Release Notes 1.12
What’s New
Dropped support of ArcGIS Enterprise 10.9.1
ArcGIS Enterprise versions up to 10.9.1 are no longer supported.
Supported ArcGIS Enterprise versions are 11.1 and later.
Support for System CA Certificates in HTTPS Connections
The security.manager for ArcGIS CLI (secmanctl) now automatically trusts certificate authorities (CAs) that are registered in the operating system’s certificate store when establishing HTTPS connections.
This means you can now omit the --insecure CLI option when communicating with a server whose certificate is signed by a CA that is trusted by the operating system.
Update Notes
| If you skip several versions during the update, please also follow all update notes of the intervening versions. |
Deprecation of Node.js 20 and npm 10
Please use Node.js 24 and npm 11 for the npm-based installation of the CLI.
Replaced vulnerability report with a VEX file
The vulnerability-report.md file in the root of the extracted rollout folder has been replaced by sbom/securitymanager-NEXT-1.12.0-openvex.vex.json.
VEX (Vulnerability Exploitability eXchange) is a machine-readable format that communicates whether a product is affected by known vulnerabilities.
Warnings
OGC API Features
With ArcGIS 11.x, on services with activated security.manager NEXT, unauthorized layer information can be exposed via the OGC API Features endpoint. Please deactivate OGC API Features on those services.
Further information can be found at Limitations.
Changelog
1.12.0
New Features
|
Don’t return error but empty result when spatial restriction is empty feature set |
|
Support ArcGIS Enterprise 12.1 |
Fixed Issues
|
[Docs] Missing instruction to set "cors.request.trustedServers" in IWA scenarios |
|
Parsing attachment infos fails if global IDs have custom field name |
|
Tutorial for automation with GitHub actions uses broken examples |
|
Duplicated restrictions may slow down request processing |
|
applyEdits request fails when feature geometry has "geometryType" property |