Salesforce CLI 2.153.5
Salesforce CLI 2.153.5 adds new sf apex trace commands for managing Apex debug log trace flags in an org. The release stops suggesting the SF_TEMP_SHOW_SECRETS environment variable for viewing redacted secrets and announces its removal on October 28, 2026. Commands such as org display user and org list users now point to the sf org auth show-* commands, and a Linux browser race condition in sf org login web is fixed.
platform teams Teams using SF_TEMP_SHOW_SECRETS in scripts should move to sf org auth show-* before October 28, 2026, when the workaround is removed. The new apex trace commands let pipelines manage trace flags from the CLI.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- ~Salesforce CLI no longer suggests the SF_TEMP_SHOW_SECRETS environment variable as a workaround for viewing redacted secrets, and now announces that this workaround will be removed on October 28, 2026. Commands such as org display user and org list users now point you to the sf org auth show-* commands instead. The SF_TEMP_SHOW_SECRETS=true workaround still works until the removal date, so...changed
- +Manage Apex debug log trace flags in your org with these new apex trace commands:added
- *Logging in with sf org login web on Linux no longer intermittently fails due to a race condition when opening the browser.fixed
3 lines1 added1 changed1 fixedtyped from the source notes
Salesforce CLI 2.151.7
Salesforce CLI 2.151.7 shows deploy notifications in both JSON and human-readable table output, and adds Refresh Token Rotation support so simultaneous commands no longer fail with a token-processing error. It also fixes plugin install, uninstall and update failures on Windows paths with spaces, false-positive diffs for Aura CSS edits, handling of AiAgentDefinitionVersion names containing #, and ENOENT errors on standalone Unix tarball installs.
platform teams Pipelines that run project deploy start now see deploy-level notifications such as ApexApiVersionRetirement in the table output, and connected apps with RTR enabled work without extra flags. Teams using AI agent metadata can deploy and retrieve versioned agent definitions without the earlier delimiter errors.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- +When you run project deploy start, any notification attached to the deployment now appears in both the JSON and the human-readable table output; previously, notifications were included only in the JSON output. Notifications are informational, non-blocking, deploy-level advisories represented by the DeployNotification metadata type—for example, ApexApiVersionRetirement. There's no new flag to...added
- +Salesforce CLI now supports Refresh Token Rotation (RTR). When your connected app has RTR enabled, the CLI persists the server-rotated refresh token and handles concurrent token refreshes safely, so simultaneous commands no longer fail with "Token request is already being processed". No new flags are required; the behavior is automatic.added
- *The plugins install, plugins uninstall, and plugins update commands no longer fail on Windows with a misleading <package> does not exist in the registry error when Node.js is installed at the default path containing a space (such as C:\Program Files\nodejs\node.exe).fixed
- *The project retrieve preview command no longer reports hundreds of unrelated, false-positive metadata diffs after you edit only the CSS resource of an Aura component through the Setup UI or Developer Console. A long-lived process (such as the VS Code Salesforce Extension) holding a stale in-memory source-tracking cache could overwrite the CLI's correctly synced revision data in maxRevision.json.fixed
- *The project deploy start and project retrieve start commands now correctly handle AiAgentDefinitionVersion metadata, which uses # as a version separator in its fullName (such as MyAgent#1). Previously, the # character was incorrectly interpreted as a key delimiter, which caused deploy messages to be unmapped and retrieves to fail.fixed
- *The plugins install, plugins link, and other commands that spawn child processes no longer fail with ENOENT when Salesforce CLI was installed from a standalone tarball on Unix. The fix ensures the CLI uses the bundled Node.js binary rather than searching PATH for a system-level node.fixed
6 lines2 added4 fixedtyped from the source notes