Neptune DXP - Open Edition 24.15.1 release notes

Artifacts created through the MCP plugin now inherit your default development package when you do not name one, instead of being left ungrouped or rejected. A package you name explicitly takes precedence, and an unusable default package is skipped rather than blocking creation.

SSO and external users (Microsoft Entra ID, OpenID Connect, SAML) are no longer logged out of a PWA launchpad on refresh while their server session is still valid. (This fix is also delivered in the 24.14.4 patch release.)

Launchpad Azure login now completes reliably, resolving an occasional failure caused by an msal.js race condition. (This fix is also delivered in the 24.14.4 patch release.)

The launchpad again requests a separate token for the scopes configured under Settings > Authentication > Optional Access Scopes (Microsoft Entra ID), resolving a v24 regression where only the base scopes were requested and no scoped token was issued. As a result, AppCache.userInfo.azureResourceToken and v2azureResourceToken are populated as in version 23, and the token is refreshed before it expires and after re-login. (This fix is also delivered in the 24.14.4 patch release.)

The neptune_chatbox now receives its startParams when loaded through AppCache.Load, so start parameters are passed to the chatbox as expected.

In the Launchpad tool, the Load Agent at Launchpad Start property is now visible on startup.

AI agent requests now allow the temperature property to be omitted. (This fix is also delivered in the 24.14.4 patch release.)

Vector store agent templates now stringify object values and support nested paths.

JSON columns are now flattened before embeddings are generated.

Creating an app through the MCP plugin now enforces the same package access check as the App Designer, so an app can no longer be created in a package you cannot edit.

A server script added to a script project through the MCP plugin now adopts that project’s package, so it is listed under Script Class in the package’s Artifacts tab. Previously, only newly created scripts picked up the package, and a script moved into a project afterward kept its old one.

Creating a script project through the MCP plugin now enforces the same package access check as the Script Editor and adopts your default development package, skipping a default you cannot edit instead of using it anyway.

The server now logs a clear warning at startup when the MCP public URL scheme (http or https) does not match the server’s actual protocol, which previously left MCP clients unable to complete authorization.

Installing an npm package through the MCP plugin now rejects an invalid package name or version immediately with a clear error, instead of failing partway through.

Creating or updating tables through the MCP plugin no longer allows saving a field with no data type or an unsupported one, which previously broke editing that table in the UI.

Saving a server script now verifies that you have edit access to the target development package. Previously, a user with Script Editor access could create, update, or move a script into a package restricted to another role, even though that package is hidden from the package list. This applies to both the Script Editor and the MCP plugin.

On iOS, the web view is no longer shifted below the status bar, resolving the empty strip at the top of the screen and the footer buttons being pushed under the home indicator. (This fix is also delivered in the 24.14.4 patch release.)

The launchpad enhancement script now runs via safe script injection instead of eval, restoring compatibility under strict Content Security Policy configurations. (This fix is also delivered in the 24.14.4 patch release.)

The DXP Marketplace is now accessible when a Content Security Policy is enabled. The Portal now serves the Marketplace app view directly and cockpit_marketplace loads it without running eval on a server script response, so the Marketplace works under strict CSP while remaining backward compatible. (This fix is also delivered in the 24.14.4 patch release.)

The PWA service worker cache is now invalidated when the Open Edition version changes, preventing a stale cached app after an upgrade. (This fix is also delivered in the 24.14.4 patch release.)

Internal packages are now re-imported reliably on upgrade. A git remote recorded on an installed package no longer blocks re-import unless it genuinely points elsewhere, so launchpad hotfixes reach existing installations.

The nep and com.neptune UI5 resource roots are now revalidated instead of being cached for 90 days, preventing a stale UI5 control build after a rebuild or branch switch. (This fix is also delivered in the 24.14.4 patch release.)