3.8.0-preview1

What's Changed

• Fix System.Dynamic registration for C# variable accessors by @RalfvandenBurg in #7415
• fix(csharp): register System.Dynamic for generated Variables wrapper by @Copilot in #7416
• fix: restore HashSet-backed Fork completion state on resumed workflows by @Copilot in #7431
• Graceful shutdown for the workflow runtime (drain, pause, recover) by @sfmskywalker in #7424
• [codex] Add live server log streaming diagnostics by @sfmskywalker in #7438
• [codex] Add structured log SQLite persistence by @sfmskywalker in #7445
• [codex] Expose structured log storage diagnostics by @sfmskywalker in #7446
• [codex] Add structured log provider tests by @sfmskywalker in #7449
• [codex] Increase structured log persistence test coverage by @sfmskywalker in #7450
• [codex] Increase structured log relational test coverage by @sfmskywalker in #7451
• [codex] Add codebase wiki by @sfmskywalker in #7453
• [codex] Add Elsa README video assets by @sfmskywalker in #7455
• [codex] Avoid duplicate structured log storage diagnostics by @sfmskywalker in #7456
• Add missing Obsolete attribute to IWorkflowBuilder by @heku in #7448
• [codex] Resolve build warnings by @sfmskywalker in #7458
• Update safe dependency patch versions by @sfmskywalker in #7459
• [codex] Add wiki update workflow by @sfmskywalker in #7454
• Fix structured log write buffer shutdown flush by @sfmskywalker in #7460
• Fix SQLite structured log shell lifecycle by @sfmskywalker in #7461
• Add state machine activity by @sfmskywalker in #7457
• Add diagnostics console logs by @sfmskywalker in #7462
• [codex] Add package manifest feature metadata by @sfmskywalker in #7463
• fix: do not resume interrupted workflows that are already finished by @jwdb in #7435
• [codex] Update package manifest generator preview by @sfmskywalker in #7465
• [codex] Refresh codebase wiki by @github-actions[bot] in #7464
• [codex] Refresh codebase wiki by @github-actions[bot] in #7466
• Add secrets module by @sfmskywalker in #7468
• [codex] Fix tenant coordinator test options reference by @sfmskywalker in #7503
• [codex] Enforce role assignment authorization by @sfmskywalker in #7501
• Scope HTTP bookmark lookup to tenant by @sfmskywalker in #7508
• Distinguish refresh tokens from API access tokens by @sfmskywalker in #7509
• [codex] Treat Python expressions as privileged host code by @sfmskywalker in #7507
• [codex] Enforce HTTP workflow request body limits while reading by @sfmskywalker in #7497
• [codex] Remove production-usable default admin credentials by @sfmskywalker in #7500
• [codex] Fail fast on default JWT signing keys by @sfmskywalker in #7496
• [codex] Authorize workflow imports before persistence by @sfmskywalker in #7510
• Stabilize bulk dispatch fire-and-forget component test by @sfmskywalker in #7520
• [codex] Require opt-in for localhost authorization grants by @sfmskywalker in #7498
• [codex] Harden C# expression host-code execution by @sfmskywalker in #7519
• Optimize workflow definition sync lookups by @sfmskywalker in #7521
• [codex] Whitelist workflow timestamp filter columns by @sfmskywalker in #7506
• Use cryptographic randomness and adaptive identity secret hashing by @sfmskywalker in #7511
• Add Elsa runtime readiness health checks by @sfmskywalker in #7513
• [codex] Validate distributed runtime lock provider by @sfmskywalker in #7515
• Add bookmark queue dead-letter store by @sfmskywalker in #7516
• Add ingress rate limiting hooks by @sfmskywalker in #7512
• Add workflow dispatch transactional outbox by @sfmskywalker in #7517
• [codex] Harden initial security remediation slice by @sfmskywalker in #7495
• Add OpenTelemetry workflow instrumentation by @sfmskywalker in #7514
• [codex] Harden workflow JSON type resolution by @sfmskywalker in #7499
• [codex] Authorize workflow instance SignalR observation by @sfmskywalker in #7504
• [codex] Secure Resilience simulate response endpoint by @sfmskywalker in #7505
• [codex] Add operational dashboard API PRD by @sfmskywalker in #7529
• [codex] Align console logs hub authorization by @sfmskywalker in #7531
• [codex] Clarify dashboard widget integration contract by @sfmskywalker in #7532
• [codex] Increase Elsa Secrets test coverage by @sfmskywalker in #7530
• [codex] Enforce console logs hub read permission by @sfmskywalker in #7533
• [codex] Refresh codebase wiki by @github-actions[bot] in #7467
• [codex] Scope console logs to workflow instances by @sfmskywalker in #7535
• Enhance console logging with improved context and lifecycle by @sfmskywalker in #7536
• [codex] Increase secrets unit coverage by @sfmskywalker in #7545
• [codex] Fix console log metadata and type resolution by @sfmskywalker in #7542
• [codex] Resolve OpenTelemetry package warnings by @sfmskywalker in #7546
• [codex] Bump dependency security patches by @sfmskywalker in #7547
• [codex] Fix diagnostics live feed regressions by @sfmskywalker in #7548
• Refactor: Overhauls workflow JSON type serialization by @sfmskywalker in #7549
• Optimize activity registry descriptor lookup by @sfmskywalker in #7538
• Preserve activity descriptors on empty refresh by @sfmskywalker in #7550
• [codex] Protect sensitive workflow input descriptors and state by @sfmskywalker in #7573
• [codex] Validate workflow secret references adoption by @sfmskywalker in #7576
• [S2] Add Secret expression runtime by @sfmskywalker in #7574
• [S4] Add JavaScript secret functions by @sfmskywalker in #7575
• [codex] Refresh codebase wiki by @github-actions[bot] in #7534
• [codex] Add EF Core secrets persistence by @sfmskywalker in #7572

New Contributors

• @jwdb made their first contribution in #7435
• @github-actions[bot] made their first contribution in #7464

Full Changelog: 3.7.0...3.8.0-preview1

3.7.0

What's Changed

• Improves HTTP context loss error handling by @sfmskywalker in #7187
• Fix spurious duplicate activity registry warnings during startup by @Copilot in #7183
• Improves workflow materializer handling by @sfmskywalker in #7195
• Fix PolymorphicObjectConverter handling of primitive values by @VedikaGupt in #7207
• Propagate exceptions from command handlers correctly by @avin3sh in #7218
• Integrate shells by @sfmskywalker in #7279
• Introduce role and user management services by @sfmskywalker in #7297
• Adds activity execution call stack support by @sfmskywalker in #7271
• Add shell middleware, call‑stack tracking, and workflow reference graph APIs by @sfmskywalker in #7333
• doc: add Elsa 3.6.0 release notes as doc/changelogs/3.6.0.md by @Copilot in #7347
• Add release notes for Elsa 3.6.0 by @Copilot in #7348
• Add shell reload API endpoints and client support by @sfmskywalker in #7353
• refactor: extract shared shell reload response models and address review feedback by @Copilot in #7355
• Add workflow export functionality and update changelog by @sfmskywalker in #7357
• fix: decouple background command execution from caller cancellation token (#7224) by @cristiandolf in #7283
• Fix/startuptask activate default tenant when empty by @RalfvandenBurg in #7305
• Isolate background workflow dispatches from caller's cancellation token by @avin3sh in #7291
• Code cleanup and typo fix by @heku in #7393
• Code cleanup by @heku in #7395
• test: refactor with WorkflowTestFixture by @heku in #7394
• fix: correct workflow summary pagination by @RalfvandenBurg in #7392
• Fix tenant scope for interrupted workflow restarts by @RalfvandenBurg in #7389
• refactor | Added a new property to expose the ability to disable the sorting by @ByronMayne in #7360
• Fix BulkDispatchWorkflows sharing input dictionary across dispatches by @avin3sh in #7284
• feat: extend shells integration and modular server support by @sfmskywalker in #7399
• Add Claude Code GitHub Workflow by @sfmskywalker in #7411
• fix: handle arrays of generic types in GetFriendlyTypeName (issue - #7369) by @minaxi98 in #7400

New Contributors

• @VedikaGupt made their first contribution in #7207
• @avin3sh made their first contribution in #7218
• @cristiandolf made their first contribution in #7283
• @ByronMayne made their first contribution in #7360
• @minaxi98 made their first contribution in #7400

Full Changelog: 3.6.0...3.7.0

3.6.2

Elsa 3.6.2 is a patch release that addresses a NuGet security warning caused by a vulnerable transitive dependency.

Security

• Fixed NU1903 warnings/errors for Snappier 1.2.0, which has a known high-severity vulnerability: GHSA-pggp-6c3x-2xmx.

• Elsa did not reference Snappier directly; it was introduced transitively through:

  Elsa.Common -> IronCompress 1.7.0 -> Snappier 1.2.0
  

• Elsa now explicitly pins Snappier to 1.3.1, the first patched version.

Notes

• We investigated replacing IronCompress, but it is used by Elsa’s Zstd compression codec.
• Factoring out IronCompress would require changing compression behavior and validating compatibility with already persisted compressed workflow data.
• For a patch release, overriding the vulnerable transitive dependency is the safest and least disruptive fix.

Validation

• Confirmed that dotnet list Elsa.sln package --include-transitive resolves Snappier to 1.3.1.
• Confirmed that NU1903 is no longer reported for Snappier.
• Confirmed that Elsa.Common builds successfully.

Full Changelog: 3.6.1...3.6.2

3.7.0-rc1

Compare: 3.7.0-preview1...3.7.0-rc1

---

✨ New features

Modular server runtime

• Elsa.ModularServer.Web: Integrated Elsa.Workflows.Runtime.Distributed and configured all shells with the core workflow, runtime, management, distributed runtime, and API shell features. (e7eaa4b1fe)

---

🔧 Improvements

• Elsa.ModularServer.Web configuration: Updated the modular server sample configuration to route the default shell at the root path, add HTTP activity base URL settings, and include SQLite identity persistence options. (ad90e81af9)
• Elsa.Http: Declared HttpJavaScriptFeature dependency on JavaScriptFeature so shell feature activation includes the required JavaScript integration first. (ad90e81af9)
• Elsa.Workflows.Management: Registered workflow definition export and file name sanitization services in WorkflowManagementFeature, making exporter services available through shell feature setup. (ad90e81af9)
• Elsa.ModularServer.Web logging: Reduced noisy CShells endpoint registration logs in development configuration. (ad90e81af9)

---

🐛 Fixes

• Elsa.Expressions: Fixed GetFriendlyTypeName for arrays of generic and nested generic types, including multi-dimensional arrays, by resolving array element types before generic formatting. (b88af1e023) (#7400)

---

🧩 Developer-facing changes

• Elsa.Workflows.Management: Shells using WorkflowManagementFeature now receive IWorkflowDefinitionExporter and IFileNameSanitizer registrations by default. (ad90e81af9)
• Elsa.ModularServer.Web: The sample modular server now references Elsa.Http and Elsa.Workflows.Runtime.Distributed, reflecting the expected feature set for distributed runtime and HTTP activity configuration. (e7eaa4b1fe) (ad90e81af9)

---

🧪 Tests

• Added coverage for TypeExtensions.GetFriendlyTypeName, including non-generic types, generic types, arrays of generic types, nested generic arrays, multi-dimensional arrays, and square bracket formatting. (b88af1e023) (#7400)

---

🔁 CI / Build

• Added the Claude Code GitHub Actions workflow, enabling repository maintainers with write access to trigger Claude Code from issue and PR comments. (8ee0b43b34) (#7411)

---

📦 Full changelog (short)

• Integrate Elsa.Workflows.Runtime.Distributed into Elsa.ModularServer.Web and configure shell features for enhanced distributed runtime support. (e7eaa4b1fe)
• Enhance logging configuration, update HttpFeature dependencies, and add new identity persistence options. (ad90e81af9)
• Add Claude Code GitHub Workflow. (8ee0b43b34) (#7411)
• fix: handle arrays of generic types in GetFriendlyTypeName (issue - #7369). (b88af1e023) (#7400)

3.7.0-preview1

Full Changelog: 3.7.0-preview1...3.7.0-preview1

What's Changed

• Improves HTTP context loss error handling by @sfmskywalker in #7187
• Fix spurious duplicate activity registry warnings during startup by @Copilot in #7183
• Improves workflow materializer handling by @sfmskywalker in #7195
• Fix PolymorphicObjectConverter handling of primitive values by @VedikaGupt in #7207
• Propagate exceptions from command handlers correctly by @avin3sh in #7218
• Integrate shells by @sfmskywalker in #7279
• Introduce role and user management services by @sfmskywalker in #7297
• Adds activity execution call stack support by @sfmskywalker in #7271
• Add shell middleware, call‑stack tracking, and workflow reference graph APIs by @sfmskywalker in #7333
• Add shell reload API endpoints and client support by @sfmskywalker in #7353
• refactor: extract shared shell reload response models and address review feedback by @Copilot in #7355
• Isolate background workflow dispatches from caller's cancellation token by @avin3sh in #7291
• Code cleanup and typo fix by @heku in #7393
• Code cleanup by @heku in #7395
• test: refactor with WorkflowTestFixture by @heku in #7394
• refactor | Added a new property to expose the ability to disable the sorting by @ByronMayne in #7360
• Fix BulkDispatchWorkflows sharing input dictionary across dispatches by @avin3sh in #7284
• feat: extend shells integration and modular server support by @sfmskywalker in #7399

New Contributors

• @VedikaGupt made their first contribution in #7207
• @avin3sh made their first contribution in #7218
• @heku made their first contribution in #7393
• @ByronMayne made their first contribution in #7360

Full Changelog: 3.6.1...3.7.0-preview1

3.6.1

What's Changed

• doc: add Elsa 3.6.0 release notes as doc/changelogs/3.6.0.md by @Copilot in #7347
• Add release notes for Elsa 3.6.0 by @Copilot in #7348
• Add workflow export functionality and update changelog by @sfmskywalker in #7357
• fix: decouple background command execution from caller cancellation token (#7224) by @cristiandolf in #7283
• Fix/startuptask activate default tenant when empty by @RalfvandenBurg in #7305
• fix: correct workflow summary pagination by @RalfvandenBurg in #7392
• Fix tenant scope for interrupted workflow restarts by @RalfvandenBurg in #7389

New Contributors

• @cristiandolf made their first contribution in #7283

Full Changelog: 3.6.0...3.6.1

2.16.1

What's Changed

• Fix: Update Swagger support for .NET 10.0 in v2.x to fix runtime exception by @cleftheris in #7377
• fix(eslint): remove eslint from productive dependencies by @marvin-grvn in #7363

New Contributors

• @cleftheris made their first contribution in #7377

Full Changelog: 2.16.0...2.16.1

3.6.0

Elsa 3.6.0 — Release Notes

Compare: 3.5.3...3.6.0

---

⚠️ Breaking changes / upgrade notes

• EF Core package names have changed: EF Core persistence packages were renamed from Elsa.EntityFrameworkCore.* to Elsa.Persistence.EFCore.*. If your application references any of the old package names, you must update them to the new package names when upgrading to 3.6.0. Be sure to review your project files, internal package feeds, CI pipelines, and deployment manifests for old package references.

• Kafka and file storage packages moved to Elsa Extensions: Elsa.Kafka and Elsa.FileStorage no longer ship from elsa-core as of 3.6.0. They were moved to the elsa-extensions repository and renamed as part of the extension package namespace realignment:

  • Elsa.Kafka -> Elsa.ServiceBus.Kafka
  • Elsa.FileStorage -> Elsa.Storage.Files

  When upgrading from 3.5.x, replace the old package references with the new elsa-extensions packages and update namespaces/usings accordingly. Elsa.ServiceBus.Kafka is the Kafka replacement package.

• Scripting package names have changed:

  • Elsa.JavaScript -> Elsa.Expressions.JavaScript
  • Elsa.CSharp -> Elsa.Expressions.CSharp
  • Elsa.Liquid -> Elsa.Expressions.Liquid
  • Elsa.Python -> Elsa.Expressions.Python

• Database migrations (EF Core — all providers): ActivityNodeId columns in ActivityExecutionRecords and WorkflowExecutionLogRecords have been widened to unlimited types (nvarchar(max) / longtext / NCLOB) to support deeply nested workflows. The corresponding B-tree indexes (IX_ActivityExecutionRecord_ActivityNodeId, IX_WorkflowExecutionLogRecord_ActivityNodeId) are dropped as part of the V3_6 migrations. You must apply the EF Core migrations before upgrading to 3.6.0 in any SQL Server, MySQL, or Oracle deployment. (d4b69be44b) (#7338)

• Multitenancy — tenant ID convention change: An empty string ("") is now the canonical default tenant ID for all tenant-aware entities; null now means tenant-agnostic (visible to all tenants). EF Core query filters and the ActivityRegistry have been updated accordingly. If your database contains rows with a null TenantId that were intended to represent the default tenant, migrate those rows to "" before upgrading. The new NormalizeTenantId() extension method on string handles the conversion in code. (#7217, #7226)

• Multitenancy — stored-trigger index updated: Database indexes on stored triggers now include TenantId. The V3_6 migration adds this index; no manual action is required beyond running migrations. (#7217)

• DefaultRegistriesPopulator constructor change: The constructor now requires an additional INotificationSender dependency. If you manually instantiate or override DefaultRegistriesPopulator in tests or custom DI registrations, add the new parameter. Standard DI consumers are unaffected. (#7293)

• Elsa.Common dependency trimmed: The DistributedLock meta-package (which pulled in all provider implementations) has been replaced with DistributedLock.Core. Applications that relied on the transitive provider packages (e.g. DistributedLock.SqlServer) being pulled in via Elsa.Common must add explicit package references. (53245cafbd) (#7169)

---

✨ New features

Activity host registration

• HostMethodActivity / activity hosts: Introduces support for registering CLR types as activity hosts. Public async methods on a registered type are automatically discovered and exposed as individual activities in the workflow designer, enabling code-first activity generation without manual activity boilerplate. New types: HostMethodActivity, HostMethodActivityProvider, IHostMethodActivityDescriber, FromServicesAttribute. (fa04e1ebcd) (#7172)

Workflow dispatch notifications

• Dispatch lifecycle notifications: BackgroundWorkflowDispatcher now emits four new notifications at dispatch time, allowing subscribers to react to durable dispatch scenarios without a custom dispatcher:

  • WorkflowDefinitionDispatching / WorkflowDefinitionDispatched
  • WorkflowInstanceDispatching / WorkflowInstanceDispatched

  (411ca0a332) (#7157)

• WorkflowDefinitionsReloaded notification: DefaultRegistriesPopulator now dispatches a WorkflowDefinitionsReloaded notification after repopulating the workflow definition store, enabling subscriber nodes to synchronize their registries. (f5505d66c9) (#7293)

Consumers API & recursive export

• GET /workflow-definitions/{definitionId}/consumers: New endpoint returns all recursive consuming workflow definitions for a given definition. Built on a new IWorkflowReferenceGraphBuilder / WorkflowReferenceGraph model that replaces the previous ad-hoc recursive query approach. (0a2e99ad42) (#7309)

• Export with transitive consumers: The export endpoint and BulkExportWorkflowDefinitionsRequest now accept an IncludeConsumingWorkflows flag (default false). When enabled, the ZIP export recursively resolves and includes all consuming workflows at their latest version. Exported filenames are now deterministic ({Name}-{DefinitionId}.json). (0a2e99ad42) (#7309)

Default commit strategies

• Global default commit strategies: New WithDefaultWorkflowCommitStrategy() and WithDefaultActivityCommitStrategy() extension methods on the workflows builder let you set application-wide fallback commit strategies. The resolution order for activities is: activity-specific → default activity → workflow-specific → default workflow → no commit. Default strategies are stored separately from the registry so they don't appear in the UI/tooling. (31eff52d24) (#7148)

Multitenancy enhancements

• Null TenantId for tenant-agnostic entities: Entities with a null TenantId are now treated as visible across all tenants. EF Core query filters and ActivityRegistry query methods include null-tenanted records in every tenant's scope. New ActivityDescriptor.TenantId (nullable) property added. (7bc9035f5e) (#7226)

• TenantsOptions.IsEnabled flag: A new IsEnabled property on TenantsOptions allows tenant-specific logic to be conditionally applied. Tenant filters and ActivityRegistry queries now respect this flag. (1b8083a5c6) (#7281)

• Distributed locks for Reload / Refresh: IWorkflowDefinitionsReloader and IWorkflowDefinitionsRefresher are now wrapped with distributed lock decorators to prevent multiple pods from concurrently executing reload or refresh operations. The refresher key incorporates definition IDs to allow concurrent refreshes of different definitions. (689f19f2f2) (#7311)

---

🔧 Improvements

• Elsa.Common — distributed lock resilience: A retry pipeline now wraps distributed lock acquisition and release to survive transient errors (network glitches, database timeouts). A new ITransientExceptionDetector service identifies retryable exceptions. (ca268c16ad) (#7161)

• Tenant task manager with dependency ordering: Tenant startup, background, and recurring task execution is now consolidated into a single TenantTaskManager. A new [TaskDependency] attribute and TopologicalTaskSorter ensure tasks execute in the correct dependency order. (b577279321) (#7174)

• Result class improvements: Result<T> now supports strongly-typed operations and async handlers; IsSuccess is exposed for use in storage drivers and tests. (1b8083a5c6) (#7281)

• HTTP activity — Content-Disposition filename parsing: GetDownloadedFileNameOrDefault now parses the Content-Disposition header (including quoted and extended filenames) before falling back to the URI. (25575e65af)

• HTTP endpoint — graceful JsonException handling: HttpEndpoint.cs now catches JsonException without rethrowin...

3.6.0 RC5

What's Changed

• Expose consumers API and recursive export option by @sfmskywalker in #7309
• Fix cross-tenant cache collision in CachingWorkflowDefinitionService by @Copilot in #7318
• Distributed locks to prevent multiple pods executing Reload and Refresh by @lukhipolito-nexxbiz in #7311
• Add idempotency tests for trigger indexing and fix serialization mismatch in WorkflowTriggerEqualityComparer by @sfmskywalker in #7320
• Fixing workflow reload logic by @lukhipolito-nexxbiz in #7324
• Preserve metadata for unknown activities by @sfmskywalker in #7323

Full Changelog: 3.6.0-rc4...3.6.0-rc5

3.6.0 RC4

What's Changed

• Assign Tenant.AgnosticTenantId in populator by @RalfvandenBurg in #7252
• Update multitenancy logic and improve Result handling: by @sfmskywalker in #7281
• Add Notification Dispatch When Workflow Definitions Are Reloaded by @sfmskywalker in #7293
• Add integration tests for enumerables with projection to arrays by @sfmskywalker in #7290

Full Changelog: 3.6.0-rc3...3.6.0-rc4