> ## Documentation Index
> Fetch the complete documentation index at: https://docs.activeviam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

<Info>
  For a brief overview of the changes, see our [Release notes](./release-notes-4.0).
  For information on upgrading from previous versions, see the
  [Atoti Limits Migration Guide](./migrate-4.0).
</Info>

<Update label="4.0.4" description="2025-10-21">
  ### Added

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1523</td><td>We have added new services to start Activiti workflows in bulk.</td></tr></tbody></table>

  ### Changed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1523</td><td>The default implementation of <code>ILimitsProcessInstanceWorkflowCacheService</code> is now a no-operation implementation as this class is unused.</td></tr><tr><td>LIM-1837</td><td>Updated warning message from “Warn when within x% of a limit” to “Warn when utilisation reaches x% of a limit” for improved clarity.</td></tr></tbody></table>

  ### Deprecated

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1523</td><td><code>ILimitsProcessInstanceWorkflowCacheService</code> is unused and has been deprecated for removal. It is still present to avoid breaking the API.</td></tr><tr><td>LIM-1523</td><td><code>IEvaluationTaskManager</code> has been deprecated for removal because most of its methods are unused.</td></tr></tbody></table>

  ### Fixed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1850</td><td>Fixed an issue where JWT tokens were not being refreshed causing requests between servers to fail after token expiration (default is 12 hours).</td></tr><tr><td>LIM-1910</td><td>Fixed the logic and wording for warning thresholds. The warning threshold is now directly correlated to the limit utilization percentage.</td></tr><tr><td>LIM-1954</td><td>You can now create limits on calculated measures where the underlying is a hierarchy.</td></tr></tbody></table>
</Update>

<Update label="4.0.3" description="2025-05-16">
  ### Added

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1488</td><td>Moved the <code>IAuthenticatedLimitsUserService</code> to <code>limits-common</code> and created a new implementation in <code>limits-activeviam</code> to assist with tasks requiring unrestricted access to Atoti Limits data.</td></tr></tbody></table>

  ### Changed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1622</td><td>Changed the default <code>DataLoadController</code> to use an implementation that delegates the security context to the spawned threads.</td></tr></tbody></table>

  ### Deprecated

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1611</td><td>The <code>ILimitsActivitiAuthenticationManager</code> and the <code>getWithAuth(...)</code> methods in <code>IWebClientService</code> are no longer used and have been deprecated and marked for removal in the next minor release.</td></tr></tbody></table>

  ### Fixed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1550</td><td>Fixed an issue where users with the <code>ROLE\_CREATE\_ANY\_LIMIT</code> permission role were blocked when attempting to create a limit via the UI or REST.</td></tr><tr><td>LIM-1611</td><td>Fixed an issue where JWT authentication was not being used when accessing Activiti or when querying the content server.</td></tr></tbody></table>

  ### Known issues

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>BAS-1330</td><td>Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint <code>/modules/limits-module/limits/rest/v2/limitDefinition/limits/save</code>. The key of the limit structure will still be visible in the admin-ui.</td></tr><tr><td>LIM-846</td><td><strong>Complex Scopes:</strong> Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures.</td></tr><tr><td>LIM-840</td><td><strong>Complex Scopes:</strong> Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures.</td></tr><tr><td>LIM-813</td><td>Managers can incorrectly upload Limit Structures through the REST endpoint.</td></tr><tr><td>LIM-594</td><td>Having email notifications enabled for breaches causes decreased limit evaluation performance. See <a href="../../../dev/limit-workflow">Configuring the breach email</a> on how to disable breach emails.</td></tr><tr><td>LIM-357</td><td>The Six Eyes workflow is currently not implemented.</td></tr><tr><td>LIM-346</td><td>Limits on calculated measures only work through File Upload, not through the UI.</td></tr><tr><td>LIM-320</td><td>Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See <a href="../../../user-ref/using-limits/measure-types">Measures</a> for more on how to create a query for Limits on calculated measures.</td></tr></tbody></table>
</Update>

<Update label="4.0.2" description="2025-03-28">
  ### Added

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1481</td><td>Added <code>RestTemplate</code> and <code>RestClient</code> beans in the connection modules when sending requests to Atoti Limits and reduced the number of requests sent between the application server and Atoti Limits.</td></tr></tbody></table>

  ### Changed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1552</td><td>Only required folders are now fetched from the connected server when resolving calculated measures.</td></tr><tr><td>LIM-1560</td><td>Use one global <code>CalculatedMeasuresResolver</code> to speed up queries on limits on calculated measures.</td></tr><tr><td>LIM-1563</td><td>Performance improvements for creating, updating, and evaluating limits.</td></tr></tbody></table>

  ### Known issues

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>BAS-1330</td><td>Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint <code>/modules/limits-module/limits/rest/v2/limitDefinition/limits/save</code>. The key of the limit structure will still be visible in the admin-ui.</td></tr><tr><td>LIM-846</td><td><strong>Complex Scopes:</strong> Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures.</td></tr><tr><td>LIM-840</td><td><strong>Complex Scopes:</strong> Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures.</td></tr><tr><td>LIM-813</td><td>Managers can incorrectly upload Limit Structures through the REST endpoint.</td></tr><tr><td>LIM-594</td><td>Having email notifications enabled for breaches causes decreased limit evaluation performance. See <a href="../../../dev/limit-workflow">Configuring the breach email</a> on how to disable breach emails.</td></tr><tr><td>LIM-357</td><td>The Six Eyes workflow is currently not implemented.</td></tr><tr><td>LIM-346</td><td>Limits on calculated measures only work through File Upload, not through the UI.</td></tr><tr><td>LIM-320</td><td>Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See <a href="../../../user-ref/using-limits/measure-types">Measures</a> for more on how to create a query for Limits on calculated measures.</td></tr></tbody></table>
</Update>

<Update label="4.0.1" description="2025-02-05">
  ### Added

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1378</td><td>Added an <code>ILimitsCacheService</code> to store structures/limits that exist on the business server to speed up evaluations.</td></tr><tr><td>LIM-1531</td><td>Added a property <code>limits.cube.scope-hierarchies-enabled</code> that can be used to disable scope hierarchies to improve loading performance for large cardinalities of limit scopes.</td></tr></tbody></table>

  ### Changed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1469</td><td>Use the <code>IConfigurationService</code> instead of REST requests to execute MDX statements when creating Atoti Limits calculated measures to improve performance.</td></tr><tr><td>LIM-1525</td><td>Improved performance of limit evaluations by skipping unnecessary retrieval of limit workflow information.</td></tr></tbody></table>

  ### Deprecated

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1378</td><td>The <code>LimitsRetriever</code> class and the <code>limits/rest/v2/limitDefinition/limitsDefinitionStoreQuery</code> endpoint are no longer used and are deprecated in favor of the <code>ILimitsCacheService</code>. They will be removed in version <code>4.1.0</code>.</td></tr></tbody></table>

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1407</td><td><code>limits-activeviam</code> no longer has a dependency on <code>limits-integration-common</code>. Classes previously imported from <code>limits-integration-common</code> are now imported from <code>limits-common</code>.</td></tr></tbody></table>

  ### Fixed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1335</td><td>Fixed an issue where data permissions in Atoti Limits were not applied to the KPIs and calculated members created by the module in the business cube.</td></tr><tr><td>LIM-1483</td><td>Fixed an issue where KPIs were not refreshed after restarting Atoti Limits in persistent mode.</td></tr><tr><td>LIM-1492</td><td>Fixed an issue where Atoti Limits calculated measures were being created on connected server KPIs that did not belong to Atoti Limits.</td></tr><tr><td>LIM-1498</td><td>Fixed an issue where the connected application would not start if Atoti Limits Auto-configuration was disabled via <code>limits.autoconfiguration.enabled=false</code>.</td></tr><tr><td>LIM-1510</td><td>Fixed an issue where the structure scope search can overflow the popover.</td></tr><tr><td>LIM-1512</td><td>Fixed an issue where KPIs were not being created unless restricted users were defined.</td></tr><tr><td>LIM-1518</td><td>Fixed an issue where warning thresholds were not being correctly evaluated.</td></tr><tr><td>LIM-1521</td><td>Fixed an issue that prevented limits from being created on nested calculated measures.</td></tr><tr><td>LIM-1522</td><td>Fixed an issue where generated IDs for limits created via the UI could collide with IDs for limits created via file upload if the uploaded limits respected the ordering of the generated IDs.</td></tr><tr><td>LIM-1530</td><td>Fixed an issue where the evaluation error popover could overflow to the end of the screen.</td></tr></tbody></table>

  ### Known issues

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1450</td><td>Deleting an official limit makes the associated temporary limits invisible in the table. As a workaround, delete the temporary limit first.</td></tr><tr><td>LIM-1426</td><td>Incidents workflows are not created/updated when modified via the IncidentCrudService. This does not apply on evaluation.</td></tr><tr><td>LIM-1309</td><td>Wildcards and exclusive scopes are not handled by the <code>IScopeRetrievalService</code> default implementation. This affects the members visible in the <a href="../../../user-ref/cube/scope-level-name">scope level name</a> and <a href="../../../user-ref/cube/scope-level-member">scope level member</a> hierarchies, but only applies if exclusive scopes are used.</td></tr><tr><td>BAS-1330</td><td>Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint <code>/modules/limits-module/limits/rest/v2/limitDefinition/limits/save</code>. The key of the limit structure will still be visible in the admin-ui.</td></tr><tr><td>LIM-846</td><td><strong>Complex Scopes:</strong> Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures.</td></tr><tr><td>LIM-840</td><td><strong>Complex Scopes:</strong> Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures.</td></tr><tr><td>LIM-813</td><td>Managers can incorrectly upload Limit Structures through the REST endpoint.</td></tr><tr><td>LIM-594</td><td>Having email notifications enabled for breaches causes decreased limit evaluation performance. See <a href="../../../dev/limit-workflow">Configuring the breach email</a> on how to disable breach emails.</td></tr><tr><td>LIM-357</td><td>The Six Eyes workflow is currently not implemented.</td></tr><tr><td>LIM-346</td><td>Limits on calculated measures only work through File Upload, not through the UI.</td></tr><tr><td>LIM-320</td><td>Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See <a href="../../../user-ref/using-limits/measure-types">Measures</a> for more on how to create a query for Limits on calculated measures.</td></tr></tbody></table>
</Update>

<Update label="4.0.0" description="2024-11-20">
  ### Added

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-468</td><td>The default format for KPI Goal values can now be configured using the <code>limits.cube.format.kpi-goal</code> property.</td></tr><tr><td>LIM-987</td><td>You can now drill down by a limit scope’s level name and level values in a pivot table.</td></tr><tr><td>LIM-1045</td><td>Updated Atoti Server to version 6.1.1. This includes the upgrade of artifacts required to connect to 6.1.1 versions of Atoti Server.</td></tr><tr><td>LIM-1155</td><td>Added an <code>IScopeRetrievalService</code> and a default implementation, facilitating granular querying of the scopes stores by passing a level or a member.</td></tr><tr><td>LIM-1199</td><td>Limits CSV files can now contain <a href="../../../dev/scopes/scope-overview">Simplified Scopes</a>.</td></tr><tr><td>LIM-1200</td><td>An “Available Amount” and “Utilization %” measure for each KPI has been added to the limits-auto-config, calculating the difference and quotient between a KPI’s goal and the KPI’s value, respectively.</td></tr><tr><td>LIM-1205</td><td>Added a property to configure whether or not filters are applied on evaluation.</td></tr><tr><td>LIM-1234</td><td>Added support for permission-based data access depending on the user’s role. See <a href="../../../dev/roles/data-access-permissions">Data access permissions</a>.</td></tr><tr><td>LIM-1268</td><td>Moved core configuration classes from <code>limits-activeviam</code> to <code>limits-starter</code>.</td></tr><tr><td>LIM-1275</td><td>Added debug logs when evaluating Atoti Limits KPIs detailing eligible limits, exposures, and evaluation location.</td></tr><tr><td>LIM-1299</td><td>Added connector artifacts for versions of Atoti Server running on Java 11.</td></tr><tr><td>LIM-1302</td><td>Added support for <a href="../../../dev/roles/data-access-permissions">restricting access on scopes</a> in the role permissions.</td></tr><tr><td>LIM-1318</td><td>Updated the Workflow Common Library to version 2.4.1 and H2 to version 2.2.220 to fix CVEs.</td></tr><tr><td>LIM-1324</td><td>Pagination has been added to the Limits viewer.</td></tr><tr><td>LIM-1328</td><td>Added new <code>matchMode</code> values for scopes to support more flexible retrievals in the <code>IScopeRetrievalService</code>. For details, see <a href="../../../dev/roles/data-access-permissions">Match mode</a>.</td></tr><tr><td>LIM-1339</td><td>Added <a href="../../../dev/roles/limits-roles">permission roles</a> to control user access to UI actions.</td></tr><tr><td>LIM-1340</td><td>Permission roles are now enforced on REST requests, blocking the action from being processed by the server if the user does not have the required permissions.</td></tr><tr><td>LIM-1341</td><td>Permission roles for the workflow actions of approving/rejecting limits and processing incidents are now supported.</td></tr><tr><td>LIM-1345</td><td>Improved performance in the Limits viewer screen by using the <code>ScopeCacheService</code> to help retrieve scope objects.</td></tr><tr><td>LIM-1355</td><td>Added <code>/limits/rest/v2/limitDefinition/limits/status/get</code> endpoint to get limits status & server setting to include status for limit structures.</td></tr><tr><td>LIM-1357</td><td>Added new property to set the <code>default-scope-match-mode</code> for scope permissions.</td></tr><tr><td>LIM-1369</td><td>Added new property to set the owner role(s) for KPIs and calculated members Limits creates in connected Atoti servers. This property is optional and can be auto-configured.</td></tr><tr><td>LIM-1373</td><td>Updated Data Connectors to version 4.2.0-AS6.1.</td></tr><tr><td>LIM-1377</td><td>Added a service in the connected servers to be triggered on limit events. See <a href="../../../dev/dev-extensions/custom-limits-events/custom-limits-event-to-connected-server">Sending events to your connected server</a>.</td></tr><tr><td>LIM-1382</td><td>Atoti Limits has been upgraded to Atoti Server 6.1.1. The <code>6.0.X</code> and <code>6.0.X-sb3</code> modules have been upgraded to use Atoti Server <code>6.0.17</code> and <code>6.0.17-sb3</code> respectively.</td></tr><tr><td>LIM-1390</td><td>Permissions for uploading/downloading limits are now supported.</td></tr><tr><td>LIM-1395</td><td>Added <code>Alive</code> field to the <code>Limits</code> store to indicate if a limit is active or deleted/expired.</td></tr><tr><td>LIM-1356</td><td>Separate loading of workflow statuses by setting <code>-Dlimits.workflow\.workflow-status-fetched-with-limit=false</code>.</td></tr><tr><td>LIM-1418</td><td>The datepicker for the limit start date in the Limits viewer screen now defaults to the server’s as of date.</td></tr><tr><td>LIM-1449</td><td>Added re-evaluate action for reviewed incidents to allow them to be re-evaluated.</td></tr><tr><td>LIM-1466</td><td>Updated Common Library to version <code>2.1.0-AS6.1</code>.</td></tr></tbody></table>

  ### Changed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1033</td><td>Maven artifact <code>groupID</code>s have been renamed from <code>com.activeviam.limits</code> to <code>com.activeviam.solutions.limits</code> to align with other ActiveViam Business Solutions.</td></tr><tr><td>LIM-1096</td><td><code>KpiCrudService</code> and <code>KpiCrudRestService</code> have been updated, separating the two classes into a Spring Service and a REST Controller wrapper.</td></tr><tr><td>LIM-1257</td><td>Improved handling of workflow-related exceptions so better information is provided in UI responses.</td></tr><tr><td>LIM-1276</td><td>The <code>limits-auto-config</code> API has been improved. For more information see <a href="../../../dev/integration/java">Atoti Java</a>.</td></tr><tr><td>LIM-1298</td><td>Improved property handling in Atoti Limits auto-configuration.</td></tr><tr><td>LIM-1300</td><td>Modified properties of <code>LimitsWorkflowConfigurationProperties</code> to add a new token. Root for these properties is now <code>limits.workflow</code>.</td></tr><tr><td>LIM-1304</td><td>The “DTO” suffix has been removed from java objects that were not pure data transfer objects.</td></tr><tr><td>LIM-1310</td><td>“Complex scopes” have been renamed to “Advanced scopes”.</td></tr><tr><td>LIM-1314</td><td>Improvements have been made to the validation framework. See the <a href="../../../dev/dev-extensions/custom-validation/custom-validators">custom validator</a> page for more information.</td></tr><tr><td>LIM-1323</td><td>Improved performance of filters in Limits tables.</td></tr><tr><td>LIM-1344</td><td>The <code>ILimitsRetrievalService</code> methods have been updated and the implementation modified to avoid executing methods recursively and to reduce the number of transactions in methods. For more details, see <a href="./migrate-4.0">Changes to <code>IlimitsRetrievalService</code></a>.</td></tr><tr><td>LIM-1359</td><td>The <code>limits-shared-properties</code> module has been renamed to <code>limits-common</code> and the <code>limits-lookup-postprocessors</code> modules have been merged into the <code>limits-integration</code> and <code>limits-common</code> modules.</td></tr><tr><td>LIM-1410</td><td>Merged <code>RemoteLimit</code>, <code>RemoteLimitEntity</code> and <code>LimitGoal</code> into the new <code>SimpleLimit</code> class.</td></tr></tbody></table>

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-285</td><td><code>Between</code> and <code>Not Between</code> KpiTypes have been disabled. For more information, see <a href="./migrate-4.0">Removing Between and Not Between KPI types</a>.</td></tr><tr><td>LIM-658</td><td>The properties for the Atoti Limits content server have been removed as they are no longer used.</td></tr><tr><td>LIM-1231</td><td>The manual configuration has been removed in favor of <a href="../../../dev/integration/java">auto-configuration</a>.</td></tr><tr><td>LIM-1274</td><td><code>private\_</code> and <code>internal</code> imports have been removed from Atoti Limits.</td></tr><tr><td>LIM-1312</td><td>Removed support for Atoti Server version 5.11 as it is no longer supported by ActiveViam.</td></tr></tbody></table>

  ### Fixed

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1303</td><td>Fixed the <code>admin-ui</code> database tab by adding <code>@EnableWebMvc</code> and removing custom message converters.</td></tr><tr><td>LIM-1308</td><td>Utilizations represented as strings as well as special or undetermined numbers are now handled correctly.</td></tr><tr><td>LIM-1325</td><td>Fixed the scope selector overflowing the popover for large lists of scope members.</td></tr><tr><td>LIM-1349</td><td>Removed the incorrect usage of the thread pool when creating/dropping KPIs in the <code>KpiCrudService</code>.</td></tr><tr><td>LIM-1358</td><td>Updated calculated member creation to set <code>ROLE\_USER</code> as the default <code>owner</code> and <code>reader</code> so all users can see the measures.</td></tr><tr><td>LIM-1366</td><td>Fixed issue with evaluation errors not being cleared when retrying the evaluation.</td></tr><tr><td>LIM-1371</td><td>Limits are now correctly evaluated via the <strong>Inventory</strong> screen or REST services when cube filters are disabled.</td></tr><tr><td>LIM-1375</td><td>The “Available amount” and “Utilization perc.” measures are now available for limits created both on startup and at runtime.</td></tr><tr><td>LIM-1413</td><td>Removing the row(s) on the last page of the Limits Viewer table will no longer result in a table with an empty page. This includes deleting limits and canceling limit creation.</td></tr><tr><td>LIM-1416</td><td>The <code>Re-Evaluate</code> icon for incidents in the <strong>Status</strong> screen is now disabled for users with no permission to evaluate limits.</td></tr><tr><td>LIM-1429</td><td>Fixed an issue where restarting Atoti Limits in persistent mode did not restore the object and workflow states.</td></tr><tr><td>LIM-1430</td><td>Corrected <a href="../../../dev/roles/limits-roles">Limits roles documentation</a> for roles that were previously prefixed by <code>GROUP\_</code>, but are now prefixed by <code>ROLE\_</code>.</td></tr><tr><td>LIM-1439</td><td>Fixed the Limits viewer column configurator allowing reordering columns.</td></tr></tbody></table>

  ### Known issues

  <table><thead><tr><th>Issue Key</th><th>Details</th></tr></thead><tbody><tr><td>LIM-1450</td><td>Deleting an official limit makes the associated temporary limits invisible in the table. As a workaround, delete the temporary limit first.</td></tr><tr><td>LIM-1426</td><td>Incidents workflows are not created/updated when modified via the IncidentCrudService. This does not apply on evaluation.</td></tr><tr><td>LIM-1309</td><td>Wildcards and exclusive scopes are not handled by the <code>IScopeRetrievalService</code> default implementation. This affects the members visible in the <a href="../../../user-ref/cube/scope-level-name">scope level name</a> and <a href="../../../user-ref/cube/scope-level-member">scope level member</a> hierarchies, but only applies if exclusive scopes are used.</td></tr><tr><td>BAS-1330</td><td>Deleting the last limit value deletes the limit structure. As a workaround, don’t delete all limits on a limit structure unless you are sure that the structure won’t be used again. Alternatively, if you do need to reuse the structure, you can create a limit on it using the endpoint <code>/modules/limits-module/limits/rest/v2/limitDefinition/limits/save</code>. The key of the limit structure will still be visible in the admin-ui.</td></tr><tr><td>LIM-846</td><td><strong>Complex Scopes:</strong> Currently, a limit with an aggregated scope and a limit with a non-aggregated scope cannot be created on the same limit structure. As a workaround, create the limits on two separate structures.</td></tr><tr><td>LIM-840</td><td><strong>Complex Scopes:</strong> Currently, limits can’t be defined with an aggregated scope location and another scope location. As a workaround, create two separate limits on two separate structures.</td></tr><tr><td>LIM-813</td><td>Managers can incorrectly upload Limit Structures through the REST endpoint.</td></tr><tr><td>LIM-594</td><td>Having email notifications enabled for breaches causes decreased limit evaluation performance. See <a href="../../../dev/limit-workflow">Configuring the breach email</a> on how to disable breach emails.</td></tr><tr><td>LIM-357</td><td>The Six Eyes workflow is currently not implemented.</td></tr><tr><td>LIM-346</td><td>Limits on calculated measures only work through File Upload, not through the UI.</td></tr><tr><td>LIM-320</td><td>Calculated measures need to be included in Pivot Table Query in order to view a Limit’s KPI in the Pivot Table. See <a href="../../../user-ref/using-limits/measure-types">Measures</a> for more on how to create a query for Limits on calculated measures.</td></tr></tbody></table>

  ### Open CVEs

  <table><thead><tr><th>Issue</th><th>Status</th><th>Details</th><th>Impacting</th><th>Product impact</th><th>Workaround</th><th>Fix expected</th></tr></thead><tbody><tr><td>CVE-2024-38821</td><td>Critical</td><td>Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true:<br />- It must be a WebFlux application<br />- It must be using Spring’s static resources support<br />- It must have a non-permitAll authorization rule applied to the static resources support.</td><td><code>org.springframework.security:spring-security-web</code></td><td><strong>Low</strong>. Atoti Server does not ship sensitive static assets, only the stock UI and the necessary config files. All sensitive information is performed in the backend.</td><td>Use an alternative provider for static resources, like Nginx, at the cost of a more complex security configuration in the Java application.</td><td>Yes, once Atoti Server is updated to the next version</td></tr><tr><td>CVE-2024-28752</td><td>Critical</td><td>An SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3, and 3.5.8 allows an attacker to perform SSRF-style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default data binding) are not impacted.</td><td><code>org.apache.cxf:cxf-core</code></td><td><strong>Low</strong>. This CVE is present in the <code>limits-atoti-server-60-sb3</code> artifact which is only intended for testing purposes.</td><td>Upgrade to the latest version of Atoti Server.</td><td>No, as this CVE only exists in an artifact intended for testing purposes.</td></tr><tr><td>CVE-2022-1471</td><td>Critical</td><td>SnakeYaml’s <code>Constructor</code> class, which inherits from <code>SafeConstructor</code>, allows any type to be deserialized given the following line:<br /><code>new Yaml(new Constructor(TestDataClass.class)).load(yamlContent);</code><br />Types do not have to match the types of properties in the target class. A <code>ConstructorException</code> is thrown, but only after a malicious payload is deserialized.</td><td><code>org.yaml:snakeyaml</code></td><td><strong>Low</strong>. This CVE is present in the <code>limits-atoti-server-60</code> artifact which is only intended for testing purposes.</td><td>Upgrade to the latest version of Atoti Server.</td><td>No, as this CVE only exists in an artifact intended for testing purposes.</td></tr><tr><td>CVE-2016-1000027</td><td>Critical</td><td>Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.</td><td><code>org.springframework:spring-web</code>, <code>com.activeviam.activepivot:activepivot-server-spring</code></td><td><strong>Low</strong>. Only applies to Atoti Server version <code>6.0.x</code> artifacts. Remote invocation is used for services defined by <code>com.qfs.server.cfg.impl.ActivePivotRemotingServicesConfig</code>. They can be optionally imported and are historically required for ActivePivotLive, an old abandoned version of AtotiUI.</td><td>Do not import <code>com.qfs.server.cfg.impl.ActivePivotRemotingServicesConfig</code> in projects.</td><td>No, as the only fix is migrating to Spring 6 by upgrading your connected server to Atoti Server version <code>6.0.x-sb3</code> or higher.</td></tr></tbody></table>
</Update>