Workflow Engine 21.1.0

May 19, 2026

Overview

Workflow Engine 21.1.0 is a maintenance release focused on Web API OpenAPI compatibility, safer HTTP header parsing, Workflow Designer settings and localization fixes, and a broad dependency refresh across Designer packages, samples, and Forms Plugin frontend assets.

Why update

• Fix Web API request header parsing so header values that contain = are preserved correctly, which is important for bearer tokens, signatures, and Base64-encoded values.
• Update Web API Swagger/OpenAPI generation to the current Swashbuckle stack and align it with supported ASP.NET Core OpenAPI packages.
• Fix Workflow Designer settings reset so it removes only Workflow Designer keys instead of clearing the entire browser localStorage.
• Get current dependency updates across Designer packages and samples, including security-related package upgrades in .NET and frontend components.

Key features

• Web API OpenAPI generation was updated for Swashbuckle 10 compatibility, including the required generator changes for breaking API changes.
• HTTP request header parsing now splits only on the first =, so values that embed = are passed through intact.
• Workflow Designer settings reset now removes only Workflow Designer entries, and the German localization pack was updated.
• Designer Angular packages and samples were aligned to the Angular 20.3 line to restore a consistent startup and build experience after partial dependency upgrades.

Changelog

Update instructions

• All packages: update Workflow Engine packages to version 21.1.0.
• If you use Workflow Engine Web API Swagger or custom OpenAPI generation extensions, review your integration after upgrading because Swashbuckle 10 required generator-level compatibility changes in this release.
• If you use workflow-designer-angular or the Angular sample, update your package lockfiles and keep the Angular dependency set aligned to the 20.3.x line.
• No database migration or other package-specific migration steps are required for this release.

Enhancements

• Web API: updated Swagger/OpenAPI generation for Swashbuckle.AspNetCore 10.0.1 and adapted the implementation to the new generation APIs.
• Designer packages: aligned Angular dependencies in workflow-designer-angular and workflow-designer-angular-sample from 20.1.7 to the 20.3.x line to restore a consistent startup experience. Dependency refresh by project:
• Designer:
  webpack 5.101.3 -> 5.105.0;
  @babel/plugin-transform-modules-systemjs 7.23.3 -> 7.29.4;
  fast-uri 3.1.0 -> 3.1.2;
  axios 1.8.2 -> 1.15.2; lodash 4.17.21 -> 4.18.1;
  lodash-es 4.17.21 -> 4.18.1;
  node-forge 1.3.1 -> 1.4.0;
  express 4.21.2 -> 4.22.1;
  postcss 8.5.6 -> 8.5.14.
• workflow-designer-angular:
  @modelcontextprotocol/sdk 1.13.3 -> 1.26.0;
  @angular/cli 20.1.6 -> 21.1.3;
  @angular/common 20.1.7 -> 20.3.20;
  @angular/core 20.1.7 -> 20.3.20;
  @angular/compiler 20.1.7 -> 20.3.18;
  fast-uri 3.0.1 -> 3.1.2;
  hono 4.11.7 -> 4.12.18;
  @hono/node-server 1.19.9 -> 1.19.14;
  express-rate-limit 8.2.1 -> 8.5.1;
  tar 7.5.7 -> 7.5.15;
  lodash 4.17.21 -> 4.18.1;
  brace-expansion 1.1.11 -> 1.1.14;
  postcss 8.5.6 -> 8.5.14.
• workflow-designer-angular-sample:
  @modelcontextprotocol/sdk 1.13.3 -> 1.26.0;
  @angular/cli 20.1.6 -> 21.1.3;
  @angular/core 20.1.7 -> 20.3.18;
  @angular/compiler 20.1.7 -> 20.3.18;
  fast-uri 3.0.1 -> 3.1.2;
  hono 4.11.8 -> 4.12.18;
  @hono/node-server 1.19.9 -> 1.19.14;
  express-rate-limit 8.2.1 -> 8.5.1;
  tar 7.5.7 -> 7.5.15.
• workflow-designer-react-sample:
  webpack 5.94.0 -> 5.105.0;
  @babel/plugin-transform-modules-systemjs 7.20.11 -> 7.29.4;
  fast-uri 3.1.0 -> 3.1.2;
  lodash 4.17.21 -> 4.18.1;
  node-forge 1.3.1 -> 1.3.2;
  js-yaml 3.14.1 -> 3.14.2.
• workflow-designer-react:
  postcss 8.5.6 -> 8.5.14.
• workflow-designer-javascript-sample:
  @babel/plugin-transform-modules-systemjs 7.15.4 -> 7.29.4.
• forms-plugin/frontend:
  fast-uri 3.1.0 -> 3.1.2;
  axios 1.11.0 -> 1.16.0;
  react-router 7.8.2 -> 7.13.0;
  react-router-dom 7.8.2 -> 7.13.0;
  js-yaml 3.14.1 -> 3.14.2;
  glob 10.4.5 -> 10.5.0;
  vite 7.3.0 -> 7.3.3;
  ip-address 10.0.1 -> 10.2.0;
  postcss 8.5.6 -> 8.5.14.

Bug fixes

• Web API: fixed HTTP request header parsing so values that contain = are no longer truncated or corrupted during dictionary parsing.
• Designer: fixed settings reset so it clears only Workflow Designer keys by prefix instead of deleting the entire browser localStorage.
• Designer: updated the German localization to correct translation issues in Workflow Designer.

Resources

• Web API OpenAPI documentation: OpenAPI.
• Workflow Designer localization guide: Languages.
• Forms Plugin documentation: Forms.

Security

• MongoDB-related packages and samples: upgraded SharpCompress from 0.30.1 to 0.48.0, moving archive extraction support beyond the affected range <= 0.47.4 for CVE-2026-44788 and GHSA-6c8g-7p36-r338.
• MongoDB-related packages and samples: upgraded Snappier from 1.0.0 to 1.3.1 to clear package security warnings and move to a maintained release line associated with the upstream Snappier advisory CVE-2023-28638 and GHSA-838x-pcvx-6p5w.