beqom v10 HF233 - Release notes
Deployment date: NPR: June 26th, 2026 - PRD: TBD
Fix version: v10 - HF233.3 - DB 10.0.1083
| Type | Reference | Description | |
|---|---|---|---|
| Zendesk | Jira | ||
| 126022 | BQM-26022 | An issue was corrected where loading a process grid and executing quick searches or sorting the grid took significantly longer than expected (up to 15 seconds) due to a suboptimal query used to retrieve payee step counts. The dynamic query logic was optimized to eliminate the performance bottleneck, reducing load times substantially. | |
| 153665 | BQM-27226 | An issue in data grids with batch operations enabled was corrected where a spurious empty row was created when a pre-save stored procedure returned an error, and unsaved edits in the row were wiped. The error recovery logic was updated to prevent empty rows from appearing and to retain unsaved cell values when save errors occur. | |
| BQM-27233 | A security issue was corrected in which two API endpoints, one in the data service and one in the notification service (GetFormValues and ValidateDocument), did not enforce server-side access control, allowing authenticated users to access personally identifiable information belonging to other employees or to validate documents they did not own. Server-side authorization checks were added: GetFormValues now strips sensitive fields based on caller role and returns 404 for out-of-scope requests, while ValidateDocument verifies ownership before persisting status changes. | ||
| BQM-27236 | Certain debugging endpoints, normally used by development teams,exposed internal system information (machine name and storage URLs) in production environments. These endpoint were removed following a security audit. The endpoints were not used by the application and posed a low-level reconnaissance risk. | ||
| 150969 | BQM-27268 | An issue was corrected in process grids where clicking Select All X Rows on a paginated population incorrectly included the approver's own record in the submission, even when that record was configured to be hidden from their view. This caused bulk validation to fail and blocked the entire submission. The select-all logic was updated to exclude hidden records consistently with the grid display behavior. | |
| 154406 | BQM-27271 | Critical SQL injection vulnerabilities in two internal stored procedures were corrected to prevent potential data exfiltration and row-level security bypass. All dynamic SQL construction was updated to use parameterized queries and identifier validation, and one obsolete stored procedure was removed from the database. | |
| 141711 | BQM-27326 | An issue was corrected where importing a file generated from an export template into a data grid based on an editable view with derived fields displayed a misleading "0 inserted, Missing Column Name" message, even though the row was successfully inserted. The import validation logic was updated to correctly reflect the actual row insertion count and suppress false column warnings. | |