Skip to Content
Evaluate Get Started Plugins Glossary

Workflow Engine 21.1.0

Release date: May 19, 2026

Overview

Workflow Engine 21.1.0 is a maintenance release focused on Web API OpenAPI compatibility, safer HTTP header parsing, Workflow Designer settings and localization fixes, and a broad dependency refresh across Designer packages, samples, and Forms Plugin frontend assets.

Why update

  • Fix Web API request header parsing so header values that contain = are preserved correctly, which is important for bearer tokens, signatures, and Base64-encoded values.
  • Update Web API Swagger/OpenAPI generation to the current Swashbuckle stack and align it with supported ASP.NET Core OpenAPI packages.
  • Fix Workflow Designer settings reset so it removes only Workflow Designer keys instead of clearing the entire browser localStorage.
  • Get current dependency updates across Designer packages and samples, including security-related package upgrades in .NET and frontend components.

Key features

  • Web API OpenAPI generation was updated for Swashbuckle 10 compatibility, including the required generator changes for breaking API changes.
  • HTTP request header parsing now splits only on the first =, so values that embed = are passed through intact.
  • Workflow Designer settings reset now removes only Workflow Designer entries, and the German localization pack was updated.
  • Designer Angular packages and samples were aligned to the Angular 20.3 line to restore a consistent startup and build experience after partial dependency upgrades.

Changelog

Update instructions

  • All packages: update Workflow Engine packages to version 21.1.0.
  • If you use Workflow Engine Web API Swagger or custom OpenAPI generation extensions, review your integration after upgrading because Swashbuckle 10 required generator-level compatibility changes in this release.
  • If you use workflow-designer-angular or the Angular sample, update your package lockfiles and keep the Angular dependency set aligned to the 20.3.x line.
  • No database migration or other package-specific migration steps are required for this release.

Enhancements

  • Web API: updated Swagger/OpenAPI generation for Swashbuckle.AspNetCore 10.0.1 and adapted the implementation to the new generation APIs.
  • Designer packages: aligned Angular dependencies in workflow-designer-angular and workflow-designer-angular-sample from 20.1.7 to the 20.3.x line to restore a consistent startup experience. Dependency refresh by project:
  • Designer: webpack 5.101.3 -> 5.105.0; @babel/plugin-transform-modules-systemjs 7.23.3 -> 7.29.4; fast-uri 3.1.0 -> 3.1.2; axios 1.8.2 -> 1.15.2; lodash 4.17.21 -> 4.18.1; lodash-es 4.17.21 -> 4.18.1; node-forge 1.3.1 -> 1.4.0; express 4.21.2 -> 4.22.1; postcss 8.5.6 -> 8.5.14.
  • workflow-designer-angular: @modelcontextprotocol/sdk 1.13.3 -> 1.26.0; @angular/cli 20.1.6 -> 21.1.3; @angular/common 20.1.7 -> 20.3.20; @angular/core 20.1.7 -> 20.3.20; @angular/compiler 20.1.7 -> 20.3.18; fast-uri 3.0.1 -> 3.1.2; hono 4.11.7 -> 4.12.18; @hono/node-server 1.19.9 -> 1.19.14; express-rate-limit 8.2.1 -> 8.5.1; tar 7.5.7 -> 7.5.15; lodash 4.17.21 -> 4.18.1; brace-expansion 1.1.11 -> 1.1.14; postcss 8.5.6 -> 8.5.14.
  • workflow-designer-angular-sample: @modelcontextprotocol/sdk 1.13.3 -> 1.26.0; @angular/cli 20.1.6 -> 21.1.3; @angular/core 20.1.7 -> 20.3.18; @angular/compiler 20.1.7 -> 20.3.18; fast-uri 3.0.1 -> 3.1.2; hono 4.11.8 -> 4.12.18; @hono/node-server 1.19.9 -> 1.19.14; express-rate-limit 8.2.1 -> 8.5.1; tar 7.5.7 -> 7.5.15.
  • workflow-designer-react-sample: webpack 5.94.0 -> 5.105.0; @babel/plugin-transform-modules-systemjs 7.20.11 -> 7.29.4; fast-uri 3.1.0 -> 3.1.2; lodash 4.17.21 -> 4.18.1; node-forge 1.3.1 -> 1.3.2; js-yaml 3.14.1 -> 3.14.2.
  • workflow-designer-react: postcss 8.5.6 -> 8.5.14.
  • workflow-designer-javascript-sample: @babel/plugin-transform-modules-systemjs 7.15.4 -> 7.29.4.
  • forms-plugin/frontend: fast-uri 3.1.0 -> 3.1.2; axios 1.11.0 -> 1.16.0; react-router 7.8.2 -> 7.13.0; react-router-dom 7.8.2 -> 7.13.0; js-yaml 3.14.1 -> 3.14.2; glob 10.4.5 -> 10.5.0; vite 7.3.0 -> 7.3.3; ip-address 10.0.1 -> 10.2.0; postcss 8.5.6 -> 8.5.14.

Bug fixes

  • Web API: fixed HTTP request header parsing so values that contain = are no longer truncated or corrupted during dictionary parsing.
  • Designer: fixed settings reset so it clears only Workflow Designer keys by prefix instead of deleting the entire browser localStorage.
  • Designer: updated the German localization to correct translation issues in Workflow Designer.

Resources

  • Web API OpenAPI documentation: OpenAPI.
  • Workflow Designer localization guide: Languages.
  • Forms Plugin documentation: Forms.

Security

  • MongoDB-related packages and samples: upgraded SharpCompress from 0.30.1 to 0.48.0, moving archive extraction support beyond the affected range <= 0.47.4 for CVE-2026-44788 and GHSA-6c8g-7p36-r338.
  • MongoDB-related packages and samples: upgraded Snappier from 1.0.0 to 1.3.1 to clear package security warnings and move to a maintained release line associated with the upstream Snappier advisory CVE-2023-28638 and GHSA-838x-pcvx-6p5w.