Skip to main content
circle-square
Outline Circle
square-square
Little Circle
square-square
Little Circle

Published Release Notes

Find release notes for the selected Pega Version and Capability.

Browse resolved issues for Platform releases.

Java injection vulnerability check

Valid from Pega Version 8.3

Pega Platform™ now notifies you of Java injection vulnerabilities in activities, functions, and stream rules at design time and at run time.  You can customize Pega Platform to check for additional vulnerabilities to ensure that your application runs without problems.

For more information, see Configuring the Java injection check.

Usability improvements to Admin Studio

Valid from Pega Version 8.3

Admin Studio offers a variety of usability enhancements, including:

  • New access groups to differentiate between full and read-only access to Admin Studio
  • A Java class lookup utility
  • A requestor list for the logged-on operator
  • The ability to display system node type in the logs

Also, if your environment uses Predictive Diagnostic Cloud (PDC), the Admin Studio overview page now includes a link to PDC.

For more information, see Managing requestors.

Simple associations for quickly joining classes

Valid from Pega Version 8.3

Associations now have a simple mode. Use a simple association to quickly and easily join a class to another class. The simple association defines a left join, using a foreign key in the source class and the class key in the target class. Use an advanced association for all other conditions. In addition, simple associations are drawn in the Visual data model reporting mode to visualize the relationships that are available for reporting.

Upgrade impact

The new simple mode draws a map of where all the classes defined in the application rule are drawn as nodes. Relationships between the nodes that are defined by relevant properties are drawn as lines linking the two classes. This feature only includes Case and Data classes that are defined on the Application rule form's Cases and Data tab. It also only includes relevant fields for those classes in order to define the relationships from one class to another.

What steps are required to update the application to be compatible with this change?

After a successful upgrade, add the data and case type classes to the application rule in Dev Studio to have the selected classes appear as a node. In addition, if you want a relationship to display as relevant, set the properties (of the class that defines that relationship) as relevant.

 

For more information, see Exploring the data model.

Association changes after upgrade

Valid from Pega Version 8.3

Associations now have a simple mode. Simple associations are those that join to only one class, use a left join, and have one filter condition to a class key in the target class. Existing associations that define a simple foreign key relationship are upgraded to simple associations when opened; all others are treated as advanced associations. All associations continue to work in reporting.

Making an association simple changes only one piece of metadata; all other data on the association rule is not affected.

Upgrade impact

The new simple mode draws a map of where all the classes defined in the application rule are drawn as nodes. Relationships between the nodes that are defined by relevant properties are drawn as lines linking the two classes. This feature only includes Case and Data classes that are defined on the Application rule form's Cases and Data tab. It also only includes relevant fields for those classes in order to define the relationships from one class to another. 

What steps are required to update the application to be compatible with this change?

After a successful upgrade, add the data and case type classes to the application rule in Dev Studio to have the selected classes appear as a node. In addition, if you want a relationship to display as relevant, set the properties (of the class that defines that relationship) as relevant.

 

For more information, see Associations.

 

Support for the JSON Web Token Bearer grant type for accessing external APIs

Valid from Pega Version 8.4

You can now access external APIs by using the new OAuth 2.0 JSON Web Token (JWT) Bearer grant type, in an OAuth 2.0 authentication profile. To use the JWT Bearer grant type as a client assertion, source the JWT from an active SSO session, a token profile, or a property reference. You can use JWTs that you obtain during an OpenID Connect SSO in connectors, to achieve user impersonation flows, such as the On-Behalf-Of (OBO) flow. The OAuth 2.0 type authentication profile now also supports authentication of client applications by using Private Key JWTs.

Instances of the OAuth 2.0 provider are now deprecated. As a best practice, use the new, unified authentication profile configuration instead.

For more information, see Configuring an OAuth 2.0 authentication profile.

Upgrade impact

After an upgrade to Pega Platform 8.4 and later, Authentication Profiles can take advantage of the new JWT based OAuth 2.0 grant type and client authentication features. To take advantage of this and other new security features, you must update any existing Authentication Profiles formats must to use those in Pega Platform 8.4 and later.

What steps are required to update the application to be compatible with this change?

Since these features are available only for profiles created in Pega Platform 8.4 and later, clients must open and then save existing 'Authentication Profile' instances to ensure that the configuration is compatible with the latest authentication formats.

Sign and encrypt signatures and content with additional algorithms

Valid from Pega Version 8.4

You can now authenticate using JSON Web Token (JWT) token profiles to symmetrically and asymmetrically encrypt both signatures and content. All algorithms in the Nimbus JWT library are supported, including nested tokens. Custom key identifier headers (kid) are also supported. Use token profiles to securely propagate identities and transfer data between systems.

For more information, see Creating a processing JSON Web token profile.

For more information, see Creating a generation JSON Web token profile.

Custom application URL alias in the application definition

Valid from Pega Version 8.4

Create application URL aliases that support your ability to launch multiple Pega applications simultaneously in a single browser. This feature makes it easier for clients and your customers to log into multiple applications using the same browser and access them simultaneously. You configure your application URL alias in the application definition. For details, see Adding an application URL alias.

For more information, see Simplify access with an Application URL alias (8.4)

Upgrade impact

After an upgrade to Pega Platform™ 8.4 and later, review to determine if and how you must update your application rules to reflect the current URL aliasing format. As part of these application rule updates, Pega also updated the URL format and value components of the clipboard property, pxRequestor.pxReqServletNameReal, which you can use to discover a servlet name. If your application uses this property to discover a servlet name, update the pxRequestor.pxReqServlet property in the application rule to use the new, required URL and value formats.

For details steps, see the section, Upgrading from Pega 8.3 or earlier: Guidelines for any required changes in your application URL aliasing, in the appropriate Pega Platform Upgrade Guide available at Deploy Pega Platform

What steps should the customer take to update their application?

After upgrading, you must update your JMeter test scripts. For detailed steps, see Updating JMeter test scripts after migrating to Pega 8.4.

Add the security checklist to applications created before 7.3.1

Valid from Pega Version 7.3.1

The security checklist is now automatically added to applications. You can manually add the security checklist to applications that were created in earlier versions.

You can improve the security of your application by completing the tasks on the checklist.

The following task reflects the procedure on how to manually add the security checklists to Designer Studio prior to 7.3.1:

  1. In the header of Designer Studio, click the name of the application, and then click Definition.
  2. Click the Documentation tab.
  3. In the Application guides section, click Add guide.
  4. In the Application guide& field, enter pxApplicationSecurityChecklist.
  5. Click the Configure icon in the Available in column and select the portals (App Studio and Dev Studio) that you want to add the security checklist to.
  6. Click Save.

Expanded checks for Java injection vulnerabilities (8.4)

Valid from Pega Version 8.4

The Java injection vulnerability check feature has been enhanced in Pega Platform™ to further prevent Java injection, including Edit validate, Edit input, and JSP rules. Pega Platform reports errors at design time and run time, and does not run any rule that includes any of the following Java code:

  • JavaCompiler
  • new ProcessBuilder()
  • org.dita.dost.invoker
  • Runtime.getRuntime()

For more information, see Configuring the Java injection check.

New JWT access token format: Authorized Access Token

Valid from Pega Version 8.5

Pega Platform™ is changing from using opaque tokens to using JSON Web (JWT) tokens and the JWT access token format: Authorized Access Token (AAT). An AAT enables a client application to validate the server for user permissions and authorizes a specific application to access specific parts of a user’s data.

The major benefits to using the JWT format are:

  • The JWT is a self-contained token that has authentication information, expire time information, and other user-defined claims digitally signed.
  • A single token can be used with multiple applications.
  • The tokens are short-lived and can minimize damage if transport security is compromised, as the token signature is verified.
  • As the token is verified with the signature, there is no need to verify against a database, thus reducing latency (usually important for Web APIs).

For more information, see Understanding authorized access tokens.

All Pega product release notes can be found on their product pages.

Ready to crush complexity?

Experience the benefits of Pega Community when you log in.

We'd prefer it if you saw us at our best.

Pega Community has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice
Contact us