CPQ Security Enhancements

As part of Salesforce’s mandatory Security Review requirements for all AppExchange packages, the CPQ packages now enforce stricter security controls. These changes ensure that managed packages comply with current Salesforce security standards and protect customer data from unauthorized access and vulnerabilities. The updates are not optional and are required for continued compliance, support, and future releases.

The security review focuses on user-level data access enforcement, prevention of injection vulnerabilities, removal of deprecated or unsupported libraries, and elimination of session identifiers being passed outside the Salesforce environment to third?party systems. Key security-focus changes are:

• Upgrade to jQuery 3.7
• Removal of deprecated YUI library
• Hardened query handling to prevent SOQL/SOSL injection
• User-context queries for standard objects and fields
• User-mode enforcement for DML operations
• Mitigation of CSRF-related risks

For more information, see CPQ Security Enhancements and Updates in JavaScript Library for Conga CPQ Classic.

Support for Creating Multiple Contracts from a Single Quote

You can now generate multiple contracts from a single quote by filtering quote line items through the Quote to Contract API. This helps you when a consolidated quote includes products for multiple customers that require separate contractual agreements.

To achieve this, you must pass filter parameters (such as a customer or account identifier) along with the quote ID to the Quote to Contract API in the Apttus_QPComply package (QPComplyWebService class). The API creates a contract containing only the line items that match your filter. You can call the API multiple times with different filters on the same quote to create multiple linked contracts.

For more information, see Creating Multiple Contracts from a Quote.

Product Attribute Value Extension (PAVE) Lookup Field

Product Attribute Value Extension (PAVE) object is now available in the Admin UI for selection in lookup field settings, allowing administrators to search and set lookup fields across all PAVE objects. Lookup fields defined on PAVE objects are included as separate records in the turbo request payload, consistent with standard product attribute lookup fields.

For more information, see Lookup Field Settings and Configuring Lookup Field Settings.

Revalidation API Support for Custom Cart Integrations

You can use the getRevalidationLineItems and applyRevalidation APIs to identify and revalidate cart line items based on your chosen criteria. You pass inputs such as Cart ID, Cart Line Item IDs, and custom criteria, and the APIs return detailed responses with product information, revalidation reasons, and errors, if any. This allows you integrate revalidation seamlessly with your custom Salesforce cart implementations.

For more information, see Apply Revalidation and Get Revalidation Line Items.

Server-Side Option Search on Configuration Page

A new execution mode, Option Search Execution Mode, in Config System Properties enables server-side option search on the configuration page. The feature supports searching across both selected and unselected sub-bundles, improving visibility of available options. Matching sub-bundles are highlighted with the count of results, and cross-tab navigation remains supported. Next and Previous actions allow easy navigation through results, with nested sub-bundles clearly indicated for matched options.

For more information, see Config System Properties.

OAuth Authentication for Conga CPQ and Smart Search

CPQ now uses the the JWT (JSON Web Token) flow for authentication OAuth token flow instead of Session Id for authentication with the Conga Merge Service and Conga Smart Search. This change enhances application security and ensures more secure authentication management. Any Session ID passed by custom code is ignored, and the current user name is used to retrieve the OAuth token.

To achieve this, you must have selected the permitted users for Conga SF Connected app and granted Conga SF Connected app to all users.

For more information, see Selecting Permitted Users for Conga SF Connected App and Granting Conga SF Connected App Access to Users.