Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.515...7.21.0-rc.516

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.514...7.21.0-rc.515

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.513...7.21.0-rc.514

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.512...7.21.0-rc.513

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.511...7.21.0-rc.512

• aa36b38: [grid] Forward file upload/download for Kubernetes, Docker and relay sessions (#17914) (Viet Nguyen Duc) #17914

• 5d5be8c: [build] Automated Browser Version Update (#17904) (Selenium CI Bot) #17904
• 83f0b26: [grid] stop forwarding se:remoteUrl past the Node that consumes it (#17908) (Titus Fortner) #17908

• #55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
• #55169 - Changing how connection closure is handled to avoid a race condition
• #55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
• #55298 - Fix test selection for nested test classes
• #55554 - Bump to Vert.x 4.5.31
• #55560 - [3.x] maven native integration tests fail after #55461
• #55584 - Qute localization breaks with too many entries
• #55587 - Add presence checks on substituted Netty classes
• #55653 - Fix VerifyError for large Qute message bundles
• #55675 - Serialization issue in rest endpoints when class has empty constructor
• #55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
• #55760 - Upgrade Yasson from 3.0.4 to 3.0.5
• #55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
• #55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
• #55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
• #55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
• #55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
• #55849 - Merge isPublicConstructors() when a reflective class is registered twice
• #55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
• #55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
• #55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
• #55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
• #55867 - ArC: fix client proxy name collision for producers
• #55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
• #55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
• #55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
• #55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
• #55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
• #55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
• #55912 - Tree Shaker breaks hibernate filters
• #55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
• #55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
• #55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
• #55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change