10.3.0

WorkflowGen 10.3.0 Preview

WorkflowGen 10.3.0 Preview introduces two major integration updates: the new WorkflowGen MCP Server preview for AI agent-assisted workflow operations, and SMTP OAuth 2.0 delivery for Microsoft 365 / Exchange Online. This release also includes targeted portal, workflow designer, packaging, and deployment improvements.

WorkflowGen MCP Server Preview

WorkflowGen now includes a preview MCP Server that lets compatible MCP clients, including Claude Cowork and Codex, connect to WorkflowGen through the MCP Streamable HTTP transport. The MCP Server is installed as a Node.js/iisnode application under \wfgen\mcp and is exposed by default at:

https://<workflowgen-url>/wfgen/mcp

The MCP Server uses OAuth-based client authentication with dynamic client registration, authorization code with PKCE, refresh token rotation, token revocation, durable OAuth storage, and scope-based authorization. Administrators can configure the server from Administration > Configuration > Integration > MCP Server, including OAuth server enablement, key and secret management, MCP resource URI, allowed scopes, and diagnostic log level.

This preview exposes MCP tools for common WorkflowGen operations, including requests, actions, datasets, comments, processes, launchable processes, viewer context, favorites, delegations, users, groups, participants, process definitions, applications, categories, folders, and global lists. Tool discovery is filtered by the approved OAuth scopes: mcp:read, mcp:write, mcp:process_admin, and mcp:admin.

MCP browser login requires WorkflowGen to be configured with OIDC or SAML authentication. Other WorkflowGen authentication modes are not supported as MCP OAuth browser login sources in this preview.

For setup instructions, see Getting started with WorkflowGen MCP Server preview.

MCP Packaging And Upgrade Notes

The MCP Server is included in the manual and update packages. New installations receive the required MCP application files automatically, while upgrades include the files needed to add MCP to an existing WorkflowGen environment.

For manual installations, the package installs a usable \wfgen\mcp\web.config.

For upgrades, the update package provides \wfgen\mcp\web.config.sample so an existing MCP IIS/iisnode configuration is not overwritten. For first-time MCP enablement from an update package, copy or rename this file to web.config; if web.config already exists, compare and merge the sample changes.

SMTP OAuth 2.0 For Microsoft 365 / Exchange Online

WorkflowGen now supports SMTP server (OAuth 2.0) as an email delivery mode for Microsoft 365 / Exchange Online. This lets WorkflowGen send notifications, forgot password emails, and SMTP test messages through Exchange Online using OAuth 2.0 client credentials instead of basic SMTP authentication.

The Configuration Panel includes the required SMTP OAuth 2.0 fields, validation, localized labels, and SMTP test behavior. The mail delivery implementation includes OAuth token caching, timeout handling, trace diagnostics, and safer handling of token request failures and SMTP sender information.

This feature targets Microsoft 365 / Exchange Online. Generic SMTP OAuth providers and Google Workspace-specific OAuth support are not included in this release.

Portal

• Bug (#4702): Preserved process folder manager precedence when checking request cancellation rights.

• Bug (#4704): Preserved the superuser context when redirecting from supervisor widgets.

Workflow Designer

• Bug (#4696): Increased the workflow designer double-click timing window to improve reliability when opening designer elements.

Notes

• All WorkflowGen Node.js applications require Node.js 22.22.2 LTS.

• For background on earlier WorkflowGen 10 updates, refer to the WorkflowGen v10 Official (10.0.3), WorkflowGen 10.1.0, WorkflowGen 10.2.0, WorkflowGen 10.2.1, and WorkflowGen 10.2.2 release notes.

10.2.2

WorkflowGen 10.2.2

This release includes bug fixes, security cleanup, and administration and workflow application improvements for WorkflowGen 10.2.

Security

• Bug (#4510): Removed obsolete legacy client-side scripts from the Administration and Portal web assets.

Portal

• Bug (#4678): Fixed inconsistent fr-CH currency formatting and validation for plain currency amounts in form data, read-only redisplay, server validation, save parsing, GridView parsing, and generated computed or mutation currency formatting paths.

Administration

• Improvement (#3340): Added separate CSV delimiter settings for report exports and global list CSV import/export, allowing report delimiter behavior to remain locale-aware while global list CSV files use an explicit administration setting.

• Bug (#4622): Stabilized priority arrow moves in administration lists when the list is sorted in a non-default order by posting and resolving stable entity IDs instead of relying only on display-order row positions.

Directory Synchronization

• Bug (#4674): Fixed PostgreSQL directory synchronization failures in update mode by matching synchronized user and group update columns case-insensitively, preventing empty SQL SET clauses when Npgsql returns lowercase column names.

Workflow Applications

• Bug (#4666): Added explicit __INTEGER and __BOOLEAN suffix support to RESTAPICLIENT JSON payload generation so strict APIs can receive integer and boolean JSON tokens instead of floating-point or string values.

• Bug (#4677): Improved RESTAPICLIENT multipart uploads to infer a file part MIME type from the upload filename when the stored source content type is empty or generic (application/octet-stream), while preserving explicit source MIME values.

Repository

• Update (#4638): Added agent-first repository guidance and supporting packaging exclusions so repository-only agent documentation is available without being included in install packages.

Notes

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3), WorkflowGen 10.1.0, WorkflowGen 10.2.0, and WorkflowGen 10.2.1 release notes.

10.2.1

WorkflowGen 10.2.1

This release includes bug fixes, security improvements, PostgreSQL compatibility fixes, and a Node.js platform support update.

Important

• Node.js 22.22.2 LTS security release (March 24, 2026)

Security

• Bug (#4648, #4645): Added missing CSRF token validation on administration forms.

Portal

• Bug (#4650): Improved the application-start data lock feedback page with clearer messaging and data grouped by user and unlock time.

• Bug (#4618): Fixed an issue where UpdateView access validation was performed inside the database transaction instead of before it, improving resource usage for unauthorized requests.

Administration

• Bug (#4665): Fixed swapped directory count aliases where user counts displayed group counts and vice versa.

• Bug (#4664): Removed unused directory detail count queries that were fetching data no longer displayed.

• Bug (#4620): Restored directory reorder arrows that were not functioning due to outdated DOM access patterns.

Workflow Designer

• Bug (#4626): Improved the SetXpdl method to avoid fetching the full XPDL column unnecessarily, reducing overhead on process saves.

• Bug (#4611): Fixed a PostgreSQL compatibility issue where table-qualified column names in UPDATE SET clauses caused errors when renaming form field parameters.

• Bug (#4642): Replaced hardcoded SQL Server DATEADD with a database-native token expiry query in the forgot password flow, enabling proper PostgreSQL and Oracle support.

Node.js Apps

• Update (#4654): Updated supported and pinned Node.js runtime references to 22.22.2 LTS in the WorkflowGen Node.js modules, CI configuration, Docker images, and PowerShell setup tooling (v2.0.13).

Notes

• All Node.js modules (GraphQL v5.4.2, Webhooks v6.3.2, Auth v3.3.2, and SCIM v3.3.2) now require Node.js 22.22.2 LTS.

• Production dependency updates were applied across the Node.js modules to address current security advisories.

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3), WorkflowGen 10.1.0, and WorkflowGen 10.2.0 release notes.

10.2.0

WorkflowGen 10.2.0

This release includes new features, improvements, bug fixes, and security updates for the User Portal, Administration Module, AI and embeddings, workflow applications, PostgreSQL compatibility, and Node.js modules.

Important

• Node.js Security Update - qs DoS vulnerability (CVE-2026-2391)
• Node.js Security Update - express-rate-limit bypass vulnerability (CVE-2026-30827)

Security

• Bug (#4509): Hardened the Administration Module with CSRF token validation on all mutation endpoints (save, delete, update operations), preventing potential cross-site request forgery attacks.

• Bug (#4591): Fixed a SQL query parameter validation issue in the portal comments module.

• Bug (#4587): Fixed a SQL query parameter validation issue in the administration process management module.

• Bug (#4589): Fixed a potential deadlock in OPENAICHAT HTTP requests under concurrent load.

Portal

• New Feature (#4525): Enhanced self-service (PULL) action assignment to automatically manage data filter access when actions are assigned, ensuring the assigned user can always access the action.

• Improvement (#4524): The full-width display mode preference is now stored server-side and syncs across all browsers and devices. New users default to full-width mode.

• Bug (#4541): Fixed an issue on PostgreSQL where saving a search view without a process filter failed due to a foreign key constraint violation. Also cleans up invalid sentinel values on SQL Server.

• Bug (#4533): Fixed an issue where saving user settings from the standard search results view crashed with a JavaScript error.

• Bug (#4530): Fixed an issue on PostgreSQL where comments and favorites queries failed due to SELECT TOP syntax not being converted to LIMIT, causing a syntax error on the User Portal welcome page and paginated lists.

• Bug (#4529): Fixed an issue where the default homepage preference could save an invalid value when the custom view dropdown had not finished loading.

• Bug (#4522): Fixed a regression introduced in version 9.2.0 where the advanced search grid could display a blank page when handling many results, due to a missing null check on the grid container element.

• Bug (#4513): Fixed a regression introduced in version 9.2.7 where error messages in the action follow-up form were displayed with encoded HTML entities due to double HTML encoding.

Administration

• New Feature (#4566): Added Anthropic, Mistral AI, and Google Gemini API settings to the Configuration panel Applications tab, following the same pattern as the existing OpenAI section. Each provider's section includes API key and API URL fields. The ExtractTextLogLevel setting has also been added to the tab.

• New Feature (#4456): Added a new AI configuration tab to the Configuration panel with an Embeddings section exposing all 16 embedding/chunk settings (API provider, endpoint, authentication, model, dimensions, batch size, chunk size, etc.) and an Embedding status section showing chunk counts, pending/failed status, and last 10 errors. The tab also includes the PostgreSqlTextSearchLanguage setting.

• New Feature (#4408): Added an Apply to all form activities checkbox in the Form Designer (VALUE IN/OUT panels) and Workflow Designer (Edit parameter panel), enabling mass propagation of data mappings across all EFORMASPX activities in a process.

• Improvement (#4411): Added a Token usage section to the AI configuration tab displaying total API tokens consumed and a per-process breakdown table with chunk and token counts.

• Improvement (#4410): Added Advanced search and Visibility columns to the process data list. Advanced search shows Indexing and Similarity tags when enabled; Visibility shows follow-up, search, lists, and home page tags.

• Improvement (#4540): Admin slide-in panels are now resizable in width with a draggable handle on the left edge. Panel width preference is persisted per user in localStorage. Table columns in the Edit action panel adapt proportionally to the panel width.

• Improvement (#4446): Improved the mapping editor UI with increased content area height, better dropdown positioning to prevent clipping, and normalized line-height for consistent rendering across macOS and Windows.

• Improvement (#4521): Widened the process and participant columns in the user activity report, with columns that expand to fit content and a horizontal scrollbar when needed.

• Improvement (#4519): Restored keyboard navigation in dropdown lists, allowing users to cycle through matching items by pressing the same letter key repeatedly and continuing from the current position after arrow-key navigation.

• Improvement (#4520, #4447): Improved dropdown auto-scrolling in action parameter data OUT, theme selection, and startup page dropdowns to ensure all options are visible when opened.

• Bug (#4535): Fixed an issue where navigating to a non-existent process in admin pages crashed with an unhandled .NET exception instead of displaying a managed error page.

• Bug (#4539): Fixed an issue on PostgreSQL where the user activity report failed with a type mismatch error when the user belongs to groups, due to group ID parameters being passed as strings instead of integers.

• Bug (#4450): Fixed an issue where the Neo style Form Designer could not display or resize fields wider than the viewport, by synchronizing the --content-width CSS variable with jQuery width changes and enabling horizontal scrolling.

Workflow Engine

• New Feature (#4552): Added support for XML, HTML, and Markdown file content extraction for embedding generation. XML uses secure parsing with DTD/XXE prevention; HTML uses HtmlAgilityPack for tag stripping and entity decoding; Markdown is preserved as-is.

• New Feature (#4554): Improved embedding quality with controlled normalization for extracted text. XML extraction now outputs structured elementName: value lines instead of concatenated text. HTML extraction preserves document structure with markdown-style headings, pipe-delimited tables, and form element values. Includes 65 unit tests.

• Bug (#4555): Fixed an issue on PostgreSQL where embedding generation for PDF attachments failed due to null bytes in extracted text, which PostgreSQL's TEXT type rejects. Null bytes are now stripped at the database boundary.

Workflow Applications

• New Feature (#4511): Enhanced OPENAICHAT with native multi-provider support for Anthropic Claude, Mistral AI, and Google Gemini. The provider is auto-detected from the API URL or can be set explicitly via the new PROVIDER parameter. Each provider has dedicated API key and URL configuration in the web.config file.

• New Feature (#4517): Added audio, document, and file input support to OPENAICHAT with new USER_AUDIO, USER_DOCUMENT_URL, USER_FILE_ID, and USER_FILE parameters, including indexed variants for multi-modal content. Supports provider-specific formats across OpenAI, Mistral, Gemini, and Anthropic.

• New Feature (#4552): Enhanced EXTRACTTEXT with support for XML, HTML, and Markdown file content extraction, with configurable ExtractTextLogLevel logging.

• Improvement (#4550): The MAX_TOKENS parameter in OPENAICHAT is now optional. When not set or set to 0, the AI provider's default token limit is used instead of forcing 256 tokens. The Anthropic fallback default has been increased from 256 to 4096 tokens.

• Bug (#4593): Fixed an issue where OPENAICHAT requests with extended thinking or high reasoning effort could time out prematurely due to an insufficient default HTTP timeout.

Node.js Apps

• Update (#4557): Updated qs dependency override to >=6.14.2 across all Node.js modules to address a DoS vulnerability (CVE-2026-2391).

• Update (#4599): Updated express-rate-limit to 8.0.2+ in the Auth and Hooks modules to fix a rate-limiting bypass vulnerability (CVE-2026-30827).

Infrastructure

• Bug (#4561): Migrated Docker Linux SQL Server image from Ubuntu 22.04 to 24.04 to align with Microsoft's updated mssql/server:2025-latest base image. Base image pinned to 2025-CU2-ubuntu-24.04 for build reproducibility.

Dependencies

• Update (#4559): Updated .NET NuGet packages: PdfPig 0.1.10 → 0.1.13, Npgsql 8.0.7 → 8.0.8, DocumentFormat.OpenXml 3.3.0 → 3.4.1, DocuSign.eSign.dll 8.4.0 → 8.6.0, BouncyCastle.Cryptography 2.4.0 → 2.6.2, EWSoftware.SHFB 2025.12.18 → 2026.1.20, Obfuscar 2.2.29 → 2.2.50.

Notes

• Node.js modules updated: GraphQL v5.4.1, Webhooks v6.3.1, Auth v3.3.1, and SCIM v3.3.1 (all require Node.js 22.22.0 LTS).

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3) and WorkflowGen 10.1.0 release notes.

10.1.0

WorkflowGen 10.1.0

This release includes bug fixes, new features, and updates improving the User Portal, Administration Module, Workflow Applications, PostgreSQL compatibility, and Node.js modules.

Important

• Node.js Security Update - (Tuesday, January 13, 2026 Security Releases)

Portal

• New Feature (#4405): Added semantic search columns (Rank, Match, Data, Similarity) displaying search ranking and match mode in portal search results.

• Bug (#4481): Fixed an issue where standard search data columns were not sortable, ensuring proper data sorting in search results.

• Bug (#4464): Fixed an issue where styles were leaking into XLSX and XLS exports from search results, ensuring clean Excel file output.

• Bug (#4478): Fixed an issue where delegations with "All processes" and "All participants" were not displaying in the portal delegation list.

• Bug (#4486): Fixed an issue in PostgreSQL where semantic search ranking and filtering was incorrect, ensuring proper search result ordering.

Administration

• New Feature (#4434): Added Neo+ form style to the Form Designer with an option to automatically manage form header and footer width, improving layout consistency and responsiveness.

• Bug (#4476): Fixed an issue where folder managers were unable to access the administration portal due to dashboard resizing logic.

• Bug (#4484): Fixed an issue where the process version became invalid when importing a process on top of an existing one.

• Bug (#4498): Fixed a regression introduced in version 9.3.0 where file handling for uploaded content in process data was causing files to be saved as 0KB, ensuring proper stream handling and content length validation.

• Bug (#4459): Fixed an issue where additional notification recipient email addresses were incorrectly encoded, ensuring proper email address handling in process notifications.

• Bug (#4494): Fixed an issue in PostgreSQL where counter renaming was not working correctly, ensuring proper counter management in process definitions.

• Bug (#4488): Fixed an issue where code-behind calling PostgreSQL database was failing due to missing assembly references, ensuring proper web.config configuration for PostgreSQL connectivity.

Workflow Engine

• Bug (#4460): Fixed an issue in PostgreSQL where additional notification recipients were being ignored, ensuring proper handling of notification configurations.

Security

• Bug (#4468): Fixed a security issue where self-service action assignment validation could be bypassed.

Workflow Applications

• New Feature (#4492): Enhanced RESTAPICLIENT with multipart/form-data file upload support and binary file download support (PDF, images, ZIP, etc.), including new parameters APP_FORMFILE_xxx, APP_FORMDATA_xxx, and APP_RESPONSE_CONTENT_FILENAME.

• New Feature (#4491): Enhanced OPENAICHAT workflow application with improved AI token management, including support for MAX_COMPLETION_TOKENS and REASONING_EFFORT parameters, and detailed token usage reporting.

Web Forms

• New Feature (#4474): Added single digit padding option for date and time fields in web forms.

Node.js Apps

• Update (#4470, #4444): Updated Node.js to version 22.22.0 LTS and dependencies to address security vulnerabilities (https://nodejs.org/en/blog/vulnerability/december-2025-security-releases).

• Improvement (#4469): Enhanced file upload error handling in the Webhooks module's processUpload function, improving reliability and error reporting.

• Bug (#4452): Fixed an issue where Node.js apps failed with "Unable to find .Net Framework Data Provider" error for PostgreSQL, ensuring proper assembly resolution for database connectivity.

Style

• Improvement (#4501): Updated Neo class names and hover styles for improved UI consistency.

• Improvement (#4377): Normalized CSS zero values (0px → 0) across stylesheets.

Infrastructure

• Update (#4442): Updated Docker images to support SQL Server 2025 GA release.

General

• Update (#4445): Updated JavaScript library dependencies.

Notes

• All Node.js modules (GraphQL v5.4.0, Webhooks v6.3.0, Auth v3.3.0, and SCIM v3.3.0) now require Node.js 22.22.0 LTS.

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3) release notes.

10.0.5

WorkflowGen 10.0.5

This release includes several bug fixes and improvements enhancing the User Portal, Administration Module, Engine, and Workflow Apps.

Portal

• Improvement (#4407): Added the version number to the delegation's process selection drop-down list to improve visibility and tracking of delegation information.

• Bug (#4422): Fixed an exception error in Semantic Search with null rows in PostgreSQL, ensuring proper handling in semantic search operations.

• Bug (#4430): Fixed an issue in Semantic Search where users were unable to use more than one keyword without specifying the operator in PostgreSQL, improving search flexibility. For search query syntax help, see the User Portal Guide - Search form - Query section.

• Bug (#4425): Resolved an issue where delegations were being duplicated in the UI, ensuring proper delegation management.

• Bug (#4417): Fixed an issue in the User Portal where the automatic switch to single-process mode was not working as intended in single-process scenarios, ensuring proper functionality.

Administration

• Bug (#4437): Fixed a rendering issue with global lists in the Administration Module, ensuring proper display of list items.

• Bug (#4429): Fixed an issue in PostgreSQL where users were unable to modify a transition condition in the process configuration, restoring proper editing functionality.

Engine

• Improvement (#4435): Enhanced text extraction from Word DOCX files for embeddings processing, improving the quality of extracted content.

• Bug (#4422): Resolved a data chunk creation issue in PostgreSQL with empty (null) embeddings, ensuring proper handling of null values in semantic search operations.

Workflow Apps

• Bug (#4424): Fixed an issue where the embeddings API was mandatory for the semantic search app, making it optional when not required. Setting GenerateEmbeddingsApiEndpoint to empty (e.g., <add key="GenerateEmbeddingsApiEndpoint" value="" />) in /wfgen/web.config would skip the embeddings search while keeping the full-text search.

Notes

All Node.js modules (GraphQL v5.3.0, Webhooks v6.2.0, Auth v3.2.0, and SCIM v3.2.0) now require Node.js version 22.20.0 LTS.

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3) release notes.

10.0.4

WorkflowGen 10.0.4

This release addresses several bug fixes and updates improving the Administration Module, Portal, User Settings, and SCIM provisioning.

Portal

• Bug (#4402): Fixed an issue where the similarity threshold was not set properly in the Similarity Search filter when the user's language was set to French.

• Bug (#4396): Fixed an issue where the delegation list was not displaying in the correct order, ensuring delegations are properly sequenced.

• Bug (#4374): Resolved a dashboard rendering issue that occurred when the process list was empty, ensuring proper display in all scenarios.

• Bug (#4393): Fixed an issue in User Settings where the view loading function was using a static value; now properly scoped to run only in the Portal context.

Administration

• Improvement (#4401): Made the edit data value and edit text file dialogs resizable to improve usability.

• Bug (#4404): Resolved an issue where dropdown-list items in the activity parameter out data panel were hidden under the panel's footer, ensuring proper visibility.

• Bug (#4414): Fixed a SQL exception error that occurred when displaying the diagnostics tab in the configuration panel of the Administration module.

• Bug (#4403): Fixed an exception error that was raised when updating data indexing settings in the process data configuration.

• Bug (#4389): Fixed an issue with folder lookup that could affect folder management operations.

• Bug (#4381): Resolved an issue where selectmenu dropdown options were not properly attached to their parent list, ensuring proper UI behavior.

Directory

• Bug (#4391): Fixed missing provisioning values in SCIM synchronization, ensuring complete user and group data provisioning.

Notes

All Node.js modules (GraphQL v5.3.0, Webhooks v6.2.0, Auth v3.2.0, and SCIM v3.2.0) now require Node.js version 22.20.0 LTS.

• For background on earlier enhancements and major features, refer to the WorkflowGen v10 Official (10.0.3) release notes.

9.6.0

WorkflowGen 9.6.0

This release includes new features, improvements, bug fixes, and security updates for the User Portal, Administration Module, workflow applications, MCP preview, Docker support, and Node.js modules.

Important

• Node.js Security Update - uuid vulnerability (GHSA-w5hq-g745-h8pq)
• Node.js Security Update - samlify vulnerability (CVE-2026-46490)

Security

• Bug (#4635): Removed obsolete administration process multi-delete functionality and ensured process deletion uses the authorized delete flow.

• Bug (#4636): Improved authorization checks when showing process delete counts.

• Bug (#4708): Improved SMTP OAuth token exchange validation.

• Bug (#4740): Updated UUID generation in Auth, GraphQL, Hooks, and SCIM to address GHSA-w5hq-g745-h8pq.

• Bug (#4646): Improved handling of administration process data file names in the UI.

• Bug (#4808): Added the missing CSRF token to the form page user settings flow.

• Update (#4815): Updated the Auth module SAML library to address CVE-2026-46490 while preserving signed SAML logout compatibility.

Portal

• Bug (#3945): Fixed Dashboard and User Portal list rendering for text process data detected as URLs or email addresses, restoring the expected link icons and styling in Dashboard, Requests, Actions, Assignments, Teams, Advanced Search, and Manage Instance lists.

• Bug (#4121): Fixed saved search views so that IDs, owners, titles, and replacement permissions stay consistent after saving.

• Bug (#4651): Kept the WorkflowGen User Portal shell visible for failed request quick searches, including not-found, out-of-range, and access-denied request number lookups.

• Bug (#4701): Fixed request cancellation permission evaluation for process folder managers.

• Bug (#4703): Fixed supervisor widget redirects for superusers.

• Bug: Preserved quick search state when refreshing portal result lists.

Administration

• New Feature (#4606): Added recurring schedules for overdue and prior overdue additional action notifications, with administration settings, import/export support, upgrade support, and duplicate-send protection.

• Improvement (#4695): Increased the Workflow Designer double-click detection window to make canvas interactions more reliable.

• Bug (#4802): Fixed notification recipient selection in the inline editor and improved the additional-notification table layout.

Workflow Applications

• New Feature (#3722, #3905): Added the SMTP OAuth2 delivery mode for Microsoft 365 / Exchange Online, including administration configuration, test email support, forgot password emails, and engine notifications.

• New Feature (#4681): Added the EXTRACTTEXT workflow application for PDF, DOCX, TXT, Markdown, XML, HTM, and HTML files, including administration configuration, runtime settings, and localized labels.

• Bug (#4711): Fixed plain-text SMTP OAuth fallback content by decoding HTML entities.

MCP Preview

• New Feature (#4643): Added the WorkflowGen MCP preview under /wfgen/mcp, including OAuth-based access for MCP-compatible clients, administration configuration, Docker deployment support, and workflow and administration tools.

• Improvement (#4736): Improved MCP import/export reliability, upload configuration, and upgrade handling.

• Improvement (#4784): Added MCP tools to import and export applications and global lists.

Docker

• Improvement (#4743): Added Windows Server 2022 (win-ltsc2022) Docker image support for the WorkflowGen v9 maintenance line.

Notes

• Node.js modules updated: GraphQL v5.4.3, Webhooks v6.3.3, Auth v3.3.4, SCIM v3.3.3, and MCP v0.1.0.

• For background on earlier enhancements and major features, refer to the WorkflowGen 9.0.0, WorkflowGen 9.1.0, WorkflowGen 9.2.4, WorkflowGen 9.3.1, WorkflowGen 9.4.0, WorkflowGen 9.5.0, WorkflowGen 9.5.1, and WorkflowGen 9.5.2 release notes.

9.5.2

WorkflowGen 9.5.2

This release includes bug fixes, security cleanup, and administration and workflow application improvements for WorkflowGen 9.5.

Security

• Bug (#4510): Removed obsolete legacy client-side scripts from the Administration and Portal web assets.

Portal

• Bug (#4678): Fixed inconsistent fr-CH currency formatting and validation for plain currency amounts in form data, read-only redisplay, server validation, save parsing, GridView parsing, and generated computed or mutation currency formatting paths.

Administration

• Improvement (#3340): Added separate CSV delimiter settings for report exports and global list CSV import/export, allowing report delimiter behavior to remain locale-aware while global list CSV files use an explicit administration setting.

• Bug (#4622): Stabilized priority arrow moves in administration lists when the list is sorted in a non-default order by posting and resolving stable entity IDs instead of relying only on display-order row positions.

Directory Synchronization

• Bug (#4674): Fixed PostgreSQL directory synchronization failures in update mode by matching synchronized user and group update columns case-insensitively, preventing empty SQL SET clauses when Npgsql returns lowercase column names.

Workflow Applications

• Bug (#4666): Added explicit __INTEGER and __BOOLEAN suffix support to RESTAPICLIENT JSON payload generation so strict APIs can receive integer and boolean JSON tokens instead of floating-point or string values.

• Bug (#4677): Improved RESTAPICLIENT multipart uploads to infer a file part MIME type from the upload filename when the stored source content type is empty or generic (application/octet-stream), while preserving explicit source MIME values.

Repository

• Update (#4657): Backported agent-first repository guidance and supporting packaging exclusions so repository-only agent documentation is available in v9 without being included in install packages.

Notes

• For background on earlier enhancements and major features, refer to the WorkflowGen 9.0.0, WorkflowGen 9.1.0, WorkflowGen 9.2.4, WorkflowGen 9.3.1, WorkflowGen 9.4.0, WorkflowGen 9.5.0, and WorkflowGen 9.5.1 release notes.

9.5.1

WorkflowGen 9.5.1

This release includes bug fixes, security improvements, and a Node.js platform support update for the WorkflowGen Node.js modules.

Important

• Node.js 22.22.2 LTS security release (March 24, 2026)

Security

• Bug (#4648, #4645): Added missing CSRF token validation on administration forms.

Portal

• Bug (#4650): Improved the application-start data lock feedback page with clearer messaging and data grouped by user and unlock time.

• Bug (#4619): Fixed an issue where UpdateView access validation was performed inside the database transaction instead of before it, improving resource usage for unauthorized requests.

Administration

• Bug (#4665): Fixed swapped directory count aliases where user counts displayed group counts and vice versa.

• Bug (#4664): Removed unused directory detail count queries that were fetching data no longer displayed.

• Bug (#4621): Restored directory reorder arrows that were not functioning due to outdated DOM access patterns.

Workflow Designer

• Bug (#4627): Improved the SetXpdl method to avoid fetching the full XPDL column unnecessarily, reducing overhead on process saves.

• Bug (#4611): Fixed a PostgreSQL compatibility issue where table-qualified column names in UPDATE SET clauses caused errors when renaming form field parameters.

Node.js Apps

• Update (#4661): Updated supported and pinned Node.js runtime references to 22.22.2 LTS in the WorkflowGen Node.js modules, CI configuration, Docker images, and PowerShell setup tooling (v2.0.13).

Notes

• All Node.js modules (GraphQL v5.4.2, Webhooks v6.3.2, Auth v3.3.2, and SCIM v3.3.2) now require Node.js 22.22.2 LTS.

• Production dependency updates were applied across the Node.js modules to address current security advisories.

• For background on earlier enhancements and major features, refer to the WorkflowGen 9.0.0, WorkflowGen 9.1.0, WorkflowGen 9.2.4, WorkflowGen 9.3.1, WorkflowGen 9.4.0, and WorkflowGen 9.5.0 release notes.