Documentation Index
Fetch the complete documentation index at: https://docs.activeviam.com/llms.txt
Use this file to discover all available pages before exploring further.
Added
| Issue Key | Details |
|---|
| LIM-1523 | We have added new services to start Activiti workflows in bulk. |
Changed
| Issue Key | Details |
|---|
| LIM-1523 | The default implementation of ILimitsProcessInstanceWorkflowCacheService is now a no-operation implementation as this class is unused. |
| LIM-1837 | Updated warning message from “Warn when within x% of a limit” to “Warn when utilisation reaches x% of a limit” for improved clarity. |
Deprecated
| Issue Key | Details |
|---|
| LIM-1523 | ILimitsProcessInstanceWorkflowCacheService is unused and has been deprecated for removal. It is still present to avoid breaking the API. |
| LIM-1523 | IEvaluationTaskManager has been deprecated for removal because most of its methods are unused. |
Fixed
| Issue Key | Details |
|---|
| LIM-1850 | Fixed an issue where JWT tokens were not being refreshed causing requests between servers to fail after token expiration (default is 12 hours). |
| LIM-1910 | Fixed the logic and wording for warning thresholds. The warning threshold is now directly correlated to the limit utilization percentage. |
| LIM-1954 | You can now create limits on calculated measures where the underlying is a hierarchy. |
Added
| Issue Key | Details |
|---|
| LIM-1488 | Moved the IAuthenticatedLimitsUserService to limits-common and created a new implementation in limits-activeviam to assist with tasks requiring unrestricted access to Atoti Limits data. |
Changed
| Issue Key | Details |
|---|
| LIM-1622 | Changed the default DataLoadController to use an implementation that delegates the security context to the spawned threads. |
Deprecated
| Issue Key | Details |
|---|
| LIM-1611 | The ILimitsActivitiAuthenticationManager and the getWithAuth(…) methods in IWebClientService are no longer used and have been deprecated and marked for removal in the next minor release. |
Fixed
| Issue Key | Details |
|---|
| LIM-1550 | Fixed an issue where users with the ROLE_CREATE_ANY_LIMIT permission role were blocked when attempting to create a limit via the UI or REST. |
| LIM-1611 | Fixed an issue where JWT authentication was not being used when accessing Activiti or when querying the content server. |
Known issues
| Issue Key | Details |
|---|
| BAS-1330 | Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint /modules/limits-module/limits/rest/v2/limitDefinition/limits/save. The key of the limit structure will still be visible in the admin-ui. |
| LIM-846 | Complex Scopes: Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures. |
| LIM-840 | Complex Scopes: Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures. |
| LIM-813 | Managers can incorrectly upload Limit Structures through the REST endpoint. |
| LIM-594 | Having email notifications enabled for breaches causes decreased limit evaluation performance. See Configuring the breach email on how to disable breach emails. |
| LIM-357 | The Six Eyes workflow is currently not implemented. |
| LIM-346 | Limits on calculated measures only work through File Upload, not through the UI. |
| LIM-320 | Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See Measures for more on how to create a query for Limits on calculated measures. |
Added
| Issue Key | Details |
|---|
| LIM-1481 | Added RestTemplate and RestClient beans in the connection modules when sending requests to Atoti Limits and reduced the number of requests sent between the application server and Atoti Limits. |
Changed
| Issue Key | Details |
|---|
| LIM-1552 | Only required folders are now fetched from the connected server when resolving calculated measures. |
| LIM-1560 | Use one global CalculatedMeasuresResolver to speed up queries on limits on calculated measures. |
| LIM-1563 | Performance improvements for creating, updating, and evaluating limits. |
Known issues
| Issue Key | Details |
|---|
| BAS-1330 | Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint /modules/limits-module/limits/rest/v2/limitDefinition/limits/save. The key of the limit structure will still be visible in the admin-ui. |
| LIM-846 | Complex Scopes: Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures. |
| LIM-840 | Complex Scopes: Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures. |
| LIM-813 | Managers can incorrectly upload Limit Structures through the REST endpoint. |
| LIM-594 | Having email notifications enabled for breaches causes decreased limit evaluation performance. See Configuring the breach email on how to disable breach emails. |
| LIM-357 | The Six Eyes workflow is currently not implemented. |
| LIM-346 | Limits on calculated measures only work through File Upload, not through the UI. |
| LIM-320 | Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See Measures for more on how to create a query for Limits on calculated measures. |
Added
| Issue Key | Details |
|---|
| LIM-1378 | Added an ILimitsCacheService to store structures/limits that exist on the business server to speed up evaluations. |
| LIM-1531 | Added a property limits.cube.scope-hierarchies-enabled that can be used to disable scope hierarchies to improve loading performance for large cardinalities of limit scopes. |
Changed
| Issue Key | Details |
|---|
| LIM-1469 | Use the IConfigurationService instead of REST requests to execute MDX statements when creating Atoti Limits calculated measures to improve performance. |
| LIM-1525 | Improved performance of limit evaluations by skipping unnecessary retrieval of limit workflow information. |
Deprecated
| Issue Key | Details |
|---|
| LIM-1378 | The LimitsRetriever class and the limits/rest/v2/limitDefinition/limitsDefinitionStoreQuery endpoint are no longer used and are deprecated in favor of the ILimitsCacheService. They will be removed in version 4.1.0. |
| Issue Key | Details |
|---|
| LIM-1407 | limits-activeviam no longer has a dependency on limits-integration-common. Classes previously imported from limits-integration-common are now imported from limits-common. |
Fixed
| Issue Key | Details |
|---|
| LIM-1335 | Fixed an issue where data permissions in Atoti Limits were not applied to the KPIs and calculated members created by the module in the business cube. |
| LIM-1483 | Fixed an issue where KPIs were not refreshed after restarting Atoti Limits in persistent mode. |
| LIM-1492 | Fixed an issue where Atoti Limits calculated measures were being created on connected server KPIs that did not belong to Atoti Limits. |
| LIM-1498 | Fixed an issue where the connected application would not start if Atoti Limits Auto-configuration was disabled via limits.autoconfiguration.enabled=false. |
| LIM-1510 | Fixed an issue where the structure scope search can overflow the popover. |
| LIM-1512 | Fixed an issue where KPIs were not being created unless restricted users were defined. |
| LIM-1518 | Fixed an issue where warning thresholds were not being correctly evaluated. |
| LIM-1521 | Fixed an issue that prevented limits from being created on nested calculated measures. |
| LIM-1522 | Fixed an issue where generated IDs for limits created via the UI could collide with IDs for limits created via file upload if the uploaded limits respected the ordering of the generated IDs. |
| LIM-1530 | Fixed an issue where the evaluation error popover could overflow to the end of the screen. |
Known issues
| Issue Key | Details |
|---|
| LIM-1450 | Deleting an official limit makes the associated temporary limits invisible in the table. As a workaround, delete the temporary limit first. |
| LIM-1426 | Incidents workflows are not created/updated when modified via the IncidentCrudService. This does not apply on evaluation. |
| LIM-1309 | Wildcards and exclusive scopes are not handled by the IScopeRetrievalService default implementation. This affects the members visible in the scope level name and scope level member hierarchies, but only applies if exclusive scopes are used. |
| BAS-1330 | Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint /modules/limits-module/limits/rest/v2/limitDefinition/limits/save. The key of the limit structure will still be visible in the admin-ui. |
| LIM-846 | Complex Scopes: Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures. |
| LIM-840 | Complex Scopes: Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures. |
| LIM-813 | Managers can incorrectly upload Limit Structures through the REST endpoint. |
| LIM-594 | Having email notifications enabled for breaches causes decreased limit evaluation performance. See Configuring the breach email on how to disable breach emails. |
| LIM-357 | The Six Eyes workflow is currently not implemented. |
| LIM-346 | Limits on calculated measures only work through File Upload, not through the UI. |
| LIM-320 | Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See Measures for more on how to create a query for Limits on calculated measures. |
Added
| Issue Key | Details |
|---|
| LIM-468 | The default format for KPI Goal values can now be configured using the limits.cube.format.kpi-goal property. |
| LIM-987 | You can now drill down by a limit scope’s level name and level values in a pivot table. |
| LIM-1045 | Updated Atoti Server to version 6.1.1. This includes the upgrade of artifacts required to connect to 6.1.1 versions of Atoti Server. |
| LIM-1155 | Added an IScopeRetrievalService and a default implementation, facilitating granular querying of the scopes stores by passing a level or a member. |
| LIM-1199 | Limits CSV files can now contain Simplified Scopes. |
| LIM-1200 | An “Available Amount” and “Utilization %” measure for each KPI has been added to the limits-auto-config, calculating the difference and quotient between a KPI’s goal and the KPI’s value, respectively. |
| LIM-1205 | Added a property to configure whether or not filters are applied on evaluation. |
| LIM-1234 | Added support for permission-based data access depending on the user’s role. See Data access permissions. |
| LIM-1268 | Moved core configuration classes from limits-activeviam to limits-starter. |
| LIM-1275 | Added debug logs when evaluating Atoti Limits KPIs detailing eligible limits, exposures, and evaluation location. |
| LIM-1299 | Added connector artifacts for versions of Atoti Server running on Java 11. |
| LIM-1302 | Added support for restricting access on scopes in the role permissions. |
| LIM-1318 | Updated the Workflow Common Library to version 2.4.1 and H2 to version 2.2.220 to fix CVEs. |
| LIM-1324 | Pagination has been added to the Limits viewer. |
| LIM-1328 | Added new matchMode values for scopes to support more flexible retrievals in the IScopeRetrievalService. For details, see Match mode. |
| LIM-1339 | Added permission roles to control user access to UI actions. |
| LIM-1340 | Permission roles are now enforced on REST requests, blocking the action from being processed by the server if the user does not have the required permissions. |
| LIM-1341 | Permission roles for the workflow actions of approving/rejecting limits and processing incidents are now supported. |
| LIM-1345 | Improved performance in the Limits viewer screen by using the ScopeCacheService to help retrieve scope objects. |
| LIM-1355 | Added /limits/rest/v2/limitDefinition/limits/status/get endpoint to get limits status & server setting to include status for limit structures. |
| LIM-1357 | Added new property to set the default-scope-match-mode for scope permissions. |
| LIM-1369 | Added new property to set the owner role(s) for KPIs and calculated members Limits creates in connected Atoti servers. This property is optional and can be auto-configured. |
| LIM-1373 | Updated Data Connectors to version 4.2.0-AS6.1. |
| LIM-1377 | Added a service in the connected servers to be triggered on limit events. See Sending events to your connected server. |
| LIM-1382 | Atoti Limits has been upgraded to Atoti Server 6.1.1. The 6.0.X and 6.0.X-sb3 modules have been upgraded to use Atoti Server 6.0.17 and 6.0.17-sb3 respectively. |
| LIM-1390 | Permissions for uploading/downloading limits are now supported. |
| LIM-1395 | Added Alive field to the Limits store to indicate if a limit is active or deleted/expired. |
| LIM-1356 | Separate loading of workflow statuses by setting -Dlimits.workflow.workflow-status-fetched-with-limit=false. |
| LIM-1418 | The datepicker for the limit start date in the Limits viewer screen now defaults to the server’s as of date. |
| LIM-1449 | Added re-evaluate action for reviewed incidents to allow them to be re-evaluated. |
| LIM-1466 | Updated Common Library to version 2.1.0-AS6.1. |
Changed
| Issue Key | Details |
|---|
| LIM-1033 | Maven artifact groupIDs have been renamed from com.activeviam.limits to com.activeviam.solutions.limits to align with other ActiveViam Business Solutions. |
| LIM-1096 | KpiCrudService and KpiCrudRestService have been updated, separating the two classes into a Spring Service and a REST Controller wrapper. |
| LIM-1257 | Improved handling of workflow-related exceptions so better information is provided in UI responses. |
| LIM-1276 | The limits-auto-config API has been improved. For more information see Atoti Java. |
| LIM-1298 | Improved property handling in Atoti Limits auto-configuration. |
| LIM-1300 | Modified properties of LimitsWorkflowConfigurationProperties to add a new token. Root for these properties is now limits.workflow. |
| LIM-1304 | The “DTO” suffix has been removed from java objects that were not pure data transfer objects. |
| LIM-1310 | “Complex scopes” have been renamed to “Advanced scopes”. |
| LIM-1314 | Improvements have been made to the validation framework. See the custom validator page for more information. |
| LIM-1323 | Improved performance of filters in Limits tables. |
| LIM-1344 | The ILimitsRetrievalService methods have been updated and the implementation modified to avoid executing methods recursively and to reduce the number of transactions in methods. For more details, see Changes to IlimitsRetrievalService. |
| LIM-1359 | The limits-shared-properties module has been renamed to limits-common and the limits-lookup-postprocessors modules have been merged into the limits-integration and limits-common modules. |
| LIM-1410 | Merged RemoteLimit, RemoteLimitEntity and LimitGoal into the new SimpleLimit class. |
| Issue Key | Details |
|---|
| LIM-285 | Between and Not Between KpiTypes have been disabled. For more information, see Removing Between and Not Between KPI types. |
| LIM-658 | The properties for the Atoti Limits content server have been removed as they are no longer used. |
| LIM-1231 | The manual configuration has been removed in favor of auto-configuration. |
| LIM-1274 | private_ and internal imports have been removed from Atoti Limits. |
| LIM-1312 | Removed support for Atoti Server version 5.11 as it is no longer supported by ActiveViam. |
Fixed
| Issue Key | Details |
|---|
| LIM-1303 | Fixed the admin-ui database tab by adding @EnableWebMvc and removing custom message converters. |
| LIM-1308 | Utilizations represented as strings as well as special or undetermined numbers are now handled correctly. |
| LIM-1325 | Fixed the scope selector overflowing the popover for large lists of scope members. |
| LIM-1349 | Removed the incorrect usage of the thread pool when creating/dropping KPIs in the KpiCrudService. |
| LIM-1358 | Updated calculated member creation to set ROLE_USER as the default owner and reader so all users can see the measures. |
| LIM-1366 | Fixed issue with evaluation errors not being cleared when retrying the evaluation. |
| LIM-1371 | Limits are now correctly evaluated via the Inventory screen or REST services when cube filters are disabled. |
| LIM-1375 | The “Available amount” and “Utilization perc.” measures are now available for limits created both on startup and at runtime. |
| LIM-1413 | Removing the row(s) on the last page of the Limits Viewer table will no longer result in a table with an empty page. This includes deleting limits and canceling limit creation. |
| LIM-1416 | The Re-Evaluate icon for incidents in the Status screen is now disabled for users with no permission to evaluate limits. |
| LIM-1429 | Fixed an issue where restarting Atoti Limits in persistent mode did not restore the object and workflow states. |
| LIM-1430 | Corrected Limits roles documentation for roles that were previously prefixed by GROUP_, but are now prefixed by ROLE_. |
| LIM-1439 | Fixed the Limits viewer column configurator allowing reordering columns. |
Known issues
| Issue Key | Details |
|---|
| LIM-1450 | Deleting an official limit makes the associated temporary limits invisible in the table. As a workaround, delete the temporary limit first. |
| LIM-1426 | Incidents workflows are not created/updated when modified via the IncidentCrudService. This does not apply on evaluation. |
| LIM-1309 | Wildcards and exclusive scopes are not handled by the IScopeRetrievalService default implementation. This affects the members visible in the scope level name and scope level member hierarchies, but only applies if exclusive scopes are used. |
| BAS-1330 | Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint /modules/limits-module/limits/rest/v2/limitDefinition/limits/save. The key of the limit structure will still be visible in the admin-ui. |
| LIM-846 | Complex Scopes: Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures. |
| LIM-840 | Complex Scopes: Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures. |
| LIM-813 | Managers can incorrectly upload Limit Structures through the REST endpoint. |
| LIM-594 | Having email notifications enabled for breaches causes decreased limit evaluation performance. See Configuring the breach email on how to disable breach emails. |
| LIM-357 | The Six Eyes workflow is currently not implemented. |
| LIM-346 | Limits on calculated measures only work through File Upload, not through the UI. |
| LIM-320 | Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See Measures for more on how to create a query for Limits on calculated measures. |
Open CVEs
| Issue | Status | Details | Impacting | Product impact | Workaround | Fix expected |
|---|
| CVE-2024-38821 | Critical | Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true:
- It must be a WebFlux application
- It must be using Spring’s static resources support
- It must have a non-permitAll authorization rule applied to the static resources support. | org.springframework.security:spring-security-web | Low. Atoti Server does not ship sensitive static assets, only the stock UI and the necessary config files. All sensitive information is performed in the backend. | Use an alternative provider for static resources, like Nginx, at the cost of a more complex security configuration in the Java application. | Yes, once Atoti Server is updated to the next version |
| CVE-2024-28752 | Critical | An SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3, and 3.5.8 allows an attacker to perform SSRF-style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default data binding) are not impacted. | org.apache.cxf:cxf-core | Low. This CVE is present in the limits-atoti-server-60-sb3 artifact which is only intended for testing purposes. | Upgrade to the latest version of Atoti Server. | No, as this CVE only exists in an artifact intended for testing purposes. |
| CVE-2022-1471 | Critical | SnakeYaml’s Constructor class, which inherits from SafeConstructor, allows any type to be deserialized given the following line:
new Yaml(new Constructor(TestDataClass.class)).load(yamlContent);
Types do not have to match the types of properties in the target class. A ConstructorException is thrown, but only after a malicious payload is deserialized. | org.yaml:snakeyaml | Low. This CVE is present in the limits-atoti-server-60 artifact which is only intended for testing purposes. | Upgrade to the latest version of Atoti Server. | No, as this CVE only exists in an artifact intended for testing purposes. |
| CVE-2016-1000027 | Critical | Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. | org.springframework:spring-web, com.activeviam.activepivot:activepivot-server-spring | Low. Only applies to Atoti Server version 6.0.x artifacts. Remote invocation is used for services defined by com.qfs.server.cfg.impl.ActivePivotRemotingServicesConfig. They can be optionally imported and are historically required for ActivePivotLive, an old abandoned version of AtotiUI. | Do not import com.qfs.server.cfg.impl.ActivePivotRemotingServicesConfig in projects. | No, as the only fix is migrating to Spring 6 by upgrading your connected server to Atoti Server version 6.0.x-sb3 or higher. |
