FDK v10.1.6 - Local anti-virus scan simulation & file upload enhancements

Happening Announcements
, , , ,
1

Why this is important

Testing file-upload flows locally has always had one gap: there was no way to simulate how the platform’s production anti-virus (AV) scanning behaves before you ship your app. With FDK v10.1.6, local testing now mirrors production behavior end-to-end - from support for larger files to AV scan simulation to strict validation at the request-template layer. If your app uploads files (images, spreadsheets, PDFs, Word docs, etc.) and sends them onward to a third-party API, this release directly affects you.

What this means for you

  • If your app uses file upload + request templates: Retest your multipart/form-data or application/octet-stream request templates locally with av_scan.status set to UNSAFE and IN_PROGRESS. Confirm your app surfaces a clear error to the user instead of silently failing or retrying indefinitely, since the platform now blocks non-SAFE files before the request template executes.
  • If you accept larger files or new file types: Update any client-side validation, messaging, or file-size checks in your app to reflect the new 40 MB limit and the added .pdf / .doc / .docx support, so your UI doesn’t reject files the platform would now accept (or vice versa).
  • If you’re still on fdk test: Start migrating to fdk unit-test now rather than waiting for the July 9, 2026, cutoff - see the dedicated deprecation notice and coverage requirements below for the full timeline and what’s required.
  • Best practice: Treat fdk config set av_scan.status as a standard part of your test suite/checklist for any app that touches file uploads - don’t rely solely on the default SAFE simulation, since it won’t catch the failure paths your users may actually hit in production.

We’re excited to announce FDK v10.1.6, which brings local AV scan simulation and several file-upload enhancements into general availability, aligning local FDK testing with production behavior.

What’s new

1. Increased file limits

  • The maximum allowed file size for uploads has increased from 10 MB to 40 MB.
  • Added official support for .pdf, .doc, and .docx file types.

2. Local AV scan simulation

You can now use the FDK CLI to simulate SAFE, UNSAFE, and stuck (IN_PROGRESS) file-scan outcomes locally, so you can test your app’s error handling before you ship.

By default, the FDK sets the simulated file status to SAFE after a one-second delay.

Set a persistent configuration (recommended for consistent local testing):

fdk config set av_scan.status <status>
Value Description
SAFE (default) The file passes the scan.
UNSAFE The file fails the scan, and the platform rejects it.
IN_PROGRESS The scan never completes - use this to test timeout handling. 
# Simulate a rejected malicious file
fdk config set av_scan.status UNSAFE

# View current FDK configuration
fdk config list

# Remove the configuration to restore the system default
fdk config delete av_scan.status

Override the status temporarily (single run, via environment variable - only works if no local config is set):

# 1. Delete the existing configuration
fdk config delete av_scan.status

# 2. Run the app with the temporary environment variable
FDK_AV_SCAN_STATUS=UNSAFE fdk run

Precedence order: local config (fdk config set) → environment variable → system default (SAFE).

:page_facing_up: Docs: Configure anti-virus scan simulation

3. Request template security gate

Request templates using application/octet-stream and multipart/form-data now strictly validate scan statuses before execution. Any file that isn’t marked SAFE is blocked, and the platform throws a standard validation error - closing a gap that previously allowed a non-scanned or unsafe file to reach a third-party endpoint via invokeTemplate().

:page_facing_up: Docs: File upload using request template → Anti-virus scan validation

:warning: Important note on Object Storage

The Object storage documentation currently reflects the prior limits (10 MB max file size; PNG, JPG, JPEG, XLS, XLSX, CSV, JSON only). With this release, the effective limits for supported apps are increased to 40 MB, and .pdf, .doc, and .docx support is added, as noted above. Please build and test against the updated limits described in the What’s new - June 2026 entry, and double-check the Object storage page for updates as it’s refreshed.

All files referenced in a request template must still be uploaded to object storage first, and the reference identifier (ref) is what you pass into the template - see file upload using request template for the full flow.

Also in this release: fdk test deprecation

Starting July 9, 2026, the fdk test command will be deprecated. Going forward, fdk unit-test (Vitest-based) is the officially supported framework for writing and running unit tests.

fdk unit-test

If you haven’t migrated yet, see Unit test for the setup steps (Vitest config, mocking client, $request, $db, etc.).

Note, this isn’t just a command rename - coverage requirements are changing too. Starting July 31, 2026, Marketplace apps must meet minimum coverage thresholds (80%+ via fdk unit-test, 50%+ via local simulation) to be packaged and pass Marketplace validation. For the full timeline, rationale, and migration checklist, see the dedicated community post: Attention: Deprecation of “fdk test”, Introduction of “fdk unit-test”, and New Coverage Requirements.

Getting started

  1. Update the FDK: confirm engines.fdk in your manifest reflects 10.1.6 or later.
  2. Set a local AV scan status to test your upload error-handling paths (UNSAFE, IN_PROGRESS).
  3. Review any request templates using multipart/form-data or application/octet-stream for the new validation behavior.
  4. If you’re still on fdk test, start migrating to fdk unit-test ahead of the July 9, 2026, deprecation.

Resources

As always, questions and feedback are welcome in the replies below. :backhand_index_pointing_down:

1 Like