EximeeBPMS 1.2.x Enterprise Edition Release Notes

Edition: Enterprise  |  Baseline: EximeeBPMS 1.2.0 CE

1.2.19-ee

Release date: 15.07.2026

Highlights

• Script Guard audit mode, persistent violation store, and SIEM integration
• UUID v7 is now the default ID generator — UUID v1 kept as a deprecated fallback, scheduled for removal in 1.4.0
• Signed SBOM published with every release — CycloneDX SBOM (JSON + XML), signed with both GPG and Sigstore
• CMMN support removed from the engine, migration tooling, and test suite
• javax (legacy) namespace support dropped — Jakarta EE only from this release on
• Large dependency refresh addressing vulnerabilities across JDBC drivers, Spring, Tomcat, WildFly, and more
• Fixed invalid X-Authorized-User header value for OAuth users with non-ASCII characters

New Features

Script Guard — Audit Mode, Violation Store & SIEM Integration

Building on the enforcement engine introduced in 1.2.13-ee, Script Guard adds:

• An AUDIT enforcement mode: violations are recorded but script execution is not blocked — the recommended first step before enabling ENFORCE.
• A persistent, queryable violation store: each violation (timestamp, process definition key, activity ID, scripting language, rule code, reason) is written to a dedicated script.security schema component, so it survives engine restarts and can be queried through the REST API.
• Hot-reload configuration: enforcement mode and the process-definition allowlist can be changed at runtime via the REST API — no restart, propagated to all engine nodes within 30 seconds.
• SIEM integration: a new ScriptViolationListener, wired through the BusinessEventPublisher SPI, forwards violations to downstream security monitoring in real time.

→ Script Guard → Securing Custom Code → Business Events

UUID v7 as Default ID Generator

The engine now generates entity IDs as UUID v7 by default (StrongUuidGenerator) instead of UUID v1. UUID v7 is time-ordered, which improves index locality on high-write tables, and — unlike UUID v1 — does not embed the generating machine’s MAC address.

The previous UUID v1 generator is kept as a deprecated fallback:

eximeebpms.bpm.id-generator=uuid-v1

It will be removed in EximeeBPMS 1.4.0.

→ Id Generators

Signed SBOM on Every Release

Every Enterprise Edition release now publishes a CycloneDX Software Bill of Materials (JSON and XML) covering all shipped modules, attached to the GitHub release alongside the build artifacts. Each SBOM file is signed twice — with a detached GPG signature and with Sigstore (cosign, keyless) — so the provenance of the SBOM itself can be verified independently of your artifact repository.

Other Engine Improvements

• Graceful shutdown — pending external tasks are now unlocked when the engine stops, instead of staying locked until their lock timeout expires.
• A new SPI listener for external task execution statistics.

Breaking Changes

CMMN Support Removed

CMMN 1.1 support — the engine, migration tooling, and associated tests — has been removed from EximeeBPMS Enterprise Edition. Case management use cases remain fully supported through BPMN.

javax (Legacy) Namespace No Longer Supported

Support for the legacy javax namespace has been dropped; only Jakarta EE (jakarta.*) is supported from this release on. Application servers and containers that have not migrated to Jakarta EE cannot run this version.

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

Medium

Bug Fixes

• Fixed invalid X-Authorized-User header value for OAuth users with non-ASCII characters in their display name.
• Resolved flaky ExclusiveJobAcquisitionTest and other flaky integration tests; removed a redundant DROP INDEX in business-event drop scripts.
• Fixed remaining CI and integration test issues (engine startup, ShrinkWrap CI resolution, HistoryCleanupTest timezone, CMMN migration leftovers, LoginIT).
• Extracted ACT_RU_SCRIPT_VIOLATION into its own script.security schema component for correct dbSchemaUpdate handling across all supported databases.

Build Configuration

• Signed SBOM generation added to the release pipeline (see Signed SBOM on Every Release above).
• Continued EximeeBPMS rebranding across internal REST resource and configuration class names.
• Removed an unused Camunda 7.2.0 reference; refactored instance-migration test fixtures to EximeeBPMS versioning.

1.2.18-ee

Release date: 16.06.2026

Highlights

• Spring Framework 7.0.7 and Tomcat 10.1.55 security updates (9 CVEs resolved)
• Removed legacy Tomcat 9 and WildFly 26 from the build matrix
• Jakarta EL API 6.0.1 and Quarkus 3.36.1 upgrades

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

High

Medium

Bug Fixes

• Fixed Jython BOM dependency configuration.
• Resolved integration test failures in the CI matrix (PostgreSQL, cross-database, WildFly + webapps).

Build Configuration

• Removed legacy Tomcat 9 and WildFly 26 from the build matrix. The shaded JUEL dependency was replaced with the standard distribution.

1.2.17-ee

Release date: 03.06.2026

Highlights

• Java version and dependency refresh
• Critical Jython deserialization vulnerability fixed (CVE-2016-4000)

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

Critical

1.2.16-ee

Release date: 02.06.2026

Highlights

• Business Events with transactional outbox — guaranteed at-least-once delivery to downstream systems
• Configurable OAuth2 endpoints and custom webapp context path support
• Script Guard NIO enforcement narrowed to file and network APIs only

New Features

Business Events with Transactional Outbox

A native business event system with a transactional outbox pattern. Process-level events (process instance lifecycle, task lifecycle, job execution) are captured inside the engine transaction and written to a dedicated outbox table. A relay component reads from the outbox and delivers events to configured downstream systems (Kafka, HTTP webhooks, etc.), guaranteeing at-least-once delivery without coupling downstream systems to the engine transaction.

A BusinessEventPublisher SPI allows custom event routing and transformation. Database schema upgrade scripts for all supported databases are included.

→ Business Events

Configurable OAuth2 Endpoints

OAuth2 configuration is now fully externalised. Authorization, token, and userinfo endpoints are configurable via Spring Boot properties. The engine also respects a configurable webapp context path for correct OAuth2 redirect handling.

→ Spring Security Integration

Configuration Changes

New properties for Business Events and OAuth2:

# Business Events
eximeebpms.bpm.business-events.enabled=true

# OAuth2 endpoints
eximeebpms.bpm.security.oauth2.authorization-endpoint=https://auth.example.com/oauth2/authorize
eximeebpms.bpm.security.oauth2.token-endpoint=https://auth.example.com/oauth2/token
eximeebpms.bpm.security.oauth2.userinfo-endpoint=https://auth.example.com/oauth2/userinfo

# Webapp context path
eximeebpms.bpm.webapp.path=/bpm

User Experience Improvements

Script Guard — Reduced False Positives

The NIO blocking enforcement in Script Guard was narrowed to file and network APIs only. Pure computation (sorting, string manipulation) is no longer subject to blocking checks, reducing false positives and improving performance of compliant scripts.

→ Script Guard
→ Securing Custom Code

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

Medium

1.2.15-ee

Release date: 22.05.2026

Release-pipeline bookkeeping only. No functional or security changes.

1.2.14-ee

Release date: 22.05.2026

Release-pipeline bookkeeping only. No functional or security changes.

1.2.13-ee

Release date: 21.05.2026

Highlights

• Script Guard — enforce which scripts are allowed to execute in the engine
• Groovy upgraded from 4.x to 5.x

New Features

Script Guard

A framework for controlling which scripts are permitted to execute in the process engine, enforced at two levels:

• BPMN parse time — script content is validated when a process definition is deployed; definitions containing disallowed scripts are rejected before they can run.
• Runtime — scripts are validated immediately before execution; violations abort execution with a ScriptEvaluationException.

A built-in NIO blocking policy prevents scripts from performing blocking file system and network calls on the engine thread pool. Policies can be composed freely:

configuration.setScriptSecurityPolicy(new CompositeScriptSecurityPolicy(
    new NioBlockingPolicy(),
    new AllowlistScriptPolicy(allowedScriptIds)
));

→ Script Guard
→ Securing Custom Code
→ Scripting

Technical Updates

Dependency Updates

Bug Fixes

• Fixed Sonar build configuration causing analysis failures on CI.

Infrastructure Releases: 1.2.1-ep – 1.2.12-ee

Releases 1.2.1-ep through 1.2.12-ee established the Enterprise Edition release pipeline.