Workflow Engine 21.1.0
Release date: May 19, 2026
Overview
Workflow Engine 21.1.0 is a maintenance release focused on Web API OpenAPI compatibility, safer HTTP header parsing, Workflow Designer settings and localization fixes, and a broad dependency refresh across Designer packages, samples, and Forms Plugin frontend assets.
Why update
- Fix Web API request header parsing so header values that contain
=are preserved correctly, which is important for bearer tokens, signatures, and Base64-encoded values. - Update Web API Swagger/OpenAPI generation to the current Swashbuckle stack and align it with supported ASP.NET Core OpenAPI packages.
- Fix Workflow Designer settings reset so it removes only Workflow Designer keys instead of clearing the entire browser
localStorage. - Get current dependency updates across Designer packages and samples, including security-related package upgrades in .NET and frontend components.
Key features
- Web API OpenAPI generation was updated for Swashbuckle 10 compatibility, including the required generator changes for breaking API changes.
- HTTP request header parsing now splits only on the first
=, so values that embed=are passed through intact. - Workflow Designer settings reset now removes only Workflow Designer entries, and the German localization pack was updated.
- Designer Angular packages and samples were aligned to the Angular 20.3 line to restore a consistent startup and build experience after partial dependency upgrades.
Changelog
Update instructions
- All packages: update Workflow Engine packages to version 21.1.0.
- If you use Workflow Engine Web API Swagger or custom OpenAPI generation extensions, review your integration after upgrading because Swashbuckle 10 required generator-level compatibility changes in this release.
- If you use
workflow-designer-angularor the Angular sample, update your package lockfiles and keep the Angular dependency set aligned to the20.3.xline. - No database migration or other package-specific migration steps are required for this release.
Enhancements
- Web API: updated Swagger/OpenAPI generation for
Swashbuckle.AspNetCore10.0.1and adapted the implementation to the new generation APIs. - Designer packages: aligned Angular dependencies in
workflow-designer-angularandworkflow-designer-angular-samplefrom20.1.7to the20.3.xline to restore a consistent startup experience. Dependency refresh by project: Designer:webpack5.101.3 -> 5.105.0;@babel/plugin-transform-modules-systemjs7.23.3 -> 7.29.4;fast-uri3.1.0 -> 3.1.2;axios1.8.2 -> 1.15.2;lodash4.17.21 -> 4.18.1;lodash-es4.17.21 -> 4.18.1;node-forge1.3.1 -> 1.4.0;express4.21.2 -> 4.22.1;postcss8.5.6 -> 8.5.14.workflow-designer-angular:@modelcontextprotocol/sdk1.13.3 -> 1.26.0;@angular/cli20.1.6 -> 21.1.3;@angular/common20.1.7 -> 20.3.20;@angular/core20.1.7 -> 20.3.20;@angular/compiler20.1.7 -> 20.3.18;fast-uri3.0.1 -> 3.1.2;hono4.11.7 -> 4.12.18;@hono/node-server1.19.9 -> 1.19.14;express-rate-limit8.2.1 -> 8.5.1;tar7.5.7 -> 7.5.15;lodash4.17.21 -> 4.18.1;brace-expansion1.1.11 -> 1.1.14;postcss8.5.6 -> 8.5.14.workflow-designer-angular-sample:@modelcontextprotocol/sdk1.13.3 -> 1.26.0;@angular/cli20.1.6 -> 21.1.3;@angular/core20.1.7 -> 20.3.18;@angular/compiler20.1.7 -> 20.3.18;fast-uri3.0.1 -> 3.1.2;hono4.11.8 -> 4.12.18;@hono/node-server1.19.9 -> 1.19.14;express-rate-limit8.2.1 -> 8.5.1;tar7.5.7 -> 7.5.15.workflow-designer-react-sample:webpack5.94.0 -> 5.105.0;@babel/plugin-transform-modules-systemjs7.20.11 -> 7.29.4;fast-uri3.1.0 -> 3.1.2;lodash4.17.21 -> 4.18.1;node-forge1.3.1 -> 1.3.2;js-yaml3.14.1 -> 3.14.2.workflow-designer-react:postcss8.5.6 -> 8.5.14.workflow-designer-javascript-sample:@babel/plugin-transform-modules-systemjs7.15.4 -> 7.29.4.forms-plugin/frontend:fast-uri3.1.0 -> 3.1.2;axios1.11.0 -> 1.16.0;react-router7.8.2 -> 7.13.0;react-router-dom7.8.2 -> 7.13.0;js-yaml3.14.1 -> 3.14.2;glob10.4.5 -> 10.5.0;vite7.3.0 -> 7.3.3;ip-address10.0.1 -> 10.2.0;postcss8.5.6 -> 8.5.14.
Bug fixes
- Web API: fixed HTTP request header parsing so values that contain
=are no longer truncated or corrupted during dictionary parsing. - Designer: fixed settings reset so it clears only Workflow Designer keys by prefix instead of deleting the entire browser
localStorage. - Designer: updated the German localization to correct translation issues in Workflow Designer.
Resources
- Web API OpenAPI documentation: OpenAPI.
- Workflow Designer localization guide: Languages.
- Forms Plugin documentation: Forms.
Security
- MongoDB-related packages and samples: upgraded
SharpCompressfrom0.30.1to0.48.0, moving archive extraction support beyond the affected range<= 0.47.4for CVE-2026-44788 and GHSA-6c8g-7p36-r338. - MongoDB-related packages and samples: upgraded
Snappierfrom1.0.0to1.3.1to clear package security warnings and move to a maintained release line associated with the upstream Snappier advisory CVE-2023-28638 and GHSA-838x-pcvx-6p5w.