Release notes

Removes the deprecated cache-config.xml file (cache configuration is now programmatic in Java)

Removes 4 obsolete Ehcache 2 properties from configuration files:

Adds new offHeapSizeMB=0 property to all cache configurations (defaults to on-heap caching)

If you customized cache configuration in bonita-platform-community-custom.properties, bonita-tenant-community-custom.properties, or cluster configuration files, these obsolete properties will be automatically removed during platform update

The new Ehcache 3 configuration uses different property names and is managed programmatically - contact Bonitasoft Support if you need to tune cache behavior

Most Ehcache 3 properties (like maxElementsInMemory, eternal, timeToLiveSeconds) remain compatible and will be preserved

Off-heap caching is disabled by default (offHeapSizeMB=0) but can be enabled for performance optimization on large-scale deployments

Community edition: bonita-platform-community-custom.properties, bonita-tenant-community-custom.properties

Subscription edition (cluster): bonita-platform-sp-cluster-custom.properties, bonita-tenant-sp-cluster-custom.properties

Hazelcast, the library used by the Cluster feature, is updated from 5.4.0 to 5.7.0. If you run a cluster, read Updating a cluster to 2026.1-u3 before updating.

Security hardening of the Hazelcast member. On a single node, the member Bonita starts for its second-level cache now listens on loopback only instead of on every interface. To restore the previous behaviour, for a deployment that attaches a Hazelcast client on purpose, set the property to an empty value in bonita-platform-sp-custom.properties: bonita.platform.hazelcast.interfaces.list= with nothing after the equals sign. Uncommenting the line as shipped in that file keeps the loopback default. In a cluster, bonita.platform.cluster.hazelcast.interfaces.list now binds the member to one address of the node matching the patterns it lists, which it never did before; its default no longer names an interface. If your cluster configuration sets that property, verify its value or unset it before updating: a value that matches no interface of the node, harmless until now, stops the node from starting. See Allow communication between servers for how to restrict the port.

All nodes must be stopped to update. The Hazelcast edition bundled with Bonita does not support updating the members of a cluster one at a time, so a node running 5.4.0 cannot join a cluster running 5.7.0. Stop every node, update them, then start them again.

No configuration change is required. The update introduces two new cluster properties, both with default values, so nothing needs to be added to your configuration. See Work recovery when a node leaves the cluster if you want to tune them.

Work recovery is more robust. The recovery of a departed node’s work runs in the background instead of on a Hazelcast event thread, gives up on its own before its lock expires, and is tried again at the next departure or start for whatever it could not take over. A node that resumes after a tenant pause now resubmits the work that arrived while it was paused, which previously waited until the node left the cluster.

Clusters updated from an earlier version log a warning about the configuration schema at every start. Fresh installations do not. The message reports that the Hazelcast schema location is incorrect and that the default is used instead. It is harmless: your stored configuration still refers to the schema of the previous version, and the update does not rewrite it. To make it stop, update the version in the schema location in platform_engine/hazelcast.xml with the platform setup tool.

Two diagnostics change. The Number of locks column of the Hazelcast statistics file now counts the locks currently held on the node that writes the file, where it previously counted lock objects across the cluster, so expect a different magnitude and a value that varies with load. A lock whose lease expires before it is released is now reported as an error instead of a warning; if you raise alerts on errors from the cluster lock service, you may start seeing them for a condition that was already being reported at a lower level.

CVE-524: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitte (public CVE-2026-12860)

CVE-525: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This iss (public CVE-2026-13506)

CVE-527: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-le (public CVE-2026-14682)

CVE-536: bcprov-jdk18on - In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished na (public CVE-2026-58059)

CVE-564: hazelcast - Authorization bypass in IMap Predicates API (public XRAY-1043284)

CVE-565: hazelcast - Arbitrary member memory access by low-privileged client (public XRAY-1043285)

CVE-578: postgresql - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require (public CVE-2026-54291)

CVE-622: agetty - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount (public CVE-2026-76642)

CVE-623: agetty - The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor ope (public CVE-2026-78408)

CVE-624: agetty - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subd (public CVE-2026-78409)

CVE-625: agetty - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that sour (public CVE-2026-78410)

CVE-627: curl - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misi (public CVE-2026-13608)

CVE-628: curl - A flaw in libcurl’s handling of HTTP/2 Server Push streams, when the parent handle is set to share connections wi (public CVE-2026-18924)

CVE-629: curl - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentica (public CVE-2026-19931)

CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)

CVE-632: curl - When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating eas (public CVE-2026-80229)

CVE-633: curl - When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (`CURLOPT_ (public CVE-2026-80230)

CVE-634: curl - A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using (public CVE-2026-80231)

CVE-635: curl - A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately befo (public CVE-2026-80255)

CVE-636: curl - With the wolfSSL backend, when CA caching is enabled and an CURLOPT_SSL_CTX_FUNCTION callback replaces the trus (public CVE-2026-82208)

CVE-637: curl - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a (public CVE-2026-82209)

CVE-630: libexpat - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy’s return code leads to insufficient (public CVE-2026-76956)

CVE-631: libexpat - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-fre (public CVE-2026-76957)