Release notes

New available values

Task Delegation

For Teamwork, Efficiency, Performance, Enterprise and Scale editions only.

When a user is away, their assigned tasks normally stay invisible to everyone else. Task Delegation lets a designated delegate see and perform those tasks on behalf of the absent user, without reassigning them, and keeps full traceability of who acted.

This feature is delivered through a new Enterprise edition Bonita User Application that supersedes the existing Bonita User Application and adds the user Delegations page. After an update the two coexist until you remove the previous one (see the migration notes below). The Enterprise edition Bonita Administrator Application is also updated to add the admin Delegations page (under BPM).

For how to set up and use delegation, see Delegations (end users) and Delegations administration (organization-wide management).

What this version includes

  • Self-service delegation setup: each user picks a delegate, an absence period, and the processes to cover.

  • Organization-wide delegation management for administrators.

  • A date-driven status model: Active, Scheduled, or Expired.

  • A dedicated view of the tasks delegated to you, with execution on behalf of the absent user and full audit traceability.

  • Programmatic management of delegation rules through the new Delegation REST API (delegation/rule and delegation/task resources).

On a fresh installation, the Enterprise edition user application is installed automatically and both admin and user Delegations pages are available. No further action is required.

Migration notes

User Application

When updating from a previous Bonita version, your existing user application is kept and the new Enterprise edition user application is added alongside it, so the two applications coexist. If you use Bonita User Application, a manual step is required to finish the setup, depending on your situation:

You did not customize the Bonita User Application

Using the Applications page of Bonita Administrator Application, delete the previous Bonita User Application (app token userAppBonita) and keep the Enterprise edition (app token userAppEEBonita).

You customized the Bonita User Application and want to keep it as is

Using the Application editor of Bonita Administrator Application, edit your custom user application to add the user Delegations page (page-user-delegation) to your custom user application’s menu entries.

When updating a project from a previous Bonita version in Bonita Studio, if you were using the Bonita User Application, depending on your situation, you have to do one of the following:

You did not customize the Bonita User Application

In the Extensions view of your project, remove Bonita User Application. Then, from the Marketplace, install Bonita User Application Enterprise.

You customized the Bonita User Application and want to keep it as is

In the application descriptor of your custom user application, add the user Delegations page (page-user-delegation) to your application’s menu entries.

Administrator Application

The Bonita Administrator Application is updated in place (no new application was introduced).

When updating from a previous Bonita version using the Application editor, edit the Bonita Administrator Application menu to add a new Delegations menu entry under BPM targeting the admin Delegations page (page-admin-delegation).

When updating a project from a previous Bonita version in Bonita Studio, if you were using the Bonita Administrator Application, depending on your situation, you have to do one of the following:

You did not customize the Bonita Administrator Application

You have nothing to do.

You customized the Bonita Administrator Application

In the application descriptor of your custom admin application, add a new Delegations menu entry under BPM targeting the admin Delegations page (page-admin-delegation).

This release ships updated versions of the provided REST API dynamic authorization rules. The task endpoints' rules TaskPermissionRule and TaskExecutionPermissionRule are updated so that an active delegate is granted access to the delegated tasks, and a new DelegationPermissionRule secures the delegation endpoints (delegation/rule and delegation/task), with the matching entries added to dynamic-permissions-checks.properties.

If you customized the REST API permissions configuration and provided your own version of those authorization rules, you need to update your custom rules to re-apply your changes on top of the new versions of those rules after upgrading (otherwise the delegation feature will not work). See Dynamic authorization checking.

Known limitations

Business data (BDM) access is controlled separately from delegation. If a task form reads business data, the delegate must have the same BDM access rights as the delegator to open the form, and delegation does not grant them automatically. If the delegate gets an access error on a form, an administrator can assign the appropriate permissions (e.g. through profiles or groups) so the delegate can open the task forms. See Delegations.

Notable changes

User Application process list migrated to Svelte

The provided process list page of the Bonita User Application has been re-implemented with the Svelte framework, replacing the previous React implementation. Existing customizations that target the page through application descriptors continue to work; teams that have forked the page source should port their changes to the new Svelte codebase.

The full dependency list for Svelte-based provided pages is available at List of Svelte pages dependencies.

Involvement APIs now include active delegates

As part of Task Delegation, ProcessAPI.isInvolvedInProcessInstance(userId, processInstanceId) and ProcessAPI.isInvolvedInHumanTaskInstance(userId, humanTaskInstanceId) now also return true when the user is an active delegate of the task’s assignee in a process covered by an active delegation, in addition to the existing cases (case started, task assigned, pending, or performed). Code that calls these methods outside authorization, for example to display who is involved in a case, will now include active delegates.

New REST API resources

Several REST resources were added to support the Task Delegation feature:

  • delegation/rule: create, search, update, and delete delegation rules. A regular user manages their own rule; an administrator can manage any user’s rule. Subscription editions only.

  • delegation/task: read-only; searches the tasks the caller can act on through an active delegation. Subscription editions only.

  • GET /API/bpm/processName: read-only; searches process deployment information grouped by name and display name, returning one entry per distinct name with its deployed versions. Available in any edition.

  • GET /API/identity/userSummary: read-only; returns a lightweight, paginated list of users (id, user name, first name, last name, and job title) for user pickers, without the full identity/user payload. Available in any edition.

Support matrix changes

Deprecations and removals

API deprecations

API removals

Custom component changes

Configuration changes

Bug fixes

Fixes in Bonita 2026.2-u3 (2026-09-23)

  • BPA-327 - java.lang.NullPointerException on bonita-ldap-synchronizer

  • BPA-686 - Webservice connector dependency not included by Studio in .bar file because already provided by Bonita engine, makes connector input groovy script fail

  • Several dependencies updated

Hazelcast 5.7.0

  • Hazelcast, the library used by the Cluster feature, is updated from 5.4.0 to 5.7.0. If you run a cluster, read Updating a cluster to 2026.2-u3 before updating.

  • Security hardening of the Hazelcast member. On a single node, the member Bonita starts for its second-level cache now listens on loopback only instead of on every interface. To restore the previous behaviour, for a deployment that attaches a Hazelcast client on purpose, set the property to an empty value in bonita-platform-sp-custom.properties: bonita.platform.hazelcast.interfaces.list= with nothing after the equals sign. Uncommenting the line as shipped in that file keeps the loopback default. In a cluster, bonita.platform.cluster.hazelcast.interfaces.list now binds the member to one address of the node matching the patterns it lists, which it never did before; its default no longer names an interface. If your cluster configuration sets that property, verify its value or unset it before updating: a value that matches no interface of the node, harmless until now, stops the node from starting. See Allow communication between servers for how to restrict the port.

Updating a cluster to 2026.2-u3

These points apply to Subscription editions running the Cluster feature. Installations that do not enable the Cluster feature are not affected, and Bonita Community edition does not use Hazelcast.

  • All nodes must be stopped to update. The Hazelcast edition bundled with Bonita does not support updating the members of a cluster one at a time, so a node running 5.4.0 cannot join a cluster running 5.7.0. Stop every node, update them, then start them again.

  • No configuration change is required. The update introduces two new cluster properties, both with default values, so nothing needs to be added to your configuration. See Work recovery when a node leaves the cluster if you want to tune them.

  • Work recovery is more robust. The recovery of a departed node’s work runs in the background instead of on a Hazelcast event thread, gives up on its own before its lock expires, and is tried again at the next departure or start for whatever it could not take over. A node that resumes after a tenant pause now resubmits the work that arrived while it was paused, which previously waited until the node left the cluster.

  • Clusters updated from an earlier version log a warning about the configuration schema at every start. Fresh installations do not. The message reports that the Hazelcast schema location is incorrect and that the default is used instead. It is harmless: your stored configuration still refers to the schema of the previous version, and the update does not rewrite it. To make it stop, update the version in the schema location in platform_engine/hazelcast.xml with the platform setup tool.

  • Two diagnostics change. The Number of locks column of the Hazelcast statistics file now counts the locks currently held on the node that writes the file, where it previously counted lock objects across the cluster, so expect a different magnitude and a value that varies with load. A lock whose lease expires before it is released is now reported as an error instead of a warning; if you raise alerts on errors from the cluster lock service, you may start seeing them for a condition that was already being reported at a lower level.

Security fixes

  • CVE-524: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitte (public CVE-2026-12860)

  • CVE-525: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This iss (public CVE-2026-13506)

  • CVE-527: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-le (public CVE-2026-14682)

  • CVE-536: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished na (public CVE-2026-58059)

  • CVE-564: hazelcast - Authorization bypass in IMap Predicates API (public XRAY-1043284)

  • CVE-565: hazelcast - Arbitrary member memory access by low-privileged client (public XRAY-1043285)

  • CVE-578: postgresql - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require (public CVE-2026-54291)

  • CVE-622: agetty - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount (public CVE-2026-76642)

  • CVE-623: agetty - The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor ope (public CVE-2026-78408)

  • CVE-624: agetty - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subd (public CVE-2026-78409)

  • CVE-625: agetty - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that sour (public CVE-2026-78410)

  • CVE-627: curl - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misi (public CVE-2026-13608)

  • CVE-628: curl - A flaw in libcurl’s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections wi (public CVE-2026-18924)

  • CVE-629: curl - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentica (public CVE-2026-19931)

  • CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

  • CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

  • CVE-632: curl - When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating eas (public CVE-2026-80229)

  • CVE-633: curl - When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (`CURLOPT_ (public CVE-2026-80230)

  • CVE-634: curl - A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using (public CVE-2026-80231)

  • CVE-635: curl - A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately befo (public CVE-2026-80255)

  • CVE-636: curl - With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trus (public CVE-2026-82208)

  • CVE-637: curl - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a (public CVE-2026-82209)

Security fixes — LDAP Synchronizer

  • CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

  • CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

Fixes in Bonita 2026.2-u1 (2026-07-17)

  • BPA-633 - GET bpm/archivedCase returns HTTP 404 for the whole list when a deployed started_by / startedBySubstitute user no longer exists in the organization

  • BPA-680 - [Studio/Windows] Process deploy runs "mvn clean install" that fails to delete the locked BDM jar → BDM build output wiped → BAR build fails "unable to resolve <bdm package>"

  • Several dependencies updated

Fixes in Bonita 2026.2-u0 (2026-06-30)

  • BPA-100 - Groovy evaluate : BDM object field is null whereas the column has a value in the database → SQL SELECT to retrieve the BO is not executed

  • BPA-445 - [SAML] authentication: race condition on /favicon.ico overwrites __REDIRECT_URI session attribute, causing 404 after successful SSO login

Security fixes

  • CVE-375: keycloak-saml-core - A remote, unauthenticated attacker can send a specially crafted XML input to the endpoint (public CVE-2026-7307)

  • CVE-431: keycloak-saml-adapter-core - An unauthenticated remote attacker can trigger an application level Denial of Service (public CVE-2026-2575)

Fixes in Bonita 2026.2-b5 (2026-06-19)

  • BPA-567 - OIDC callback fails with IllegalArgumentException - login never completes

  • Several dependencies updated