EximeeBPMS 1.2.x Enterprise Edition Release Notes

Edition: Enterprise  |  Baseline: EximeeBPMS 1.2.0 CE

1.2.18-ee

Release date: 16.06.2026

Highlights

• Spring Framework 7.0.7 and Tomcat 10.1.55 security updates (9 CVEs resolved)
• Removed legacy Tomcat 9 and WildFly 26 from the build matrix
• Jakarta EL API 6.0.1 and Quarkus 3.36.1 upgrades

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

High

Medium

Bug Fixes

• Fixed Jython BOM dependency configuration.
• Resolved integration test failures in the CI matrix (PostgreSQL, cross-database, WildFly + webapps).

Build Configuration

• Removed legacy Tomcat 9 and WildFly 26 from the build matrix. The shaded JUEL dependency was replaced with the standard distribution.

1.2.17-ee

Release date: 03.06.2026

Highlights

• Java version and dependency refresh
• Critical Jython deserialization vulnerability fixed (CVE-2016-4000)

Technical Updates

Resolved CVE Vulnerabilities

Critical

1.2.16-ee

Release date: 02.06.2026

Highlights

• Business Events with transactional outbox — guaranteed at-least-once delivery to downstream systems
• Configurable OAuth2 endpoints and custom webapp context path support
• Script Guard NIO enforcement narrowed to file and network APIs only

New Features

Business Events with Transactional Outbox

A native business event system with a transactional outbox pattern. Process-level events (process instance lifecycle, task lifecycle, job execution) are captured inside the engine transaction and written to a dedicated outbox table. A relay component reads from the outbox and delivers events to configured downstream systems (Kafka, HTTP webhooks, etc.), guaranteeing at-least-once delivery without coupling downstream systems to the engine transaction.

A BusinessEventPublisher SPI allows custom event routing and transformation. Database schema upgrade scripts for all supported databases are included.

Configurable OAuth2 Endpoints

OAuth2 configuration is now fully externalised. Authorization, token, and userinfo endpoints are configurable via Spring Boot properties. The engine also respects a configurable webapp context path for correct OAuth2 redirect handling.

→ Spring Security Integration

Configuration Changes

New properties for Business Events and OAuth2:

# Business Events
eximeebpms.bpm.business-events.enabled=true

# OAuth2 endpoints
eximeebpms.bpm.security.oauth2.authorization-endpoint=https://auth.example.com/oauth2/authorize
eximeebpms.bpm.security.oauth2.token-endpoint=https://auth.example.com/oauth2/token
eximeebpms.bpm.security.oauth2.userinfo-endpoint=https://auth.example.com/oauth2/userinfo

# Webapp context path
eximeebpms.bpm.webapp.path=/bpm

User Experience Improvements

Script Guard — Reduced False Positives

The NIO blocking enforcement in Script Guard was narrowed to file and network APIs only. Pure computation (sorting, string manipulation) is no longer subject to blocking checks, reducing false positives and improving performance of compliant scripts.

→ Script Guard
→ Securing Custom Code

Technical Updates

Dependency Updates

Resolved CVE Vulnerabilities

Medium

1.2.15-ee

Release date: 22.05.2026

Release-pipeline bookkeeping only. No functional or security changes.

1.2.14-ee

Release date: 22.05.2026

Release-pipeline bookkeeping only. No functional or security changes.

1.2.13-ee

Release date: 21.05.2026

Highlights

• Script Guard — enforce which scripts are allowed to execute in the engine
• Groovy upgraded from 4.x to 5.x

New Features

Script Guard

A framework for controlling which scripts are permitted to execute in the process engine, enforced at two levels:

• BPMN parse time — script content is validated when a process definition is deployed; definitions containing disallowed scripts are rejected before they can run.
• Runtime — scripts are validated immediately before execution; violations abort execution with a ScriptEvaluationException.

A built-in NIO blocking policy prevents scripts from performing blocking file system and network calls on the engine thread pool. Policies can be composed freely:

configuration.setScriptSecurityPolicy(new CompositeScriptSecurityPolicy(
    new NioBlockingPolicy(),
    new AllowlistScriptPolicy(allowedScriptIds)
));

→ Script Guard
→ Securing Custom Code
→ Scripting

Technical Updates

Dependency Updates

Bug Fixes

• Fixed Sonar build configuration causing analysis failures on CI.

Infrastructure Releases: 1.2.1-ep – 1.2.12-ee

Releases 1.2.1-ep through 1.2.12-ee established the Enterprise Edition release pipeline.