Release notes

New available values

Bonita UI Builder integration into Bonita Studio

During development, the Bonita Studio now allows you to launch Bonita UI Builder very easily (for production, the Studio is not used). See Development instance from Studio for more information.

New functionalities and improvements are on dedicated UIB release notes.

New Ollama AI Connector

A new AI connector for Ollama is now available, enabling you to run AI models locally without requiring cloud-based API keys or internet connectivity. This connector extends the existing AI connector capabilities (Ask, Extract, and Classify) to work with locally-hosted Ollama models.

Key features:

  • Local deployment: Run AI models on your own infrastructure using Ollama

  • Privacy-first: Keep sensitive data within your organization without sending it to external AI providers

  • No API key required: Works out-of-the-box with your local Ollama instance

  • Cost-effective: Eliminate per-request API costs for development and production environments

  • Offline capability: Process automation continues even without internet access

  • Same functionality: Supports all three use cases (Ask, Extract, Classify) with the same interface as cloud providers

Default configuration:

  • Base URL: http://localhost:11434

  • Default model: llama3.1

  • Supports all Ollama-compatible models including Llama, Mistral, CodeLlama, and more

This connector is ideal for organizations with strict data governance requirements, development/testing environments, or scenarios where internet connectivity is limited. See AI Connectors documentation for complete configuration details.

REST Connector OAuth2 Authentication Support

The REST connectors now provide built-in OAuth2 authentication support.

  • OAuth2 Client Credentials Flow: For machine-to-machine authentication (RFC 6749)

  • OAuth2 Authorization Code Flow: For user-specific authentication with optional PKCE support (RFC 7636)

  • OAuth2 Bearer Token: For using pre-obtained access tokens

  • OAuth2 Token Retrieval Connector: A dedicated connector to obtain OAuth2 access tokens that can be reused across multiple API calls

The OAuth2 Token Retrieval connector allows you to obtain an access token once and reuse it for subsequent REST API calls using the Bearer authentication mode.

See REST Connectors documentation for more information.

Email Connector OAuth2 Authentication Support

The Email connector now supports OAuth2 authentication using the XOAUTH2 mechanism, enabling secure email sending through modern email providers such as Gmail and Office 365/Exchange Online that require OAuth2 authentication.

This feature allows the Email connector to authenticate using a pre-obtained OAuth2 access token (for example using the new OAuth2 Token Retrieval connector) instead of traditional username/password authentication, providing better security and compliance with modern authentication requirements.

See Email Connector documentation for more information.

Bug fixes

Fixes in Bonita 2025.2-u12 (2026-11-06)

  • BPA-167 - Human task permanently stuck with orphaned contract data when a concurrent task update (take, priority, due date) overwrites state_executing (SWorkPreconditionException)

  • BPA-210 - Fix "Could not set ObjectFilter: null" message

  • BPA-291 - Configuration and license file lost when parallel setup pull / push are run

  • BPA-902 - Docker: Kerberos SSO fails with HTTP 500 when the ProGrade security manager is enabled

Platform configuration update (Setup tool)

  • setup push now updates the configuration in a single transaction, so a setup pull run at the same time no longer loses the configuration or the license.

  • setup push no longer deletes the licenses from the database when the platform_conf/licenses folder is missing.

  • Reading or writing the platform configuration now times out after 60 seconds by default, instead of waiting indefinitely. Change it with the new property bonita.platform.setup.transaction-timeout (for example 90s):

    • when running the Bonita Setup tool: in setup/internal.properties, or on the command line, for example setup.sh push -Dbonita.platform.setup.transaction-timeout=90s;

    • when Bonita starts: as a JVM system property, for example -Dbonita.platform.setup.transaction-timeout=90s in CATALINA_OPTS, or as the environment variable BONITA_PLATFORM_SETUP_TRANSACTION_TIMEOUT, for example with Docker (see Bonita Runtime configuration).

  • The value of bonita.platform.setup.transaction-timeout must be at least 1 second: 0 does not disable the timeout.

File upload allowed extensions

  • Generic file upload widgets and forms now restrict uploaded files to a default whitelist of common business file extensions (pdf, doc, docx, xls, xlsx, ppt, pptx, txt, csv, json, jpg, jpeg, png, gif, bmp, xml, msg, eml, tif, tiff, odt, ods, odp, zip), and reject files whose declared content type or, for binary formats, file signature does not match their extension. Binary files whose content matches their extension are accepted whatever their declared content type (for example application/octet-stream, sent by clients that do not recognize a file type), except types that a browser can execute.

  • The content type check applies to every file upload, including the .xml files of the administration imports (organization, actor mapping, profiles, applications, BDM access control). See Content type and content verification.

  • The whitelist can be customized, or opened to any extension with *, using the form.attachment.allowed.extensions property in the console-config.properties file. See Document allowed file extensions setting.

  • Rejected uploads are logged as warnings in the server log. See Rejected uploads.

Hazelcast clients refused by default

  • The Hazelcast member embedded in Bonita now accepts other Hazelcast members only, on a single node as in a cluster. Hazelcast clients, Management Center included, are refused, and the Hazelcast REST API, health check included, and Memcache are no longer served. Nothing in Bonita uses them. If your deployment uses any of them on purpose, set bonita.platform.hazelcast.client-protocol.enabled=true in bonita-platform-sp-custom.properties, with the same value on every node of a cluster, and restrict port 5701 to the hosts that need it. See Allow communication between servers.

  • The Hazelcast member embedded in Bonita no longer tries to send statistics.

Audit log

  • Bonita now writes one JSON event per login, failed login and logout to an audit log, so that a SIEM can collect who authenticated, when and from where: in server/logs/audit.log in the Tomcat bundle, and on the standard output in the Docker image, where the new AUDIT_LOG_STDOUT_ENABLED and AUDIT_LOG_FILES_ENABLED environment variables, like the access logs ones, also write them to a file or switch them off. The audit log is on by default. If you reuse a log4j2-appenders.xml customized for an earlier version, add the audit appenders and logger of the default file to it. See Audit log.

  • In the Docker image, the color reset of the console log lines now ends each line instead of starting the next one.

Fixes in Bonita 2025.2-u11 (2026-09-23)

  • BPA-327 - java.lang.NullPointerException on bonita-ldap-synchronizer

  • BPA-686 - Webservice connector dependency not included by Studio in .bar file because already provided by Bonita engine, makes connector input groovy script fail

  • Several dependencies updated

Hazelcast 5.7.0

  • Hazelcast, the library used by the Cluster feature, is updated from 5.4.0 to 5.7.0. If you run a cluster, read Updating a cluster to 2025.2-u11 before updating.

  • Security hardening of the Hazelcast member. Two properties are involved, one per deployment mode.

    • Single node (Cluster feature not enabled). The Hazelcast member that Bonita starts for its second-level cache now listens on loopback (127.0.0.1) only; it used to listen on every interface. This is controlled by a new property, bonita.platform.hazelcast.interfaces.list, whose default is 127.0.0.1. Nothing to do, unless a Hazelcast client or Management Center connects to that member from another host. In that case, in bonita-platform-sp-custom.properties, uncomment the line and remove its value so that it reads bonita.platform.hazelcast.interfaces.list=: the member then follows the network settings of hazelcast.xml, which by default listen on every interface, as before. Uncommenting the line without removing the value keeps the loopback default.

    • Cluster. The default behaviour does not change: members keep listening on every interface, so that their peers can reach them. A new optional property, bonita.platform.cluster.hazelcast.interfaces.list in bonita-platform-sp-cluster-custom.properties, binds the member to the one address of the node that matches it, for example on a host with several networks. Earlier versions read a property of that name without applying it: if your configuration already sets it, make sure its value matches an address of the node, or the node does not start.

    • See Allow communication between servers for how to restrict port 5701.

Updating a cluster to 2025.2-u11

These points apply to Subscription editions running the Cluster feature. Installations that do not enable the Cluster feature are not affected, and Bonita Community edition does not use Hazelcast.

  • All nodes must be stopped to update. The Hazelcast edition bundled with Bonita does not support updating the members of a cluster one at a time, so a node running 5.4.0 cannot join a cluster running 5.7.0. Stop every node, update them, then start them again.

  • No configuration change is required. The update introduces new cluster properties, all with default values, so nothing needs to be added to your configuration. See Work recovery when a node leaves the cluster if you want to tune them.

  • Work recovery is more robust. The recovery of a departed node’s work runs in the background instead of on a Hazelcast event thread, gives up on its own before its lock expires, and is tried again at the next departure or start for whatever it could not take over. A node that resumes after a tenant pause now resubmits the work that arrived while it was paused, which previously waited until the node left the cluster.

  • Clusters updated from an earlier version log a warning about the configuration schema at every start. Fresh installations do not. The message reports that the Hazelcast schema location is incorrect and that the default is used instead. It is harmless: your stored configuration still refers to the schema of the previous version, and the update does not rewrite it. To make it stop, update the version in the schema location in platform_engine/hazelcast.xml with the platform setup tool.

  • Two diagnostics change. The Number of locks column of the Hazelcast statistics file now counts the locks currently held on the node that writes the file, where it previously counted lock objects across the cluster, so expect a different magnitude and a value that varies with load. A lock whose lease expires before it is released is now reported as an error instead of a warning; if you raise alerts on errors from the cluster lock service, you may start seeing them for a condition that was already being reported at a lower level.

Security fixes

  • CVE-524: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitte (public CVE-2026-12860)

  • CVE-525: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This iss (public CVE-2026-13506)

  • CVE-527: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-le (public CVE-2026-14682)

  • CVE-536: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished na (public CVE-2026-58059)

  • CVE-564: hazelcast - Authorization bypass in IMap Predicates API (public XRAY-1043284)

  • CVE-565: hazelcast - Arbitrary member memory access by low-privileged client (public XRAY-1043285)

  • CVE-578: postgresql - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require (public CVE-2026-54291)

  • CVE-622: agetty - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount (public CVE-2026-76642)

  • CVE-623: agetty - The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor ope (public CVE-2026-78408)

  • CVE-624: agetty - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subd (public CVE-2026-78409)

  • CVE-625: agetty - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that sour (public CVE-2026-78410)

  • CVE-627: curl - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misi (public CVE-2026-13608)

  • CVE-628: curl - A flaw in libcurl’s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections wi (public CVE-2026-18924)

  • CVE-629: curl - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentica (public CVE-2026-19931)

  • CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

  • CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

  • CVE-632: curl - When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating eas (public CVE-2026-80229)

  • CVE-633: curl - When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (`CURLOPT_ (public CVE-2026-80230)

  • CVE-634: curl - A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using (public CVE-2026-80231)

  • CVE-635: curl - A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately befo (public CVE-2026-80255)

  • CVE-636: curl - With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trus (public CVE-2026-82208)

  • CVE-637: curl - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a (public CVE-2026-82209)

Security fixes — LDAP Synchronizer

  • CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

  • CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

Fixes in Bonita 2025.2-u9 (2026-07-17)

  • BPA-100 - Groovy evaluate : BDM object field is null whereas the column has a value in the database → SQL SELECT to retrieve the BO is not executed

  • BPA-445 - [SAML] authentication: race condition on /favicon.ico overwrites __REDIRECT_URI session attribute, causing 404 after successful SSO login

  • BPA-633 - GET bpm/archivedCase returns HTTP 404 for the whole list when a deployed started_by / startedBySubstitute user no longer exists in the organization

  • BPA-680 - [Studio/Windows] Process deploy runs "mvn clean install" that fails to delete the locked BDM jar → BDM build output wiped → BAR build fails "unable to resolve <bdm package>"

  • Several dependencies updated

Security fixes

  • CVE-375: keycloak-saml-core - A remote, unauthenticated attacker can send a specially crafted XML input to the endpoint (public CVE-2026-7307)

  • CVE-431: keycloak-saml-adapter-core - An unauthenticated remote attacker can trigger an application level Denial of Service (public CVE-2026-2575)

Fixes in Bonita 2025.2-u8 (2026-04-27)

  • BPA-100 - Groovy evaluate : BDM object field is null whereas the column has a value in the database → SQL SELECT to retrieve the BO is not executed

  • BPA-183 - Process instance never completes: row in FLOWNODE_INSTANCE table with stateid 28 and kind multi

  • BPA-297 - BDM REST API returns empty JSON for HibernateProxy entities

  • BPA-443 - [Cluster] NPE on HTTP API for every void method (retryTask, logout, …​)

  • BPA-449 - Studio: .bar built from a process with no declared dependencies contains all project dependencies

  • RUNTIME-410 - XA transaction timeout while performing db operation leaves thread in bad state, causing subsequent db operation attempts to fail with "Logical connection is closed" error

  • Several dependencies updated

Fixes in Bonita 2025.2-u7 (2026-04-01)

  • Brute-force login protection is now enabled by default. This security feature rate-limits failed login attempts per username and temporarily locks out accounts after too many failures.

  • This version restores the Java dependencies configuration page with selective export that was available in 2024.3 and older versions.

  • BPA-316 - Prograde Java policy is too restrictictive for AI connectors

  • BPA-321 - ThreadLocal EntityManager leak after JTA transaction timeout causes stale persistence context reuse

  • BPA-411 - [OIDC][Cluster] single-use refresh token invalidation causes repeated session loss

  • Several dependencies updated

Security fixes

  • CVE-265: catalina.jar - Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat (public CVE-2026-34483)

  • CVE-263: catalina.jar - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled (public CVE-2026-29145)

  • CVE-262: catalina.jar - Configured cipher preference order not preserved vulnerability in Apache Tomcat (public CVE-2026-29129)

  • CVE-258: catalina.jar - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Tomcat (public CVE-2026-24880)

  • CVE-253: Zip Slip path traversal in IOUtil.extractZipEntries()

  • CVE-252: Path traversal via resourceFileName in DocumentDownloadServlet and DocumentImageServlet

  • CVE-244: keycloak-saml-adapter-core - Keycloak’s Security Assertion Markup Language (SAML) endpoint does not properly validate (public CVE-2026-2092)

  • CVE-43 - Brute-force login protection

Fixes in Bonita 2025.2-u5 (2026-02-26)

  • BPA-206 - LASTUPDATEDATE of rows in the flownode_instance table is not updated

  • BPA-278 - Bonita Administrator Application - License page is broken

  • BPA-281 - BDM JPQL x Custom REST API BDM query with String[] as input: the result only includes elements with String[0]

  • BPA-294 - Docker: Slow reverse DNS lookups with ProGrade security manager cause delays on HTTP requests

  • CVE-233 - Path Traversal and Authentication Bypass via semicolon parsing differential

  • CVE-234 - Pre-Authentication RCE via XStream Deserialization

  • CVE-235 - Pre-Authentication SSRF via ObjectInputStream Deserialization

  • CVE-240 - Input Sanitizer reports but leaves unchanged HTML and JS

  • CVE-241 - Reflected XSS / Information disclosure via RestRequestParser error messages

  • Several dependencies updated

Fixes in Bonita 2025.2-u3 (2026-01-21)

  • Java Security Policy is now enabled by default in Docker image in community edition as well. This security feature protects against malicious Groovy script execution, including command execution and access to sensitive files.

  • BPA-276 - REST API regression: Cannot get or install/update BDM on Community edition (10.3 & 10.4)

  • BPA-279 - [OIDC] Bearer authentication (Oauth) for REST API is broken

Fixes in Bonita 2025.2-u2 (2026-01-13)

  • Java Security Policy is now enabled by default in Docker image (Subscription editions only). This security feature protects against malicious Groovy script execution, including command execution and access to sensitive files.
    Note: The System script connector will not work when this policy is active. Set PRO_GRADE=false to disable if needed (not recommended).

  • BPA-141 - Process diagram (Case visu) shows whitespace on top when the process is not first in the diagram.

  • BPA-178 - UiPath connector fails with java.lang.NoSuchFieldError

  • BPA-189 - Studio Extra long build duration compare to previous version

  • BPA-220 - session_user missing from access logs when cluster mode is enabled

  • BPA-256 - Bonita Usage Metrics Plugin: Duplicate Requests

  • BPA-266 - Incorrect counting of active sessions in tomcat.sessions.active.current

  • BPA-271 - UiPath connector does not support OAuth2 authentication to connect to UiPath Cloud

  • CVE-123 - Apache Tomcat - Console manipulation via escape sequences in log messages (fixing CVE-2025-55754)

  • CVE-124 - RCE through admin resources upload or admin process script update

  • CVE-125 - OWASP Java HTML sanitizer - XSS via noscript tag and improper sanitization in style tags (fixing CVE-2025-66021)

  • CVE-126 - postgresql JDBC Driver - Channel binding option in pgJDBC may allow local network attackers to perform man-in-the-middle (fixing CVE-2025-49146)

  • CVE-128 - Bouncy Castle for Java - bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation (fixing CVE-2025-8916)

  • Several dependencies updated

Fixes in Bonita 2025.2-u0 (2025-12-15)

Fixes in Bonita Runtime (including Bonita Applications)

  • BPA-204 Classloader initialisation fails because of a hardcoded 5-minutes timeout

  • BPA-209 Incorrect Java Version in Docker 2025.1 Image

  • BPA-215 [OIDC][Cluster] Parallel token refresh race condition and failure to save new tokens

  • BPA-244 [OIDC][CORS] Allowed origins verification fails with opaque tokens (it assumes access token is a JWT)

  • CVE-120 - SQL Server JDBC driver - Improper input validation (fixing CVE-2025-59250)