Skip to content

nexxcite 1.0.3.6143

Released on 2026-10-27.

Security

  • REST API tokens stop working as soon as the client secret they were requested with is removed or the API access is deleted.
  • The edit limits of a user's roles now apply to every change of a stored record - in forms, in actions and through the REST API alike.
  • A user with an expired password is asked to set a new one also when they sign in with a second factor, and the page for changing a password respects "Enable change password".
  • "LDAP Add User With Password" creates directory accounts that require a password and enables them only after the initial password has been set.
  • REST API answers with the error code query_failed no longer contain details of the underlying database error; the reason is written to the application log.
  • Locking a user now also ends the sessions of that user that are still open: browser sessions at their next re-check, API tokens immediately.

New features

  • 37 new value modification rules for the Modify Value expression make lists, JSON, dates and text easier to work with:

  • JSON arrays: JoinJArray (join into one text with a separator), JArraySum, JArrayMin, JArrayMax, JArrayAverage, JArrayContains, JArraySort, JArrayDistinct, JArrayReverse, JArrayRemoveAt

  • JSON objects: JObjectMerge, JObjectRemoveProperty, JObjectKeys
  • Conversions: XmlToJson, JsonToXml, CsvToJArray, JArrayToCsv, SplitLines, SplitStringJsonArrayKeepEmpty
  • Dates: DateTimeParse (dates in a given format such as 31.05.2024), DateTimeDiff, DateTimeToUnixTimestamp, ConvertTimeZone
  • Text and tests: Trim, StartsWith, EndsWith, TextEquals (each also case-sensitive as ...Cased), IsEmpty, RegexIsMatch, RegexFirstMatch, HtmlEncode, HtmlDecode, Not
  • Numbers: MathCeiling, MathFloor
  • The event based workflow rule now runs. For each record it starts a process that can wait for a date stored in the record (and follow the date when it changes) or for a further change, run actions, and loop – for example a reminder before a due date. Waiting processes are continued by the servers with ApplicationServer:ProcessScheduledActions and are configured in the new RuleProcesses settings section. Event based background action rules now honour "Max Executions": once a record has reached the number, further matching saves start no job and are recorded as "Skipped" in the execution history. The default is 0 (unlimited), and the field is now always shown in the editor.
  • The Tab Block of forms and dashboards has a new "Header Padding" setting. As tabs it indents the header strip while the line below the headers keeps its full length; as an accordion it is the inner spacing of every section header. The Typography settings of the Tab Block (font size, weight, text color, decoration, transform) now style the tab and accordion headers instead of the content – the blocks inside a tab keep their own typography. In addition, every form block and widget has two new typography settings: "Text Decoration" (underline, overline, line-through) and "Text Transform" (uppercase, lowercase, capitalized words). Both change only how the text is displayed, the stored value stays as it is.
  • Every form block and widget has two new typography settings: "Text Decoration" (underline, overline, line-through) and "Text Transform" (uppercase, lowercase, capitalized words). Both change only how the text is displayed, the stored value stays as it is.
  • The command "Open E-Mail Form" can now suggest addresses from an address book: with the address suggestions source "Query", the records of an entity with full text search are searched while the user types a recipient, and picking one adds its mail address. This keeps the form fast with large address books, because nothing is loaded up front.
  • The command "Open E-Mail Form" has a new setting "Max Total Size (MB)" for all attachments of a mail together. The form does not attach a file that would exceed it and keeps the send button disabled while the attachments are too large.
  • The command "Open E-Mail Form" has a new setting "Allow upload": users can then attach files of their own from their device. "Max File Size (MB)" sets the upper bound for one uploaded file (default 20 MB); larger files are refused with a message in the form.
  • Users can save records and queries to collections – their own and one per group they belong to – and reach them through the new bookmark button in the top app bar. Records are saved with the bookmark button in the record header of entities that allow it ("Allow Saving To Collections"); queries with "Save query" on a query result page or in the custom search. Four new permissions switch the feature on per role: "Use collections", "Save records to collections", "Save queries to collections" and "Create and manage own collections". The collections are stored in the new entities "Collection" and "CollectionItem"; the entities "Group" and "GroupMember" are now created on the first start as well, and the new system function CurrentUserGroupRecIds returns the groups of the signed-in user.
  • The new page System → Sketch History of the Admin Studio lists every publish of a sketch with what it changed, drawn as a graph that shows when each sketch was created and when it was published. Each publish can be opened again as a sketch, rolled back on its own and compared with what is live now – including which later publishes changed each definition and which one its current state comes from. A content hash identifies the state a publish brought, so the same state can be recognised on another installation. Access requires the new permission "View sketch history".
  • The user menu button in the top app bar can show the picture of the signed-in user. The picture is the result of an image expression stored in a field of the user profile entity that carries the new flag SpecialField.UserAvatar, usually filled by a calculation rule; without it, the placeholder icon stays. The separate Home button in the top app bar is removed.
  • The new authentication log records every attempt to sign in – with password, second factor, an external identity provider or as a REST API client – with user name, result, reason of a failure, IP address and browser. It is switched off by default and switched on in the global settings with "Record sign in attempts"; entries are kept for 90 days unless configured otherwise. The page Monitoring → Authentication Log of the Admin Studio shows the attempts with counters and filters for period, result, reason, method, user name and IP address. Access requires the new permission "View Authentication Log", which administrators and developers have by default. Behind a proxy that passes the client address in a header other than X-Forwarded-For, the new setting ForwardedHeaders:ForwardedForHeaderName names that header.
  • The new area Communication of the Admin Studio lists the e-mails your actions sent and the e-mails your mailbox listeners received, with their content. Each mail links to the action, the business rule, scheduled action or mailbox listener behind it, the record, the background run and the other mails of its conversation. Incoming mails are now recorded with their content as well; access requires the new permission "View Communication". Administration AI assistants can search and read the mails through the new tool group "Communication".
  • The HTML block of forms and the HTML widget of dashboards have a new setting "Isolate HTML". It shows the HTML in a frame of its own, so styles inside the HTML can no longer change the rest of the page, while the standard styles of nexxcite still apply inside. HTML mails in the Communication area of the Admin Studio now also use the standard styles and grow with their content.

Improvements

  • The event based workflow rule can now be created and edited in the business rule manager ("Event Based Workflow Rule"). The editor shows the processing items as nested cards with their follow-up items, and the AI assistant addresses processing items by name.
  • The new tab "Workflow Rules" under Monitoring → Background Processes shows every waiting process of an event based workflow rule – rule, record, current item, the time it waits for – and every finished process with its outcome and the decisions it took. Administrators with "Background Job Administration" can cancel a process or continue it right away. A start that a rule's "Max Concurrent Processes" or "Max Executions" prevents appears there with the outcome "Ignored" and the reason.
  • Business rules that keep setting each other's fields are now stopped by a general limit: within one chain of changes, the same rule may set the same field at most 5 times, and at most 50 changes may be nested. A change beyond that is skipped and written to the application log. Both limits can be changed with the settings BusinessRuleRuntime:MaxRepeatedFieldChanges and BusinessRuleRuntime:MaxFieldChangeDepth.
  • A required field can now be filled by a set before save rule. The field is checked once the rule has run, so the value the rule writes satisfies the requirement, and forms no longer highlight such a field as missing. The save is still refused if the rule leaves the field empty.
  • With several servers connected through a message bus, a new, changed or deleted authentication provider (single sign-on) is now offered on all servers as soon as it is published. Before, the other servers picked it up only after a restart.
  • The mail form of "Open E-Mail Form" has a new layout: the message takes the available height, the send and cancel buttons stay in a footer at the bottom, and attachments are shown as chips that are attached or detached with a click. Attachments that are attached by default can now be detached and attached again, and the send button cannot be clicked twice while the mail is handed to the send action.
  • The Sub Query expression has a new setting "Limit" for the maximum number of records the query reads. Empty keeps the previous limit of 9,999.
  • The system functions CurrentUserRoleIds and CurrentUserRoleNames are now offered in the selection lists of the expression editor.

Changes in behaviour

  • How long the execution history keeps its entries and logs is now set in the global settings (System → Settings, category "Background processing") for the whole installation. The keys ExecutionHistory:RetentionDays and ExecutionHistory:LogRetentionDays in the configuration file are no longer read; an installation that changed them sets the values in the global settings once. "Max Executions" of a rule is now counted in a table of its own, so the retention of the history no longer resets the count.
  • Only a date of 1 January 1753 or earlier counts as empty. Dates before the year 2000 - a date of birth, for example - are values now: they satisfy required fields and are found by NotEmpty in expressions and queries. An empty date is shown as an empty value in grids, labels and texts instead of the year 1753.
  • The REST API returns null for a date field without a value instead of the date 1 January 1753.
  • The command "Open E-Mail Form" now also works where no user interface is attached, for example in scheduled actions, background business rules and actions run through the REST API. Instead of being skipped, it runs its send action at once with the prefilled mail and the attachments marked "Attach by default", as with "Don't prompt UI". Check actions with this command that run in the background: they now send their mail.
  • "Create Entity Record" and "Create Related Record" now end the action with an error when the save of "Save" is rejected, like "Update Entity Record" does. Before, the action continued with the unsaved record. "Append" in "Set Fields" now also works for these two commands and adds the value to what the new record already holds, for example its default value.
  • The date part "Week" of a date part clause and the x axis type "Week" of a chart now use the ISO week: weeks start on Monday, and week 1 is the week with the first Thursday of the year. Week numbers can differ from before for Sundays and for days around the turn of the year.
  • The numbers on the badges of an expression filter in a related items block are only shown when "Show counts" is switched on for the filter, as for query filters. Switch it on for filters whose numbers should stay visible.
  • When two roles of a user have the same "Priority", the role whose name comes first in alphabetical order now wins for permissions and for custom styles and scripts as well, as it already did for the home action, the theme and the logo. The role with the lower "Priority" value still wins in every other case.

Fixes

  • The "Tags" column in the "Columns" tab of the entity editor now shows the tags of each field. Before, the column stayed empty and searching the list by tags found nothing.
  • Search and filter fields no longer lose letters while you type on a slow connection. This affects the filter above the folder tree in the definition manager, the block filter in the form editor, the filters in nexxcite Admin Studio and the search fields of lists.
  • The card widget keeps the selected field of Minimum, Maximum, Average and Total when the dashboard is saved.
  • Logical expressions compare dates chronologically with LessThan, GreaterThan and their variants, also across months and years.
  • "Iterate File Lines" reads an Excel worksheet completely also when the table does not start in cell A1; no rows or columns at the end are lost any more.
  • When a validation rule rejects a value and the previous value is no longer accepted either, the field stays marked as invalid and the save is refused; the REST API then answers with 422 and names the field in validationErrors.
  • "Remove image" and the removal of a font file delete the file from the storage only when the definition is saved. Closing the editor without saving no longer leaves a definition that points at a deleted file.
  • In a form without an entity, element and button blocks keep their click actions, the popover form and their further settings, and the blocks inside an element block show up in the block tree again.
  • "After Save" event based UI action rules with field triggers ("Any Field Change", "Change From Value", "Change To Value", "Change From/To Value") now run when the save wrote the field. Before, only the trigger "Any Change" worked for this timing.
  • An action now keeps working on its own current record after a loop, a switch case or a called action changed fields of another record of the same entity. Before, the action could continue on that other record afterwards.
  • "Change Context" with "Original Context" now always returns to the record the action started with, also after a loop, a "Switch" or the pre commands of the action. Before, it could return to the record of the last loop pass or to the record that was current when the switch started.
  • A deleted scheduled action or mailbox listener now stops as soon as the deletion is published. Before, it was recorded as a failed run at every scheduled time until the server that runs it was restarted. With several servers, the server that runs scheduled actions and mailbox listeners learns about the deletion through the message bus.
  • Counters: a monthly reset on the 29th, 30th or 31st no longer fails in months without that day – it falls on the last day of the month instead. The first number of a counter and the number after an automatic reset are now as safe against simultaneous requests as every other number. In the counter editor, the list of days for "Every Month" offers every day, is labelled "Day of Month" and shows the chosen day again, and "Initial Value" accepts large whole numbers. "Change Value" in the counter management takes effect immediately – also while a sketch is open – works before the first number was drawn and accepts large whole numbers.
  • A scoped counter now keeps a separate running number for every scope key. Before, numbers for a further key continued the sequence of the first key that drew a number.
  • Min and Max of the aggregate expression no longer fail when the values have different types, for example whole and decimal numbers or a date next to an empty value. Empty values are ignored; numbers are compared as numbers and dates as dates.
  • A user-defined global value inserted into a text now returns the value the user set, like the "Global Value" expression. A changed default value of a user-defined global value now reaches every user without a value of their own right away, without a server restart.
  • Conditions inside nested groups of a logical expression, and the scope of a counter expression, now count as read by the expression: a calculation rule with "Trigger on any change" runs when such a field changes, and the expressions they use are listed among the dependencies.
  • In the editor of the prompt expression, "Lookup Return Field" is offered for "From Query" without having to switch on "Enforce Lookup Value", and is no longer shown for "From Field", where it has no effect.
  • Expressions used as title or message of a prompt expression, or in the query of its selection list, are now listed among the definitions the prompt depends on.
  • The system functions CurrentTimeZone and CurrentTimeZoneOffset return the time zone of the user's browser and its offset from UTC; without a browser they return the time zone of the application server. LoremIpsum returns a placeholder paragraph. Before, all three returned an empty value.
  • A related clause with AllContains now applies the values of its inner conditions correctly. Before, it could compare against wrong values and return wrong records.
  • In the editor of a sub query expression, choosing a "Lookup Field" is now applied to the lookup field. Before, the choice was not applied to it.
  • The "Priority" of "Send E-Mail" is now passed on with the mail, both with SMTP and with Exchange Online. Mails with "High" or "Low" priority are marked accordingly in the mail program of the recipient.
  • Deleting a user in the Admin Studio now takes effect immediately, also while a sketch is open – like saving a user.
  • Sketches with changes to entities can be published again after an earlier publish, also when a previous attempt stopped halfway: database changes that already exist are no longer made a second time. Rolling back a sketch no longer deletes a definition that existed before the sketch – also for sketches imported from another installation – and a rollback that deletes a definition which no longer exists is no longer reported as an error.
  • The Admin Studio now lists authenticated users by the name of their user profile, as the Authenticated Users management view does, and no longer shows sign-ins under "Last edited" on its overview. A management view opened from the studio with a row preselected no longer shows an empty list when that row belongs to no folder.