Published Release Notes

Java injection vulnerability check

Pega Platform™ now notifies you of Java injection vulnerabilities in activities, functions, and stream rules at design time and at run time.  You can customize Pega Platform to check for additional vulnerabilities to ensure that your application runs without problems.

For more information, see Configuring the Java injection check.

Usability improvements to Admin Studio

Admin Studio offers a variety of usability enhancements, including:

• New access groups to differentiate between full and read-only access to Admin Studio
• A Java class lookup utility
• A requestor list for the logged-on operator
• The ability to display system node type in the logs

Also, if your environment uses Predictive Diagnostic Cloud (PDC), the Admin Studio overview page now includes a link to PDC.

For more information, see Managing requestors.

Simple associations for quickly joining classes

Associations now have a simple mode. Use a simple association to quickly and easily join a class to another class. The simple association defines a left join, using a foreign key in the source class and the class key in the target class. Use an advanced association for all other conditions. In addition, simple associations are drawn in the Visual data model reporting mode to visualize the relationships that are available for reporting.

Upgrade impact

The new simple mode draws a map of where all the classes defined in the application rule are drawn as nodes. Relationships between the nodes that are defined by relevant properties are drawn as lines linking the two classes. This feature only includes Case and Data classes that are defined on the Application rule form's Cases and Data tab. It also only includes relevant fields for those classes in order to define the relationships from one class to another.

What steps are required to update the application to be compatible with this change?

After a successful upgrade, add the data and case type classes to the application rule in Dev Studio to have the selected classes appear as a node. In addition, if you want a relationship to display as relevant, set the properties (of the class that defines that relationship) as relevant.

For more information, see Exploring the data model.

Association changes after upgrade

Associations now have a simple mode. Simple associations are those that join to only one class, use a left join, and have one filter condition to a class key in the target class. Existing associations that define a simple foreign key relationship are upgraded to simple associations when opened; all others are treated as advanced associations. All associations continue to work in reporting.

Making an association simple changes only one piece of metadata; all other data on the association rule is not affected.

Upgrade impact

The new simple mode draws a map of where all the classes defined in the application rule are drawn as nodes. Relationships between the nodes that are defined by relevant properties are drawn as lines linking the two classes. This feature only includes Case and Data classes that are defined on the Application rule form's Cases and Data tab. It also only includes relevant fields for those classes in order to define the relationships from one class to another. 

What steps are required to update the application to be compatible with this change?

After a successful upgrade, add the data and case type classes to the application rule in Dev Studio to have the selected classes appear as a node. In addition, if you want a relationship to display as relevant, set the properties (of the class that defines that relationship) as relevant.

For more information, see Associations.

Case-insensitive filtering in reports

Filtering in reports is now case-insensitive, improving the reporting and searching experience. You can turn off case-insensitive filtering, for example, by using an activity. You might want to do this if your index is too big or if the length of time it takes for indexing impacts performance.

For more information on report filtering, see Editing filter conditions.

All search data is encrypted

All search data in Pega Cloud deployments is now encrypted, both at rest and in transit. The encryption of search data makes search compliant with regulatory requirements.

For more information about search, see Full-text search.

Authentication service for basic credentials

A new type of authentication service is available for authenticating operators by using basic credentials (user ID and password). The default Pega Platform™ login is now an instance of this type of authentication service. All basic credentials authentication services include mobile authentication with the OAuth 2.0 protocol and Proof Key for Code Exchange (PKCE). You no longer have to create a custom authentication service to support mobile applications.

For more information, see Configuring a basic authentication service.

Unauthenticated sessions transition seamlessly to authenticated

A new authentication service type allows a guest user to use an application without logging in, and to be prompted to authenticate later in the session. This enhancement supports scenarios such as online shopping portals where a user can browse for items and load a shopping cart as a guest but be prompted for credentials at checkout.

For more information, see Configuring an anonymous authentication service.

Create single sign-on authentication services from App Studio

You can create and enable single sign-on (SSO) authentication services from a new landing page in App Studio. From this new landing page you can also configure new SAML and OpenID Connect authentication services to provision users. For more information, see Creating a SAML SSO authentication service and Creating an OIDC SSO authentication service.

Protect against insecure deserialization

Deserialization is the process of rebuilding a data stream into a Java object. The Open Web Application Security Project (OWASP) has identified insecure deserialization as one of the top 10 security vulnerabilities for web applications. Pega Platform™ protects against this vulnerability by using filters that prevent deserialization of suspect data streams. You can configure these filters from the Deserialization Blacklist landing page.

For more information, see Configuring the deserialization filter.