Action Required: The `SF_TEMP_SHOW_SECRETS` Compatibility Workaround Will Be Removed on October 28th, 2026
まだ誰も着手していません。
評価
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 初心者へのやさしさ
- 25/100
- issue の種類
- ドキュメント
- 明瞭さ
- 説明が足りない
- 活発さ
- 活発
- 技術スタック
- shell
- 領域
- cli, documentation
調査の方向性
This issue is an announcement and names no repository files, tests, or concrete documentation entry to update. Start by checking whether a maintainer has identified a documentation location or separate implementation task; done would require an explicitly scoped repository change that reflects the October 28th, 2026 migration guidance.
索引モデルが issue の本文から書いたものです。
説明
Summary
⚠️ After October 28th, 2026, access tokens, passwords, and SFDX Auth URLs will only be available through the dedicated sf org auth show-* commands. At that time, the temporary SF_TEMP_SHOW_SECRETS environment variable will stop working.
This change will occur when the CLI is promoted to latest on Wednesday, October 28th, 2026. Any workflows that set SF_TEMP_SHOW_SECRETS=true must be migrated to use the show-* commands before that date.
This is the final step of the credential-exposure changes announced in https://github.com/forcedotcom/cli/issues/3560.
Background
In #3560, we removed sensitive authentication artifacts (access tokens, passwords, and SFDX Auth URLs) from the standard and --json output of commands like sf org display, and we introduced dedicated commands for retrieving them explicitly. To give teams time to migrate, we shipped a temporary environment variable (SF_TEMP_SHOW_SECRETS) that restored the previous output. That variable was always intended to be temporary and was slated to be removed in "Summer 2026". We are now setting the official date.
What is changing, and when
| Date | Milestone |
|---|---|
| October 21st, 2026 | available on latest-rc for validation |
| October 28th, 2026 | promoted to latest; SF_TEMP_SHOW_SECRETS no longer has any effect |
Until October 28th, 2026, SF_TEMP_SHOW_SECRETS=true continues to work as it does today. On and after October 28th, 2026, setting it has no effect, and the affected commands behave as they do without it.
Why we are removing it
The environment variable reintroduces the exact exposure it was meant to contain by putting long-lived credentials back into standard command output where automated systems and AI agents can capture and store them in plain text. This is not a safe long-term control because an AI agent could set the variable itself. The dedicated show-* commands are the durable replacement. Retrieval becomes an explicit, auditable action that you can also deny-list from an AI agent's allowed commands.
What you need to do
If a workflow currently relies on SF_TEMP_SHOW_SECRETS, switch it to the matching command below. Each command supports --json and --no-prompt for non-interactive use in CI/CD.
- Access token:
sf org auth show-access-token - SFDX Auth URL:
sf org auth show-sfdx-auth-url - User password:
sf org auth show-user-password
Example retrieving an access token in a pipeline:
# Before
ACCESS_TOKEN=$(sf org display --json --target-org my-org | jq -r '.result.accessToken')
# After
ACCESS_TOKEN=$(sf org auth show-access-token --json --no-prompt --target-org my-org | jq -r '.result.accessToken')
What is NOT changing
- The
sf org auth show-*commands remain the supported way to retrieve these values. Removing the workaround does not remove your ability to retrieve a credential when you genuinely need one. sf org login sfdx-urlis unchanged. Existing SFDX Auth URLs stored as CI/CD secrets continue to authenticate.- The
@salesforce/core(sfdx-core) library APIs are unchanged. - CLI versions released before
2.136.8are unaffected by this change.
- 主要言語
- 言語のデータがありません
- スター
- 571
- フォーク
- 80
- 平均マージ
- 23時間 43分
- マージ済み PR（30日）
- 5
環境構築
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートなし
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
forcedotcom/cli のほかの issue
-
sf agent mcp asset replace --assets null throws raw TypeError instead of InvalidShape対応中かも @konkonrong-lgtm が 71 日前に担当しました。 オープンarea:afdx bug investigating owned by another team validated
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
forcedotcom/cli#3625 · コメント 4 件 ·
-
area:afdx bug owned by another team
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
forcedotcom/cli#3608 · コメント 2 件 ·
-
bug investigating validated
難易度 3/5 1〜2日 初心者へのやさしさ 66/100
forcedotcom/cli#3667 · コメント 5 件 ·
-
[BUG]: sf package version create always warns about org-capitalize-record-types, even when it's setオープンarea:packaging more information required owned by another team regression stale
難易度 3/5 1〜2日 初心者へのやさしさ 52/100
forcedotcom/cli#3663 · コメント 5 件 ·
-
[BUG]: NavigationMenu SourceMember name mismatch prevents source-tracked retrieve from completingオープンbug investigating validated
難易度 4/5 3〜5日 初心者へのやさしさ 52/100
forcedotcom/cli#3660 · コメント 3 件 ·
forcedotcom/cli の issue をすべて見る
似ている issue
-
area: config effort: S good first issue P3 type: bug
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
ferenyl/azuredevopstui#63 ·
-
bug
難易度 2/5 1〜3時間 初心者へのやさしさ 84/100
メンテナーはふだん 1 日以内に返信
-
bug CLI config mcp
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
メンテナーはふだん 1 日以内に返信
-
good first issue help wanted
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
eugenioenko/ttt#1085 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 70/100
colbymchenry/codegraph#2770 ·
メンテナーはふだん 1 日以内に返信