Release 3.8.0 · elsa-workflows/elsa-extensions

Compare: 3.7.1...3.8.0

🌟 Highlights

Stable package alignment: Extensions consumes Elsa Core and Elsa Studio 3.8.0 stable packages. (66861ae)
Package discovery: Extension manifests now identify their runtime as Server, helping platform tooling distinguish server packages. (d407e96)
Webhooks: Webhook modules are consumed as packages instead of being built from this repository. (335a264)
Publishing: Stable NuGet publishing uses the account that created the Trusted Publishing policy. (a44e2b0)

Source integrations: Elsa.Http.Webhooks and Elsa.Studio.Http.Webhooks sources have moved out of Extensions. Custom solutions that referenced these projects by path should use the corresponding package references, as the bundled hosts and OrchardCore integration now do. (335a264)

Manifests: Modules with shell features use Elsa.Platform.PackageManifest.Generator 0.0.1-preview.50 and include a Server runtime hint. (d407e96)
Repository tooling: Local codebase-memory artifacts are excluded from Git. (224c81a)

NuGet: The build project uses NuGet.Packaging 7.9.0. Trusted Publishing login selects the policy creator account. (7cfbea6, a44e2b0)

Elsa: Core and Studio package references move from 3.8.0-rc2 to 3.8.0. (66861ae)

Hangfire SQLite storage: The existing Hangfire.Storage.SQLite dependency chain includes SQLitePCLRaw.lib.e_sqlite3 2.0.4, which is affected by GHSA-2m69-gcr7-jv3q. The SQLite backend is selected through UseSqliteStorage. This release does not remediate that dependency; deployments using it should review the advisory. The dependency's presence is not proof that the vulnerable SQL pattern is reachable through Hangfire.
MongoDB: Restore may report GHSA-6c8g-7p36-r338 for transitive SharpCompress 0.30.1. MongoDB's maintainer assessment states that the driver uses in-memory ZLib compression and does not call the affected archive-extraction API.