Composer API: Event-Driven Webhook Notifications for Merge Events

Composer API introduces webhook-based event notifications for merge completion events, supporting both MERGE_SUCCESS and MERGE_FAILED states.

These capabilities enable administrators, integration developers, and technical teams to automate downstream workflows, reduce API traffic, and maintain robust event-driven integrations with Composer API.

For more details, refer to Event Notifications.

Platform Composer OAuth Authentication and Payload Optimization

This release updates the Platform Composer module to enhance authentication security and optimize payload handling. OAuth authentication for both the Lightning Component merge flow and the Email Preview feature now occurs through the Composer backend using oauthProxy.aspx, aligning with the Composer UI flow. These components open a new authentication window or popup, retrieve the CAID, and use it as the access token for subsequent operations, supporting both Legacy and Platform composer merge flows. This approach provides consistent and secure token handling across all Composer interfaces.

Salesforce access_token values are now restricted to server-side processing, preventing exposure in mobile and Lightning flows. Mobile and Salesforce1 users authenticate once and reuse a stored refresh token for silent re-authentication, while the client receives only authentication state responses, further strengthening security.

Additionally, merge operations in Platform Composer now store only lightweight metadata and S3 references for large dataset payloads in Redis, rather than full dataset objects. This change reduces memory usage and network impact, addressing issues related to large payload handling and improving system reliability.

No changes to existing data or user permissions are introduced in this release.

Composer Integration with DocuSign AppLauncher for Salesforce Package

Composer integrates directly with the DocuSign for Salesforce App Launcher package, supporting both legacy and platform Composer solutions. Existing DocuSign integration parameters are mapped to their equivalents in the new App Launcher UI.

The integration supports end-to-end flows initiated from Salesforce, including UI-based and fully automated (background mode) document generation and sending. Composer solutions launched via custom Salesforce buttons, Conga Trigger, and Conga Batch are compatible with the DocuSign App Launcher package. Both the legacy and new Document Merge UIs in Salesforce are supported, and users are redirected to the DocuSign UI for envelope preparation and recipient configuration.

Administrators and implementation teams can migrate existing solutions without rebuilding, as parameter compatibility is maintained. Documentation is updated to guide both existing DocuSign7 customers and new users through integration and migration steps. For more information, see Install and Setup DocuSign AppLauncher for Salesforce.

Conga Logo Standardization and Branding Update Across Composer and Batch Screens

All Conga logos and brand visuals across Composer and Batch Trigger screens are updated to reflect the latest Conga branding. This update standardizes logo style, size, alignment, and placement in accordance with the new design system and UI/UX guidelines.

PKCE and RTR Enforcement for Composer OAuth Flows

Salesforce enforces Proof Key for Code Exchange (PKCE) and Refresh Token Rotation (RTR) across all Composer OAuth flows, including Composer, Batch, Trigger, CIG, and CQG connected apps. All authorization requests include the required code_challenge and code_challenge_method=S256 parameters, and token exchanges require a valid code_verifier, which is securely managed and removed after use. Legacy non-PKCE flows are deprecated, and PKCE is mandatory for all new and existing integrations.

For more information, see Secure Your Connected Apps and External Client Apps.

Salesforce Security Compliance and Code Analyzer Security Updates

This release continues to strengthen security across Composer, CQG, CIG, and batch packages by addressing findings from Salesforce Code Analyzer and Checkmarx scans. The application enforces CRUD (Create, Read, Update, Delete) and Field-Level Security (FLS) checks across all Apex controllers and services, ensuring that all data queries and DML operations validate object and field permissions, including for standard and custom objects such as Lead. Dynamic SOQL queries now use strict server-side whitelisting for allowed objects and fields, blocking unauthorized access to sensitive metadata and restricting client-controlled inputs. Debug logs are sanitized to remove or mask sensitive information such as access tokens, session IDs, and authorization headers, reducing the risk of information leakage.

Administrators and implementation teams benefit from enhanced security, improved compliance with AppExchange requirements, and reduced risk of unauthorized data access or code vulnerabilities. For more information, see PMD AppExchange Rules Reference, PMD Source Code Analyzer Project

Composer OAuth Password Grant Authentication Update

Composer discontinues the use of the OAuth password grant type for authentication, in accordance with Salesforce's deprecation of this method in the Winter release. This change is implemented automatically on the backend and does not require any action from users or administrators.

For more information, see Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update).

Composer and Salesforce Summer 26 Compatibility Updates

This release updates the Composer, Batch, and Trigger packages to support Salesforce Summer 26, including the application of API version 66.0 to these packages.