Neptune DXP - Open Edition 24.14.5 release notes

Job scripts now run with a user context. A manual run uses the user who started it, a scheduled or event-triggered run uses the job’s creator, and a global admin can override this with the new Run as user field. The job log shows which user a run executed as.

P9_SCRIPT_DEBUGGER_DISABLED=1 turns the server script debugger off.

IN_PROCESS_CACHE_ENABLED=false turns the in-process caches off. The in-process cache limits and ages are configurable through IN_PROCESS_CACHE_* environment variables.

POST /api/functions/Overview/Pool returns the database pool counters and the query cache usage of every process of the instance: the main process, each web worker, the engine and its running job and script executors. The system monitor data carries the same counters per process. It requires the Cockpit overview permission.

With P9_PROMETHEUS_ENABLED, every web worker exposes p9_db_pool_connections (labelled by pid and state), p9_query_cache_bytes and p9_query_cache_entries through the cluster metrics endpoint, so the pool usage of all web workers can be scraped across instances.

Jobs and scripts in a script executor wait the equivalent of DB_PSQL_EXECUTOR_POOL_ACQUIRE_TIMEOUT or DB_MSSQL_EXECUTOR_POOL_ACQUIRE_TIMEOUT seconds (default 60) for a database connection.

With SESSION_STORE_REDIS=true and Redis configured (DB_ENABLED_REDIS with DB_URI_REDIS), sessions are stored in Redis instead of the sessions table. This removes the session read on every request and the expiry writes from the database. Redis is then required for login: if it is unreachable, requests fail and /healthz reports the session store as down. The cockpit session list and the session cleanup on user deletion work with both stores.

Starting, canceling or watching a job over the socket now requires the Job Manage or System Processes role.

Running a job now requires edit access to the job’s development package.

Running or debugging a server script over the socket now requires Script Editor edit permission and edit access to the script’s development package.

Listing API debugger conditions now requires Script Editor access and is limited to projects you can edit.

Saving or deleting an API debugger condition now requires edit access to its project.

Listing lock entries now requires the Lock Entries role, and deleting them requires edit access.

Cockpit worker methods started over the socket now require the matching role and development package access.

The system monitor live data stream now requires System Processes or Job Manage access.

A script API with Run in own process enabled no longer fails on every call.

An API debugger condition can no longer be saved for a project that does not exist.

Bootstrap components now have their correct CSS applied.

The unused App Designer collaboration socket channel was removed. Its messages are ignored.

A Socket.io connection can now authenticate with a JWT Bearer token, like HTTP routes.

A script that calls an AI agent without a user context now fails with an error explaining that Run as user must be set on the job.

Importing a development package no longer fails for jobs whose Run as user does not exist in the target system.

The Run button is disabled for a job you cannot edit, and a refused run now shows the reason.

On a PWA launchpad with a start application, the PIN pad stays busy and ignores input after a correct PIN until the application has rendered, instead of accepting a second PIN entry while the app is still loading.

An AI agent on a PWA launchpad is hidden while the launchpad is locked and only returns after the user unlocks.

Unlocking a PWA launchpad with the PIN no longer leaves it stuck on a busy PIN screen when the AI agent was opened before the lock.

After a fingerprint, Face ID or Windows Hello check is accepted, the PIN pad is covered while the launchpad signs in, instead of staying visible and accepting input.

Saved splitviews are restored when a PWA launchpad is unlocked while offline.

Launchpad/GetDoc returns an empty list when the action type or its filter value is missing instead of listing all documentation.

App Designer apps on the iOS mobile client now show configured i18n texts instead of their keys.

Signing in with an SAP login that requires a password change no longer crashes the mobile client.

Submitting a new password after an SAP login asks for one no longer throws an error.

Hide Login Selection, Hide Local Login, and the other launchpad login settings now apply in the mobile client.

The launchpad’s default login IDP now applies in the mobile client.

On iOS, the configured status bar background is painted behind the status bar again instead of the app background bleeding through, which in dark mode left the clock and system icons unreadable.

Table AI tools no longer fail when the query returns a date or timestamp column.

Unsaved data dialog no longer appears after deleting and opening another tool.

Sorting by Type no longer fails.

Legacy tables with empty or text default values no longer fail with validation errors.

Secret expiration notifications are now sent by email.

vault.decrypt in the Script Editor no longer throws Vault is disabled on Neptune DXP Cloud.

A request without an Authorization header or a configured token header no longer runs the Basic and JWT strategies before falling through to the session.

A client that sends a Basic or JWT credential on every request gets its logon recorded in the user activity log and lastLogin once per five minutes per user and web worker instead of on every request. Session logins are recorded every time as before.

The PWA service worker no longer grows Cache Storage without bound. API and proxy responses are no longer cached, every cache now has a maximum number of entries and age, static assets are keyed without their cache-busting query string so a rebuild replaces the old copy instead of adding one, cross-origin caching is limited to scripts, styles, fonts and CORS-enabled images, and storage accumulated by earlier versions is reclaimed when the new worker activates.

Launchpad/GetTiles reads each relation separately instead of in one joined query, which cost about 500 ms of database CPU and 98,000 page reads per call on a copy of a production database. The launchpad structure is cached per web worker for one minute, and the images inlined for mobile clients for five minutes. Saving a launchpad or any of its parts clears the cache in every process at once.

Launchpad/GetUserInfo sends about 50 KB less on every login.

A database error no longer restarts the web worker, and an error after a response has started no longer crashes it.

A request that cannot get a database connection within the equivalent of DB_PSQL_POOL_ACQUIRE_TIMEOUT or DB_MSSQL_POOL_ACQUIRE_TIMEOUT seconds (default 10) fails with 503 instead of waiting indefinitely.

Data read on nearly every request, such as users, roles, apps, launchpads, customizing and script APIs, is cached per web worker or no longer read on every call. Saving clears the cache in every process at once. The global admin roles, ACL lists, and other query-cached data reach the other web workers within one minute.

Compiled apps and web app assets are served from memory. App view ETags are derived from the app version, so a browser revalidating against a different server gets a 304.

The app access log no longer delays the app response, and the log file size limit holds when several processes write to the same file.

A session’s expiry is extended at most once per minute instead of on every request, and concurrent requests that find it due share one write.

While Redis is unreachable, requests answer 503 with a session store message instead of a generic error page, and the outage is logged once instead of per request.