Disable Enforce CSP Deprecated - The "Disable enforce Content Security Policy" experimental feature has been moved to Deprecated Features. Enabling it now displays a warning to administrators for as long as it remains turned on.
Client APIs and Development Notes
Pipeline Job Deserialization Type Validation - Pipeline jobs and status messages are now validated against an allowlist of permitted classes when deserialized using Jackson and XStream, improving security. If a legitimate type is unexpectedly blocked, check the allowed list in 'PipelineJacksonTyping' or contact LabKey support. A deprecated feature flag, "Disable pipeline deserialization type allowlists," provides a temporary workaround if needed.
Require Transform Scripts in @scripts or a Module - Transform scripts attached to an assay design must now be located in the design's container's @scripts directory, or supplied by a module. Referencing a script anywhere else now produces a validation error when the assay design is saved or a run is imported. A deprecated feature flag, "Allow assay transform scripts at arbitrary file system paths," provides a temporary way to skip this check while migrating.
