Salesforce CLI 2.128.5

Changes

• !For enhanced security, the minimum (and new default) value of the --length flag of the org generate password CLI command is now 20. If you specify a value less than 20, the command displays a message and uses 20 instead. Starting in Summer '26, the command will fail if you specify a password length less than 20. The maximum value is still 100.security
• +The Lightning Local Dev CLI commands are now just-in-time (JIT). This means that when you update to this Salesforce CLI release and run a lightning dev command, Salesforce CLI checks if the associated plugin-lightning-dev is installed. If it's not, Salesforce CLI automatically installs it and then runs your command. These are the CLI commands included in this plugin:added
• +Specify the version of an agent you want to activate with the new --version flag of agent activate. If you run the command without the --version flag, the command provides a list of agent versions for you to choose from. The value of --version is always a number, corresponding to the vX part of the BotVersion metadata in your project.added
• *The project retrieve start command now correctly retrieves specific versions of the Bot metadata type (BotVersion); previously it would retrieve just the latest version. This example shows how to retrieve version 3 of the Local_Info_Agent Bot:fixed
• *The project deploy start command now works correctly when you use both mechanisms for deleting metadata components at the same time: use a destructive change file (such as --pre-destructive-changes manifest/destructiveChangesPre.xml) and remove a different component from the standard manifest file (such as --manifest manifest/package.xml).fixed