Changelog

Release history for codev and sfp server — what changed in each version.

codev is delivered through sfp server releases. Cloud tenants receive updates automatically. Self-hosted deployments update through the sfp server lifecycle commands. The desktop app updates itself; a release that requires a new desktop build says so in its entry.

August 2026

v52.1.0 — August 6, 2026

• Outbound Release Deployed webhooks now fire for releases run through codev, and every delivery carries the deployed commit SHA and version. A deploy event was previously emitted only by the external build flow, so a release requested and deployed from within codev advanced no release-candidate status and sent no webhook; it now posts the same deployment event on a successful deploy. Each release.deployed payload gains commitSha and version, so a destination subscribed to the event can associate the deploy with its merge commit and label it — reachable in a body template as { "$path": "data.commitSha" } and { "$path": "data.version" }. The change is additive; existing consumers are unchanged.
• GitHub webhook deliveries missed while the server was unavailable are replayed automatically. GitHub attempts each delivery once with no retry, so an event sent during a server update or outage — a push that triggers a build, for example — was lost until an operator redelivered it by hand. The server now asks GitHub for failed deliveries about a minute after start and every ten minutes after, and replays them within a two-hour window, oldest event first, leaving any event that already had a successful attempt untouched. Each replay is claimed through the existing idempotency guard, so it runs at most once across restarts and replicas, and only webhooks pointed at this server's own URL are read or replayed — a customer's own hooks on the same repository are never touched. Set WEBHOOK_REPLAY_DISABLED=true to turn it off. (Self-hosted.)
• sfp server stop, status, logs, and scale accept --base-dir, matching start, init, and update. A deployment rooted somewhere other than ./sfp-server was startable but could not be stopped, and over SSH stop reported success while stopping nothing; it now targets the given base directory and errors when the tenant is not found there rather than exiting cleanly. (Self-hosted.)
• macOS desktop builds are notarized again. Every v52 macOS build since v52.0.0 was rejected by Apple's notary service — a bundled Java library (jna) shipped native libraries signed ad-hoc, which the notary rejects — and Gatekeeper blocked the resulting installs, though the packaging job still reported success. The native libraries inside the bundled jars are now signed with a Developer ID before the app is sealed, and both notarization steps decide on Apple's reported status instead of the command exit code. The fix takes effect in the next desktop build. (Desktop, macOS.)

v52.0.2 — August 6, 2026

• Release candidates on GitHub-tracked projects show their work items. Work-item extraction recognised only the closes/fixes/resolves/refs #N forms and excluded the bare (#N) suffix that a GitHub squash merge writes, so a project whose commits carry only squash-merge references extracted nothing. Extraction now consults a project's declared work-item provider and, for GitHub, additionally recognises the bare #N and (#N) squash-merge reference. The rule is additive only — Jira and Azure DevOps projects, and projects that declare no provider, extract exactly as before. On the run and release views a filter that discarded every non-Jira work item before display is removed, so GitHub and Azure Boards work items now appear, and each work-item link is built for its own tracker rather than a Jira-shaped URL. (Web and desktop.)
• The Request Release dialog's Linked Releases section always renders. It previously appeared only when the candidate had detected work items, so cross-domain release linking was invisible on a candidate with none and appeared to be per-domain only. With no work items the section explains that work items are read from commit messages — a Jira key, a pull request reference, or an Azure Boards item — and links to the work-items documentation; when a candidate has work items but shares none with another domain it says so, which is expected for a change confined to one domain. The guidance is held back while the rolling analysis is still loading, so an in-progress result is not shown as "none detected". (Web and desktop.)
• The Code Analyzer run page's severity panels agree. The summary bar and Issues by Class counted every finding by numeric severity while Issues by Rule read a server summary capped at the ten highest-count rules, so a low-frequency but severe rule — a Critical, or a security finding such as ApexSOQLInjection — was counted in the totals yet dropped from the rule list, and filtering the rule tab by that severity returned nothing. The summary bar, Issues by Class, and Issues by Rule now read from a single severity rollup of the analysis, so the three panels cannot disagree; the rule list carries every rule that fired, ordered most-severe then most-frequent, and the server no longer truncates the rule summary. (Web and desktop.)
• PR Analysis no longer fails when the AI architecture check stalls. The architecture linter's AI turn could consume the entire pr-analyze step and take the run down with it, leaving a red check on the pull request even though the deterministic linters had already finished and published. The AI turn is now bounded — two attempts within a total budget, with a stall guard that abandons a wedged attempt and retries it on a fresh session — and when the budget is exhausted the check degrades to an advisory skipped result, so the other linters' findings still land and a stalled turn no longer reds the check. The architecture.timeout in config/ai-assist.yaml now lowers the per-attempt budget as a mitigation, and the pr-analyze step limit is raised from 30 to 45 minutes.

v52.0.1 — August 5, 2026

• The Jira integration defaults to OAuth Client Credentials. The Integration Type selector lists OAuth Client Credentials first and selected, with a Preferred badge and a one-line reason: it reads work items and writes deployment and build status back to Jira, which drives release status, where Basic Auth is read-only. Basic Auth remains available as the second option. Every integration's View Documentation link is repointed from the retired /flxbl/sfp/integrations/* path, which returned a 404, to the live /codev/integrations/* pages. (Web and desktop.)
• The Code Analyzer run page surfaces each finding's numeric severity. A named Severity column — for example, High (2) — appears on both the Issues by Class and Issues by Rule tabs, alongside a Severity facet filter, per-class severity badges, and a whole-run distribution across Critical, High, Moderate, Low, and Info. A finding whose rule carries no recognised 1–5 severity is shown as Unknown rather than folded into a level, and rules are resolved per analysis run so a result cannot inherit another run's severity. (Web and desktop.)
• Release builds on long-running domains no longer fail on the post-build step with a git authentication error. The git credential is refreshed before every git-touching step that runs after the build — artifact publish and tag push, release-candidate generation, and sync release-definition generation — so a build that runs past the lifetime of its clone-time token completes instead of failing with "could not read Username for https://github.com".

v52.0.0 — August 5, 2026

• Outbound webhooks deliver deploy and build events. A webhook subscribed to Release Deployed, Release Finalized, Build Completed, or Build Failed now fires when that event occurs; previously such a subscription stayed active but never sent. An optional body template reshapes the delivered JSON into the schema a destination expects — { "$path": "data.releaseName" } pulls a value from the event payload and { "$literal": … } emits one verbatim — so a deployment tracker or a custom endpoint receives the exact shape it needs; with no template the raw payload is sent as before. The Add/Edit webhook dialog gains a JSON editor with formatting, live validation, and a click-to-insert reference of the fields each event exposes. Each webhook has a delivery-history panel with success, failure, and success-rate figures, where every delivery expands to the exact body sent and the destination's response. A delivery that returns a 4xx or 5xx, or hits a template error, is recorded as a failure instead of a success, and a deterministic template error is not retried.
• Push to Org returns to codev, with an explicit soft/full sync choice and a pre-deploy drift preview. Push to Org is available from the command palette (⇧⌘P) and the Workspace sync section. The deploy step distinguishes Soft sync, which deploys the committed state of the branch, from Full sync, which deploys the committed state and then pushes uncommitted local changes on top; the deploy scope can be narrowed to a single domain. Opening the sync section runs a background analysis that shows what a sync would deploy before it runs — a per-package table of new, changed, up-to-date, skipped, and orphaned components, the org-side changes with their last editor, and the uncommitted local changes.
• Org Tracking is available from the command palette as a compact dialog. Pending SourceMember changes from the target org can be searched, filtered by type, sorted, multi-selected, and retrieved — into a chosen package — without opening the full Org Tracker page. (Desktop.)
• PR Analysis states why a check passed or failed. Every Code Analyzer finding shows its severity and whether it blocks, and the check names the threshold in effect — for example, 3 violations at or above the Info (5) threshold — so a naming-convention note and a real defect are no longer indistinguishable. Note-level findings, previously omitted from the check, are shown, since at the default threshold they can block. Findings render as a compact table rather than a heading each. AI architecture analysis reports what it found and where, distinguishing blocking concerns from advisory warnings; a project that lists architecture in its --fail-on set now gates on concern-level findings, where before the check always reported clean and never gated. The built-in release/* branch rule excludes architecture, so this remains opt-in.
• A failed validation shows the real build error on the GitHub check instead of a generic "Failed to create packages". A StaticResource whose content lives in a folder no longer intermittently loses its content file during a diff-package build. sfp analyze and diff-package validation resolve their bundled Java libraries from the packaged binary, correcting an ENOENT … /opt/jars failure on the Docker, deb, rpm, and macOS builds.
• Release builds no longer time out on long-running domains — the build step's limit is raised from 60 minutes to 4 hours — and the git credential used to push build tags is refreshed before the push.

v51.51.1 — August 4, 2026

• Org drift analysis stops reporting components as missing that are present in the org. The comparison materialized only files written to a flat main/default/… layout, so a component in a nested folder (classes/selectors/…) or under a non-main package root was compared against nothing and reported as missing-in-org at high severity. Retrieved files are now matched by their metadata type directory, so nested and alternate-root layouts resolve — removing the large majority of drift findings on the measured tenant as false positives.
• Org drift analysis no longer misclassifies large text files as binary. A file over 4 KB containing any non-ASCII character — an ─ in a comment, for example — was sampled across a byte boundary that split a multi-byte character, so it was declared binary. That disabled presentation-difference detection and surfaced trailing-newline-only differences (Salesforce strips the final newline on retrieve) as byte-level drift. Each side is now sampled to a character boundary.
• Compare no longer reports "Component … not found" for metadata whose name contains special characters — a layout named Case-Case (Marketing) Layout, for example. Cached listMetadata names are URL-encoded while names resolved from files are decoded, so the exact-match lookup never matched them; it now falls back to a normalized comparison — URL-decode and whitespace collapse, including non-breaking spaces from copy-pasted org names — scoped to the org and metadata type.
• Push reports what it deployed. A push that resolves no deployable components — everything filtered by .forceignore, or a path that matched nothing — now reports an error ("Nothing pushed — no deployable components resolved…") instead of "Push successful", and a successful push reports the number of components deployed.
• Non-owner developers can list a repository's pull requests. The pull-request list endpoint was the only read endpoint on the controller that required the owner role, which left members with a permanent "Insufficient permissions. Required roles: owner" entry in the activity feed.

v51.51.0 — August 4, 2026

• The compliance check gates a pull request on the severity of its findings. A complianceSeverityThreshold of error, warning, or info sets the cut-off — settable in config/analyze.yaml, in project settings, or per branch rule — with the CLI value taking precedence over the local file, and the local file over the server project config. Findings below the threshold are still reported in full on the check and in the report; only the gate narrows. The GitHub check conclusion is derived from the same gate, so a red compliance sub-check can no longer sit under a green build. Behaviour change: the default threshold is error, so a rule authored as a warning now advises instead of failing the check — most rules in the shipped example preset are warnings. A project that relies on warnings failing the check must set complianceSeverityThreshold: warning (or info to gate on every finding) under failOn: [compliance].
• An approval-gated developer access grant resolves its developer configuration from the server at the moment the grant runs, so an elevation approved later applies the current configuration rather than the one captured when the request was made. A named configuration can be selected; otherwise the server default is used. De-elevation retries a transient failure with backoff, so a restore step that briefly fails does not leave a user elevated.

v51.50.0 — August 4, 2026

• Onboarding preflight runs against every branch a project tracks, not only the repository default branch. Configuring a project for sfp clones, runs preflight, and opens the configuration pull request for each tracked branch, with baselines registered on the branch the project actually tracks. Wildcard branches are skipped, and when none resolve it falls back to the default branch. The configuration pull request is idempotent per branch — a re-run updates the existing one instead of opening a duplicate — and a per-branch failure is isolated and recorded in the preflight status. sfp project preflight accepts a --branch override.
• A pull request validation that fails on a pool-backed target reports the exact reason — for example, a missing pool — as a comment on the pull request with a link to the run, and keeps that reason in the check summary. Pool-backed review targets are verified before the first validation is dispatched.
• config/analyze.yml, config/ai-assist.yml, and config/ai-architecture.yml are detected with either the .yml or .yaml extension. Previously only the .yaml spelling was read and a .yml file was silently ignored; .yaml still takes precedence when both exist.
• The Review environments page shows a pull request's author and avatar instead of the CI application token (app:…) that created the environment. The author filter and search use the same value.
• The environment deploy panel distinguishes a release candidate from a release. On test and snapshot environments it presents as a Release candidate with the candidate's full deployed-to progression and an N / M stages indicator, and opens a detail dialog.
• Server logs distinguish a workflow disabled in Workflow Configuration from a branch exclusion, and include the matched branch pattern, so a missing build is easier to diagnose.

v51.49.2 — August 4, 2026

• On the Change Analysis page, a row for a pull request whose analysis is still running links to the analysis run itself rather than the validation run. In-flight analyses show a Running state and an Analysis Pending status, and homepage analysis chips read Analyzing… instead of Clean until the run finishes. An analysis that fails or is cancelled without publishing results is marked failed or cancelled instead of staying pending.
• PR Analysis no longer times out on large, multi-file pull requests. Version assist now runs under a bounded time limit and degrades to an advisory skip when it exceeds it, so the linters and architecture checks still run and the pull request receives its checks.
• Cascade merges on large, heavily conflicted branches (100+ files) no longer fail with a timeout. AI-assisted conflict resolution is allowed up to two hours to complete.
• The Code Analyzer run page is rebuilt on web and desktop, with summary cards for errors, warnings, and trend; a filter toolbar for rule, class, and severity with clear-all; and search that filters the results — including by rule id in the class view — and persists across navigation.

v51.49.1 — August 4, 2026

• PR Analysis on Azure DevOps now analyzes the files a pull request changed. Changed-file paths from Azure DevOps are normalized correctly; previously Code Analyzer received no files and reported a clean pass without checking anything.
• Pull requests that delete or rename files no longer fail Code Analyzer with a "path must be of type string" error. Deleted and renamed entries are handled, folder entries are ignored, and empty paths are filtered out.
• config/duplicates.yml and compliance configs are detected with either the .yml or .yaml extension. Each analysis run states which config file it used — or where it looked when none was found — and warns when an explicitly supplied config path does not exist.

v51.49.0 — August 3, 2026

• Package and domain AI reports are branch-aware end to end — a report, its status check, and its share link stay tied to the branch they were generated against. Completed reports can be printed, opened in a standalone view, downloaded as HTML, and shared with a branch-qualified link. Regenerate forces a fresh analysis, and a report refreshes automatically when its run finishes.
• The alias chosen when fetching a pool sandbox is saved and shown as the primary label in Assigned to me on web and desktop. Aliases are cleared when a sandbox returns to the pool or expires.
• Validation no longer fails with "Cannot delete managed object" when a packaged custom-metadata (__mdt) picklist has had values renamed or removed. Locked, installed fields are skipped with a warning naming the leftover values; records, sibling fields, and regular picklists deploy normally.
• Average PR Turnaround on the CI/CD Performance dashboard counts pull requests opened in the selected period and is reported in hours. Past time ranges are anchored to their calendar window.

v51.48.1 — August 2, 2026

• Error Monitoring parses standard Salesforce Flow failure emails — including sandbox notifications — extracting the flow name, failing element, error detail, and affected user. Flow emails without an org id are matched to the org by their Lightning domain.
• Selecting a time range with no errors shows a "No errors found" state. The setup screen appears only when monitoring has never received error data.
• Desktop: cloning a project on a machine with no stored git credentials fails with a clear authentication message and a ready-to-copy git clone command, instead of a /dev/tty crash. Credentials embedded in a URL are redacted from error messages.
• Desktop: Sync → Deploy works for projects containing unlocked packages. The deploy step receives the target Dev Hub, selected through a new dialog with a live connection check.
• A failing PR analysis check names the linter that gated it. A check that cannot be created is no longer recorded as a success, and transient network errors are retried.

July 2026

v51.48.0 — July 31, 2026

• GitHub's native Re-run button works on every codev check — per-domain validation checks, PR Analysis, and project analysis checks all dispatch the right run. Re-running a child check re-runs its parent validation, and a skipped rerun logs its reason.
• Validation reruns on merge-based checkouts anchor the diff baseline on the merge commit's own base, so a rerun only re-checks what the pull request touched.
• Pushing new commits to a pull request cancels the in-flight validation, its child runs, and any pending approvals before the new validation starts, instead of queueing behind them.
• Collapsed groups in flow logs show how long each step took — final duration for completed groups, live elapsed time for running ones.
• Projects that gated on Code Analyzer before severity thresholds existed had an empty threshold that fell back to the strictest setting. The intended Critical threshold is backfilled, and the settings UI persists the value on save.
• The Conflicts button on Dev › Review › Pull Requests toggles a "with conflicts" filter on the table instead of navigating to a route that did not exist.
• Tenants that do not use the platform AI integration can turn it off with PLATFORM_AI_PROVIDER=none. Credentials are retained so it can be re-enabled later.

v51.47.0 — July 31, 2026

• Pull requests are branch-based end to end on desktop and web. Create one from the command palette or the Source Control header; the dialog shows source and target branch, warns about unpublished branches and unpushed commits, and lets you push from there. If a pull request already exists the action opens it. Azure DevOps repositories can now create pull requests.
• Org Changes attributes each changed component to its real package instead of labelling everything src-temp. Retrieving from Org Changes matches Org Explorer: cancellable bulk retrieve, a main/default layout pre-flight with one-click migration, and a completion toast.
• A code-analyzer.yml at the repository root is discovered and applied. A severity threshold controls when the analysis check fails — settable in config/analyze.yaml or project settings — and a run that analyzed nothing can no longer pass green.
• When a GitHub or Azure DevOps token has expired, creating a work item guides you through reconnecting. Permission denials name the missing permission, and an expired server-side integration credential no longer signs you out of codev.
• Impact analysis for release configs runs package checks in parallel — roughly 6–7× faster on a ~200-package repository, with identical output.
• Desktop: macOS updates apply a ~2 MB delta instead of re-downloading the full app (one final full download is needed to reach this build). A regression that broke desktop Apex test execution and PR validation since 1.23.0 — runtime code in folders named tests was pruned from packaged builds — is fixed, and every bundled worker is now boot-tested before a release ships.

v51.46.0 — July 30, 2026

• For cloud tenants, the platform-managed AI fallback can route through Anthropic directly in addition to the existing gateway. Keys you configure yourself always take precedence. Decrypted integration secrets are returned only to application tokens, never to interactive users.
• The Module Explorer in Workspace Explorer resolves domains and packages for the selected branch instead of always showing the default branch.
• Desktop: Create Package runs against the selected project, appears in the footer with a clear title, and reports the real outcome instead of success before the work finishes. The Sync to Org deploy step reports package-level failures instead of showing "Deployed".
• Windows: filesystem moves and deletes during diff-package builds retry with backoff when antivirus or indexers hold file locks, and stale staging directories from failed builds are cleaned up.

v51.45.0 — July 28, 2026

• Every sync entry point accepts a domain name, not just a release-config file path — /codev sync <env> --domain <name>, the CLI, and UI-dispatched syncs. Names are matched on the release name declared inside the config, and an unknown name fails fast listing the available domains. On /codev sync-review-env, --domain chooses what to sync while the pull request's active assignment chooses where, and a requested domain fans out to every review environment assigned to the pull request.
• Desktop: the remaining pages — Org Changes, Tag Manager, Domains, Packages, Package Versions, Validation Reports, Pull Requests, Run Apex Tests, Local Test Results, and Settings → Orgs — use the unified header row with the command palette (⇧⌘P).
• The Domains YAML editor saves. The Save button previously cleared the "Unsaved" badge without writing anything; it now persists through the same path as the Edit dialog, ⌘S saves, and invalid YAML surfaces inline.
• On Change Validation, long domain names truncate cleanly and the table fits ~1270px viewports.

v51.44.0 — July 28, 2026

• Developer Config stores one named configuration per developer-config file instead of merging every file into a single block. De-elevation restores a user to the correct configuration's own default access level, and access-level names are no longer renamed on collision. The editor is a master-detail view with YAML autocomplete — schema keys with inline docs, profiles, and permission sets suggested from branch and org. The Elevate and Add Users dialogs gain a configuration selector. Existing configurations keep working as default.
• Desktop: a background worker that exits abnormally marks its task failed and releases its review environment, instead of ticking "running" forever. The validation worker reports the fatal error, and skipTesting: false is honored.
• Desktop fixes: Create Package lists every authenticated Dev Hub with the default preselected; the Org Changes refresh spinner clears reliably with a 60-second timeout on org round-trips; the Settings shortcut is ⌘, (Ctrl+, on Windows/Linux); the package-creation folder picker refreshes on open; renaming a package updates every domain release-config that referenced the old name.

v51.43.2 — July 27, 2026

• The Run Apex Tests dialog in Ops no longer offers Coverage Validation and Results Storage options that were invalid for the test levels this action runs and made runs fail immediately.
• Importing a developer configuration is additive — existing access levels are preserved, and an imported level whose name already exists is kept under a suffixed name instead of overwriting. When a branch holds several configurations, a picker shows each file and its levels, and the import result lists what was added and renamed.

v51.43.1 — July 27, 2026

• Desktop: the packaged app no longer crashes on startup of its sync-to-org worker with a "Cannot find module" error — a runtime dependency had been stripped during packaging. Ships in a new desktop build; server and CLI are unaffected.

v51.43.0 — July 27, 2026

• Error Monitoring spans every registered Salesforce org in the tenant, with paginated loading and a guided setup screen. Error emails — including asynchronous Apex exceptions — are ingested through an unguessable, rotatable per-tenant address with signature validation, duplicate protection, and automatic retries.
• On cloud tenants the server decides which AI provider is used, so AI features keep working when a repository pins a specific provider. When no provider resolves, the feature skips with a clear message instead of failing with an authentication error. Self-hosted deployments managing their own keys are unaffected.
• Fetching a sandbox from a pool reports what happened — "no sandbox available" or "N sandboxes are currently being provisioned" instead of Error: 200 — and reused assignments authenticate correctly. Desktop, web, and CLI behave identically.

v51.42.0 — July 27, 2026

• Pool users can be provisioned individually, each with their own access level and password-reset choice. The Add Users dialog looks up existing codev users or accepts an email. Access levels are resolved on the server from the project's developer configuration — the client only sends the level name, closing a privilege-escalation gap where a forged policy block could grant more than the named level.
• New owner-only Ops → Developer Config page for defining a project's developer access levels on the server, with a schema-assisted editor, versioned saves, and an import from the repository. The same named levels drive pool provisioning and privilege elevation.
• Desktop: the activity lock lives in the database instead of UI state, so triggering the same action twice against the same target — from another window, or after a project switch — returns an "already running" message. Actions against different targets still run in parallel.
• Background tasks are tracked with heartbeats: tasks left behind by a crashed or force-quit app are recovered at next launch, and stalled tasks are reclaimed automatically.

v51.41.0 — July 26, 2026

• Pending Approvals gains an Approved · Last 30 days tab scoped to the active repository — task type, scope, requester, approver, timestamps, response time, and work-item context. Tab selection is URL-addressable.
• Org Insights reports are shareable — Share copies a URL carrying the selected org. Opening Insights without an org picks the newest registered org that has a report.
• The Performance and Domain Evolution dashboards live under Insights → Dashboards. Existing dashboard URLs keep working.
• A pool tag reused across a sandbox pool and a scratch-org pool could make one pool unreachable by tag. New cross-type collisions are blocked at creation, and the Pools overview flags pre-existing ones.
• Cloud tenants route AI features through a platform-managed gateway with no keys to configure. A new Settings → AI page shows gateway status, model selection, and monthly usage. An AI integration you configure yourself takes precedence.
• Data-package org actions (Pull, Push, Simulate, Preview) run in the background with the outcome delivered as a toast with a logs link. Analysis and Validation tabs are URL-addressable.
• Desktop: auto-update completes its relaunch cleanly, and the app bundle is ~56 MB lighter.

v51.40.3 — July 25, 2026

• Publishing artifacts to external npm registries (JFrog Artifactory, npmjs, GitLab) authenticates correctly for both token-based and basic-auth configurations. Previously no credentials were sent to any registry other than GitHub Packages.
• Artifacts published to external registries receive the intended branch dist-tag instead of always landing on latest.

v51.40.2 — July 25, 2026

• Desktop: My Activity no longer crashes when switching to a tenant whose Project Pulse dashboard was cached from an older server build. Tiles with missing values show a "—" placeholder until fresh data loads.

v51.40.1 — July 24, 2026

• Azure DevOps identity linking through Microsoft Entra device sign-in no longer loops for guest users whose Microsoft account lives in a different tenant than the Azure DevOps organization. The correct tenant is determined automatically; a genuine mismatch produces a message naming both tenants. Affected connections self-heal on their next token refresh.

v51.40.0 — July 24, 2026

• The Release Dry Run Results comment links to the release candidate's detail page in codev — work items, packages, and commits since the production baseline — so approvers can review what a release carries before approving it.
• Release KPIs on the CI/CD Performance dashboard are scoped to environments in the release category. New cards break out snapshot and test release outcomes and flag release failures outside release environments.
• Log section timers stop when a run reaches a terminal state, instead of counting past the run's real end.
• Auth sessions show distinct active, refresh available, and expired states, and an expired token is never returned for scripting — you are pointed to refresh instead.

v51.39.0 — July 23, 2026

• Retrieving metadata into a package that does not use the main/default layout warns before the retrieve and offers a one-click migration to the convention, so retrieves merge instead of creating a duplicate folder tree. Applies to bulk retrieves in Org Explorer and profile retrieves.
• Terminal runs record end timestamps, so Elapsed and Duration reflect the run's real length — a failed run no longer shows hours of phantom elapsed time.
• Validation concurrency is scoped per pull request, so different pull requests validate the same domain in parallel on their own pooled orgs. Same-PR safety is preserved.
• Pools using installAll resolve the artifact scope and registry from the repository's npm integration instead of falling back to the public registry.
• An inactive review-pool assignment rule no longer blocks creating a rule on the same branch pattern.

v51.38.0 — July 23, 2026

• Org Insights introduced under Observe → Org Insights: an on-demand report for any registered org, covering twelve sections — an executive summary plus Apex, users, permissions, fields, field utilization, connected apps, object automation, packages, flows, logins, and content usage. Captures run in the background, keep a history, and download as a self-contained HTML file.
• Editing a pool offers schema-aware assistance — inline suggestions and validation as you type.
• Running an Apex test suite no longer trips over the .cls extension, and a rejected run shows the underlying Salesforce error.
• The Open Org frontdoor shortcut is disabled for production orgs.
• Work Items refresh runs as a background workflow instead of on the API request path, eliminating timeouts on larger boards.
• Run rows are clickable through to the run's details.

v51.37.0 — July 22, 2026

• The log viewer shows elapsed time for each section of a run, and long transcripts are folded into collapsible phases — successful phases collapsed, failing phases expanded.
• The Runs and Scheduled Runs views add a sortable Work Item column and a searchable multi-select work-item filter. Filter and search selections persist between views.
• The Work Items board's Refresh forces a live status fetch, so merged pull requests no longer stay stuck showing "in progress". The cards gain an Open / Closed / All filter and hover details.
• Pool reconciliation interprets localized Salesforce sandbox statuses (German, French, Italian, Japanese, and others), so an in-progress sandbox on a non-English Dev Hub is not marked failed. Unrecognized statuses are held for retry.

v51.36.0 — July 21, 2026

• codev's AI features — architecture and domain insights, validation-error analysis, AI reviews, version assist — can run on Claude through Google Cloud Vertex AI, for organizations that license Claude through their own Google Cloud project.
• Repository workspaces are cached: a persistent, token-free git mirror with a fresh isolated clone per run, instead of cloning from scratch every time. This speeds up builds on merge, PR validation and analysis, releases, sync, package creation, changesets, and repository visualization — most noticeably on large repositories.
• The pool editor's advanced configuration step discovers and inserts supported fields with schema-derived defaults, with formatting, copy, and reset. Field definitions come from the server.

v51.35.4 — July 20, 2026

• Stopping the server waits for active runs — builds, releases, sandbox provisioning — to finish before shutting down, with options to force an immediate stop or bound the wait. An update aborts if work is still running when the drain times out, instead of interrupting it.
• In a release targeting several environments, one environment's failure no longer cancels the others. A mix of success and failure ends as Partial, a release with no successes shows Failed, and a rejected approval is recorded as cancelled for that environment only.
• Filters on the Runs page apply server-side, so pagination and the total count reflect the filtered set. A Status filter is added.

v51.35.3 — July 16, 2026

• Sync → Deploy to org works from git worktree project layouts. A linked worktree's .git pointer file is recognized and a self-contained repository is rebuilt in the temporary deploy location, instead of failing with "fatal: not a git repository".

v51.35.2 — July 16, 2026

• A self-hosted server update no longer silently disables SAML SSO. The update backfills the SAML setting when missing, while always preserving an explicit choice.
• Completes the passkey fix from v51.35.1: formatting escape codes leaking into machine-readable output made successful passkey preparations read as failures. Color output is disabled for these steps, so a success is reported as a success.

v51.35.1 — July 16, 2026

• Passkey enrollment during PR validation is confirmed directly from the virtual authenticator, so gated runs no longer log false "Passkey preparation attempt failed" warnings. A genuine failure carries a secret-redacted reason.

v51.35.0 — July 15, 2026

• Cherry-to introduced — delivers a pull request's net change onto a divergent target branch as a draft delivery pull request, for the exception cases where artifact promotion does not fit. Triggered from a pull request with /codev cherry-to <target>. A deterministic native apply is tried first, with bounded AI analysis and semantic file resolution as fallback when histories have diverged. The delivery pull request surfaces the AI's confidence, dependency findings, warnings, and resolved or unresolved conflicts, and preserves each original commit's author, date, and message. It is always a draft. Works on GitHub and Azure DevOps; requires per-project configuration, a target allow-list, and an active AI provider.
• PR validation prepares a virtual passkey after authentication, so UI automation on MFA- or passkey-enrolled review orgs runs without enrollment prompts. The credential exists only for the life of the job.
• Approval gating is resolved centrally: builds on merge and cascade releases (and their retries) stay ungated by default, adding a human gate applies to both, and changing a retry's environment or target re-applies the current gate.
• Retrying a failed build continues downstream releases by default, instead of leaving the rebuilt release candidate stranded.
• Version allocation is floored on the Dev Hub's promoted version, so a build can no longer produce a version Salesforce rejects after the artifact is built.
• The Releases "changes from previous" view compares all four version segments, so rollbacks show their real removed content instead of a placeholder.
• Package content diffs use a real diff algorithm — a one-line change shows as one line changed, not a rewritten file.

v51.34.0 — July 11, 2026

• The Change Analysis and Change Validation tables link each result to the run that produced it — server runs open in place, external CI runs open in a new tab.
• Retrying a failed build resumes the release: failed and impacted packages are rebuilt under the same release-candidate version, and the release continues from where it left off. The retry dialog gains controls to force specific domains or packages and a Continue releases after successful build toggle.
• The flow-run detail page separates rerunning a whole flow from retrying a single job — Rerun entire flow in the header links to the new run, which carries a persistent rerun marker; Retry job groups attempts into job lineages and is allowed only from the latest attempt.
• Retrying a release re-resolves the environment's configured approver list instead of falling back to all project owners, and the latest-attempt rule is enforced at the server boundary.

v51.33.4 — July 10, 2026

• Release requests apply Exclude Packages and Override Package Versions to the release candidate before the dry run, approval, and deployment — previously both were silently dropped.
• The build version sweep starts from each package's most recent published or tagged point instead of scanning most of the repository history, so builds on large repositories no longer stall at "Computing package versions".
• Build logs are organized into collapsible nested phases; failed phases stay expanded.

v51.33.3 — July 10, 2026

• Review-environment assignment rules can be ranked, and when the winning pool has no free org the request falls through to the next ranked pool — including across pool types, such as a scratch-org tier falling back to a sandbox tier. Only capacity exhaustion triggers fallback; authentication and configuration errors surface immediately. The rule editor gains pool type and an integer priority.
• Priority acts as a tie-breaker between equally specific rules; a more specific rule always wins.
• Simultaneous requests for the same review environment settle on a single winner, and a losing speculative claim returns to its pool.

v51.33.2 — July 10, 2026

• Replacing a registered org's stale SFDX auth URL now persists. Previously the new value validated but could not be saved, so expired credentials could not be rotated in place.

v51.33.1 — July 9, 2026

• Web: registering an org with This is a DevHub org unchecked no longer validates it as a Dev Hub, so sandboxes, scratch orgs, and production orgs can be registered from the web app. A sandbox mistakenly marked as a Dev Hub is rejected with a message saying so, and genuine connection problems surface instead of reading as "not a Dev Hub".
• Review environments spanning multiple domains resolve correctly when opened without naming a domain, instead of reporting "not found".

v51.33.0 — July 9, 2026

• A production release can be gated on a ServiceNow change request: one change request is opened (or reused) per release, carrying the release's changelog — package deltas and linked work items — and the deployment holds until it is approved. Environments without the gate deploy independently. Poll cadence and timeout are configurable per project. See ServiceNow release gating.
• Owners can define exactly who approves — for releases and for operational actions (sandbox requests, freeze and unfreeze, installs, elevate, rollback, unbundle, sync). Approver lists can include non-owners, and the configured list is authoritative for both approve and reject across the UI, the API, and the /codev approve comment. See Configuring approval gates.
• With segregation of duties enabled, the requester of an action cannot approve it — enforced uniformly across release and operational gates. A self-approval bypass was closed: caller-supplied approver lists and skip flags are stripped at the boundary.
• When checksum skip prunes unchanged Apex from a validation with tests, tests are selected from what is actually deployed and coverage is evaluated against the deployed Apex only.
• Behaviour change: the default approval timeout is 60 hours (previously 24), configurable per project. Projects that configure none of the new approval settings keep their previous behaviour.

v51.32.0 — July 8, 2026

• A pool sandbox's stored login can be refreshed in place with a Regenerate auth URL action in My Dev Orgs and the pool detail instances table. Pool owners can refresh any sandbox in the pool; members can refresh their assigned sandbox.
• Fixed false "GitHub App not installed" errors that blocked git operations and the onboarding Verify Installation step for organizations with many app installations.
• Transient network errors between the server and its database on read-heavy pages retry automatically. Writes are never retried.
• On Azure DevOps, the version-assist /version comment edits its existing comment on each run instead of leaving stale information.