Changelog

Version 8.7.0

Use undici as the HTTP client instead of Phin, which is no longer maintained.
Added undici HTTP client implementation
Added risk_rtt field to activities in case of S2S timeout
Support for JWT key names that contain dots (such as URLs) when extracting the user id and additional fields
Custom block on error message configuration support
Pass request object to response custom parameters custom function
MCP Protection support
Send original vid from cookie on all activities under orig_cookie_vid
Added Hard Block Support

Added support for the custom_sensitive_request feature, which enables using a custom function to identify sensitive routes
Added is_sensitive_route field in activities

Added support for running the Enforcer as a standalone Node.js process without requiring a code bundle.
Added remote_config_id field to risk and async activities
Added remote_config_id and remote_config_version fields to telemetry activity
DefaultGraphQLParser modified to extract operationName and variables even when the query is not present
Specifying token version (v2 or v3) with px_token_version always for consistency in telemetry activities
Fixed issue where telemetry would fail for array of cookie strings
Fixed issue where UrlImpl constructor would throw an error for @ character in the path or search params
CD process fix

Decode the request URL, send it on the enforcer activities URL field, and use it for all enforcer processing.

Added px_token_version configuration to support both v2 and v3 (default is v3)
GraphQL query keyword extraction via string/regex (px_graphql_keywords) and custom function (px_extract_graphql_keywords)
Support for cookie secret rotation
Configuration px_sensitive_graphql_operation_names expanded to include regular expressions and applies to extracted GraphQL keywords as well
Telemetry activity includes redacted sensitive configuration fields
Default value for px_bypass_monitor_header changed from an empty string to “x-px-block”
Modify telemetry activity to include all types of config
Updated the captcha template
Using raw URL instead of parsed URL in block page captcha script query parameter
Converted fields login_successful_reporting_method, sent_through of CredentialEndpointConfiguration to optional
Fixed issue where unvalidated _pxvid value was added to the captcha page
Fixed issue where regular expressions occasionally failed on calls to test() due to global flag

Added base64-encoded request HTTP method to captcha script query parameters on block pages
JSON parsing issue with generated package.json for CommonJS library build fixed
Issue with mix-ups in header-based logs fixed
Issue where block activities may contain http_status_code field fixed