Neptune DXP - Open Edition 25.0.0 release notes

Node.js moves to version 26.8.1. The version previously in use, Node.js 22, reaches the end of its maintenance window in May 2027.

The default UI5 version is upgraded to 1.148. The previous default, 1.136, reaches the end of maintenance in Q3 2026.

Upgraded Node.js binary to Node.js 26.8.1 to stay aligned with current development and security enhancements of Node.js

Upgraded the default UI5 version to 1.148.

Process Flow Designer, where you build a process flow, including its canvas, its nodes, and the interface that defines the data it works with.

Process Flows Overview, where you monitor every execution, with a step-by-step trace of what each run did.

For SingleSelect and SingleSelect Script fields in the adaptive edit template, you can now choose whether the main content displays the key and text of the selected value together (for example, 1 - test), only the text, or only the key.

New authentication type SAML 2.0 Bearer (S/4HANA Public Cloud) that exchanges a signed SAML assertion for an OAuth access token on behalf of the logged-in user, enabling principal propagation to S/4HANA Public Cloud APIs.

New authentication type OpenID Connect Bearer that forwards the access token the logged-in user received from SAP Cloud Identity Services to the remote system, refreshing it before it expires, enabling principal propagation through SAP API Management for both proxied app requests and the AI Context Hub.

When the Vault is enabled, header value fields (Headers tab and OAuth 2.0 token request headers) get a value help that lists the available vault secrets and inserts the {/vault/keyId} reference. Manual entry keeps working, and a reference saved with Encrypt selected is still resolved.

The import dialog now allows dragging and dropping .json and .yml files.

The search panel has been improved to more easily add filters and to save searches. Scope filters such as Within selected object and Exclude selected object, type filters, and matching filters, including Empty Value and Regular Expression, can be combined. Regular expression replacements support capture groups and case modifiers, and replacements can be undone. Searches can be saved for the current app or for all apps, and the five most recent searches of each app are kept.

The to-do list is now available as the To-Do Lines filter in the search panel instead of a separate tab.

The worklist is now a toggle panel, and components can be added to or removed from the worklist directly from the search results.

A new Color Folders option displays each folder in a color that is generated from its name, so folders with the same name have the same color in all apps.

Cut is now available in the context menu of the application tree.

In the Data Model dialog of a MultiModel, array fields can now be typed as object[], string[], number[], boolean[], or any[], which gives more accurate generated types.

TypeScript is now the first option when selecting a script for events.

The expression binding editor now uses the editor theme selected by the user and highlights the %{ syntax and arithmetic operators.

Old dialogs were replaced with new and improved artifact dialogs in most Cockpit tools for enhanced search, filtering and artifact retrieval.

The start pages of the Connectivity Group, Code Snippets, Approvers, and Task Action tools have a new package filter.

Expired user certificates of the type SAP Principal Propagation can now be deleted in bulk.

Translations now use the locale instead of the ISO code, which allows separate translations for language variants, for example, Brazilian and European Portuguese.

Fields bound to an i18n model now have a button that previews the existing translations. The button shows how many locales have translations and marks missing translations. The preview is available in the Documentation, Launchpad, PDF Designer, Tile, and Tile Group tools.

Job scripts now run with a user context. A manual run uses the user who started it, a scheduled or event-triggered run uses the creator of the job, and a global administrator can override this with the new Run as user field. The job log shows which user a run executed as. A script that calls an AI Agent without a user context now fails with an error that asks you to set Run as user on the job.

The new PWA Install Dialog Title field sets a fixed app name for the PWA install dialog for all users. If the launchpad title uses an i18n binding, the install dialog now shows the title in the browser language instead of the raw i18n key.

The PWA Display Mode setting now takes effect and is saved. Browser has been replaced by Minimal UI, an app window with a back and reload toolbar. The field can be cleared, which uses Standalone, and carries help text that describes each mode per platform. A launchpad without a display mode now opens as Standalone. On Android and on desktop Chrome, such a launchpad previously opened in full screen. To keep the previous behavior, select Full Screen.

UI5 Path and SAP UI5 Module Path carry help text that describes the path they expect, including the CORS headers that a cross-origin resources server needs.

The SAP UI5 Module Path now loads the SAP UI5 libraries and takes the resources folder rather than the sap-ui-core.js file. Shorten paths that were configured before this release. For apps from Neptune DXP - SAP Edition 25.0.0 or higher, leave the field empty.

Appearance overrides, such as brand and highlight colors and header styling, now also apply to the login screen, not only to the runtime launchpad.

The new Designer Config tab in the Launchpad tool lists all appearance changes made in the Launchpad Designer, so overrides can be reviewed without opening the designer.

The overrides are shown as a read-only tree, grouped by light and dark theme, then by launchpad, tile group, and tile appearance, and nested under the screen tile group, section tile group, or tile they belong to.

Each override shows the level it applies at, the resulting value with a color swatch for color properties, how many settings it covers, and its technical name.

With the designer active, selecting a menu tile group in the tree menu opens its section for editing.

Agents with JSON output now support tool calling.

Vector store agent templates now support nested field paths and render object and array values as readable text instead of [object Object].

The vector source results of the chatbox have been revamped. Each source is shown with a percentage of how closely it matches, and with a table of its data.

The SAP AI icon has been replaced with the Neptune icon in the chatbox.

Artifacts can no longer be assigned to template packages. Template packages are imported again when the system is upgraded, and that import deletes any custom artifacts assigned to them.

A warning appears when you add a role to a package that you do not have yourself.

Added support for i18n bindings, including a preview of the translations.

Added a link option to the Text element that leads to either URLs or a page in the document.

Added snaking columns.

Added support for SVGs.

Added the option to use a connector as the PDF interface.

When creating a PDF from a file, the PDF gets its name.

Added validation to the PDF interface, both to the JSON import and when creating the keys manually.

Added the right-click Add menu from the App Designer to the document tree.

The /metrics endpoint now exports oe_active_users{window="5m"|"15m"|"60m"}, the distinct authenticated users with a session active within the window, and oe_active_sessions, the authenticated, non-expired sessions. Active user load can be tracked next to CPU, memory, and request rates.

New tool groups:

Artifacts created through the MCP plugin now inherit your default development package when you do not name one. A package you name explicitly takes precedence, and an unusable default package is skipped rather than blocking the create.

The MCP token secret is now generated once at startup instead of separately by each server process, so tokens issued by one instance are no longer rejected by another in multi-instance setups. It can also be pinned with the MCP_TOKEN_SECRET environment variable.

Artifact changes made through the MCP server are now written to the audit log under the signed-in user, when audit logging is enabled in the System Settings. This covers create, update, and delete for the MCP tools that change artifacts. Audit log entries do not yet show whether a change was made through the MCP server or through the Cockpit. Changes to apps, locks, the deletion of script projects, PDF generation, and process flow executions are not yet logged.

Full IntelliSense for the server script context. Typing entities., tables., apis., agents., modules., or globals. now lists the resources attached to the current script, with method and parameter documentation for table repositories and for p9.ai, including p9.ai.createEmbedding. Suggestions are scoped to the active script, so only resources that work at runtime are offered.

Tables and API operations attached to a script are now strongly typed. entities.<table> and tables.<table> return rows typed from the table definition, and apis.<operation>() returns a typed response built from the response definition of the operation.

Agent calls now return a typed completion response. await agents.<agent>({ input }) exposes output, finishReason, usage, reasoning, and related fields.

entities.<table>.findSimilar in server scripts can now return a cosine similarity score for each row with the withSimilarity option.

Folders on the Scripts tab can now be created, renamed, and deleted through the context menu. Deleting a folder asks whether to remove or keep its scripts, and scripts can be assigned to a folder by drag and drop.

Added a new option to toggle colored folders.

Projects can now be deleted like in the other designers, and deleting a project also deletes its scripts. Existing scripts without a project are migrated to a new project called NO PROJECT.

Added JSDoc and a code snippet for the p9.runScript function.

Saving a server script now checks that you have edit access to the target development package. This applies to the Script Editor and the MCP plugin alike.

A custom password validation script can be selected under Settings > Password. The server script runs after the built-in rules on every password change, that is, user creation, a password set by an administrator, a self-service change, and a forgotten-password reset. It receives password, user, and result. Adding a message to result.errors rejects the password with that message. If the script fails or cannot be found, the password is rejected.

The password policy gained a Minimum Number of Lowercase Characters rule and an option to reject passwords that contain the username or email address of the user.

The Vector Store dialog has been revamped.

Telemetry now includes adoption data for the AI Context Hub, Process Flows, Remote MCP, A2A peers, agent runtime features, the AI Chart tool, API authentication types, and Agentic Apps. See Telemetry data collection.

New tile type Fiori Application (beta). See Native SAP Fiori support.

A PWA launchpad now fetches the current launchpad configuration from the server on every update, including PIN entry. Changes made in the Cockpit after the PWA was installed, such as the header, top menu, search, footer, title, start application or blackout settings, the assigned launchpad layouts, and the appearance preference, no longer wait for the cached HTML to be replaced. Settings that need a restart, such as PWA, PIN, and public access, are unchanged.

With Disable Customizations set, the tile action button remains available with only the non-customization actions (favorites, settings, and help). Lock Screens, Enable Screen Changes, and Clear Customizations are hidden in the user’s settings.

Clear Customizations now asks once instead of twice, and states that the standard launchpad will be restored and reloaded.

The dialog shown when the launchpad language is changed while apps are open now reads as text instead of showing i18n attribute names, ships in every supported language, and states that open applications will be closed.

A Socket.io connection can now authenticate with a JWT Bearer token, like HTTP routes.

The Operations tab now displays all the operations that exist in the API model.

Speech-to-text no longer cuts off while dictating.

The startParams are loaded in the chatbox when it is placed in a launchpad.

With Enable History turned off, the chatbox no longer creates a conversation thread, so the agent no longer remembers previous messages. A button to clear the chat is now shown at the top of the chat.

The Session Expired popup now appears consistently.

Logs with a suffix now appear in the System Log tool.

Saving a security group no longer times out with a large number of users assigned.

A connector that failed to return a field catalog no longer hangs when loading.

Duplicate font files are no longer uploaded.

Only .ttf, .otf, and .woff2 files can be uploaded by drag and drop.

The Use in PDF Designer and Use in Theme Generator checkboxes are blocked while the font is in use in the respective artifact.

The color pickers on the PWA tab are no longer editable in display mode.

The Pin Code Iterations input no longer allows arbitrarily large numbers.

The delete button on the Tile Groups tab is no longer pushed off screen by long content. The Subtitle and Description columns have been removed.

The graphs now use the viewer’s own time zone, and their columns are grouped on the viewer’s own hour, day, and minute boundaries, including across daylight saving changes. The API Trace and Agent Trace graphs are corrected with it.

Access to the Neptune DXP Marketplace is no longer blocked when CSP is enabled.

A launchpad assigned in the Create dialog is now persisted, so creating a build no longer fails with "You need to connect the app to a launchpad".

The agent can no longer fetch data from deleted conversations through the AI Memory tool.

JSON columns included in the vectorizer configuration of a table no longer break embeddings. Their values are flattened to text instead of showing up as [object Object].

MSSQL no longer rounds similarity values to 0 or 1.

Azure models now support embedding, so tables can be vectorized with an Azure model.

Installing or registering an ESM-only npm module that uses top-level await, for example, @ui5/mcp-server, no longer fails with "require() cannot be used on an ESM graph with top-level await". Such modules are now loaded with import() after install and in server scripts.

Descriptions with an i18n binding now display correctly.

Viewing modified files in the Git integration of a package no longer crashes when the package has more than approximately 1000 modified or new files against the remote, such as on the first push of a large package with media library files.

Elements can now be removed from the Recent menu list.

When the correct password is entered, the PDF is unlocked.

Access permissions can now be set for PDFs.

A valid structure is no longer reported as an error.

Context menus are now deleted properly.

Images and colors now have a preview icon. Selecting it shows the image in full resolution or opens a color picker.

The table wizard now shows all data when its properties are nested.

Defining fewer column widths than columns in a table no longer crashes the server.

Bindings inside tables no longer drop bound values.

The syntax check now works properly, without hard-coded checks for table rows.

The copy function now keeps the data when there are unsaved changes.

Creating an app or a script project through the MCP plugin now enforces the same package access check as the App Designer and the Script Editor.

A server script added to a script project through the MCP plugin now takes the package of that project, so it is listed under Script Class in the Artifacts tab of the package.

Creating or updating tables through the MCP plugin no longer allows saving a field with no data type or an unsupported one.

Installing an npm module through the MCP plugin now rejects an invalid package name or version straight away with a clear error.

The server now logs a clear warning at startup when the scheme (http or https) of the MCP public URL does not match the actual protocol of the server.

Saving or deleting an artifact through the MCP plugin now respects a lock that someone else is holding.

The URL of a remote system keeps its path when saved, so a system reached through an SAP API Management proxy basepath can be configured from the Cockpit.

Toggling on edit mode in the Role tool no longer always navigates to the General tab.

The Run Script code snippet for adaptive applications now reads the method from req.query.method instead of req.body.method.

Elements can now be removed from the Recent menu list.

Images and colors now have a preview icon. Selecting it shows the image in full resolution or opens a color picker.

Converting a script between JavaScript and TypeScript now refreshes the editor automatically.

Empty script folders are kept when the last script in them is moved or deleted, can be renamed and deleted from the context menu, and cannot be renamed to an existing name.

Importing data into a table without the required role now shows the correct error message.

Changing the font of a theme now saves, and the compiled CSS is generated before the save, so it always matches the font on the record.

A theme with a custom font now shows that font in the preview as soon as the theme is opened. Switching between two themes of the same appearance also updates the preview.

The allowed subtitle length of a tile group has been increased to 256 characters.

The layout pickers for light and dark appearance no longer offer a layout that is already in the list.

The Layout Hierarchy pickers of tile layouts and tile group layouts no longer offer the layout being edited.

The remove button on each row of the Tiles tab of a tile group is now visible without resizing the dialog. The Subtitle and Tags columns have been removed.

The unresolved i18n key is no longer shown as the abbreviation of a navbar card, and i18n models used by the launched configuration and inside section tile groups are registered correctly.

The login box blur is now applied when the login placement is left or right.

Navigating to a screen no longer adds empty scroll space below the content.

SSO and external users (Microsoft Entra ID, OpenID Connect, SAML) are no longer logged out of a PWA launchpad on refresh while their server session is still valid.

Azure login no longer fails occasionally.

After signing out of a desktop launchpad, the login box renders completely and keeps user input.

An enabled AI Agent no longer forces the launchpad into full width. The launchpad follows the configured layout width and only expands while the AI Agent chatbox is open in fullscreen position.

A non-PWA launchpad no longer opens in PWA mode after a PWA launchpad has been installed. Service worker registrations from earlier versions are cleaned up automatically.

The launchpad again requests a separate token for the scopes configured under Settings > Authentication > Optional Access Scopes (Microsoft Entra ID), so AppCache.userInfo.azureResourceToken and v2azureResourceToken are populated as in version 23. The token is refreshed before it expires and after re-login.

An empty screen tile group is now listed in the menus while Edit Screen mode is active, so tiles can be added to it.

Boolean tile settings maintained on the tile layout of the launchpad layout now apply at runtime, for example, the Fiori style flag, Hide Context Button, Hide Context Menu, and Open Button No Text.

Selecting a menu tile group in the tree menu now expands or collapses it, and the menu stays open while moving through the tree.

The documentation and field help of an app that runs from a Neptune DXP - SAP Edition system are now read from that system, when the tile has documentation enabled. The documentation reader also opens on top of apps from a remote system.

On a phone, the documentation reader and every other app opened in a dialog now open in full screen.

A locked local user now sees a Locked Account message when signing in to a PWA launchpad, and a failed password reset now shows why the new password was rejected.

The border under the launchpad header no longer breaks where an open top menu meets it.

On a launchpad with a start application, the PIN pad stays busy after the last digit until the app has rendered, and the blackout dialog is raised reliably.

The PIN screen is no longer exposed while a launchpad is still loading.

The PWA service worker no longer grows the browser’s cache storage without bound. API and proxy responses are no longer cached, and storage accumulated by earlier versions is reclaimed automatically.

After an upgrade, the PWA service worker no longer serves a stale UI5 build from its cache.

A launchpad running a language that has no entry under the maintained additional languages now keeps that language instead of falling back to English. Signing out of such a launchpad no longer throws an error into the console.

i18n texts on tiles now translate when a PWA launchpad runs offline.

The launchpad header returns to the launchpad title when you move on from an open app with Show Active App Title in Launchpad Header enabled.

The SAML login button on a PWA launchpad opens the identity provider instead of a blank page.

A toast message now appears when a key is saved after editing.

Secret expiration notifications are now sent by email.

Web apps now get a version assigned when committed to Git, so pulling from Git can update an existing web app.