WorkflowGen v10.4.0

Announcements Release Notes & Downloads
1

WorkflowGen 10.4.0 adds administrator Change Events, JSON Process Definition Language (JPDL) import and export, and the production-ready WorkflowGen MCP Server 1.0.0. It also upgrades the supported Node.js runtime to Node.js 24 and includes fixes for Administration, authentication, directory synchronization, Docker, GraphQL, Webhooks, and workflow applications.

Important

  • Existing WorkflowGen installations must run the database update script for their database provider before starting WorkflowGen 10.4.0: MsSQLServer/Update_WFG-V10-4-0.sql for SQL Server or PostgreSQL/Update_WFG-V10-4-0.sql for PostgreSQL. Running this script directly assumes a fully updated WorkflowGen 10.3.1 database; older installations must first apply the existing update scripts for their provider in order.

  • Update packages preserve the installed Inetpub\wwwroot\web.config and provide the 10.4.0 version as web.config.sample. On upgraded installations, merge the three wfgen/admin/change-events URL Rewrite rules from the sample into the installed root web.config before using Change Events.

  • Change Events is disabled by default. Before enabling Standard or Full mode, set ApplicationSecurityChangeEventIntegrityKey to a securely generated Base64-encoded 32-byte key. Use the same key on every WorkflowGen node and retain a secure backup. After the first event is recorded, the original key is required to verify the retained history and cannot be rotated in this release.

  • If the Change Events integrity key is missing or incorrect while Standard or Full mode is configured, most Administration and Configuration pages remain unavailable until the original key is restored or Change Events is switched Off in General configuration. Switching Off restores access but does not repair or verify the retained history.

  • Standard mode records supported changes. Full mode also records successful user-visible page navigation and can substantially increase database growth. Retention defaults to 365 days, continues while capture is Off, and must use the same positive value on every Engine Service node sharing the database. Full history verification is started manually by an administrator.

  • All WorkflowGen Node.js applications now require Node.js 24.19.0 or later in the Node.js 24 release line. IIS deployments require iisnode 0.2.26. Upgrade these components before starting the WorkflowGen 10.4.0 Node.js applications.

  • GraphQL and Webhooks integrations that read XPDL files from the WorkflowGen server through xpdl.url can now access only trusted folders. Before upgrading, add the required folders to GraphqlInputFileAllowedFolders or HooksInputFileAllowedFolders. Inline XPDL content must use UTF-8 encoding and remain within the configured input-file size limit.

  • The Docker helper now uses versioned volume names with its versioned WorkflowGen and database image tags. To intentionally reuse volumes created by the previous latest defaults, run it with -VolumeNameSuffix latest -SQLVolumeNameSuffix latest. Review the data in those volumes before reusing them with 10.4.0.

  • When using the WorkflowGen MCP Server, install the Portal and MCP components from the same 10.4.0 package. The MCP application must run with one Node.js process and an IIS application pool configured with Maximum Worker Processes set to 1. Update packages preserve an existing MCP web.config and provide the 10.4.0 configuration as web.config.sample; compare and merge the sample before enabling MCP. Production MCP must not use an active wfgen/mcp/iisnode.yml override when trusted IIS headers are enabled. Configure either ApplicationUrl or McpResourceUri; MCP host validation requires one of them even when its OAuth server is disabled.

Platform

  • Update (#4917): Upgraded the bundled and supported runtime from Node.js 22.23.2 to Node.js 24.19.0 LTS. Auth, GraphQL, Webhooks, MCP, and SCIM have also been updated for Node.js 24.

Security

  • Update (#4960): Updated production dependencies used by Authentication and Webhooks to address a known vulnerability.

Administration

  • New Feature (#4433): Added Change Events with Off, Standard, and Full capture modes. Access to the Change Events interface is restricted to WorkflowGen administrators, who can list, filter, review, export, print, verify, and retain supported Administration, Configuration, and User Portal changes. Full mode also records successful user-visible page navigation.

  • New Feature (#4716): Added JPDL process-definition import and export, including associated files. The Administration Module now exports process definitions as XPDL (.xml) or JPDL (.json) and recognizes the format of imported files by their extension.

  • Bug (#4716): Fixed XPDL imports in which a literal initial parameter value could be incorrectly interpreted as a reference to process data.

  • Bug (#4900): Restored unsaved-changes confirmation in Chromium 150 and later for the Process Form Designer, JavaScript editor, Source editor, ASP.NET code-behind editor, and Workflow Designer canvas.

Directory Synchronization

  • Bug (#4949): Fixed LDAP directory synchronization over secure Global Catalog connections on port 3269. Existing LDAP and non-secure Global Catalog connections are unchanged.

  • Bug (#4954): Fixed secure LDAP and Global Catalog port detection when an LDAP:// base DN contains a slash. For LDAP:// roots, ports 636 and 3269 now select SSL authentication independently of base-DN content.

GraphQL and Webhooks

  • New Feature (#4716): Added JPDL process-definition fields, downloads, and create and update operations. Existing XPDL operations remain available.

  • Security (#4716): Restricted server-local XPDL file inputs to configured trusted folders and added encoding and file-size validation.

  • Update (#4956): Clarified the documented behavior for creating process versions. Supplying a different process name when creating a version renames the entire process family; the API behavior is unchanged.

Authentication

  • Bug (#4945): Fixed SAML browser sign-in failures introduced in WorkflowGen 10.3.1, including deployments that use custom SAML request templates.

Workflow Applications

  • Bug (#4958): Fixed RESTAPICLIENT PDF downloads when an endpoint omits the response content type. The PDF content and filename are now preserved correctly.

  • Bug (#4969, #4973, #4974, #4976): Fixed RESTAPICLIENT multipart requests with media-type parameters, custom boundaries, form inputs, and content-specific headers. Existing manually constructed multipart request bodies remain supported, and invalid boundary settings now produce a clear configuration error.

  • Bug (#4969, #4972, #4975, #4977, #4978, #4979): Improved RESTAPICLIENT response filename handling for international, escaped, invalid, misleading, and overly long names. Valid filenames, response content, and content-type information remain unchanged.

Docker

  • Bug (#4909): Made public Docker floating tags deterministic, platform-stable, and monotonic. WorkflowGen latest follows the latest stable v10 LTSC 2019 image, SQL latest refers to Ubuntu 24.04, and PostgreSQL publishes latest-linux, latest-win-ltsc2019, and latest-win-ltsc2022 while preserving postgres-latest as an LTSC 2019 compatibility alias. Floating aliases are promoted only when the candidate is the newest published image for its platform.

  • Bug (#4993): Fixed the Windows SQL image health check so a successfully initialized container reports as healthy. Database initialization and application connections are unchanged.

WorkflowGen MCP Server 1.0.0

  • New Feature (#4716): Added JPDL import and export support to MCP process-administration tools.

  • Bug (#4716): Fixed MCP process imports so requests containing more than one process definition are rejected instead of silently selecting one.

  • Update (#4945): Promoted the WorkflowGen MCP Server from Preview to a supported production feature at version 1.0.0.

  • Update (#4956): Clarified the create_process inputs for creating a new process family or adding a version to an existing family.

  • Security (#4907, #4945): Strengthened MCP production security through updated dependencies and stricter validation of hostnames, authentication configuration, and request identity information. Unsafe or incomplete configurations are rejected during startup. Reverse proxies, load balancers, and health probes must use a configured hostname.

  • Update (#4945): Added protected, size-limited production diagnostic logs. These logs may contain user or request identifiers and should follow the deployment’s privacy and retention policies.

Notes

  • The 10.4.0 update scripts create and initialize the Change Events data and integrity structures. New installations receive the same structures from the database creation scripts.

  • Change-event capture is asynchronous. Database write failures, temporary overload, or application shutdown can result in missing audit events. Integrity verification confirms the authenticity of records that reached storage; it does not prove that every business event was captured.

  • Full-mode page-view events cover successful user-visible Portal, Administration, and Configuration pages. Background requests, downloads, saves, feeds, polling, and suggestions are excluded. Successful Change Events CSV, JSON, and printable exports are recorded when integrity is available.

  • Retention removes expired Change Events in integrity order and continues while capture is Off. Events can be kept longer than the configured period; retention is a minimum age, not a maximum. Keep the original integrity key to verify the retained history after cleanup.

  • JPDL process-definition files must use the .json extension and snake_case property names. The .jpdl extension is not supported.

  • Node.js modules are Auth v3.4.1, GraphQL v5.6.0, Webhooks v6.5.0, MCP v1.0.0, and SCIM v3.4.0. All WorkflowGen Node.js applications require Node.js 24.19.0 LTS.

  • For background on earlier enhancements and fixes, refer to the WorkflowGen 10.3.1 release notes.

Installation Packs

For PostgreSQL 17.6 and SQL Server 2025

WorkflowGen 10.4.0 (Upgrade)
WorkflowGen 10.4.0 (Clean Install - Manual)

For SQL Server 2025 only

WorkflowGen 10.4.0 (Clean Install - PowerShell)

Documentation

WorkflowGen 10.4.0 Upgrade Guide: English - Français
WorkflowGen 10.4 Manual Installation Guide: English - Français
WorkflowGen 10.4 PowerShell Installation: English - Français
WorkflowGen 10.4 Technical Guide: English - Français
WorkflowGen 10.4 Administration Guide: English - Français
WorkflowGen 10.4 User Portal Guide: English - Français
WorkflowGen 10.4 Integration Guide: English
WorkflowGen 10.4 for Azure: English - Français
WorkflowGen 10.x for Docker: English - Français
WorkflowGen Documentation: English - Français

Getting Started with WorkflowGen MCP Server 1.0.0