Salesforce Winter '27: Release Updates and Deadlines to Watch

The dates that matter

Most of the risk in Winter '27 comes after the upgrade, on fixed dates. Put these on your calendar.

Newer orgs already work this way. The username-password flow is blocked in orgs created in Summer '26 or later, and the user-agent flows are blocked in orgs created in Winter '27, including new sandboxes and scratch orgs, but not sandboxes refreshed from an existing org.

The five release updates in effect now

Release updates are changes Salesforce announces ahead of time and then switches on for everyone. You find them in Setup, under Release Updates. Salesforce lists five as enforced with Winter '27.

• 1. Enable Profile Filtering. People see only their own profile name unless they have View All Profiles or an admin permission such as Manage Users or Customize Application. Without View All Profiles they also cannot create or edit login flows. What to do: test flows, validation rules, Apex, integrations and installed packages that read another user's profile name, logged in as a standard user rather than an admin. Grant View All Profiles only where it is needed. The setting is in Setup, under User Management Settings.
• 2. The Use Any API Auth permission for SOAP login(). Salesforce lists it as enforced with this release, and its own note says the requirement applies in every org from December 1, 2026. What to do: see the December 1 row above.
• 3, 4 and 5. Three accessibility updates for zoom above 200 percent. They cover page headers and modal windows; date pickers, popovers, bottom utility bars and record headers; and cards, docked containers, menu lists and panels. Page headers now scroll with the page, and modal buttons stay inside the window. What to do: check custom Lightning components, custom CSS and your busiest pages at 200 to 400 percent zoom in a sandbox. Turn on the page headers update first, because the other two depend on it.

Release updates to test now, enforced later.

What admins get

Flow.

• Edit history. A timeline of every save. Restore an earlier save as a new version, or copy it into a new flow. In Enterprise, Performance, Unlimited and Developer editions.
• Screen flows for many records at once. A mass quick action on a list view or related list sends the selected record IDs to a screen flow, in a text collection variable named ids.
• Test mode (beta). One place to debug and test autolaunched and record-triggered flows, with saved test scenarios, assertions, coverage, and mock outputs for actions and subflows. Turn on "Flow Test Mode (Beta)" in Process Automation Settings.
• Filter collections without loops. A new Collection Filter Criteria resource, which Salesforce says runs more than 200 times faster than a loop.
• Simpler decisions. The Decision element can split paths by date or by field value without writing expressions.
• Permissions that always apply. On API version 68.0, screen and autolaunched flows can run in a user context that always enforces the running user's permissions, however the flow is started.
• Warnings at save time for missing required fields and for values longer than a field allows. The flow still saves.
• Performance on the canvas, when "Log occurrences for all flow executions" is on. Not available for screen flows.
• End elements are saved in the flow's metadata. Existing flows pick them up on their next save, so expect differences in source control.

List views and pages.

• Two new User Interface settings, both off by default, make inline editing in list views more flexible. One removes the dependency on the page layout, and one allows inline edits in list views that show more than one record type.
• Dark mode is generally available for orgs on an SLDS 2 theme. Turn it on in Themes and Branding with "Let users enable dark mode". Reports, dashboards, builders and Setup are not tuned for it yet.
• The Follow button can go on the Dynamic Highlights Panel. It is hidden by default.

Reports and dashboards.

• Record previews from Lightning reports (beta), with the setting "Show record previews on Lightning Reports (Beta)". Enterprise edition and up.
• Lightning reports and dashboards can be embedded in Lightning Web Runtime Experience Cloud sites (beta), each with its own setting.

Security and setup.

• Manual shares can be kept when records change owner. It is an org setting in Sharing Settings, off by default.
• Field history tracking for users is generally available, for up to 20 User fields.
• Security Center Essentials, free in all editions, adds seven permission metrics, including Modify All Data, View All Data and Export Reports.
• Every admin can now monitor org health and usage from Setup, including the Health Check score, storage, licenses and release updates.
• Guest access to the GraphQL API is now an admin control in Setup, under API Access Controls. It is off by default in new orgs and in orgs that had not used it since March 2026.

Agentforce. For orgs entitled to it (Enterprise edition and up with Foundations or Agentforce 1), the Agentforce platform is now on by default, turned on gradually since September with no billing change. To turn it off, switch off Einstein on the Einstein Setup page. If your prompt templates use Gemini 2.5 models, Salesforce reroutes them to Gemini 3.5 models on October 20, 2026, so test them now.

What developers get

• API version 68.0. Lightning Web Components have no version-specific changes in 68.0.
• A bigger Apex heap. The limit rises from 6 MB to 10 MB for synchronous Apex and from 12 MB to 25 MB for asynchronous Apex, automatically.
• A "latest" REST API version. /services/data/latest/ always resolves to the newest version. Salesforce's developer blog still advises pinning a version for production integrations.
• Warnings for very old Apex. Classes and triggers on API versions 9.0 through 19.0 now get compiler warnings, because those versions are scheduled for retirement. Move them to 20.0 or later.
• Compare fields in SOQL (beta). FORMULA() in a WHERE clause compares values between fields. Not available in production orgs.
• Third-party web components in LWC are generally available with lwc:external, when Lightning Web Security is on.
• No data: URLs on links when Lightning Web Security is on. Use blob: URLs instead.
• Developer Console is hidden by default and in maintenance mode, and the new Web Console is generally available. You can turn Developer Console back on in Setup, under Web Console.
• Salesforce CLI. org display and org list --json no longer print tokens or passwords, and the SF_TEMP_SHOW_SECRETS workaround ends on October 28, 2026. The CLI now needs Node.js 22 or later.

Developers should also look at four of the release updates above: sharing recalculation, Aura non-public fields, platform event trigger rollback, and anonymous Apex from managed packages.

What is being retired

Common mix-ups in other write-ups

We checked popular Winter '27 summaries against Salesforce's release notes on October 16, 2026. These claims are out of date or wrong.

• Eight release updates enforced with Winter '27. Salesforce's Release Updates page lists five.
• The OAuth username-password flow ending in Winter '27. Salesforce postponed it to February 20, 2027.
• Adopt Authorized Email Domains being enforced. Salesforce canceled that release update. A narrower one, Maintain Your Email Verification Exception, takes effect on December 1, 2026, and only in orgs where Support once turned verification off.
• Instanced URLs failing for every API call in Winter '27. That release update is enforced in Spring '27, in phases. Only sandbox traffic stops with this release.
• Enable ICU Locale Formats being enforced. Salesforce says it is not enforced in Winter '27, though it still recommends it.
• Web Console replacing Developer Console. Developer Console is hidden by default and in maintenance mode, and you can still turn it back on.
• Flow Tags and a redesigned Flow element search. Salesforce took both out of the release notes on September 14, 2026, saying they were not ready.

How DewWow can help

Most of our client work is Salesforce development, and we publish a guide like this for each Salesforce release. For Winter '27 we can:

• list your integrations and check how each one signs in, before the October, December and February dates
• test your flows, Apex and installed packages as standard users, for profile filtering and the sharing changes
• move your connected apps to external client apps
• set up a sandbox test plan, so the next release is a checklist instead of a surprise

Sources: Salesforce's Winter '27 release notes and Release Updates list, and the Salesforce Admins and Salesforce Developers blogs, read on October 16, 2026.

More guides

• Salesforce and MCP: connecting AI assistants safely
• Salesforce to Odoo 20 migration guide
• Odoo vs Salesforce
• All guides