FSM 2025.10.3: Locale Support, Idempotency Keys, and HTML Sanitization in Mobile
Field Service Management 2025.10.3 adds browser-locale formatting, idempotency-based duplicate prevention on mobile sync, Text Enhance on FSM custom record fields, and stricter HTML sanitization in the mobile app that may break existing rich content.
This is a Field Service Management (FSM) point release. It is not a SuiteScript or platform-wide change, but several items have direct impact on custom records, mobile configuration, and any HTML you've embedded in FSM task details.
Internationalization in FSM
FSM now formats dates, times, and numbers based on the user's browser locale across the scheduler, mobile app, and NetSuite UI. String translation is not yet implemented — only formatting. Oracle has unlocked the custcollection_fsm translation collection so you can begin staging translation strings now and reference them from custom records, fields, and forms ahead of the future release that will turn on full translation. A PDF guide is available only via NetSuite Customer Support, not in the public docs.
Idempotency keys on mobile sync
The FSM mobile app now generates a unique idempotency key on each draft record before syncing, plus a 3-second debounce on resync after reconnect. This is intended to stop duplicate record creation when sync retries fire on flaky connections.
This only works automatically for standard mobile tabs. If you've built custom tabs, you must:
- Add an idempotency field to the underlying custom record.
- Reference that field in your FSM mobile configuration (see the Idempotency topic in the FSM docs).
Until you do this, custom-tab records remain vulnerable to duplicate creation on retried syncs.
Text Enhance on FSM records
Oracle's AI-assisted Text Enhance is now enabled on a fixed list of FSM fields. These are all custom records and custom event fields, so any UI customization or scripting that targets them should be reviewed:
customrecord_nx_repair_notes— Field Service Repair Notescustomrecord_nx_maintenance_notes— Field Service Maintenance Notescustomrecord_nx_install_notes— Field Service Install Notescustomrecord_nx_uninstall_notes— Field Service Uninstall Notescustomrecord_nx_jobsafety_notes—custrecord_nx_jobsafety_notes(Safety Check Notes)- Case:
custevent_nx_case_details - Task:
custevent_nx_internal_note,custevent_nx_actions_taken
HTML sanitization in the mobile app — potentially breaking
The FSM mobile app now sanitizes HTML in configuration content (e.g., Task details) before rendering. Any tag or attribute outside the allow-list will be stripped. If you've been embedding rich HTML — custom forms, inline SVG, iframes, scripted content — you need to audit it against the supported list before this release rolls into your account.
Supported tags (summary)
- Structure:
<address>,<article>,<aside>,<footer>,<header>,<h1>–<h6>,<hgroup>,<main>,<nav>,<section>,<head>,<body>,<title>,<center> - Text content:
<blockquote>,<div>,<p>,<ul>,<ol>,<li>,<dl>,<dt>,<dd>,<pre>,<hr>,<figure>,<figcaption>,<details>,<summary> - Inline:
<a>,<span>,<b>,<i>,<em>,<strong>,<code>,<kbd>,<samp>,<mark>,<sub>,<sup>,<time>,<abbr>,<cite>,<q>, plus ruby/bidi tags - Media/SVG:
<img>,<svg>,<g>,<path>,<polygon>,<rect>,<use>,<font> - Forms:
<form>,<input>,<button>,<label>,<select>,<option> - Embedding:
<iframe> - Style/scripting:
<style>,<script>(notably still allowed)
Supported attributes (summary)
- General:
id,class,title,name,hidden,style - Links/media:
href,target,src,srcset,alt,width,height,loading,border,align - SVG:
d,viewbox,points,x,y,transform,fill - Forms:
type,value,multiple,accept,for, plus FSM-specificnxcvaidandnxctaskid - Events:
onclick,onchange,onmouseover,onmouseout,onerror
Note: Oracle's release note doesn't enumerate which tags or attributes are now stripped — only what remains. Anything not on these lists (e.g., <table>, <tr>, <td>, <canvas>, <video>, <audio>, data attributes) appears to be removed. Verify in a sandbox before release.
Issue fixes worth flagging
- Asset address field now accepts more than 200 characters without erroring on record creation.
- Status Scheduled Script now reliably detects task status changes (start on-site / complete off-site) — the system no longer resets the Field Service Update Status box prematurely. If you previously built workarounds for missed case status updates, you can likely remove them.
- Field Service Start Date on new tasks created from an asset now correctly defaults to today regardless of timezone mismatch between user and asset.
- Scheduler no longer freezes on In-Progress unassigned tasks, handles invalid latitude values on tasks/assets/employees, and renders hover pop-ups without map view enabled.
- Mobile multi-select fields now persist values when navigating away and back.
- Draft forms survive app closure mid-sync and resume on relaunch.
- Date/DateTime fields in mobile now enforce min/max and block save with clear errors.
What to do
- Audit embedded HTML in FSM Task details and any configuration that renders to mobile. Anything outside the allow-list above will be stripped. Test in a sandbox account before this release reaches production.
- Add idempotency fields to custom mobile tabs. Without this, your custom tabs do not benefit from the duplicate-prevention fix. Reference the Idempotency topic in the FSM docs for the field shape and configuration syntax.
- Review Text Enhance enablement on the listed custom records and custom event fields. If your org has policies around AI-generated content in repair/safety notes, you may want to disable Text Enhance on those fields.
- Remove workaround code for the Status Scheduled Script timing bug if you wrote any — the underlying race condition is fixed.
- Stage translation strings in
custcollection_fsmand your own collections now, but do not expect them to render until Oracle ships the full translation feature in a later release. - Request the FSM translations PDF from NetSuite Customer Support if you're planning multi-language FSM rollouts — it's not in the public docs.
Source: Oracle NetSuite Release Notes