Quality Clouds 21.3.2.0 Release Notes

Release date: 29th September, 2021


New general features and changes 

The view contains almost all the selected instance characteristics, from inventory to best practice violations, except the details of the issues detected. 

  • Open Source libraries engine improvements


  • Security improvements in all API services

Quality Clouds for ServiceNow


  • Upgradeability impact for Quebec patch 7 and Rome is now available here


  • New Quality Clouds for ServiceNow Application released version 9.0.13, available here

Application LiveCheck

Applications are now analysed following the same approach as we already do with elements and update-sets, but integrated into the Application lifecycle. You can scan your application quality in 2 ways: 

    1. On demand: by clicking the Live Check button at the top right, in case of scoped applications the results are shown in the related list section below, in case of global applications, the information is shown in the Quality Clouds Application section Application LiveChecks. Quality Gates information, if enabled, show issues asl always in 2 categories new and baseline.
    2. Automatically: by publishing a new app, the Live Check is automatically triggered and results are shown in the Quality Clouds Application section.

Application Live Check requires users to have a valid API Key, which can be automatically issued by navigating to Quality Clouds Application > API Keys and clicking New, this will create a valid API Key for the selected user.


Ability to write-off issues in Applications, Update-sets and elements

Navigating through Livecheck detected issues list, and just clicking an issue, in case of already written-off, a red warning will be shown indicating the issue is under write-off scrutiny. In case no write-off has been already done, a button will appear to apply write-off and provide justification.

You may typically perform a write-off in case of one of the following situations, and always impacts the quality and metrics, main reasons are:

    1. Complex solution, requires refactoring
    2. Insufficient time to fix and test
    3. Complex to test and validate all situations
    4. False positive
    5. Other

By default, all write-off requests are automatically approved by the platform and reason/justification recorded for future actioning.

Important: Issues written-off by the will appear in the QC Instance dashboards after the next full scan execution, to maintain the instance quality metrics consistent. 


Enhanced Update-set quality control

This new feature will require to provide a justification by an admin role in case of trying to change the state of an update-set to Complete and failing Quality Gates. The purpose is to Complete update-sets only when they pass the Quality Gate, and there is no outstanding new issues pending to fix. Before using this justification process we recommend the following:

    1. Ask development team to fix issues failing the Quality Gate (red message is shown everytime Live Check is executed). So very easy to identify and fix.
    2. Perform a write-off on the new issues causing the Quality Gate to FAIL. 


Usability improvements and bug fixes

All Live Check activity is now shown under 3 new sub menus in the Quality Clouds Application section. This helps to easily track the quality check activity of the teams by Architects and Team Leads.




  • New ServiceNow rules: aligned with ServiceNow HealthScan and new applied to open source libraries vulnerability  


DescriptionSeverityImpact area
Avoid Script Includes with duplicate namesHighManageability
Usage of current.update() in Script Workflow ActivitiesHighPerformance
Scheduled Jobs run by deleted usersHighManageability
Usage of gs.cacheFlush() on ScriptsHighPerformance
Auditing for Update Sets should be enabledHighManageability
Usage of window objects instead of AngularJS servicesHighManageability
Forms with duplicate fieldsMediumManageability
jQuery - XSS vulnerability on versions under 3.5.0, via the htmlPrefilter method.HighSecurity
AngularJS - XSS vulnerability on versions under 1.8.0, via nested option in select elements.HighSecurity
AngularJS - XSS vulnerability on versions under 1.8.0, via JQLite DOM manipulation functions.HighSecurity
tinyMCE - XSS vulnerability on versions between 5.0.0 and 5.1.4, on the core parser, paste and visualcharts plugins.HighSecurity
tinyMCE - XSS vulnerability on versions under 5.4.0, in iframe elements.HighSecurity
tinyMCE - XSS vulnerability on versions under 5.2.2, in media elements.HighSecurity
tinyMCE - XSS vulnerability on versions under 5.1.6, in CDATA elements.HighSecurity
tinyMCE - XSS vulnerability on versions under 4.7.12, in links with XLINK:HREF attributesHighSecurity
tinyMCE - XSS vulnerability on versions under 4.2.0, in some default config implementationsHighSecurity
tinyMCE - XSS vulnerability on versions under 4.2.4, in media pluginHighSecurity
tinyMCE - Static Code injection vulnerability on versions under 1.4.2, in inc/function.base.phpHighSecurity
swfobject - XSS vulnerability on versions under 2.1, on swfobject.getQueryParamValue.HighSecurity
Bootstrap - XSS vulnerability on versions between 4.0.0 and 4.3.1, on data-template, data-content and data-title attributes.HighSecurity
Bootstrap - XSS vulnerability on versions under 3.4.1, on data-template, data-content and data-title attributes.HighSecurity
Bootstrap - XSS vulnerability on versions between 4.0.0 and 4.1.2, on data-target attribute.HighSecurity

Quality Clouds for Salesforce


  • SSH connectivity support for GIT repositories

You can connect to GitHub using the Secure Shell Protocol (SSH), which provides a secure channel over an unsecured network. As alternative to user and password credentials.


  • New Flow best practices

The simplicity of building flows with the designers (Flow & process) can lead to complex structures difficult to understand and maintain. Check here the available rules to early flag potential manageability issues.


  • Visual Studio Code extension allows to write-off issues

Our VSCode Extension not only shows the information of issues that have been written-off, and the justification, but also permits to request a write-off action over an existing issue. This will trigger the associated approval workflow depending on your configuration: auto-approve (default) or collaborative.

Please note that all approved written-off issues are directly sent to the BASELINE and will not impact the Quality Gates condition.

  • Visual Studio Code extension supports LWC and test flows quality checks

The newest VSCode Extension allows to trigger LWC elements quality check and also 



What's here





Last modified on Oct 13, 2021