Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.585...7.21.0-rc.586

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.584...7.21.0-rc.585

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.583...7.21.0-rc.584

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.582...7.21.0-rc.583

• 971e8bf: [build] Automated CDDL Spec Update (#18015) (Selenium CI Bot) #18015
• 6724d95: [dotnet] [bidi] Add image size to capture screenshots (#18016) (Nikolay Borisenko) #18016
• 754c31e: [build] Automated Browser Version Update (#18014) (Selenium CI Bot) #18014
• b946ffc: [build] reorder packaging task to be more logically consistent (Titus Fortner)
• 84b08bc: [build] only need to run nightly Grid release after production release (#18013) (Titus Fortner) #18013
• 133a66a: [build] merge the release PR automatically once required checks pass (#18018) (Titus Fortner) #18018
• 3221998: [build] move Selenium Manager publishing into sm-snapshot.yml so releases no longer skip it (#18017) (Titus Fortner) #18017
• 98908d4: [build] only open the CDDL update PR when the projected BiDi schema changes (Titus Fortner)
• ea36522: [rb] register BiDi event callbacks on the bridge connection instead of driver.bidi in Protocol specs (Titus Fortner)
• 4d27eb3: [adr] Network async/event API (#17685) (Titus Fortner) #17685
• d5d21d0: [docs] ADR 17685: mark accepted, link tracking issue #18019, link record from Selenium 5 plan (Titus Fortner)
• 08046d5: [adr] Low-level WebDriver BiDi layer (#17786) (Titus Fortner) #17786
• bce93ba: [docs] ADR 17786: mark accepted, link tracking issue #18020 (Titus Fortner)

• #42976 - Quarkus REST in NATIVE - abstract resources with @Path requires impl. to be CDI beans while RESTEasy does not
• #45257 - update guide on writing extension regarding docs generation
• #45791 - Range response status reset when using a @ServerResponseFilter
• #55119 - Use branch instead of version to avoid dead link on main guides
• #55674 - context propagation not working correctly
• #55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
• #55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
• #55962 - Enable WebSocket traffic logging in aesh websocket tests
• #55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
• #56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
• #56103 - Mention the quarkus-config-doc-maven-plugin
• #56106 - Add licenses for generic file components in SBOMs
• #56120 - Move SSH enabled config to build time and gate all processor build steps
• #56129 - Fix wrapWithSpan context propagation
• #56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
• #56222 - Make sure the callouts follow the Asciidoc syntax
• #56240 - Update redirect instructions for Roq
• #56279 - Security overview guide style review (3.40)
• #56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
• #56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
• #56340 - Add a packaging overview guide
• #56346 - Manage projectreactor in the bom, update to 3.8.7
• #56348 - Update building-docs skill and docs-preview.sh for Roq migration
• #56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
• #56357 - [3.39] backport of doc improvement
• #56359 - Check Keycloak token type on the OIDC server-less verification path
• #56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
• #56374 - Remove warning from PeriodicMetricReader
• #56386 - Style and syntax violations in docs callouts
• #56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
• #56391 - Fix numbered callout lists in documentation examples
• #56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
• #56395 - Suppress PeriodicMetricReader exporter warnings
• #56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
• #56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
• #56408 - Update the logging guide for supported APIs
• #56413 - Redis client: fix connection leaks caused by cancellation during acquisition
• #56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
• #56425 - Doc - place callout lists after source listings
• #56429 - Typo fixes in websockets-next guides
• #56430 - Ensure FullyFeaturedServerJacksonMessageBodyWriter uses media type properly
• #56431 - Ensure SecurityCustomSerialization uses ContextResolver
• #56432 - Remove orphaned callout markers with missing explanations
• #56444 - Drop steps for discarded toc plugin in docs preview
• #56449 - Fix remaining callout list placement issues in docs
• #56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
• #56480 - fix: align docs-preview.sh default port to 8042
• #56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
• #56489 - SBOM component to product attribution
• #56493 - Certificate reload skips restored certificates by comparing against startup snapshot
• #56497 - [3.39] SBOM CPE attribution
• #56498 - Ensure restoring certificate to original works

• 0a5e0e7: [build] Reset versions to nightly after selenium-4.49.0 release (Selenium CI Bot)
• 60238b4: Update mirror info (Wed Sep 9 15:45:10 UTC 2026) (Selenium CI Bot)
• 56636ca: [build] key the repository cache on its trigger files and cache the Selenium Manager binaries (Titus Fortner)
• cec4b03: [build] retry the Bazel run once after a transient download failure (Titus Fortner)
• e44e60b: [build] pass secrets to the release verify job so it can query Sonatype (Titus Fortner)
• ca5effb: [rust] drop stale note that Selenium Manager cannot be built locally on Windows (Titus Fortner)
• 135dd70: [build] do not compute test targets for a release (Titus Fortner)
• eebe911: [build] support passing multiple targets to bazel execute (Titus Fortner)
• abc6eec: [build] build all Java release targets in one Bazel invocation (Titus Fortner)
• e56ba7d: [build] start the Selenium Manager release build after the CDP check instead of after the trunk lock (Titus Fortner)

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

• Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in https://github.com/netty/netty/pull/17224
• Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in https://github.com/netty/netty/pull/17228
• Update junit version by @normanmaurer in https://github.com/netty/netty/pull/17233
• Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in https://github.com/netty/netty/pull/17230
• Update setup-testlens to v1.9.4 (#17223) by @chrisvest in https://github.com/netty/netty/pull/17229
• Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in https://github.com/netty/netty/pull/17241
• Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in https://github.com/netty/netty/pull/17251
• Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in https://github.com/netty/netty/pull/17265
• Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in https://github.com/netty/netty/pull/17268
• Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in https://github.com/netty/netty/pull/17269
• Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in https://github.com/netty/netty/pull/17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in https://github.com/netty/netty/pull/17273
• Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in https://github.com/netty/netty/pull/17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in https://github.com/netty/netty/pull/17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in https://github.com/netty/netty/pull/17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in https://github.com/netty/netty/pull/17291
• Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in https://github.com/netty/netty/pull/17294
• Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in https://github.com/netty/netty/pull/17302
• Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in https://github.com/netty/netty/pull/17311
• Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in https://github.com/netty/netty/pull/17316
• Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in https://github.com/netty/netty/pull/17322
• Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in https://github.com/netty/netty/pull/17319
• Update to use graal 21 by @normanmaurer in https://github.com/netty/netty/pull/17327
• Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in https://github.com/netty/netty/pull/17329
• Fix graal docker file usage by @normanmaurer in https://github.com/netty/netty/pull/17333
• Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in https://github.com/netty/netty/pull/17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in https://github.com/netty/netty/pull/17309
• Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in https://github.com/netty/netty/pull/17338
• Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17345
• Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in https://github.com/netty/netty/pull/17347
• Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in https://github.com/netty/netty/pull/17349
• Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in https://github.com/netty/netty/pull/17351
• Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in https://github.com/netty/netty/pull/17355
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/17361
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/17365
• Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17364
• Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in https://github.com/netty/netty/pull/17369
• Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in https://github.com/netty/netty/pull/17398
• Bulk merge for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17403

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.137.Final...netty-4.1.138.Final