| Feature | Summary |
| NLS & AI > AI Architecture - new capability map with live status, guided setup, and a downloadable setup guide | A new AI Architecture page has been added under NLS & AI > AI Architecture. It gives administrators a single, always-current map of every AI and Natural Language Search capability on the site - what each one is, how the pieces connect, the order to turn them on, and each one's live configuration status.
The page has two tabs:
- Architecture & Status - a layered diagram (Foundation, Data Preparation, AI Experiences) plus the related cross-cutting tools, with each capability badged by its current state (Configured, Partial, Off, or Available). It distinguishes the two ways AI reaches the assistants: answering directly from a provider versus retrieval from the vector index (RAG). Header chips summarize the site at a glance - whether AI Chat and Summarization are enabled, the default provider and embedding model, vector-index availability, and how many features are configured. Clicking any capability opens a help panel with why you go there, step-by-step setup instructions with the exact buttons to click, optional settings, prerequisites, and a link straight to that Console page; where relevant it shows a copyable sample configuration.
- Guided Setup - an ordered checklist for turning AI on, each step marked done / next / not-started against the site's live state, with a worked example, a link to the relevant page, and an advanced site-properties reference.
A Download setup .md button generates a complete setup document combining the capability reference, the guided-setup checklist, and the site's current configuration - intended to be pasted into a local AI to get tailored setup help.
Separately, under NLS & AI > AI Properties, the AI Chat and AI Summarization switches are no longer labeled "(beta)", and the on-page AI Summarization button tooltip is updated to match.
|
| Master > Content > Scheduled Tasks - faster forecast and execution for chained ("run after") data transfers | The Scheduled Tasks forecast and the execution of chained data transfers have been optimized. When a Data Transfer is configured to run after another (a follow-on "run after" chain), the system previously re-scanned the entire set of follow-on transfers at every step of the chain, so a site with many chained transfers saw both the Scheduled Tasks forecast and the transfer run slow down disproportionately as the chain grew. The follow-on lookups are now built once and reused, so the forecast calendar and the chained execution both scale smoothly no matter how many follow-on transfers exist. Behavior and results are unchanged - the same transfers run in the same order and the forecast shows the same schedule; only the speed on large chains improves. |
| AsposeToPdf (Word Conversion - Variable Fields) — PDF now shows typed values instead of placeholders | What happened
The PDFs created from Word files were showing placeholder text instead of the real content. For example, a policy's title appeared as Document Title within the PDF, even though the Word document itself showed the title the author had actually typed.
Why it happened
The cause was in how these Word documents are built. Their templates use variable fields for items like the title, keywords, reference number, and dates. A variable field displays a stored value behind the scenes, and when someone types directly over it in Word, only the visible text changes, not the stored value underneath. When the PDF was generated it refreshed those fields and fell back to the stored placeholder (Document Title, Keywords, and so on), so the PDF did not match what the author saw in the Word document.
The fix
The PDF now keeps the values exactly as they appear in the Word document, so the two match.
Preventing it at the template level
These problems can also be prevented by using regular typed text instead of variable fields for values that authors fill in directly (such as the title). Variable fields are best reserved for values that get filled in automatically. When a value is meant to be typed by the author, plain text has no hidden stored value to fall back to, so the PDF always matches what was typed.
Clearing cached PDFs
Generated PDFs are cached on the server to keep the site fast, so a document whose PDF was created before this change keeps showing the old PDF until its cached copy is regenerated. To correct an affected document:
- Re-save or re-upload the document (this regenerates the PDF automatically), or
- Delete just that document's cached PDF on the server.
Cached PDFs live under the site's Temp\AsposeToPdf\ folder, in a subfolder path that mirrors the document's Uploads location, named after the source file. For example:
- Document:
/Uploads/Public/Documents/Template/MyPolicy.docx - Cached PDF:
...\Temp\AsposeToPdf\Uploads\Public\Documents\Template\MyPolicy.pdf
Only delete the cached PDFs for documents showing the problem. Do not clear the entire Temp\AsposeToPdf folder. The cached files exist to improve performance and will regenerate on next view. |
| NLS & AI — Page Assistant answers with live charts from curated Data Sources, plus a new AI Data Source Tuner | Two related additions bring live, content-grounded charts to the Page Assistant. This first release certifies charts only (Chart.js Data Sources); other output types will be certified one at a time in later releases.
AI Data Source Selection (Charts Only). Under Design > Data Sources, each Data Source now has an Available to Page Assistant option (AvailableToAI), an AI Description, and an optional loading placeholder. When the feature is enabled on a Page Assistant (under NLS & AI > Script Generator, the Enable AI Data Sources option), the assistant matches a visitor's question to the single best-described eligible Data Source and renders its chart inline in the chat bubble, grounded in real content. Selection is prompt- and context-aware and returns at most one source; if nothing is a confident match, no chart is shown (never a low-confidence guess). Each source is executed under the asking user's own security, so a visitor only sees data they are permitted to see, and the selected source's title is shown above the chart for transparency. The feature is off by default and stays inert until an admin turns it on for a specific Page Assistant.
AI Data Source Tuner (new page). A new Console page at NLS & AI > AI Data Source Tuner lets admins test and tune selection before going live. Enter a sample question to see which Data Source is selected and its confidence score, a per-candidate score list against the confidence threshold, and the full catalog of eligible sources plus any excluded sources with the reason they are excluded (for example, an uncertified output type, or a source that depends on page context). Admins tune each source's AI Description until the assistant reliably picks the right one. |
| API - resolved a high-severity OpenAPI dependency advisory (security + dependency maintenance) | This is a security and dependency maintenance release with no client-facing UI changes. This sync itself makes NO web.config changes (see the follow-up patch below for those).
- Resolved a high-severity security advisory (GHSA-v5pm-xwqc-g5wc) in the API's OpenAPI documentation dependency by pinning the transitive
Microsoft.OpenApi library to a patched version. This clears a build/security warning and does not change any API behavior or output. - Brought several third-party libraries current to their latest patched versions (including
Newtonsoft.Json) with no functional or visual change. - Added internal deployment-engine support for applying web.config binding redirects as part of a patch. This is infrastructure only - it enables the follow-up update below to be delivered safely and has no effect on this release's behavior.
Delivered separately in a follow-up patch (NOT in this sync):
The larger .NET Framework library updates that require web.config binding-redirect changes are deferred to a coordinated patch, so the updated libraries and their matching redirects land together atomically. That patch updates these runtime libraries to current versions, with no intended behavior change:Dapper (data access) - and Microsoft.Bcl.AsyncInterfaces, which it requiresSystem.IdentityModel.Tokens.Jwt (JWT token handling) - and its System.Memory support librariesHumanizer (text formatting)Microsoft.Extensions.DependencyInjectionSystem.Security.Cryptography.ProtectedData
The patch is built and deployed after this sync ships, only to servers already updated to this version. Tracked separately; watch for it as a follow-up.
WARNING - the follow-up patch modifies web.config (binding redirects). Clients with custom code or virtual directories must read this.
The patch adds/updates these runtime > assemblyBinding binding redirects in each site's web.config:Microsoft.Bcl.AsyncInterfaces -> 10.0.0.9System.Memory -> 4.0.5.0, System.Buffers -> 4.0.5.0, System.Numerics.Vectors -> 4.1.6.0Humanizer -> 3.0.0.0Microsoft.Extensions.DependencyInjection and .Abstractions -> 10.0.0.9
The patch updates the web.config of the main site (Root) and Console only. It does NOT touch a web.config that is part of a separate application - so a site with a virtual directory running as its own IIS application, or client custom code with its own configuration, must add these same binding redirects to that web.config by hand. Without them, custom code (or the sub-application) that loads the updated libraries can fail with a "could not load file or assembly" error. If a client has custom code that references any of the libraries above at an older version, confirm it still loads after the patch.
|
| Word Add-In: Save no longer reports success on an expired session; clearer re-sign-in and sign-in resilience | - No false "Save successful." Previously, if the sign-in session had expired, clicking Save could still show a success message even though the document was not actually saved. The add-in now detects the expired session, does not report a false success, and prompts the user to sign in again before saving.
- Clearer messaging. When a lapsed session is detected, the add-in shows a plain "your session has expired, please sign in again" message instead of a confusing error or an add-in that appears stuck.
- Sign-in resilience behind single sign-on (SSO). The add-in recovers more gracefully from an expired session: it retries a failed load and, if needed, clears a stale sign-in so the next attempt starts clean (similar to the manual "Reset Add-in" step users rely on today). The sign-in dialog also retries once if the login redirect does not complete on the first attempt.
- First-attempt sign-in. A new SSO sign-in entry point helps sign-in complete on the first try for SSO-configured sites, instead of landing on the site home page.
|
| Resource.ashx links: download=1 forces a file to download | Resource links (Resource.ashx) now accept an optional download=1 query parameter that forces the file to download rather than render in the browser. Previously, common file types that browsers display inline - text files, PDFs, images, audio, and video - always opened in the browser tab, with no per-link way to make them download. Adding &download=1 to a resource link now delivers the file as a download for that single request, and the saved file keeps its proper name (e.g. appendix.txt instead of Resource.txt). This is especially helpful for large text files, which could bog down or crash the browser tab when opened inline. The option can only ever force a download; it can never make a file open inline, so it introduces no security change.
|
| Learning Record Store (LRS) — xAPI statement POST now accepts array submissions so SCORM/xAPI course completions record | The Learning Record Store service (lrs.svc) that receives xAPI statements from SCORM/xAPI courses now accepts statement submissions sent as an array, not only as a single statement. Standard xAPI course players (the TinCan/SCORM driver) send even one completion as a one-item array, which the service previously rejected, so no completion records were being stored. The service now handles both a single statement and an array of statements, stores each, and returns the corresponding statement identifiers.
Separately, a read-back of activity state when none is stored now returns an empty No Content response instead of an empty JSON list, which stops a JavaScript error in the course player when resuming an attempt.
Note: full resume/bookmarking support (storing and returning xAPI state documents) is a separate planned enhancement and is not part of this change. |
| Site Maintenance: SSO login, site search, module downloads, file-cleanup security, and API health | This maintenance release includes fixes and hardening across sign-in, search, module downloads, the Console, data transfer, and API reliability.
- SSO / SAML login: users whose identity provider sends a role that does not map to any Centralpoint role can now sign in; this previously failed during login.
- Site search: very long search queries no longer produce an error (an internal capacity-calculation issue).
- Module results download: downloading a result set whose columns appear before the record identifier now completes instead of failing.
- Console custom attributes: a malformed or empty custom-attributes file no longer causes a module's Console page to error; it falls back to the base attributes.
- Data transfer: a supplied batch id and auto-number are now saved with a document upsert (they were previously dropped).
- Scheduled tasks: a transient configuration-service error during a scheduled run no longer aborts the run; it falls back to the site's local configuration.
- Update install: an incomplete update package now reports a clear, actionable message instead of a generic "path not found."
- Security, file cleanup (
Development > Utilities): the upload-cleanup tool now rejects any entry that resolves outside the site's uploads directory, preventing directory traversal. - API reliability: the API application folder's read permission for its application-pool identity is now set explicitly and re-applied during scheduled maintenance, preventing and self-healing the IIS 500.19 "cannot read configuration" class of API outages without a manual server fix.
Developer note (custom code): IsInArray(value, array, ignoreCase) now honors the ignoreCase argument. Previously the three-argument form always compared case-insensitively regardless of the flag. Custom code that passed ignoreCase: false and relied on the old behavior will now get case-sensitive matching; the no-argument form stays case-insensitive, so role, audience, and id membership checks are unaffected. |
| Data Transform - import field map lists each option on its own line; Attribute Switch types sorted by code | On a Data Transform record's field-mapping screen, the properties table under each destination field previously showed option lists as a single comma-joined line that was very hard to read. Now:
- List Items rows (options defined on the destination attribute) render one option per line. For Attribute Switch attributes, such as the Data Cleaning Type on the HtmlCleaner module, options are sorted by their code and shown as Label = code with the fields each option reveals de-emphasized in gray, e.g. HTML Cleaner = 01 (cfrSearchFor, ...) through SQL Query = 07.
- Top 10 Items rows (options loaded from data, such as modules, audiences, taxonomy, and yes/no lists) also render one per line, with the more… link on its own line.
- The more… marker now appears only when more options than the ones shown actually exist.
- Option labels are HTML-encoded before display.
|
| Admin > Properties — new Resource Allow Any File Extension option for Resource uploads | A new site property, Resource Allow Any File Extension (AllowAnyFileExtension), has been added under Admin > Properties, default Disabled. When enabled, authenticated users can upload files with any extension — including files with no extension — through the Resource upload window used by form resource fields. The upload window's hint changes to "All file types are accepted." Anonymous users remain restricted to the standard allowed-types list regardless of the setting. Uploaded resources are stored outside the web root and are always delivered as downloads, never executed. Other upload areas (Documents, Bulk Upload, File Manager) keep their existing restrictions. Additionally, the resource replace window now validates file extensions under the same rules (previously it accepted any file type regardless of the allowed list). |