Release v1.4.0

EximeeBPMS 1.4.0, Community Edition — released 15 September 2026.

📖 Full release notes · ⬆️ Upgrade guide 1.3 → 1.4 · 🔐 Security notices · 🔗 REST API reference

Highlights

• Business events — the engine publishes domain-level occurrences (task completions, variable changes, incidents, job/batch/external-task lifecycle, user operation log, DMN evaluations, Script Guard violations) through a transactional outbox: the outbox write commits in the same transaction as the change itself, giving at-least-once delivery without coupling the engine's transaction to a downstream system's availability. A Kafka publisher ships with it.
• Script Guard everywhere — enforcement mode, allowlisting, violation persistence and business-event forwarding now work on plain-XML and application-server deployments, not just Spring Boot. Retention cleanup became an engine-native, self-rescheduling job. The rule set is also available as a standalone module (org.eximeebpms.commons:eximeebpms-commons-script-guard-rules) with no engine dependency, so applications can validate scripts before deploying a process definition.
• Selective history exclusion — historyExcludedProcessDefinitionKeys turns history recording off for named process definitions without lowering the history level engine-wide.
• Java 21 baseline, Tomcat 11.0.25, WildFly 41.0.1.Final. JDK 25 is additionally verified in CI.
• Security — six sets of CVE fixes that were open against 1.3.0 are closed, and every remaining Critical/High dependency alert outside webapps is resolved.

⚠️ Breaking changes

Each item's migration is in the upgrade guide; the short form:

Change	What to do
Java 21 is the minimum (was 17)	Move the runtime to 21 before upgrading. Container images and application servers included.
CMMN support removed — case definitions no longer deploy; the 1.3-to-1.4 migration drops CMMN history and definition tables	Complete or terminate every active case instance first. The migration halts before touching the schema if rows remain in ACT_RU_CASE_EXECUTION. Export anything worth keeping.
camunda:caseRef on a call activity is rejected at deploy time	Remove the attribute and redeploy those process definitions before upgrading.
javax namespace dropped — only Jakarta artifacts are built and published	Recompile against jakarta.* and swap every javax-targeted artifact. There is no javax build of this release.
Tomcat 9 and WildFly 26 distributions removed	Upgrade the container first.
Tomcat distribution moves 10.1 → 11.0.25 (Servlet 6.1 / Jakarta EE 11)	Review server.xml/context.xml carried over from 10.1; check filters and container-provided libraries for Servlet 6.1. A WAR deployed to your own Tomcat is not forced onto 11 by this.
Shaded JUEL artifact removed	Depend on the unshaded artifact.
scriptSecurityEnabled → scriptSecurityMode (ENFORCE default, AUDIT, DISABLED)	setScriptSecurityEnabled(false) becomes setScriptSecurityMode("DISABLED"). An unrecognized value now fails startup instead of being ignored. The Spring Boot property name is unchanged.
eximeebpms.bpm.script-security.cleanup-cron removed	Cleanup is now an engine job on a fixed 24-hour interval, gated on retention-days. Drop the property.
Admin-user bootstrap now fails fast when admin-user.id is set alongside SSO or an LDAP-style read-only identity provider	Opt back in deliberately with eximeebpms.bpm.admin-user.allow-with-external-identity-provider=true.
Telemetry/diagnostics field camunda-integration → eximeebpms-integration	Update anything parsing collected diagnostics — dashboards, SIEM pipelines, inventory jobs. The old key is no longer emitted.
MSSQL image → varbinary(max) on three LOB columns	Nothing to plan for: same LOB storage, applied as a metadata-only change (measured at 4 ms on a 1 GB ACT_GE_BYTEARRAY).

Two upgrade traps worth calling out, neither of which fails loudly:

• SLF4J 1.7 → 2.0.19 is a generation change on the logging facade. A 1.7-era binding does not error at startup — SLF4J reports no provider and every log call becomes a no-op. Supply a 2.0-compatible backend (Logback 1.3+, log4j-slf4j2-impl). Spring Boot 4 applications are already on the 2.x line.
• Deprecations for removal in 1.5.0: every camunda-named identifier on the BPMN/DMN Model APIs now has an EximeeBpms-named counterpart and the old name is @Deprecated(forRemoval = true). This release is purely additive — existing code compiles and behaves identically throughout 1.4.x — and the XML wire format is unchanged: the extension namespace URI and attribute names stay, so no .bpmn or .dmn file needs editing. Migration is a mechanical rename, camundaX → eximeeBpmsX.

Where to get it

Maven Central — the consumable libraries and eximeebpms-sql-scripts:

<dependency>
  <groupId>org.eximeebpms.bpm</groupId>
  <artifactId>eximeebpms-engine</artifactId>
  <version>1.4.0</version>
</dependency>

This release page — the three server distributions, as assets:

Distribution	Archives
Tomcat	eximeebpms-bpm-tomcat-1.4.0.tar.gz / .zip
Run (Spring Boot)	eximeebpms-bpm-run-1.4.0.tar.gz / .zip
WildFly	eximeebpms-bpm-wildfly-1.4.0.tar.gz / .zip

New in 1.4.0: the server distributions ship here rather than on Maven Central, which is a dependency-resolution index and not a place anyone resolves a 230 MB application-server install from. eximeebpms-bpm-wildfly is published again for the first time since 1.0.0. Snapshot builds are unaffected and still reach Central's snapshot repository.

Container images — ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.4.0 and :tomcat-1.4.0

Helm chart — eximeebpms 0.4.0 on Artifact Hub

Supply chain

A CycloneDX SBOM is attached in both JSON and XML, each with a detached GPG signature (.asc) and a keyless Sigstore bundle (.sigstore.bundle). Container images are signed keylessly with cosign via GitHub Actions OIDC — the verification command is in the chart repository's README.

---

The complete, commit-level record is in CHANGELOG.md.