Composer and Salesforce Winter 27 Compatibility Updates

The Composer package 8.304 update provides compatibility with the Salesforce Winter 27 release and the latest Salesforce platform features. This will include the Conga Batch package 8.37 and Conga Trigger package 8.37 updates as well. Salesforce users can start using the Sandbox environment installation for the Conga Platform package release on October 3rd. To install the updated Composer, Batch and Trigger packages, visit the Conga Community Install Center.

Action Needed

We ask that you please review any Composer solutions that use Reports as data source to confirm if it falls within the new limits Salesforce us introducing as part of a mandatory MFA security requirement in its Winter'27 release. If a report exceeds 100 columns and 2,000 records, please switch its data source to Conga Queries before October 3rd to avoid disruption.

Batch and Salesforce Winter 27 Compatibility Updates

The Conga Batch package 8.37 update provides compatibility with the Salesforce Winter 27 release and the latest Salesforce platform features. Salesforce users can start using the Sandbox environment installation for the Conga Platform package release on October 3rd. To install the updated Composer, Batch and Trigger packages, visit the Conga Community Install Center.

Trigger and Salesforce Winter 27 Compatibility Updates

The Conga Trigger package 8.37 update provides compatibility with the Salesforce Winter 27 release and the latest Salesforce platform features. Salesforce users can start using the Sandbox environment installation for the Conga Platform package release on October 3rd. To install the updated Composer, Batch and Trigger packages, visit the Conga Community Install Center.

Batch and Trigger: Updated Conga Logos to Align with New Branding

All Conga logos across Batch and Trigger UI now use the latest Conga branding and design system, ensuring consistent style, size, placement, and accessibility compliance. The updated logo assets render correctly across supported screen sizes, themes, and meet accessibility standards without impacting Batch and Trigger functionality.

Composer Integration with DocuSign AppLauncher for Salesforce Package

Apex SOQL/SOSL User Mode Enforcement

Enforce User Mode in all Apex SOQL and SOSL queries to apply user-level sharing and field-level security controls. This update addresses a security finding by ensuring queries respect user permissions, reducing unauthorized data access risks.

Apex Crypto Secrets Security Update

Address multiple instances of insecure handling or potential exposure of cryptographic secrets in Apex code to mitigate identified security risks. Security findings are documented and addressed per the latest review.

Apex SOQL/SOSL User Mode Enforcement

Apex SOQL and SOSL queries now execute in User Mode to consistently enforce user-level sharing and field-level security controls. This update addresses medium security risks by aligning query execution with security best practices.

Composer Authentication Security Update

Composer restricts Salesforce access_token values to server-side processing, preventing exposure in mobile and Lightning flows. Mobile and Salesforce1 users can authenticate once and reuse a stored refresh token for silent re-authentication, while the client receives only authentication state responses.

Updated Conga Branding Across Composer Interfaces

All Conga logos across Composer interfaces - including Solution Manager, Document Merge UI, Admin UI, Setup Menu, and related screens - now display the updated Conga branding, following the latest size, placement, theming, and accessibility guidelines. The new logo assets support responsive layouts and accessibility standards without impacting existing functionality.

CRUD and Field-Level Security Enforcement in Apex Operations

The application enforces CRUD (Create, Read, Update, Delete) and Field-Level Security (FLS) checks across all Apex controllers and services. All data queries and DML operations now validate object and field permissions, including for objects such as Lead, to align with Salesforce security best practices and prevent unauthorized data access or modification.

Debug Log Sensitive Data Redaction

The application now removes or masks sensitive information such as access tokens, session IDs, and authorization headers from debug logs to prevent unintended exposure. All debug statements that previously logged confidential data are sanitized or replaced with generic messages, aligning with secure coding practices. This update helps administrators and security teams maintain compliance and reduce the risk of information leakage in system logs.

ComposerMerge Component Clickjacking CSS Update

Update the ComposerMerge component's CSS to use position: relative instead of position: absolute, addressing potential clickjacking vulnerabilities identified during security review. The component now renders correctly in both affected packages without exposing overlay risks.

sObjectRecordController.getRecords Object and Field Access Controls

The sObjectRecordController.getRecords method restricts queries to allowlisted standard and custom objects, blocking access to metadata objects (_mdt), platform events (_e), and big objects (_b) to prevent information disclosure. The CongaInvoiceGeneration package adds ESAPI field-level security (FLS) checks to enforce proper field access controls. Existing integrations and tests continue to function as expected.

Secure Storage of Sensitive Configuration Data

Sensitive configuration data is now stored using secure mechanisms like Protected Custom Metadata or Named Credentials instead of being hardcoded in Apex. No sensitive values are exposed to client-side code through @AuraEnabled methods, aligning with secure coding practices.

Secure Token Handling in Apex Controller Methods

All Apex controller methods annotated with @AuraEnabled and @RemoteAction now restrict the exposure of sensitive authentication data, such as access tokens and refresh tokens, to the client side. Token handling and API calls are performed exclusively server-side, and only non-sensitive data is returned to the client, aligning with OWASP guidelines and secure coding practices.

Removal of Unauthorized Session ID Transmission in ComposerSolutionExtension

The use of Salesforce session IDs in ComposerSolutionExtension has been removed from Composer packages. Export-related buttons from the ComposerSolution.page are removed from the CQG package to prevent session IDs from being sent to external endpoints, aligning with AppExchange security requirements.

Removed Unused Remote Site Settings

The legacy metadata for the CongaMergeServices remote site settings have been removed from the current Composer package.

Composer Authentication Security Update

Composer restricts Salesforce access_token values to server-side processing, preventing exposure in mobile and Lightning flows. Mobile and Salesforce1 users can authenticate once and reuse a stored refresh token for silent re-authentication, while the client receives only authentication state responses.