ServiceNow SDK 4.14.0
SDK 4.14.0
security~~***************!
ServiceNow SDK 4.14.0 changes how credentials are stored: they are now encrypted with AES-256-GCM in a local file under ~/.now-sdk/credentials.enc, with only a 32-byte key kept in the OS keychain. A new SN_SDK_CREDENTIALS_DIR variable sets the credentials directory. The release also lists one security fix that preserves Sys_dictionary security roles through transform and build, along with about 19 fixes to transform and build behavior.
What changes for platform teams
Teams that run the SDK in CI or on shared machines should check where credentials.enc is written and whether SN_SDK_CREDENTIALS_DIR is needed for their runners. Pipelines that rely on the previous credential storage location may need updating.
Changes
- Sys_dictionary security roles are preserved through transform and build.security
- Credentials are encrypted with AES-256-GCM and stored in ~/.now-sdk/credentials.enc. The file has no size limit.changed
- Only a random 32-byte encryption key is kept in the OS keychain (macOS Keychain, Windows Credential Manager, or the Linux keyring), under the account now-sdk-credentials-key. It's a fixed size and never approaches any platform's limit.changed
- SN_SDK_CREDENTIALS_DIR — directory for credentials.enc. Defaults to ~/.now-sdk; an empty value is treated as unset.changed
- Fixed single quotes in attribute values being written unescaped on transform.fixed
- Scoped apps no longer treat tables carrying their own scope prefix as augmentations of an existing table.fixed
- Unlabeled columns get the platform's sentence-case label on transform.fixed
- OverrideColumn readOnlyOption now matches instance behavior.fixed
- Sys_name is preserved for sys_number records and set on override records.fixed
- Role() and Property() keep an explicit suffix.fixed
- Script Includes: a missing sandbox_callable now falls back to client_callable, as on the platform.fixed
- Related lists are written as a single XML with their entries.fixed
11 more lines
- Fixed duplicate sys_es_latest_script records on transform.fixed
- Sys_ui_message records are now handled as regular records instead of being dropped.fixed
- Sys_app vendor / vendorPrefix are preserved during Fluent conversion.fixed
- Fixed an AIUX ACL path-handling bug on Windows.fixed
- Fixed corrupted component_props on dashboard widgets that aren't chart-family widgets.fixed
- RestApi: default_operation_uri is set only on the route matching the API's default version.fixed
- Fixed an unresolved default_view identifier breaking List update names.fixed
- Fixed the Array.from polyfill in now-ux-globalsfixed
- Updated third-party dependencies to address reportfixed
- Required AI-agent fields are now allowed regardless of aiAgentFieldDisplayPreferences.fixed
- Fixed unquoted gs.dateGenerate arguments in the RequestAdHocApproval list query.fixed
2 maintenance lines (dependency bumps, CI, tests, docs)
- ATF guides now recommend testing as a dedicated user with the app's role, and looking up a table's schema before setting its fields.maintenance
- Fixes to the UI page patterns, application menu, and UI page guides.maintenance
Full release notes ↗ · all ServiceNow SDK releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules