Release notes

setup push now updates the configuration in a single transaction, so a setup pull run at the same time no longer loses the configuration or the license.

setup push no longer deletes the licenses from the database when the platform_conf/licenses folder is missing.

Reading or writing the platform configuration now times out after 60 seconds by default, instead of waiting indefinitely. Change it with the new property bonita.platform.setup.transaction-timeout (for example 90s):

The value of bonita.platform.setup.transaction-timeout must be at least 1 second: 0 does not disable the timeout.

Generic file upload widgets and forms now restrict uploaded files to a default whitelist of common business file extensions (pdf, doc, docx, xls, xlsx, ppt, pptx, txt, csv, json, jpg, jpeg, png, gif, bmp, xml, msg, eml, tif, tiff, odt, ods, odp, zip), and reject files whose declared content type or, for binary formats, file signature does not match their extension. Binary files whose content matches their extension are accepted whatever their declared content type (for example application/octet-stream, sent by clients that do not recognize a file type), except types that a browser can execute.

The content type check applies to every file upload, including the .xml files of the administration imports (organization, actor mapping, profiles, applications, BDM access control). See Content type and content verification.

The whitelist can be customized, or opened to any extension with *, using the form.attachment.allowed.extensions property in the console-config.properties file. See Document allowed file extensions setting.

Rejected uploads are logged as warnings in the server log. See Rejected uploads.

The Hazelcast member embedded in Bonita now accepts other Hazelcast members only, on a single node as in a cluster. Hazelcast clients, Management Center included, are refused, and the Hazelcast REST API, health check included, and Memcache are no longer served. Nothing in Bonita uses them. If your deployment uses any of them on purpose, set bonita.platform.hazelcast.client-protocol.enabled=true in bonita-platform-sp-custom.properties, with the same value on every node of a cluster, and restrict port 5701 to the hosts that need it. See Allow communication between servers.

The Hazelcast member embedded in Bonita no longer tries to send statistics.

Hazelcast, the library used by the Cluster feature, is updated from 5.4.0 to 5.7.0. If you run a cluster, read Updating a cluster to 2024.3-u11 before updating.

Security hardening of the Hazelcast member. Two properties are involved, one per deployment mode.

All nodes must be stopped to update. The Hazelcast edition bundled with Bonita does not support updating the members of a cluster one at a time, so a node running 5.4.0 cannot join a cluster running 5.7.0. Stop every node, update them, then start them again.

No configuration change is required. The update introduces new cluster properties, all with default values, so nothing needs to be added to your configuration. See Work recovery when a node leaves the cluster if you want to tune them.

Work recovery is more robust. The recovery of a departed node’s work runs in the background instead of on a Hazelcast event thread, gives up on its own before its lock expires, and is tried again at the next departure or start for whatever it could not take over. A node that resumes after a tenant pause now resubmits the work that arrived while it was paused, which previously waited until the node left the cluster.

Clusters updated from an earlier version log a warning about the configuration schema at every start. Fresh installations do not. The message reports that the Hazelcast schema location is incorrect and that the default is used instead. It is harmless: your stored configuration still refers to the schema of the previous version, and the update does not rewrite it. To make it stop, update the version in the schema location in platform_engine/hazelcast.xml with the platform setup tool.

Two diagnostics change. The Number of locks column of the Hazelcast statistics file now counts the locks currently held on the node that writes the file, where it previously counted lock objects across the cluster, so expect a different magnitude and a value that varies with load. A lock whose lease expires before it is released is now reported as an error instead of a warning; if you raise alerts on errors from the cluster lock service, you may start seeing them for a condition that was already being reported at a lower level.

CVE-524: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitte (public CVE-2026-12860)

CVE-525: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This iss (public CVE-2026-13506)

CVE-527: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-le (public CVE-2026-14682)

CVE-536: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished na (public CVE-2026-58059)

CVE-564: hazelcast - Authorization bypass in IMap Predicates API (public XRAY-1043284)

CVE-565: hazelcast - Arbitrary member memory access by low-privileged client (public XRAY-1043285)

CVE-578: postgresql - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require (public CVE-2026-54291)

CVE-622: agetty - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount (public CVE-2026-76642)

CVE-623: agetty - The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor ope (public CVE-2026-78408)

CVE-624: agetty - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subd (public CVE-2026-78409)

CVE-625: agetty - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that sour (public CVE-2026-78410)

CVE-627: curl - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misi (public CVE-2026-13608)

CVE-628: curl - A flaw in libcurl’s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections wi (public CVE-2026-18924)

CVE-629: curl - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentica (public CVE-2026-19931)

CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

CVE-632: curl - When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating eas (public CVE-2026-80229)

CVE-633: curl - When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (`CURLOPT_ (public CVE-2026-80230)

CVE-634: curl - A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using (public CVE-2026-80231)

CVE-635: curl - A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately befo (public CVE-2026-80255)

CVE-636: curl - With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trus (public CVE-2026-82208)

CVE-637: curl - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a (public CVE-2026-82209)

CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

CVE-77 - Keycloak SAML adapter - Improper verification of SAML responses leading to impersonation attacks (fixing CVE-2024-8698)

CVE-78 - Apache Tomcat - Potential RCE and/or information disclosure and/or information corruption with partial PUT (fixing CVE-2025-24813)

RUNTIME-44 - NPE when iterating on multiple BDM object in event subprocess

RUNTIME-1865 - When level 2 cache is enabled and Cluster disabled, two or more nodes connect via Hazelcast

RUNTIME-1932 - Cancelled and Aborted process instances are not returns when using the REST API (bpm/archivedCase)

RUNTIME-1947 - Oracle/MS SQL Server Deadlock Occurring During Mass Task Completion/Cancellation

STUDIO-4520 - Old version Git repository clone fails with NullPointerException during the execution of bonita-project-maven-plugin:create-bdm-module if local .m2/repository/ is empty

STUDIO-4566 - Studio freeze during check dependencies in Groovy console

UID-732 - $form.$invalid x Tabs container : the Submit button is enabled when the widgets' Required of the current tab have a value, and even if there are empty Required widgets in other tabs

RUNTIME-1786 - When updating an SCA application with profiles mapping, the log is deceitful

RUNTIME-1870 - REST API: JSON in the HTTP GET response cannot be parsed /API/bpm/caseInfo/{id}

RUNTIME-1885 - Doubtful queries on application_* tables each time we navigate to a page

RUNTIME-1889 - Super Admin App page is refreshed for each page switch

RUNTIME-1911 - Using tenantid column in index causing query performance degradation

STUDIO-4477 - Some reserved keyword (limit) are missing during validation on Business Data Attributes

STUDIO-4516 - Errors at .bos file import and migration

STUDIO-4540 - Cloning a community project into a Subscription studio should migrate the internal build for subscription

STUDIO-4542 - Due to Maven archetype plugin update, rest api generation generates invalid test class

STUDIO-4543 - Rest API Extension validation fails with NPE when project folder and artifactId does not match

STUDIO-4547 - Git repository clone failed when migrating a project which has already been cloned in the workspace.

STUDIO-4551 - Bonita Project Analyze Plugin Market Type error

UID-732 - $form.$invalid x Tabs container : the Submit button is enabled when the widgets' Required of the current tab have a value, and even if there are empty Required widgets in other tabs

RUNTIME-48 - SFlowNodeNotFoundException: Quartz’s Trigger associated to a Boundary timer does not get deleted when the process instance terminates

RUNTIME-1895 - [SAML & OIDC SSO]: Bonita redirects to IdP if redirected target URL request lands on different node than the one where the original request was received

RUNTIME-1697 - Avoid reading configuration from database, in favor to caching
Bonita Runtime makes heavy usage of cache to improve performance. In that context, most configuration changes require server restart to be taken into account. In particular, all SSO activations and configuration changes fall into this category (OIDC, SAML, Kerberos, JAAS, …​).

RUNTIME-1877 - Session Sharing x sameSiteCookies value systematically set to "lax" when cluster is enabled. New configuration properties specific to cluster mode and session cookie have been added.

RUNTIME-1883 - Add extra java 17 open packages instructions for Bundle packaging

RUNTIME-1884 - password attribute silently removed from org.bonitasoft.engine.identity.impl.UserImpl class. Add removal information in the release note. Make the XStream deserialization less strict to avoid deserialization exception when a some fields are unknown.

RUNTIME-1887 - Regression in ServerProxifier algorithm produce a greater number of SQL requests.

RUNTIME-1890 - [LDAP Synchronizer] - Add add-opens for packaged scripts

STUDIO-4517 - Old version Git repository clone fails with DirectoryNotEmptyException if REST API extension does not contain pom.xml file

STUDIO-4515 NPE generated during project migration

STUDIO-4526 - Cannot add or edit a database connector

STUDIO-4530 - ResourceException at Studio 9.0.4 restart after a Switch Workspace to exisitng workspace from a 9.0.3

STUDIO-4531 - Getting started tutorial not working out of the box in Subscription editions.

STUDIO-4533 - Refreshing a project after a git switch branch now adds/removes submodules as expected.

STUDIO-4535 - Renaming a project without bdm or extensions fails

STUDIO-4536 - Hazecalst discovery is enabled by default for Studio embedded Runtime

RUNTIME-1697 - Avoid reading configuration from database, in favor to caching
Bonita Runtime makes heavy usage of cache to improve performance. In that context, most configuration changes require server restart to be taken into account. In particular, all SSO activations and configuration changes fall into this category (OIDC, SAML, Kerberos, JAAS, …​).

STUDIO-4517 - Old version Git repository clone fails with DirectoryNotEmptyException if REST API extension does not contain pom.xml file

STUDIO-4515 NPE generated during project migration

STUDIO-4526 - Cannot add or edit a database connector

STUDIO-4530 - ResourceException at Studio 9.0.4 restart after a Switch Workspace to exisitng workspace from a 9.0.3

STUDIO-4531 - Getting started tutorial not working out of the box in Subscription editions.