Skip to content

Bump Elsa.Workflows.Api from 3.5.3 to 3.7.0 - #7

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/src/BioTrace.Elsa.Abp.AspNetCore/develop/Elsa.Workflows.Api-3.7.0
Closed

Bump Elsa.Workflows.Api from 3.5.3 to 3.7.0#7
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/nuget/src/BioTrace.Elsa.Abp.AspNetCore/develop/Elsa.Workflows.Api-3.7.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown

Updated Elsa.Workflows.Api from 3.5.3 to 3.7.0.

Release notes

Sourced from Elsa.Workflows.Api's releases.

3.7.0

What's Changed

New Contributors

Full Changelog: elsa-workflows/elsa-core@3.6.0...3.7.0

3.7.0-rc1

Compare: 3.7.0-preview1...3.7.0-rc1

✨ New features

Modular server runtime

  • Elsa.ModularServer.Web: Integrated Elsa.Workflows.Runtime.Distributed and configured all shells with the core workflow, runtime, management, distributed runtime, and API shell features. (e7eaa4b1fe)

🔧 Improvements

  • Elsa.ModularServer.Web configuration: Updated the modular server sample configuration to route the default shell at the root path, add HTTP activity base URL settings, and include SQLite identity persistence options. (ad90e81af9)
  • Elsa.Http: Declared HttpJavaScriptFeature dependency on JavaScriptFeature so shell feature activation includes the required JavaScript integration first. (ad90e81af9)
  • Elsa.Workflows.Management: Registered workflow definition export and file name sanitization services in WorkflowManagementFeature, making exporter services available through shell feature setup. (ad90e81af9)
  • Elsa.ModularServer.Web logging: Reduced noisy CShells endpoint registration logs in development configuration. (ad90e81af9)

🐛 Fixes

  • Elsa.Expressions: Fixed GetFriendlyTypeName for arrays of generic and nested generic types, including multi-dimensional arrays, by resolving array element types before generic formatting. (b88af1e023) (#​7400)

🧩 Developer-facing changes

  • Elsa.Workflows.Management: Shells using WorkflowManagementFeature now receive IWorkflowDefinitionExporter and IFileNameSanitizer registrations by default. (ad90e81af9)
  • Elsa.ModularServer.Web: The sample modular server now references Elsa.Http and Elsa.Workflows.Runtime.Distributed, reflecting the expected feature set for distributed runtime and HTTP activity configuration. (e7eaa4b1fe) (ad90e81af9)

🧪 Tests

  • Added coverage for TypeExtensions.GetFriendlyTypeName, including non-generic types, generic types, arrays of generic types, nested generic arrays, multi-dimensional arrays, and square bracket formatting. (b88af1e023) (#​7400)

🔁 CI / Build

  • Added the Claude Code GitHub Actions workflow, enabling repository maintainers with write access to trigger Claude Code from issue and PR comments. (8ee0b43b34) (#​7411)

📦 Full changelog (short)

  • Integrate Elsa.Workflows.Runtime.Distributed into Elsa.ModularServer.Web and configure shell features for enhanced distributed runtime support. (e7eaa4b1fe)
  • Enhance logging configuration, update HttpFeature dependencies, and add new identity persistence options. (ad90e81af9)
    ... (truncated)

3.7.0-preview1

Full Changelog: elsa-workflows/elsa-core@3.7.0-preview1...3.7.0-preview1

What's Changed

New Contributors

Full Changelog: elsa-workflows/elsa-core@3.6.1...3.7.0-preview1

3.6.2

Elsa 3.6.2 is a patch release that addresses a NuGet security warning caused by a vulnerable transitive dependency.

Security

  • Fixed NU1903 warnings/errors for Snappier 1.2.0, which has a known high-severity vulnerability: GHSA-pggp-6c3x-2xmx.

  • Elsa did not reference Snappier directly; it was introduced transitively through:

    Elsa.Common -> IronCompress 1.7.0 -> Snappier 1.2.0

  • Elsa now explicitly pins Snappier to 1.3.1, the first patched version.

Notes

  • We investigated replacing IronCompress, but it is used by Elsa’s Zstd compression codec.
  • Factoring out IronCompress would require changing compression behavior and validating compatibility with already persisted compressed workflow data.
  • For a patch release, overriding the vulnerable transitive dependency is the safest and least disruptive fix.

Validation

  • Confirmed that dotnet list Elsa.sln package --include-transitive resolves Snappier to 1.3.1.
  • Confirmed that NU1903 is no longer reported for Snappier.
  • Confirmed that Elsa.Common builds successfully.

Full Changelog: elsa-workflows/elsa-core@3.6.1...3.6.2

3.6.1

What's Changed

New Contributors

Full Changelog: elsa-workflows/elsa-core@3.6.0...3.6.1

3.6.0

Elsa 3.6.0 — Release Notes

Compare: 3.5.3...3.6.0

⚠️ Breaking changes / upgrade notes

  • EF Core package names have changed: EF Core persistence packages were renamed from Elsa.EntityFrameworkCore.* to Elsa.Persistence.EFCore.*. If your application references any of the old package names, you must update them to the new package names when upgrading to 3.6.0. Be sure to review your project files, internal package feeds, CI pipelines, and deployment manifests for old package references.

  • Kafka and file storage packages moved to Elsa Extensions: Elsa.Kafka and Elsa.FileStorage no longer ship from elsa-core as of 3.6.0. They were moved to the elsa-extensions repository and renamed as part of the extension package namespace realignment:

    • Elsa.Kafka -> Elsa.ServiceBus.Kafka
    • Elsa.FileStorage -> Elsa.Storage.Files

    When upgrading from 3.5.x, replace the old package references with the new elsa-extensions packages and update namespaces/usings accordingly. Elsa.ServiceBus.Kafka is the Kafka replacement package.

  • Scripting package names have changed:

    • Elsa.JavaScript -> Elsa.Expressions.JavaScript
    • Elsa.CSharp -> Elsa.Expressions.CSharp
    • Elsa.Liquid -> Elsa.Expressions.Liquid
    • Elsa.Python -> Elsa.Expressions.Python

  • Database migrations (EF Core — all providers): ActivityNodeId columns in ActivityExecutionRecords and WorkflowExecutionLogRecords have been widened to unlimited types (nvarchar(max) / longtext / NCLOB) to support deeply nested workflows. The corresponding B-tree indexes (IX_ActivityExecutionRecord_ActivityNodeId, IX_WorkflowExecutionLogRecord_ActivityNodeId) are dropped as part of the V3_6 migrations. You must apply the EF Core migrations before upgrading to 3.6.0 in any SQL Server, MySQL, or Oracle deployment. (d4b69be44b) (#​7338)

  • Multitenancy — tenant ID convention change: An empty string ("") is now the canonical default tenant ID for all tenant-aware entities; null now means tenant-agnostic (visible to all tenants). EF Core query filters and the ActivityRegistry have been updated accordingly. If your database contains rows with a null TenantId that were intended to represent the default tenant, migrate those rows to "" before upgrading. The new NormalizeTenantId() extension method on string handles the conversion in code. (#​7217, #​7226)

  • Multitenancy — stored-trigger index updated: Database indexes on stored triggers now include TenantId. The V3_6 migration adds this index; no manual action is required beyond running migrations. (#​7217)

  • DefaultRegistriesPopulator constructor change: The constructor now requires an additional INotificationSender dependency. If you manually instantiate or override DefaultRegistriesPopulator in tests or custom DI registrations, add the new parameter. Standard DI consumers are unaffected. (#​7293)

  • Elsa.Common dependency trimmed: The DistributedLock meta-package (which pulled in all provider implementations) has been replaced with DistributedLock.Core. Applications that relied on the transitive provider packages (e.g. DistributedLock.SqlServer) being pulled in via Elsa.Common must add explicit package references. (53245cafbd) (#​7169)

✨ New features

Activity host registration

  • HostMethodActivity / activity hosts: Introduces support for registering CLR types as activity hosts. Public async methods on a registered type are automatically discovered and exposed as individual activities in the workflow designer, enabling code-first activity generation without manual activity boilerplate. New types: HostMethodActivity, HostMethodActivityProvider, IHostMethodActivityDescriber, FromServicesAttribute. (fa04e1ebcd) (#​7172)

Workflow dispatch notifications

  • Dispatch lifecycle notifications: BackgroundWorkflowDispatcher now emits four new notifications at dispatch time, allowing subscribers to react to durable dispatch scenarios without a custom dispatcher:

    • WorkflowDefinitionDispatching / WorkflowDefinitionDispatched
    • WorkflowInstanceDispatching / WorkflowInstanceDispatched

    (411ca0a332) (#​7157)

  • WorkflowDefinitionsReloaded notification: DefaultRegistriesPopulator now dispatches a WorkflowDefinitionsReloaded notification after repopulating the workflow definition store, enabling subscriber nodes to synchronize their registries. (f5505d66c9) (#​7293)

... (truncated)

3.6.0-rc5

What's Changed

Full Changelog: elsa-workflows/elsa-core@3.6.0-rc4...3.6.0-rc5

3.6.0-rc4

What's Changed

Full Changelog: elsa-workflows/elsa-core@3.6.0-rc3...3.6.0-rc4

3.6.0-rc3

Compare: 3.6.0-rc2...3.6.0-rc3

This release candidate includes significant multitenancy improvements, bug fixes, and enhanced test coverage.

⚠️ Breaking changes / upgrade notes

Multitenancy Tenant ID Convention Changes

Affected users: Applications using multitenancy features, especially those with existing tenant data.

What changed:

  • Default tenant ID convention: The default tenant now uses an empty string ("") instead of null (ADR-0008). (b09a56481) (#​7217)
  • Tenant-agnostic entity convention: Tenant-agnostic entities (visible to all tenants) now use asterisk ("*") as the sentinel value instead of null (ADR-0009). (7bc9035f5) (#​7226)
  • Database schema impact: Database indexes on the Triggers table now include TenantId in unique constraints across all EF Core providers. (b09a56481) (#​7217)

Migration required:

  • Convert existing null TenantId values to empty strings for default tenant data in WorkflowDefinitions, WorkflowInstances, and runtime entities.
  • Review ADR-0008 (Default Tenant ID) and ADR-0009 (Tenant-Agnostic Entities) in doc/adr/ for detailed rationale and migration guidance.

Query filter changes: EF Core query filters have been updated to handle the new tenant ID conventions, ensuring tenant isolation is properly maintained. (7bc9035f5) (#​7226)

✨ New features

Multitenancy enhancements

  • Configuration-based multitenancy: Introduced configuration-based tenant provider to streamline tenant initialization and customization. (b09a56481) (#​7217)
  • Tenant-agnostic workflow support: Workflows and activities can now be marked as tenant-agnostic (using "*" as tenant ID) to make them accessible across all tenants. (7bc9035f5) (#​7226)
  • Selective lock mocking in tests: Added SelectiveMockLockProvider for precise lock mocking in tests without affecting unrelated background operations. (b09a56481) (#​7217)

🔧 Improvements

Multitenancy

  • Tenant filtering in workflow store populator: Added tenant-specific filtering in DefaultWorkflowDefinitionStorePopulator to ensure workflows are only loaded for the current tenant. (b09a56481) (#​7217)
  • Tenant isolation in activity provider: Enforced tenant isolation in WorkflowDefinitionActivityProvider and included tenant ID in activity type names for better separation. (558902bb7)
  • Optimized activity registry: Improved ActivityRegistry.Find to prefer tenant-specific descriptors over tenant-agnostic ones with single-pass iteration for better performance. (7bc9035f5) (#​7226)
  • Tenant headers support: Added tenant headers support to BackgroundWorkflowCancellationDispatcher for proper tenant context propagation during workflow cancellation. (bc70beff1) (#​7040)

API improvements

  • Labels endpoints migration: Updated Labels endpoints to use ElsaEndpoint base class with standardized permission configuration. (72569702f) (#​7205)

Error handling

... (truncated)

3.6.0-rc2

Compare: 3.6.0-rc1...3.6.0-rc2

⚠️ Breaking changes / upgrade notes

  • CI / SDK: GitHub workflow now uses .NET SDK 10.x (was 9.x). (b22956c792) (fa2254f41b) (72597f733f)
  • Bookmarks model change: Bookmark moved from a positional record to a mutable class (serialization/back-compat oriented). (ca268c16ad) (#​7161)
  • DistributedLock package: Elsa.Common now references DistributedLock.Core instead of DistributedLock. (#​7169)

✨ New features

Activity hosts / host-method activities

  • Introduced host-method activities: expose public methods on configured CLR types as workflow activities. (#​7172)
    • Parameter binding extensibility (e.g. DI-backed parameters using [FromServices]). (#​7172)
  • Added a sample activity host (Penguin) and registered it in Elsa.Server.Web. (#​7172)

Commit strategies (defaults)

  • Added support for global default commit strategies (fallback when no explicit strategy is configured). (#​7148)

Resilience / transient exception detection

  • Added transient exception detection infrastructure and registration. (ca268c16ad) (#​7161)

Workflow dispatch notifications

  • Added new notifications emitted by the background dispatcher. (#​7157)

Tenant task lifecycle & dependencies

  • Introduced TenantTaskManager and dependency ordering support ([TaskDependency], TopologicalTaskSorter). (#​7174)

🔧 Improvements

  • Distributed runtime lock resilience: Polly retry around distributed lock acquisition (with transient exception detection), and safer lock release behavior. (#​7161)
  • Mediator background services: improved cancellation handling to avoid noisy failures. (ca268c16ad) (#​7161)
  • Xunit logging: suppress “no currently active test” errors from late background log writes. (ca268c16ad) (#​7161)
  • Small cleanups:
    • Make correlationId parameter non-optional in WorkflowExecutionContext constructor. (fa798b0a47)
    • Remove unused ClearCompletionCallbacks from WorkflowExecutionContext. (79a64e90fd)

🐛 Fixes

  • Literal inputs: ActivityExecutionContext.TryGet(...) correctly handles Literal references by returning the literal’s value directly. (#​7075)

🧩 Developer-facing changes

  • Attribute usage expanded:
    • ActivityAttribute: now valid on classes, interfaces, and methods. (3778a14e54)
    • InputAttribute: now valid on properties and parameters. (3778a14e54)
    • OutputAttribute: now valid on properties, classes, methods, and return values. (3778a14e54)

🧪 Tests

  • Added/expanded coverage for:
    • Host method activity registration & descriptor behavior. (#​7172)
    • Distributed lock resilience (acquisition retries + release failure behavior). (#​7161)
    • Literal input handling. (#​7075)
    • Default workflow/activity commit strategy behavior. (#​7148)
    • Workflow dispatch notifications. (#​7157)
    • Tenant task dependency ordering / topological sorting. (#​7174)
      ... (truncated)

3.6.0-rc1

Elsa Workflows 3.6.0 RC1

This release focuses on Flowchart execution improvements, stronger runtime correctness, major test coverage expansion, reliability fixes for scheduling/triggers and HTTP content handling, and a platform upgrade to .NET 10 while retaining support for .NET 8 and .NET 9.

Highlights

  • Token-centric Flowchart execution model with configurable MergeMode, plus multiple refinements and DI-based configuration (opt-in). See Flowchart: token-based execution + per-activity MergeMode. (PRs: #​6632, #​6937, #​6993, #​7141)
  • Upgrade to .NET 10 across the solution (with conditional compatibility dependencies where needed). (PR: #​7062)
  • New Activity Testing API and a major expansion of unit/integration/component test coverage across core activities, scheduling, HTTP endpoints, JavaScript, and flowchart execution. (PR: #​6719 and many follow-ups)
  • Improved runtime observability & execution record serialization, including snapshots and a new ActivityCompleted notification. (PRs: #​6675, #​6800, #​6807)
  • Reliability fixes across triggers/scheduling and HTTP content handling (cron delay edge cases, multi-engine trigger registration, Content-Length / charset issues). (PRs: #​7047, #​7131, #​6676, #​7027)

Flowchart: token-based execution + per-activity MergeMode (opt-in)

Elsa 3.6.0 introduces an optional token-based execution algorithm for the Flowchart activity. Instead of relying on the previous counter-based scheduling model, the Flowchart can now track progress using tokens that represent a taken connection (from a source activity outcome to a target activity).

When an activity completes, the flowchart:

  • Emits tokens for each taken outbound connection (based on the activity’s outcome names).
  • Consumes inbound tokens that were waiting for the completed activity.
  • Schedules downstream activities based on each target activity’s MergeMode.

New: MergeMode (configurable per activity)

With token-based execution enabled, Flowchart supports a new MergeMode concept that determines how a node behaves when it has multiple inbound connections. You can now specify a merge mode per activity, allowing different “join” semantics within the same flowchart.

In broad terms, merge modes enable behaviors like:

  • Stream-like behavior: proceeds without strict joining, helping avoid dead-path waiting.
  • Forward-join behavior (Merge): waits for tokens from all forward inbound connections (loop/back edges don’t block).
  • Strict join behavior (Converge): waits for tokens from all inbound connections, including loop/back edges.
  • First-arrival behavior (Cascade / Race): schedules on the first arriving inbound token; in Race mode, other inbound ancestors are canceled so only the “winning” path continues.

This improves predictability for joins, forks, and cyclic graphs, while giving you fine-grained control over how each activity merges incoming paths.

How to opt in (Program.cs)

Token-based Flowchart execution is opt-in. Enable it via the Flowchart feature configuration:

elsa.UseFlowchart(flowchart => flowchart.UseTokenBasedExecution())

Breaking / Upgrading Notes

These are the changes most likely to affect upgrades from 3.5.x.

1) Multi-targeting: .NET 8, .NET 9, and .NET 10

Elsa 3.6.0 multi-targets .NET 8, .NET 9, and .NET 10.

  • Most consumers can continue targeting .NET 8 or .NET 9.
    ... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump Elsa.Workflows.Api from 3.5.3 to 3.7.0
ff070b6 
---
updated-dependencies:
- dependency-name: Elsa.Workflows.Api
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/nuget/src/BioTrace.Elsa.Abp.AspNetCore/develop/Elsa.Workflows.Api-3.7.0 branch June 11, 2026 07:45
@SamTangJunwen SamTangJunwen mentioned this pull request Jun 15, 2026
Merged
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SamTangJunwen