere custom-action pattern,
• Element changes: DataTable better supports lookups by allowing a display of Record Name instead of Id, and Decision Elements can use more Date options which brings you closer to parity with other places in Salesforce (but isn’t really there yet)
• On the UI side, you can collapse Fault Paths and can group radio buttons, you get new resource pickers for Prompt Instructions and recommendation Strategy elements, you can add images from Static Resources directly from the builder, and you can override styles for more stuff. Also Timeout Path isn’t shown anymore by default for async actions.
• You can now finally set the batch amount for Scheduled Flow, leading I am sure to no admin ever setting the batch size to 1 to compensate for their horrible tens of after-save flows that do SOQL in loops.
• For debugging, there is now a version-comparison tool to check what changed between Flow versions (easily my favourite point of this release) which also supports transform mapping changes, Flows report health per-element on the List View (wow), Screen Flows now show Execution Path even after execution, and Agentforce can help you interpret errors (one use case I genuinely consider value-adding for admins)
• Flow Orchestration is now standard with no usage based entitlements, it was paid before. Details about the function here. This heavily changes how multi-step processes should be built. I’m assuming they did this to try to boost Agentforce adoption.

DEVELOPMENT

• Web Console (Beta) is the probable replacement for Developer Console with pretty much the same functionality I guess, but with the Org Browser added?.
• Salesforce allows devs to subscribe to the Dev channel for Orgs so they can push even more unstable stuff, such as private method updates for LWCs, which shouldn’t change anything, but… yeah
• SOQL WHERE now allows FORMULA() to calculate arithmetic functions. Not the same thing as the Apex Formula thing.
• Salesforce has discovered string templates so your HTTP payloads aren’t as horrible to read.
• External Services, the “API as low code” from Salesforce, supports Enums now as well as 100-MB binary file support
• Shoved into “Agent-stuff” for no reason, the “Named Query API” is a great way to not only expose specific queries to Agents, but also packages, or APIs if you want to decouple maintenance responsibility.
• If you’re using APEX actions in Flows, you can now add a custom Header to your Apex Actions to give context or instructions to users, define Custom Property Editors for individual Apex Action outputs, or create Custom Output parameter types rather than APEX Actions to store the data, which improves builder load performance. While using those, you can do complex data mappings in the Action Input without using a Transform element, which honestly feels weird to me, why wouldn’t I want an explicit transformer that’s class-agnostic ???, and you can set Field Values directly otherwise. Also they removed a useless toggle so if you’re wondering why it’s gone it’s because you were using something that did nothing at all.
• The usual distortion additions and changes if you use Lightning Web Security, including one that’s breaking on data: URI Scheme
• Salesforce implementing Lazyloading for lists (dev preview, will as always break unexpectedly because item 5001 has a null attribute or smth)
• Custom Lightning Types for the SDK seem to be tailored for agent data output and have the worst fucking screenshot to display the concept
• You can now build React apps in Salesforce with what the call “Multi-Framework”. Announced in April, the docs have also been updated
• Local Dev is renamed to “Live Preview” and still allows you to see LWCs locally while you’re developing without having to push to sf, both in browser and in VScode.
• If I’m not reading this wrong, this Chat Transcript Migration which requires changing pipelines, only applies to LiveAgent and Standard Messaging, which are both legacy.
• In “Impactful non-prod stuff”, Integration Tests are Dev Preview and allow you to commit data and see end-to-end results, before removing the generated data with “@TearDown” and Elastic Limits for Async Jobs allows you to exceed daily allocation but with throttled rate of usage.

COMMERCE

• B2CCommerce, ex-DemandWare, new “Agentforce Commerce” or something, has a shitton of updates, signalling a probable “Deeply Connected, Permanently Separate” approach contrary to CPQ. You get integrations with Agentforce Marketing, a better Salesforce Connection with Shopper profile Syncs, better Staging handling with automated Image replication from Staging to Prod, various storefront updates including content blocks if you’re using Next, anomaly detection… so sizable updates that really hint to a product that’s still living for quite a bit.
• B2BCommerce on core, gets a few pricing management updates, some Checkout updates (including multiple carts which is great for big Groups), and a few search updates geared towards better ordering your products for your clients. They also put forward their Connect REST APIs for better headless management, but those mostly all existed before and are quite robust already.

MARKETING

• Marketing Cloud Next, the Data-Cloud-native successor stitched together out of nine-ish marketing acquisitions that you’re assured needs “no migration” while Engagement sits quietly in the SF-tech-murder waiting room, has finally shipped AMPscript. Yes. The scripting language that’s powered Marketing Cloud Engagement since roughly the bronze age is, in 2026, a new feature (let’s not use a new framework). r/salesforce noticed: the running theme over there is that “Next” keeps re-implementing things the old product already did a decade ago, except now metered against consumption-based Data Cloud credits no one can forecast. And that’s the tell behind the whole Agentforce-everything rename wave >> Sales Cloud, Service Cloud and Commerce all getting the prefix: the rebrand is cosmetic, but it quietly walks you onto consumption billing you can neither forecast nor cap. Anyway…
• RCS is suddenly everywhere, and it’s worth asking why now: not a groundswell of user demand, but Apple finally caving and shipping it on the iPhone, which is what gave the carriers’ Universal Profile actual reach. The gap versus plain SMS is the whole story: SMS is a simple, universal pipe (160 characters, no branding, no read receipts, and crucially no analytics flowing back to whoever sent it). RCS is IP-based and rich, as in verified-branded sender, delivery + read receipts, typing dots, carousels… every one of which is really a telemetry-and-ads channel for the vendor, presented as a feature. For actual end users, plain text is still the better deal: it works everywhere and doesn’t quietly report back. Salesforce is bolting RCS onto Marketing Cloud regardless, because more rich = more trackable = more billable.

AGENTFORCE

• You can chat and talk in more languages, but remember that any non-english language is a 50% increase in token cost at minimum, thank heck you can see consumption now
• Voice enabled Agents arrive, I wonder how token expensive those are…
• Factor this into your migration roadmap: you’ll need the new Agent Builder Studio to continue building agents and upgrade the old ones.
• The new Implementation Guide is a great step into AgentScript, the famous pro-code option for your low-code agents.
• Agents can be created from Flow Builder without tool switching when selecting an Agent action from a flow. The advent of the Builder for all things is nigh :)
• Setup with Agentforce (not to be confused with Agent for Setup, now discontinued) is free (for 500 agent actions per month) and can help you manage permissions, because a non-deterministic permissions management tool is what you need.
• In Service World, you can Use Agentforce to meet your SLAs in communication or case updates which doesn’t mean the case will actually advance, just that you met the contractual point of sending an email. I look forward to being a customer on the receiving end of that.
• It seems you can plug Agentforce to Gemini which is great as cross-vendor interoperability is always a positive signal (and almost always gets sunset once the margins stop justifying it)
• Agentforce gets MCP compatibility but I’d still wait until the industry decides if MCP is really the future before investing into it. Use Policies to define which ones which Agent uses or doesn’t.
• Salesforce now hosts MCP servers for your favourite AI tools, some examples here, example of how to setup your own hosted MCP here on github, usages include finding or creating metadata which is just an MDAPI wrapper but eh. As above - I’d be careful about MCP-everything as of yet.
• You can expose AI functionality to Experience Cloud users if you love paying for their licences and their usage costs.
• Observability is better now thanks to custom scorers and analytics meaning you can see if your agent is having a positive impact on public reception as well.

DOGELAND

• :doge: Even SF realized the Agentforce for Flow thing I was dissing for two releases isn’t ready for Prod but hey you can spend an unknown amount of tokens to modify screen flows
• :doge: Salesforce starting work on IPv6 a rough 15 years after it got released… how about them one-month enforcement timelines ?
• :doge: Salesforce Launches Agentforce Operations, or you know, just fuckin buys Regrello in November 2025 and rebrands it with no integration whatsoever yet (twice, it was Agentforce Supply Chain up until today) and then shoves it in the release notes for no fuckin reason

This abridged version was graciously written up by the SF Discord

We have a nice wiki: https://wiki.sfxd.org/

And a LinkedIn page: https://www.linkedin.com/company/sfxd/

Join the ~18000 members in the most active chat-based community around Salesforce these parts of the web at http://join.sfxd.org/