What Changed in the Latest Salesforce Release for DevOps Teams

TL;DR: The current live release, Summer '26 (API version 67.0), reshaped Salesforce deployments: DevOps Center is now native with no managed package, a new Metadata Deployment beta resolves component dependencies automatically, and Apex now defaults to user mode. Winter '27 reaches production between September 4 and October 9, 2026, and retires the OAuth username-password flow, so audit your integration auth before then.

If your pipeline still runs on habits from two releases ago, the last few months moved the ground under you. Here is what actually changed, what is arriving next, and what a release manager should do about it this week.

What is the latest Salesforce release for DevOps teams?

Summer '26 is the release currently running in production, having rolled out to instances between May 15 and June 13, 2026, on API version 67.0. Winter '27 is next: its release notes publish on August 19, 2026, sandbox preview opens August 28, and production upgrades run in three waves on September 4, October 2, and October 9. In other words, the release you deploy against today is not the one you will deploy against next month.

How did Summer '26 change deployments and DevOps Center?

The headline for teams is that DevOps Center is now native. There is no managed package to install and version anymore, which removes a whole class of upgrade friction from the tool that tracks your changes and promotes them through stages tied to sandboxes.

Two more changes matter for anyone who deploys metadata:

• Metadata Deployment (Beta) moves components between orgs from the UI, with a DX Inspector that automatically identifies and includes the related dependencies that historically broke deployments.
• An agentic direction. Salesforce introduced a DX MCP server so you can drive DevOps Center from agentic IDEs and command-line tooling, not only the point-and-click UI.

These are genuine improvements, but native and beta are not the same as battle-tested at scale. Teams running dozens of parallel branches, environment-specific config, and profile-heavy releases still need governance, conflict resolution, and audit trails that a first-party tool at beta maturity does not fully cover yet. That gap is exactly why dedicated platforms like Copado, Gearset, and Serpent exist, and if you are weighing native tooling against a purpose-built pipeline, our Copado comparison lays out where each fits.

What Apex and API changes affect release pipelines?

API version 67.0 shipped defaults that can change runtime behavior, so they belong in your regression tests, not a footnote:

• User mode by default. In classes saved at API 67.0 or later, SOQL, SOSL, DML, and Database methods run in user mode instead of system mode, enforcing object permissions and field-level security automatically.
• Sharing default flipped. Also for classes saved at 67.0 or later, an Apex class without an explicit sharing keyword now defaults to with sharing rather than without sharing. Existing classes keep their behavior until your pipeline bumps their API version.
• Security syntax removed. WITH SECURITY_ENFORCED no longer compiles at API 67.0. Any deployment still carrying it fails the build, so replace it with WITH USER_MODE before you bump the version.

On the tooling side, the Salesforce CLI now redacts access tokens and passwords from command output by default, and a Metadata API MCP server entered beta. Looking further out, the SOAP login() call for username and password authentication is scheduled to retire in Summer '27, which is a deadline worth putting on the roadmap now rather than discovering in a failed deploy.

What should DevOps teams do before Winter '27 lands?

The most disruptive Winter '27 change is not a feature, it is a retirement. The OAuth 2.0 username-password flow is going away, and connected apps that still authenticate with a username, password, and security token will stop receiving access tokens on your upgrade date. The failure is silent, so integrations degrade without an obvious error.

A release you did not test is a release you are deploying blind. Sandbox preview is the cheapest place to find out what breaks.

A tight pre-upgrade checklist:

1. Refresh or create your preview sandbox before the cutoff at 5 p.m. PT on August 27, 2026, or you miss the preview instance entirely.
2. Inventory every integration using username-password OAuth and migrate it to JWT or the web server flow.
3. Remember that metadata created on the Winter '27 API version cannot deploy to a production org until that org is upgraded, so keep release testing off your normal deployment path during the preview window.

None of this is optional busywork. Getting ahead of it is the difference between a quiet upgrade weekend and an incident. For the broader picture of where the platform is heading, see our takes on what changed in Summer '26 and the DevOps trends every release manager should watch in 2026. If a release like this is the moment you outgrow change sets and native tooling, a guided migration to a real pipeline is the next step.

FAQ

What is the latest Salesforce release right now?

Summer '26 is the release in production today, on API version 67.0. Winter '27 upgrades production in waves on September 4, October 2, and October 9, 2026.

Is DevOps Center still a managed package?

No. As of Summer '26, DevOps Center is native to the platform with no managed package to install or upgrade.

What is the biggest breaking change for DevOps teams?

Winter '27 retires the OAuth 2.0 username-password flow. Integrations using a username, password, and security token stop receiving tokens after the upgrade, and they fail silently.

Why did my Apex behavior change after Summer '26?

API version 67.0 defaults SOQL, DML, and unspecified-sharing classes to user mode and with sharing, so object and field-level permissions are now enforced where they may not have been before.

When is the Winter '27 sandbox preview?

Sandbox preview opens August 28, 2026. To land on a preview instance, refresh or create the sandbox before 5 p.m. PT on August 27.