ServiceNow Scoped Applications Australia

Apply these rules to scoped applications on the ServiceNow Australia family, including server scripts, tables, portals, REST resources, integrations, and automation. Use the instance's actual patch, installed features, and JavaScript mode when selecting APIs and security settings.

Release and runtime

• Deploy on a maintained Australia patch or hotfix and check each ServiceNow security advisory's list of fixed builds against the instance's exact build. When you stay on an earlier patch, confirm the advisory names a hotfix for that patch rather than assuming a later patch's fix reached it, and check for newer advisories before each deployment.
• When the application is built from source with the ServiceNow SDK, add the @servicenow/sdk release line that supports the instance's family and any third-party npm libraries through npm, so the committed package-lock.json records them and Dependabot or Renovate keeps them current, and take any exact SDK version from the npm registry or leave a placeholder that fails the build. Take family, patch, and hotfix identifiers from ServiceNow's patch listing or the advisory itself, never from memory.
• Use ServiceNow's supported scoped APIs and server-side JavaScript features. New scoped applications and newly created scripts default to ECMAScript 2021 (ES12), implementing a subset of ES2021/ES2022; existing applications can use ES5 Standards or Compatibility. Check both application and script settings and regression-test mode changes; do not assume Node.js APIs or full ECMAScript support.
• Review the effective instance properties