Composer and Salesforce Winter 27 Compatibility Updates

The Composer package 8.304 update provides compatibility with the Salesforce Winter 27 release and the latest Salesforce platform features. Salesforce users can start using the Sandbox environment installation for the Conga Platform package release on September 5th. To install the updated Composer package, visit the Conga Community Install Center.

Action Needed

We ask that you please review any Composer solutions that use Reports as data source to confirm if it falls within the new limits Salesforce us introducing as part of a mandatory MFA security requirement in its Winter'27 release. if a report exceeds 100 columns and 2,000 records, please switch its data source to Conga Queries before October 3rd to avoid disruption.

Composer Integration with DocuSign AppLauncher for Salesforce Package

Apex SOQL/SOSL User Mode Enforcement

Enforce User Mode in all Apex SOQL and SOSL queries to apply user-level sharing and field-level security controls. This update addresses a security finding by ensuring queries respect user permissions, reducing unauthorized data access risks.

Apex Crypto Secrets Security Update

Address multiple instances of insecure handling or potential exposure of cryptographic secrets in Apex code to mitigate identified security risks. Security findings are documented and addressed per the latest review.

Apex SOQL/SOSL User Mode Enforcement

Apex SOQL and SOSL queries now execute in User Mode to consistently enforce user-level sharing and field-level security controls. This update addresses medium security risks by aligning query execution with security best practices.

sObjectRecordController.getRecords Object and Field Access Controls

The sObjectRecordController.getRecords method restricts queries to allowlisted standard and custom objects, blocking access to metadata objects (_mdt), platform events (_e), and big objects (_b) to prevent information disclosure. The CongaInvoiceGeneration package adds ESAPI field-level security (FLS) checks to enforce proper field access controls. Existing integrations and tests continue to function as expected.

ComposerMerge Component Clickjacking CSS Update

Update the ComposerMerge component's CSS to use position: relative instead of position: absolute, addressing potential clickjacking vulnerabilities identified during security review. The component now renders correctly in both affected packages without exposing overlay risks.

Secure Token Handling in Apex Controller Methods

All Apex controller methods annotated with @AuraEnabled and @RemoteAction now restrict the exposure of sensitive authentication data, such as access tokens and refresh tokens, to the client side. Token handling and API calls are performed exclusively server-side, and only non-sensitive data is returned to the client, aligning with OWASP guidelines and secure coding practices.

Secure Storage of Sensitive Configuration Data

Sensitive configuration data, such as the LaunchDarkly key, is now stored using secure mechanisms like Protected Custom Metadata or Named Credentials instead of being hardcoded in Apex. No sensitive values are exposed to client-side code through AuraEnabled methods, aligning with secure coding practices.

Conga Batch: Updated Logo Assets for New Branding

All Conga logos across Conga Batch legacy, platform, and package screens are replaced with updated assets that align with the latest Conga branding and design guidelines. The new logo assets use approved size, placement, theming, and accessibility standards, and render consistently across supported screen sizes and themes without impacting existing functional behavior.

Batch and Trigger: Updated Conga Logos to Align with New Branding

All Conga logos across Batch and Trigger UI now use the latest Conga branding and design system, ensuring consistent style, size, placement, and accessibility compliance. The updated logo assets render correctly across supported screen sizes, themes, and meet accessibility standards without impacting Batch and Trigger functionality.

Removal of Unauthorized Session ID Transmission in ComposerSolutionExtension

The use of Salesforce session IDs in ComposerSolutionExtension has been removed from Composer packages. Export-related buttons from the ComposerSolution.page are removed from the CQG package to prevent session IDs from being sent to external endpoints, aligning with AppExchange security requirements.

Removed Unused Remote Site Settings

The legacy metadata for the CongaMergeServices remote site settings have been removed from the current Composer package.

Composer Authentication Security Update

Composer restricts Salesforce access_token values to server-side processing, preventing exposure in mobile and Lightning flows. Mobile and Salesforce1 users can authenticate once and reuse a stored refresh token for silent re-authentication, while the client receives only authentication state responses.

Debug Log Sensitive Data Redaction

The application now removes or masks sensitive information such as access tokens, session IDs, and authorization headers from debug logs to prevent unintended exposure. All debug statements that previously logged confidential data are sanitized or replaced with generic messages, aligning with secure coding practices. This update helps administrators and security teams maintain compliance and reduce the risk of information leakage in system logs.

Secure Storage of Sensitive Configuration Data

Sensitive configuration data, such as the LaunchDarkly key, is now stored using secure mechanisms like Protected Custom Metadata or Named Credentials instead of being hardcoded in Apex. No sensitive values are exposed to client-side code through @AuraEnabled methods, aligning with secure coding practices.