WorkflowGen v9.7.0

Announcements Release Notes & Downloads
1

WorkflowGen 9.7.0 adds administrator Change Events, JSON Process Definition Language (JPDL) import and export, and the production-ready WorkflowGen MCP Server 1.0.0. It also upgrades the supported Node.js runtime to Node.js 24 and includes fixes for Administration, authentication, directory synchronization, Docker, GraphQL, Webhooks, and workflow applications.

Important

  • Existing WorkflowGen installations must run the SQL Server database update script MsSQLServer/Update_WFG-V9-7-0.sql before starting WorkflowGen 9.7.0. Running this script directly assumes a fully updated WorkflowGen 9.6.1 database; older installations must first apply the existing update scripts in order.

  • Update packages preserve the installed Inetpub\wwwroot\web.config and provide the 9.7.0 version as web.config.sample. On upgraded installations, merge the three wfgen/admin/change-events URL Rewrite rules from the sample into the installed root web.config before using Change Events.

  • Change Events is disabled by default. Before enabling Standard or Full mode, set ApplicationSecurityChangeEventIntegrityKey to a securely generated Base64-encoded 32-byte key. Use the same key on every WorkflowGen node and retain a secure backup. After the first event is recorded, the original key is required to verify the retained history and cannot be rotated in this release.

  • If the Change Events integrity key is missing or incorrect while Standard or Full mode is configured, most Administration and Configuration pages remain unavailable until the original key is restored or Change Events is switched Off in General configuration. Switching Off restores access but does not repair or verify the retained history.

  • Standard mode records supported changes. Full mode also records successful user-visible page navigation and can substantially increase database growth. Retention defaults to 365 days, continues while capture is Off, and must use the same positive value on every Engine Service node sharing the database. Full history verification is started manually by an administrator.

  • All WorkflowGen Node.js applications now require Node.js 24.19.0 or later in the Node.js 24 release line. IIS deployments require iisnode 0.2.26. Upgrade these components before starting the WorkflowGen 9.7.0 Node.js applications.

  • GraphQL and Webhooks integrations that read XPDL files from the WorkflowGen server through xpdl.url can now access only trusted folders. Before upgrading, add the required folders to GraphqlInputFileAllowedFolders or HooksInputFileAllowedFolders. Inline XPDL content must use UTF-8 encoding and remain within the configured input-file size limit.

  • The Docker helper now uses versioned volume names with its versioned WorkflowGen and SQL Server image tags. To intentionally reuse volumes created by the previous latest defaults, run it with -VolumeNameSuffix latest -SQLVolumeNameSuffix latest. Review the data in those volumes before reusing them with 9.7.0.

  • When using the WorkflowGen MCP Server, install the Portal and MCP components from the same 9.7.0 package. The MCP application must run with one Node.js process and an IIS application pool configured with Maximum Worker Processes set to 1. Update packages preserve an existing MCP web.config and provide the 9.7.0 configuration as web.config.sample; compare and merge the sample before enabling MCP. Production MCP must not use an active wfgen/mcp/iisnode.yml override when trusted IIS headers are enabled. Configure either ApplicationUrl or McpResourceUri; MCP host validation requires one of them even when its OAuth server is disabled.

Platform

  • Update (#4923): Upgraded the bundled and supported runtime from Node.js 22 to Node.js 24.19.0 LTS. Auth, GraphQL, Webhooks, MCP, and SCIM have also been updated for Node.js 24.

Security

  • Update (#4961): Updated production dependencies used by Authentication and Webhooks to address a known vulnerability.

Administration

  • New Feature (#4433): Added Change Events with Off, Standard, and Full capture modes. Access to the Change Events interface is restricted to WorkflowGen administrators, who can list, filter, review, export, print, verify, and retain supported Administration, Configuration, and User Portal changes. Full mode also records successful user-visible page navigation.

  • New Feature (#4716): Added JPDL process-definition import and export, including associated files. The Administration Module now exports process definitions as XPDL (.xml) or JPDL (.json) and recognizes the format of imported files by their extension.

  • Bug (#4716): Fixed XPDL imports in which a literal initial parameter value could be incorrectly interpreted as a reference to process data.

  • Bug (#4932): Restored unsaved-changes confirmation in Chromium 150 and later for the Process Form Designer, JavaScript editor, Source editor, ASP.NET code-behind editor, and Workflow Designer canvas.

Directory Synchronization

  • Bug (#4949): Fixed LDAP directory synchronization over secure Global Catalog connections on port 3269. Existing LDAP and non-secure Global Catalog connections are unchanged.

  • Bug (#4954): Fixed secure LDAP and Global Catalog port detection when an LDAP:// base DN contains a slash. For LDAP:// roots, ports 636 and 3269 now select SSL authentication independently of base-DN content.

GraphQL and Webhooks

  • New Feature (#4716): Added JPDL process-definition fields, downloads, and create and update operations. Existing XPDL operations remain available.

  • Security (#4716): Restricted server-local XPDL file inputs to configured trusted folders and added encoding and file-size validation.

  • Update (#4956): Clarified the documented behavior for creating process versions. Supplying a different process name when creating a version renames the entire process family; the API behavior is unchanged.

Authentication

  • Bug (#4945): Fixed SAML browser sign-in failures introduced in WorkflowGen 9.6.0, including deployments that use custom SAML request templates.

Workflow Applications

  • Bug (#4958): Fixed RESTAPICLIENT PDF downloads when an endpoint omits the response content type. The PDF content and filename are now preserved correctly.

  • Bug (#4969, #4973, #4974, #4976): Fixed RESTAPICLIENT multipart requests with media-type parameters, custom boundaries, form inputs, and content-specific headers. Existing manually constructed multipart request bodies remain supported, and invalid boundary settings now produce a clear configuration error.

  • Bug (#4969, #4972, #4975, #4977, #4978, #4979): Improved RESTAPICLIENT response filename handling for international, escaped, invalid, misleading, and overly long names. Valid filenames, response content, and content-type information remain unchanged.

Docker

  • Bug (#4912): Updated the Docker helper to use matching, explicit WorkflowGen 9.7.0 and SQL Server image tags by default. WorkflowGen v9 releases now publish only versioned platform tags and no longer replace the shared advantys/workflowgen-sql:latest tag owned by the current v10 Linux image.

WorkflowGen MCP Server 1.0.0

  • New Feature (#4716): Added JPDL import and export support to MCP process-administration tools.

  • Bug (#4716): Fixed MCP process imports so requests containing more than one process definition are rejected instead of silently selecting one.

  • Update (#4945): Promoted the WorkflowGen MCP Server from Preview to a supported production feature at version 1.0.0.

  • Update (#4956): Clarified the create_process inputs for creating a new process family or adding a version to an existing family.

  • Security (#4908, #4945): Strengthened MCP production security through updated dependencies and stricter validation of hostnames, authentication configuration, and request identity information. Unsafe or incomplete configurations are rejected during startup. Reverse proxies, load balancers, and health probes must use a configured hostname.

  • Update (#4945): Added protected, size-limited production diagnostic logs. These logs may contain user or request identifiers and should follow the deployment’s privacy and retention policies.

Notes

  • The SQL Server 9.7.0 update script creates and initializes the Change Events data and integrity structures. New installations receive the same structures from the SQL Server database creation scripts.

  • Change-event capture is asynchronous. Database write failures, temporary overload, or application shutdown can result in missing audit events. Integrity verification confirms the authenticity of records that reached storage; it does not prove that every business event was captured.

  • Full-mode page-view events cover successful user-visible Portal, Administration, and Configuration pages. Background requests, downloads, saves, feeds, polling, and suggestions are excluded. Successful Change Events CSV, JSON, and printable exports are recorded when integrity is available.

  • Retention removes expired Change Events in integrity order and continues while capture is Off. Events can be kept longer than the configured period; retention is a minimum age, not a maximum. Keep the original integrity key to verify the retained history after cleanup.

  • JPDL process-definition files must use the .json extension and snake_case property names. The .jpdl extension is not supported.

  • Node.js modules are Auth v3.4.1, GraphQL v5.6.0, Webhooks v6.5.0, MCP v1.0.0, and SCIM v3.4.0. All WorkflowGen Node.js applications require Node.js 24.19.0 LTS.

  • For background on earlier enhancements and fixes, refer to the WorkflowGen 9.6.1 release notes.

Installation Packs

WorkflowGen 9.7.0 (Upgrade)
WorkflowGen 9.7.0 (Clean Install - PowerShell)
WorkflowGen 9.7.0 (Clean Install - manual)

Documentation

WorkflowGen 9.7.0 Upgrade Guide: English - Français
WorkflowGen 9.7 PowerShell Installation: English - Français
WorkflowGen 9.7 Manual Installation: English - Français
WorkflowGen 9.7 Technical Guide: English - Français
WorkflowGen 9.7 Administration Guide: English - Français
WorkflowGen 9.7 User Portal Guide: English - Français
WorkflowGen 9.7 Integration Guide: English
WorkflowGen 9.7 for Azure: English - Français
WorkflowGen 9.x for Docker: English - Français
WorkflowGen Documentation: English - Français

Getting Started with WorkflowGen MCP Server 1.0.0