SDK 4.13.x Patch Notes
ServiceNow released SDK 4.13.x patch changes. The release adds table support for db_object_id in bootstrap and for configuration_access, and adds a protectionPolicy option for sys_security_acl_role. It fixes an OAuth CSRF issue by restoring cookie replay and binding CSRF lookup to the exact session, and it also fixes a now-ux-globals Array.from polyfill requirement and a TypeScript error during UI type-checking.
platform teams Platform teams that use the ServiceNow SDK should pick up the OAuth CSRF fix, which is a security fix in the SDK itself. Teams managing ACL rules can use the new protectionPolicy option on sys_security_acl_role, and telemetry events no longer have person profile processing applied.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- +Added table support for db_object_id in bootstrap and for configuration_access.added
- +Added a protectionPolicy option for sys_security_acl_role.added
- *Fixed an issue requiring an Array.from polyfill in now-ux-globals.fixed
- *Fixed an OAuth CSRF issue by restoring cookie replay and binding CSRF lookup to the exact session.fixed
- ·Bumped isomorphic rollup dependency.other
- ·Improved telemetry client safety across SDK version boundaries.other
- ·Build/tooling fix to eliminate a TypeScript error during UI type-checking.other
- ·Disabled person profile processing on telemetry events for improved privacy.other
8 lines2 added2 fixed4 othertyped from the source notes
SDK 4.13.0
ServiceNow SDK 4.13.0 adds support for adding an index to an existing table during table augmentation. It also changes augmentation so it no longer overwrites platform-set columns such as access flags. The release fixes an inline script scriptActive field update and a label cache bug that could produce stale labels.
platform teams Teams building ServiceNow apps through the SDK can add indexes to existing tables without losing platform-managed columns like access flags. Teams should review any augmentation scripts that relied on the earlier overwrite behavior.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- +Table augmentation now supports adding an index to an existing table.added
- +Augmenting an existing table no longer overwrites platform-set columns like access flags.added
- *Inline script scriptActive field is now updated correctly.fixed
- *Resolved a label cache bug that could produce stale labels.fixed
10 maintenance lines (dependency bumps, CI, tests, docs)
- ·Hoisting support extended to Try/Catch and Data-in-Process (DIP) blocks, with docs for the hoisting use case.maintenance
- ·EndFlow is now supported inside a Catch block.maintenance
- ·Variant overrides and variant-specific activities — a playbook can now express variants with their own activities and per-variant overrides on shared activities.maintenance
- ·New Go Back activity for navigating back to a prior step in a playbook, with a build-time diagnostic for the variant evaluation point.maintenance
- ·IsIdealPath on decision branches — mark the intended happy-path branch on a decision.maintenance
- ·Automation plan pills — support for automation plan pill references in playbook fields.maintenance
- ·Image attachment support on playbook activities.maintenance
- ·Public playbooks — support authoring playbooks that expose a public API.maintenance
- ·Activity action-overrides for customizing activity actions per playbook.maintenance
- ·Fixes: empty args in a variant-override startRule After() on transform; validation for mandatory activity inputs and experience properties; corrected JSDoc @since versions.maintenance
14 lines2 added2 fixed10 maintenancetyped from the source notes
SDK 4.12.0
- *Fixed SPMenu double-wrapping widgetParameters that were already wrapped in {value, displayValue} form, corrupting widget configuration.fixed
- *The SDK now retries once on an HTTP 401 during instance requests to recover from an expired session, instead of failing the operation outright.fixed
- *Fixed CSRF token handling for non-OAuth credentials, restored alongside the session-cookie fix above.fixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bumped the bundled isomorphic-rollup dependency, picking up several upstream Vite fixes and fixes for sourcemap support.maintenance
4 lines3 fixed1 maintenancetyped from the source notes
SDK 4.11.0
- +Support for vite for building applications, and for dev server bringing support for HMR. Find an example app in sdk-examples repo.added
- +Added table support for sys_ui_style, so Field Styles (conditional list/form styling rules) can now be defined with Record().added
- +Fixed sys_ui_list records being lost during install due to missing root XML attributes; added support for setting a domain on lists.added
- +Fixed form sections created via Record() breaking on rebuild when they referenced the platform's built-in Default view.added
- +Fixed table-level documentation (hint/help/URL text) being dropped or incorrectly merged with column-level documentation during build/transform.added
- +Form, list, and choice-set generated XML now correctly sets apply_defaults on child elements.added
- +Fixed reference fields on sys_dictionary records (e.g. dictionary overrides) being serialized incorrectly on update.added
- +Fixed Data Policy Rule fields at their default (unenforced) state round-tripping to an invalid XML value instead of the correct platform default.added
- +Fixed builds generating unsafe delete instructions for table, column, and index definitions.added
- +Fixed an incorrect view reference on sysrule_view_workspace records, and documented how to work around similar reference issues.added
- +Fixed UI Page apps loading legacy platform scripts that could silently break modern client libraries relying on native Array.from behavior (e.g. overlay dismissal and keyboard navigation in Radix UI-based components).added
- +Fixed app logo images not converting correctly when transforming a sys_app record from XML.added
23 more lines
- +CLI error logs now include the underlying cause of fetch failures (e.g. network/auth errors), making them easier to diagnose.added
- +Fixed CLI OAuth login unexpectedly requesting an id_token.added
- +Reworked the doTheFollowingUntil flow logic with an improved design, and added a validation error for using until outside of doTheFollowingUntil.added
- +Fixed complex output handling in assignActionOutputs.added
- +Fixed an inline-script issue in setFlowVariables.added
- +Allowed Decimal values inside FlowObject/FlowArray structures.added
- +Added a rawInputs property to the flow Action type for dependent-field resolution.added
- +Fixed AI Agent version details being silently dropped for legacy/migrated agents that store instructions directly on the agent record instead of a version record.added
- +Fixed skill input/output names incorrectly rendering as empty instead of falling back to the attribute name.added
- +Added support for adding/editing Playbook and Stage Level Permissions.added
- +Added optional activity support.added
- +Added Set Playbook Outputs Activity definition support.added
- +Added support for adding/editing Agentic Activity configuration on Hybrid Agentic Activities.added
- +Added On-Demand launcher configurations.added
- +Updated build to output a single XML artifact similar to the platform.added
- +Added support for input-dependent resolution in Playbook activities.added
- +Fixed removed lanes and activities being left orphaned instead of properly deleted.added
- +Fixed reference qualifiers being dropped for playbook inputs during transform.added
- +Fixed global optional activity variables being incorrectly renamed on transform.added
- +Fixed startWithDelay duration transform issues.added
- +Fixed TemplateValue pills transform not updating the pill value.added
- +Playbook warnings for unsupported features now include the playbook's name for easier troubleshooting.added
- *Flow actions now generate valid XML with the correct table name in <record_update> elements.fixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Added an SDLC whitepaper and build-support guide.maintenance
36 lines34 added1 fixed1 maintenancetyped from the source notes
SDK 4.10.0
- *Fixed a timezone default mismatch that could shift run_start during round-trip — an empty/floating timezone is now treated as UTC consistently in both directions.fixed
- *Fixed an "Invalid time value" crash when a timezone conversion landed exactly on midnight.fixed
- *Fixed midnight (00:00:00) execution times being dropped instead of preserved.fixed
- *Removed incorrect defaults for entered_time, run_weekinmonth, and run_month that didn't match the platform's actual database defaults.fixed
- *Added many-to-many relationship (mtom) attribute support to reference columns.fixed
- *Table access policy fields are now only written when explicitly defined, instead of always being emitted.fixed
- *Column max_length now defers to the instance's install-time default instead of the SDK guessing a value.fixed
- *Fixed build failures related to sys_ux_macroponent categories on non-standard platform values.fixed
- *Tightened the criteria for emitting sys_documentation on build to avoid unnecessary noise.fixed
- *Stopped incorrectly inferring add_message from a Business Rule's message field.fixed
- *Added icon field support to UiAction and fixed a client boolean handling bug in build.fixed
- *Reference columns are now inferred from table schema, and view fields resolve correctly by name.fixed
2 more lines
- *Numeric-literal choice field values (e.g. a schema resolving to a union of number literals) are now coerced correctly instead of being missed.fixed
- *Fixed $meta on Form not being usable to control output directory.fixed
5 maintenance lines (dependency bumps, CI, tests, docs)
- ·Added support for authoring and running list steps in ATF tests.maintenance
- ·Added surface support for the runServerSideScript step in Script Include ATF tests.maintenance
- ·Fixed a catalog client script order mapping bug.maintenance
- ·Preserved label overrides on inherited table fields during transform.maintenance
- ·Local_or_existing is now omitted correctly when not present in the source record.maintenance
19 lines14 fixed5 maintenancetyped from the source notes
SDK 4.9.0
- +Added protectionPolicy support to AiAgent/AiAgenticWorkflow.added
- +Added support for additional LLM providers: Now LLM LTS Generic, Google Cloud Vertex AI (alias of Google Gemini), and Amazon Bedrock (alias of AWS Claude) — plus new model options (gpt-5-mini, gemini_small, claude-haiku-4-5, llm_generic_small_v2-lts).added
- +Added federatedId support to Role.added
- +Added the missing allow_high_security_roles field to the Flow type definition, fixing transform failures.added
- +Added a fallback to the Record API when Flow/Action hoisting can't be detected.added
- *Fixed a transform crash on legacy sn_aia_agent_config XML that was missing public or agent_learning boolean fields.fixed
- *Fixed a descendant-only table transform that emitted an invalid shape and could fail the build.fixed
- *Fixed missing advanced_mode field handling so agent configs without it no longer error.fixed
- *Fixed a wrong default value in the built-in new-record-form activity definition that could cause a cycle and out-of-memory error during transform.fixed
- *Fixed provider resolution during transform for skills where multiple providers (e.g. Azure, Google, Bedrock) share a single capability definition — each configuration's own provider now resolves correctly instead of falling back to the definition's default.fixed
- *Preserve the order field on ClientScript transform/build instead of resetting it.fixed
- *Preserve field values for all event types, and downgraded an overly strict error diagnostic to a warning.fixed
12 more lines
- *Fixed the Look Up Record action's compiled output emitting its parameter under the wrong internal name (dont_fail_flow_on_error).fixed
- *Fixed action table definitions creating multiple records instead of updating a single record.fixed
- *Fixed record-format flow files splitting companion records between sys_hub_flow and sys_hub_flow_snapshot model references, which could produce a "Corrupted flow" error. Introduced main_snapshot support so Flow/Action definitions no longer generate a new snapshot on every rebuild.fixed
- *Fixed action step sequence numbering not starting from 1 in the Workflow Studio canvas for adapter subflows.fixed
- *Fixed endFlow used inside "Do the following in parallel" throwing build errors.fixed
- *Fixed wfa.flowLogic.elseIf steps not rendering after build.fixed
- *Fixed a complex object input issue for Spoke actions.fixed
- *Fixed inline scripts inside TemplateValue being converted to a plain string in both the build and transform directions.fixed
- *Fixed FieldListColumn's dependent attribute not honoring its non-mandatory setting.fixed
- *Fixed Subflow/Action inputs and outputs of type Choice changing from "Dropdown with None" to "Dropdown without None".fixed
- *Fixed internalName handling for Flow and Action definitions.fixed
- *Fixed the Flow "post install" hook to publish only the flows in the project instead of all flows in the scope.fixed
6 maintenance lines (dependency bumps, CI, tests, docs)
- ·Numeric and reference fields in ImportSet and SLA no longer silently revert to their default value when a valid value is provided.maintenance
- ·Fixed invalid gzip data produced when transforming a bad/corrupted attachment.maintenance
- ·Fixed use_reference_qualifier not defaulting to simple when unset on input XML.maintenance
- ·Fixed the column plugin dropping the "edge encryption" attribute during transform.maintenance
- ·Fixed FieldListColumn transform and added missing parent table definitions for sys_report.maintenance
- ·ScheduledScript: fixed invalid run_time (and run_period/max_drift/offset) output when executionTime, executionInterval, maxDrift, or offset were passed as plain objects (e.g. { hours: 9, minutes: 30 }) instead of the Time()/Duration() helpers — both forms now produce correct output.maintenance
30 lines5 added19 fixed6 maintenancetyped from the source notes
SDK 4.8.1
- !SDK: Update vulnerable transitive dependenciessecurity
- *CLI: Fix credential information logging during query command with -o json output modefixed
- *Flow: Action tables are creating multiple records rather than a single recordfixed
- *Flow: Fix Flow and Action definitions generating new snapshots on every rebuildfixed
- *Flow: Fix missing internal name for Flows, Subflows, and Actionsfixed
- *Flow: Fix Datapills from actions inside Do-In-Parallel and Try-Catchfixed
- *Flow: Fix FieldListColumn dependent is set as required instead of optionalfixed
- *Flow: Fix Subflows/Actions with Inputs or Outputs of type "Choice" are changing from "Dropdown with None" to "Dropdown without None"fixed
- *Flow: Action defined in a dependency scope, any input that is a complex object is serialized incorrectlyfixed
- *Flow: Fix Flows post install hook to pass the IDs of flows in the project to publish instead of trying to publish all flows in the scopefixed
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Update Now.ID guide to advise LLMs to not invent sys IDsmaintenance
11 lines1 security9 fixed1 maintenancetyped from the source notes
SDK 4.8.0
- ·$override on DataPolicy and UserPreferenceother
- ·ScheduledScript supports $metaother
- ·ACL field accepts custom column typesother
3 lines3 othertyped from the source notes
SDK 4.7.0
- +Adds support for configuring role-based access on NowAssist Skills via two fields (at least one field must be defined):added
- +Added augment property. Use this when augmenting an existing table that is not part of the application scope. This can be used when you need to add properties.added
- +Added createAccessControls for creating default access controlsadded
- +Added userRole to wire the tables auto-generated access controls to a given user role.added
- +Added protectionPolicy to all APIs that have sys_policy support in metadata.added
- +Transform by table — The transform command now supports targeting one or more specific tables at a time. Records are filtered to the metadata directory on transform, and transformed XML files are cleaned up automatically.added
- +Performance - The CLI startup time has been substantially reduced, particularly for commands that don't load the project such as explain, help, version, etc.added
- +OAuth client_credentials auth for CI install — The install command now supports OAuth client_credentials flow via environment variables for CI/CD pipeline authentication. New env variables are available to configure this, see ci integration docs.added
- +Init in current working directory — The init command can now be run directly in the current working directory without requiring a new subdirectory.added
- *Fixed datapill becoming empty in script step input for custom action.fixed
- *Fixed an empty annotationType causing a build error after transform.fixed
- *Fixed a missing action_status element mapping when wfa.errorEvaluation() is present.fixed
24 more lines
- *Fixed internal_name being regenerated from name during Fluent→XML transformation.fixed
- *Fixed sys_dictionary records not being set to active as part of component output.fixed
- *Fixed calculated and reference field qualifier handling.fixed
- *Fixed callerAccess had incorrect default valuefixed
- *Fixed choice on column componentns had incorrect default valuefixed
- *Fixed the UI Policy plugin dropping sys_ui_policy_action and sys_ui_policy_rl_action records.fixed
- *Fixed Column readOnly and readOnlyOption handlingfixed
- *Fixed default values for service catalog records.fixed
- *Fixed carriage returns not being escaped, which caused data loss during round-trips on Windows.fixed
- *Fixed transform generating invalid Fluent for ACL, ScriptInclude, and Test records in some situations.fixed
- *Fixed ScheduledScript weekly frequency validation to accept either dayOfWeek or daysOfWeek.fixed
- ·Flow Stages — Flows now support stage definitions, with diagnostics and the ability to use stages inside tryCatch blocks.other
- ·TryCatch — Flows can now define try/catch logic blocks for structured error handling.other
- ·DoInParallel — A new flow logic block enables parallel execution of steps within a flow.other
- ·AppendToFlowVariables — A new action appends values to existing flow variable collections.other
- ·Action Outputs and Error Evaluation — Flows can now evaluate action outputs and error states as part of flow logic.other
- ·RoleList made optional, roleMap added — Both DataAccessConfigType (AiAgent) and DataAccessConfigWorkflowType (AiAgenticWorkflow) now accept either roleList (legacy role sys_ids) or the new roleMap (role names stored in M2M sys_agent_access_role_mapping records). At least one must be non-empty at build time. Customers on ZP10 or later should prefer roleMap.other
- ·AgentDescriptor field added to AiAgent — New optional field ('require_caller_id' | 'created_by_ai_agent_advisor' | 'created_by_build_agent' | '') written to sn_aia_agent_config.other
- ·RoleMap recommended for ZP10 and AP3+other
- ·RoleRestrictions pre ZP10 and AP3 instancesother
- ·Corrected the lookUpRecord core action property from snc_dont_fail_on_error to dont_fail_flow_on_error.other
- ·Fluent linting level for server modules is now overridable via new linter property in now.config.jsonother
- ·Scope prefix is now validated against the instance vendor code during init command if auth is configured.other
- ·Improved build times for large projects by reducing garbage collection pressure.other
36 lines9 added14 fixed13 othertyped from the source notes
SDK 4.6.1
- +Add new field augments for Table. Use this when adding new columns to existing tables that do not belong to this appadded
- *Fix transform generating invalid Fluent for ACL, ScriptInclude, and Testfixed
- *Fix when ScriptInclude has access=package_private and caller_access=2fixed
- *Fix when ACL has local_or_existing = empty stringfixed
- *Fix when Test missing second argument in some situationsfixed
- *Fix ServiceCatalog not setting correct default values for no_search and ui_typefixed
- *Fix transform for calculated and reference field qualifiers on Table columnsfixed
- *Fix active not being set on sys_dictionary outputs by defaultfixed
8 lines1 added7 fixedtyped from the source notes
SDK 4.6.0
- ~The Table API now supports creating dictionary override records (sys_dictionary_override) directly, without needing a separate API.changed
- ~ScheduledScript script fields now support modules.changed
- ~Project templates have been simplified: tsconfig relocated to src/, unnecessary index file removed, and a jsconfig added for JavaScript templates.changed
- +Author Custom Actions — Custom Action definitions can now be created directly in Fluent with typed step references for IntelliSense and compile-time safety. Script steps are externalized to separate files for a better editing experience.added
- +Call Subflows from Flows and Subflows — Flows and Subflows can now invoke other Subflows as steps.added
- +Call Custom Actions from Flows and Subflows — Custom Actions can be used as steps within Flows and Subflows.added
- +Reference global and cross-scope Subflows and Actions — Flows and Subflows can reference Subflows and Custom Actions from global scope or other application scopes via the SDK's dependency mechanism.added
- +More accurate results using tag-based lookup.added
- +--list displays the full index of available topics.added
- +--format=raw outputs raw Markdown.added
- +--peek shows a brief summary without opening the full document.added
- *Fixed duplicate tool inputs and outputs being generated in certain configurations.fixed
17 more lines
- *Fixed issues with UI action handling in skill definitions.fixed
- *Fixed delete functionality for skill records.fixed
- *Fixed active flag not being correctly applied during build.fixed
- *Fixed duplicate M2M records being created for catalog and knowledge base items when using the Service Portal Fluent API.fixed
- *Fixed missing portal settings and availability config fields on CatalogItemRecordProducer that were already supported on CatalogItem (hideAddToCart, hideAddToWishList, hideDeliveryTime, hideQuantitySelector, hideSP, image, model, mobilePictureType).fixed
- *Fixed source manifest generation failing when a project contains multiple UI pages with different entry file names.fixed
- *Fixed source artifacts missing assets that were imported via CSS url() references.fixed
- *Fixed a regression where flow variable column types were lost during build.fixed
- *Fixed a data type mismatch in datapill expressions where reference types were incorrectly treated as strings.fixed
- *Fixed empty strings being silently accepted for mandatory inputs in core actions.fixed
- *Fixed HTML entities being appended as individual characters instead of being decoded during transform.fixed
- *Fixed a TypeScript error after transform where "GUID" was not recognized as a valid flow data type.fixed
- ·SPHeaderFooter for creating header and footer recordsother
- ·SPPageRouteMap for defining page-to-page redirect mappings within a portalother
- ·Fluent vs Fluent conflicts (two .now.ts files defining the same record) always produce an error.other
- ·XML vs Fluent conflicts continue to respect the --errorOnConflict flag.other
- ·TableDefaultLanguage in now.config has been renamed to defaultLanguage. The old name continues to work but is deprecated.other
2 maintenance lines (dependency bumps, CI, tests, docs)
- ·Fixed UI Page build failures when inline scripts contain unescaped < operators or HTML literals.maintenance
- ·Fixed object keys that start with a digit not being quoted, which caused JavaScript parse errors.maintenance
31 lines8 added3 changed13 fixed5 other2 maintenancetyped from the source notes
SDK 4.5.0
- ~Removed eslint dependency from projects and updated internal reference to v9. After upgrading to 4.5.0 of @servicenow/sdk you can remove the dependency on @servicenow/eslint-plugin-sdk-app-plugin from your projects package.jsonchanged
- ~Init command no longer prompts for credentials unless converting from the instancechanged
- ~Fix metadata folder content copy for binary files being copied as utf8changed
- ~FieldListColumn accepts either dependent or attributes.tablechanged
- ~Fix EmailNotification not correctly escaping encoded valueschanged
- ~Fix CatalogItem checkbox selection required field mapping missingchanged
- ~Fix dev server watching HTML and CSS asset fileschanged
- ~Fix unable to create global app with UI customizationschanged
- ~Flow fixes:changed
- ~SetFlowVariable transform issueschanged
- ~SubFlow complex object transform issueschanged
- ~Trigger createOrUpdate converting to wrong type on transformchanged
14 more lines
- ~Flow runAs defaulting to user instead of systemchanged
- ~Issues with diagnostic errors on setFlowVariables not workingchanged
- +Adds new Fluent APIs AiAgent for creating AI Agent definitionsadded
- +Adds new Fluent API AiAgentWorkflow that allows for creating dynamic agentic workflow definitionsadded
- ·LinterCheckother
- ·ScriptOnlyCheckother
- ·ColumnTypeCheckother
- ·TableCheckother
- ·SPPage for creating pagesother
- ·SPTheme for creating themesother
- ·SPWidget for creating widgetsother
- ·SPMenu for creating menusother
- ·All Flows and Subflows installed from the SDK will now be auto published as part of now-sdk install. Use flag -skip-flow-activation to disable this if needed.other
- ·NOTE: This requires version 4.1.1 or later of the ServiceNow IDE installed on your instance.other
26 lines2 added14 changed10 othertyped from the source notes
12 older releases
| 4.4.0 | 2026-03-12 | minor | ++++~~~~~~ 15 lines |
| 4.3.0 | 2026-02-25 | minor | ++++++++ 39 lines |
| 4.2.0 | 2026-01-21 | minor | *********** 29 lines |
| 4.1.1 | 2025-12-10 | patch | security **! 3 lines |
| 4.1.0 | 2025-11-25 | minor | ++++++++********** 22 lines |
| 4.0.2 | 2025-09-29 | patch | * 2 lines |
| 4.0.1 | 2025-09-17 | patch | ****** 8 lines |
| 4.0.0 | 2025-09-04 | major | breaking ++++++++~~~~~~ 31 lines |
| 3.0.3 | 2025-07-24 | patch | * 3 lines |
| 3.0.2 | 2025-05-19 | patch | ********* 9 lines |
| 3.0.1 | 2025-05-06 | patch | **** 4 lines |
| 3.0.0 | 2025-03-31 | major | ~~~~~~~~~~~~~~~~~ 17 lines |