November 11, 2026

• Web: 2.0.0
• CLI: 4.0.0
• Cloud: 3.0.0

New features

Org connections

This release introduces the concept of an org connection, which is a workspace-level authenticated connection to a specific Salesforce org (instance URL) with a specific Salesforce username. All interaction with Salesforce (for example, from DevOps operations or data operations) is automatically routed through the appropriate org connection. Each org connection can have one or more authentication sessions, each using different authentication methods, created by different users, and optionally shared with other users in the same workspace. OrgFlow automatically selects the best authentication session to use when connecting to Salesforce. You create and manage org connections under the orgs tab directly underneath your workspace.

Salesforce authentication methods

This release adds support for two new authentication methods for authenticating to Salesforce:

• Browser sign-in uses the OAuth 2.0 Web Server Flow: you sign in to Salesforce in a new browser window, and the connection completes in the OrgFlow tab where you started. OrgFlow uses refresh tokens to keep the authentication session alive without needing further human interaction.
• App credentials uses the OAuth 2.0 Client Credentials Flow: you provision a connected app or external client app (ECA) in your org, enable it for the Client Credentials Flow, assign a run-as user, and give OrgFlow the consumer key and consumer secret for this app. OrgFlow uses these consumer credentials to authenticate without needing human interaction.

Username/password remains supported for existing orgs where the OAuth 2.0 Username/Password Flow is enabled. Salesforce has permanently disabled support for this flow for new orgs, but it will still work for existing orgs and it remains the most convenient way to achieve zero-touch sandbox management.

Support for device code (using the OAuth 2.0 Device Code Flow) has been removed from OrgFlow because Salesforce is restricting this flow to local external client apps (ECAs) starting November 30th 2026, and browser sign-in is a more secure and user-friendly alternative.

Improvements

• Excluding a whole metadata type in the include file (e.g. !unpackaged/~/ContentWorkspace following unpackaged/~) now prevents OrgFlow from listing items of that type in Salesforce, which improves performance, consumes less metadata API calls, and makes it possible to work around metadata types that Salesforce is unable to list by specifically excluding them.
• Web: Salesforce-related lookup data used to drive some parts of the UI (such as sandboxes, sandbox templates, Apex classes and public groups) is no longer periodically refreshed by your browser, which leads to less network traffic, fewer console warnings and generally improved performance.

Fixes

• Fixes an issue where preempted or abandoned job inquiries showed no outcome on the job timeline, and in some cases still offered to be answered.
• Web: Fixes an issue where explanation tooltips stayed open until their link was clicked again, and several of them could be open at the same time. Explanations now close when you click anywhere outside them.
• Fixes an issue where sandbox post-copy class selectors included Apex classes that did not implement the System.SandboxPostCopy interface.
• CLI: Fixes an issue where Apex test results from test runs referenced the ID of the test result rather than the ID of the Apex class, causing each test method to be listed under a separate class heading in CLI output.