Cumulusci

Latest version: v4.3.0

Safety actively analyzes 723200 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 15 of 57

3.38.0

Not secure
Changes:

- The built-in connected app that CumulusCI uses by default is now
visible in the output of the `cci service list` command. This makes
it possible to switch back and forth between this connected app and
another one as the current default when multiple connected_app
services are configured. The built-in connected_app service has the
name `built-in` and cannot be renamed or removed. (2664)
- The `generate_data_dictionary` task includes a new option,
`include_prerelease`. If set to `True`, CumulusCI will include
unreleased schema in the data dictionary from the current branch on
GitHub, with the version listed as "Prerelease". (2671)
- Added a new task, `gather_release_notes`, which generates an HTML
file with release notes from multiple repositories. (2633)
- The `deploy_marketing_cloud_package` task includes a new option,
`custom_inputs`, which can be used to specify values to fill in for
inputs in a Marketing Cloud package. (2683)
- Mappings for the `extract_dataset` task can now specify a
`soql_filter` to restrict which records are extracted. Thanks
\sfdcale (2663)
- Robot Framework: The `Scroll Element Into View` keyword in the
Salesforce library now scrolls the center of the element into view
rather than the top. (2689)

Issues closed:

- Fixed a bug where CumulusCI could not parse the repository owner and
name from an ssh git remote URL if it used an ssh alias instead of
`github.com`. (2684)
- Fixed a bug where `cci service info <service_type>` would display
`None` as the name for the default service if no name was provided.
(2664)
- Fixed a missing dependency on the `contextvars` Python package in
Python 3.6.

3.37.0

Not secure
Changes

- The `install_managed` task now supports 2GP releases (2655).
- We changed the behavior of the `release_2gp_beta` flow to always
upload a package version, even if metadata has not changed (2651).
- We now support sourcing install keys for packages from environment
variables via the `password_env_name` dependency key (2622).

Robot Framework

- We upgraded SeleniumLibrary to 5.x (2660).
- We added a new keyword "select window" to Salesforce library, to
replace the keyword of the same name which was renamed in
SeleniumLibrary 5.x to 'switch window'. We will be removing this
keyword in a future release; tests should use 'switch window'
instead.

Issues Closed

- We corrected some JavaScript issues that were occurring with
Chrome 91. (2652)
- We fixed a bug impacting the `generate_data_dictionary` task when
used with dependencies (2653).
- We fixed an issue causing `sfdx` commands that had options with
spaces to fail to execute on Windows (2656).
- We fixed an issue causing the creation of incorrect 2GP beta tags
(2651).

3.36.0

Not secure
Changes

- Added the option `tag_prefix` to the `github_release` task. This
option can be set to specify what prefix you would like to use when
CumulusCI creates a release tag for you in GitHub. (2642)
- The `deploy_marketing_cloud_package` task has been updated to match
changes to the Marketing Cloud Package Manager API. It also now
raises an exception if the deployment failed. (2632)

Robot Framework

- Improved the output of the `robot_libdoc` task. (2627)

Data generation with Snowfakery:

- Updated to [Snowfakery

3.35.0

Not secure
Critical Changes

- Upgraded Robot Framework to 4.x. For information about new features
and some backward incompatibilities see the [Robot Framework 4.0
release
notes](https://github.com/robotframework/robotframework/blob/master/doc/releasenotes/rf-4.0.rst).
(2603)
- The `update_dependencies` task now guarantees to resolve unpackaged
metadata directories (subdirectories of `unpackaged/pre` and
`unpackaged/post`) in alphabetical order, matching the behavior of
`deploy_pre` and `deploy_post`. `unpackaged/pre/bar` will deploy
prior to `unpackaged/pre/foo`. The previous behavior was undefined,
which caused rare problems. This change is critical only for
projects that have deployment-order dependencies between unpackaged
directories located in upstream dependencies and rely on the current
undefined load order. (2588)

Changes

- The CumulusCI documentation has a new section: [Testing with
Second-Generation
Packaging](https://cumulusci.readthedocs.io/en/latest/2gp-testing.html)
(2597)
- CumulusCI has two new service types: `oauth2_client` &
`marketing_cloud`. These are considered experimental. (2602)
- The `marketing_cloud` service allows users to connect to a Marketing
Cloud tenant via OAuth so that tasks that work with Marketing Cloud
can make API calls on the user's behalf. (2602)
- The `oauth2_client` service takes information for an individual
OAuth2 client which can then be used in place of the default client.
This currently applies only to the `marketing_cloud` service. To
setup a Marketing Cloud service with a specific OAuth2 client use:
`cci service connect marketing-cloud <name-of-service> --oauth_client <name-of-oauth-client>`.
(2602)
- CumulusCI has a new task: `deploy_marketing_cloud_package`. This
task allows a user to pass the path to a .zip file to a Marketing
Cloud package (downloaded from the Marketing Cloud Package Manager)
and deploy the package via a `marketing_cloud` service (see above).
Note that successfully deploying a package using this task may
require permissions that are not generally available. (2602)
- The `install_managed` and `install_managed_beta` tasks now take no
action if the specified package is already installed in the target
org. (2590)
- The `cci org list` command can now output in `JSON` format by
passing it the `--json` flag. (2593)

Issues Closed

- Fixed an issue parsing `cumulusci.yml` files that contained Unicode
characters on Windows. (2617)
- Fixed an issue in the `github_copy_subtree` task where CumulusCI
would silently generate incorrect or truncated commits when a
directory was passed to the `include` task option. (2601)
- The `deploy_pre` and `deploy_post` tasks avoid warnings by freezing
installer steps that match current expectations. (2589)

3.34.1

Not secure
Issues Closed

- Fixed a regression in the `load_dataset` task where some sObjects
could not be loaded without explicitly turning off the new
`set_recently_viewed` option.

3.34.0

Not secure
Critical Changes:

- If you have custom flows that utilize the `github_release` task,
they will need to be updated to include the `package_type` option
(which is required). (2546)

Changes:

- The `github_release` task now has a `package_type` option which is included in the information written to GitHub release tags. The following standard library "release" flows have been updated with hardcoded values (either `1GP` or `2GP`) for this option:

: - `release_beta` (1GP) - `release_production` (1GP) - `release_2gp_beta` (2GP) - `release_2gp_production` (2GP)

(2546)

- The `update_dependencies` task now supports a `packages_only`
option, which suppresses the installation of unpackaged metadata
dependencies. This option is intended to support building
update-only or idempotent installers. (2587)

- The `github_automerge_main` task has a new option,
`skip_future_releases`, which can be set to `False` to disable the
default behavior of skipping branches that are numeric (and thus
considered release branches) but not the lowest number. (2582)

- Added an new option `set_recently_viewed` to the `load_dataset` task
that sets newly inserted data as recently viewed. This changes the
default behavior. By default (if you do not specify the option), the
first 1000 records inserted via the Bulk API will be set as recently
viewed. If fewer than 1000 records are inserted, existing objects of
the same type being inserted will also be set as recently viewed.
(2578)

- The `update_dependencies` task can now consume 2GP releases in
upstream repositories, provided they're stored in release tags as
generated by CumulusCI. (2557)

- The `extract_dataset` and `load_datast` tasks now support adding or
removing a namespace from a mapping file to match the target org for
sObjects and not just fields. (2532)

- The `create_package_version` task can now increment package version
numbers when the package is not in a released state. (2547)

- Includes [Snowfakery

Page 15 of 57

Links

Releases

Has known vulnerabilities

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.