ServiceNow Scoped Applications Yokohama

Apply these rules to scoped applications on the ServiceNow Yokohama family. Use the instance's managed JavaScript engine and Yokohama APIs; rules for guarded script enforcement below require Yokohama Patch 13 or later.

Establish the runtime and upgrade state

• Confirm the exact family, patch, hotfix, installed Store applications, and plugins before using an API or changing a security property. Apply the relevant platform and Store security updates in production and sub-production.
• When the application is built from source with the ServiceNow SDK, add the @servicenow/sdk release line that supports the instance's family and any third-party npm libraries through npm, so the committed package-lock.json records them and Dependabot or Renovate keeps them current, and take any exact SDK version from the npm registry or leave a placeholder that fails the build. Take family, patch, and hotfix identifiers from ServiceNow's patch listing or the advisory itself, never from memory.
• Confirm family support entitlement and upgrade deadlines with Now Support separately from hotfix availability; schedule migration when the instance falls outside the supported families.
• Check the application and individual script JavaScript modes. ECMAScript 2021 (ES12) is the default for new scoped applications; ES5 Standards and Compatibility remain available. Use the documented feature subset and regression-test existing scripts before changing modes; do not assume Node.js APIs exist.
• Verify the High Security Settings plugin and the installed Security Center baseline. Yokohama installs