Skip to content

deps: Bump the elsa-preview group with 2 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/main/elsa-preview-6bb50e99a4
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/main/elsa-preview-6bb50e99a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •

Copy link
Copy Markdown

Updated Elsa.Studio from 3.6.3 to 3.8.4.

Release notes

Sourced from Elsa.Studio's releases.

3.8.4

Compare: 3.8.2...3.8.4

Elsa Studio 3.8.4 — Release Notes

Critical patch for consumers of Studio packages.

elsa-studio 3.8.3 on nuget.org declares Elsa.Api.Client >= 3.8.0-preview.5565, which is not published. Clean restores fail (NU1603) or fall back to an old preview (#​1052). nuget.org versions are immutable, so this 3.8.4 release ships Studio packages that depend on a published stable Elsa.Api.Client (aligned with Core 3.8.4).


🌟 Highlights

  • Restore works again: Elsa.Api.Client package reference points at published stable 3.8.4 (not a missing preview). (#​1052)

⚠️ Breaking changes / upgrade notes

  • Upgrade to elsa-studio 3.8.4 (with elsa-core 3.8.4). Do not use Studio 3.8.3 from nuget.org for new restores.
  • Prefer aligning elsa-extensions to 3.8.4 as well.

🐛 Fixes

  • Pin Elsa.Api.Client in Directory.Packages / package metadata to a nuget.org-available stable version. (#​1052)

3.8.3

What's Changed

New Contributors

Full Changelog: elsa-workflows/elsa-studio@3.8.0...3.8.3

3.8.2

Compare: 3.8.1...3.8.2

Elsa Studio 3.8.2 — Release Notes

Patch release paired with elsa-core 3.8.2 and elsa-extensions 3.8.2.

Package-reference bump to Core 3.8.2 for the aligned patch train. No Studio product-behavior changes vs 3.8.1.


🌟 Highlights

  • Elsa.Api.Client → 3.8.2: Studio packages track Core 3.8.2 for the integrity fix cascade.

⚠️ Breaking changes / upgrade notes

  • Upgrade with elsa-core 3.8.2 (and elsa-extensions 3.8.2 if you use Mongo/Dapper persistence).

🐛 Fixes

  • None in Studio UI/source vs 3.8.1 beyond package reference alignment.

3.8.1

Compare: 3.8.0...3.8.1

Elsa Studio 3.8.1 — Release Notes

Patch release for Studio 3.8.0: OpenID Connect host startup, static-feature dashboard modules, and the Executions details drawer.

Upgrade together with elsa-core 3.8.1 (and elsa-extensions 3.8.1 if you use those packages).


🌟 Highlights

  • OIDC hosts start again: AddOpenIdConnectAuth no longer throws TryAddIndistinguishableTypeToEnumerable when registering the authentication provider. (#​1016, #​1025)
  • Static-feature dashboards show 3.8 modules: Workflow Dashboard / Structured Logs (and similar) match when configured as static features with Elsa-prefixed catalog names. (#​1014, #​1026)
  • Executions details drawer opens: Clicking a row in an activity’s Executions tab opens the Execution Details drawer again so inputs/outputs are inspectable. (#​1021, #​1028)

⚠️ Breaking changes / upgrade notes

  • None expected. Static feature catalog matching is intentionally limited to Elsa-prefixed names so third-party last-segment collisions (e.g. Acme.Identity) are not treated as Elsa modules.

🐛 Fixes

  • Fix OpenID Connect authentication provider registration so Studio hosts using AddOpenIdConnectAuth can start. (#​1016, #​1025)
  • Accept static feature catalog names for dashboard modules, restricted to Elsa-prefixed names, with collision coverage. (#​1014, #​1026)
  • Mount the Temporary Execution Details MudDrawer while open so selecting an Executions row shows details (including overlay / header close). (#​1021, #​1028)

3.8.0

Compare: 3.7.1...3.8.0


🌟 Highlights

  • Operational dashboard: Studio’s root experience is now a dashboard shell with remote-gated workflow and diagnostics widgets. Companion modules contribute widgets through stable zones and payload contracts, so hosts can include only the capabilities their backend advertises. (948777a7, ac383501, 72bf112a, #​879)

  • Diagnostics workspace: Studio adds separate Structured Logs, raw Console Logs, and OpenTelemetry viewers with recent-data backfill, live SignalR updates, feature/permission gating, workflow/trace correlation, and dashboard status widgets. Structured Logs remains semantic ILogger data; Console Logs remains raw stdout/stderr. (#​810, #​821, #​822, #​833, #​834)

  • Workflow authoring: Sequence workflows gain a React Flow designer and explicit sequence mode; State Machine workflows move to X6 and gain structured state/transition inspectors, trigger/condition/action authoring, lossless condition editing, JSON repair guidance, and accessible activity selection. (#​812, #​818, #​819, #​873, #​985)

  • Root activity and designer productivity: New workflow creation and embedded activity ports can choose a root activity template. The activity picker supports suggested/recent/all views, category filtering, search, designer-backed replacement, and safer JSON editing while preserving activity identity. (#​878, #​946, 6f178db2, a5b2d237)

  • Authentication and administration: Studio adds brokered External Authentication management, connection and identity-link workspaces, configurable application/login themes, user and role management, and improved identity display/copy flows. (#​920, #​921, #​936, 39637f74, 3905f930)

  • Operational extensions: New Secrets management and picker/update UX, Alterations staging/designer flows, Platform artifact submission actions, HTTP Webhooks navigation, and the Weaver AI workspace extend Studio beyond workflow editing. Weaver streams Core-owned capabilities, tools, and chat; proposal review/apply controls remain unavailable until Core exposes the corresponding action endpoints. (#​823, #​826, #​839, #​900, a067420e)


⚠️ Breaking changes / upgrade notes

  • Authentication composition is now explicitly selected. Hosts that adopt the shared authentication UI or brokered External Authentication must register exactly one authentication provider. Direct OpenID Connect and Elsa Identity remain supported, but legacy Elsa.Studio.Login, Elsa Identity, direct OIDC, and brokered External Authentication registrations must not be mixed. See the External Authentication migration guide. (c0b1969f, aa8dd851)

  • Brokered External Authentication has separate Server and WebAssembly trust models. Server hosts use a confidential client with server-side credential retention; WebAssembly hosts use a public client with mandatory PKCE and memory-only credentials by default. Configure Authentication:Provider and the matching Authentication:ExternalAuthentication section before enabling it. (497a3cae, docs/migrations/external-authentication.md)

  • Pair Studio with the matching Elsa Core diagnostics and authentication features. Diagnostics navigation and dashboard widgets are remote-feature and permission gated; when the backend does not advertise a feature, the corresponding route is hidden or renders an unavailable/unauthorized state. (72bf112a, 3b2ea27f, d6018c30)

  • Backend compatibility: Studio 3.8.0 consumes Elsa.Api.Client 3.8.0. Upgrade the corresponding Core packages before updating Studio. (85395246)


✨ New features

Dashboard and diagnostics

  • Dashboard: Replaces the previous Studio home with a composable operational dashboard. Widgets register by semantic zone and required backend capability, allowing workflow, structured-log, console-log, and OpenTelemetry modules to contribute independently. (948777a7, 5997b32d, d746b39d, ac383501, 72bf112a)
  • Structured Logs: Adds a semantic log viewer for rendered messages, templates, properties, scopes, exceptions, source metadata, trace/span IDs, workflow context, tenant, and correlation fields, with recent backfill, live updates, storage diagnostics, and filtering. (#​810, #​816, #​821)
  • Console Logs: Adds a raw stdout/stderr viewer with source selection, recent lines, live streaming, ANSI color support, workflow-instance scoping, and an instance-viewer tab. (#​822, #​831, #​833, b82e3756)
  • OpenTelemetry: Adds a feature-gated viewer for normalized Core resources, traces, metrics, OTLP logs, storage diagnostics, and collector configuration. Trace/span/resource/time correlation uses public contracts and remains separate from Structured Logs and Console Logs. (#​834, 3b2ea27f, 2cdb8853)
  • Alterations: Adds a feature-gated designer for discovering supported instance/activity changes, staging edits, reviewing a plan, and submitting alterations. (#​823, #​837, 43dbadc9)
  • Secrets: Adds secret management pages, secret picker controls for activity inputs, and managed secret update UX. (#​826, #​840, 8145e7e3)
  • Platform integration: Adds workflow-definition submission actions and snapshot packaging for Elsa Platform artifacts. (#​839, c8755016)
  • Webhooks: Adds the Studio HTTP Webhooks module and navigation entry. (a067420e)

Workflow designer

  • React Flow Sequence designer: Adds a React Flow-based designer, sequence mode, auto-layout, vertical/horizontal layout controls, and move-earlier/move-later actions. (#​812, #​819, #​873, 64034310)
  • State Machine designer: Migrates the State Machine canvas to X6 and adds an outline, state inspector, transition inspector, trigger/condition/action slots, state/transition authoring, designer-backed activity replacement, and safe fallbacks for incomplete definitions. (#​818, d8077579, 1de8617a, 402168f1, 69285b09, ab8261fb)
  • Activity picker and JSON editing: Adds suggested/recent/all activity views, category filters, search, recent activity tracking, JSON editing with line/column validation, repair guidance, and identity-preserving Apply/Cancel behavior. (1133f8fa, 6f178db2, a5b2d237)
    ... (truncated)

3.8.0-rc2

Studio grew from a workflow editor into an operations console. A dashboard on the home page, three diagnostics workspaces, an alterations designer, SSO and user management, and two new designers — Sequence and StateMachine — alongside an opt-in React Flow rewrite of the flowchart canvas.

This is the release candidate for 3.8.0, covering everything since 3.7.1: 51 pull requests and 18 new modules. It pairs with elsa-core 3.8.0-rc2, which shipped the backend half of most of what's here — the dashboard API, the diagnostics endpoints, the secrets store, the external authentication broker and Weaver. Upgrade both together. Studio 3.8 talks to APIs that 3.7 servers don't expose, and most new screens are gated on a backend feature being present, so against an older server they simply won't appear.

If you tried 3.8.0-rc1: it produced no packages. The rc1 tag was cut on a commit whose build failed, so no Elsa.Studio* 3.8.x package was ever published — dotnet add package would have failed for reasons that had nothing to do with your setup. The cause was a dependency pin: Studio moved to Elsa.Api.Client 3.8.0-rc1, which is built from elsa-core's release branch and did not carry the output-converter API this branch already consumed. elsa-core 3.8.0-rc2 backports that work, and this release pins to it. rc2 is the first installable 3.8 build of Studio. Nothing else changed between rc1 and rc2.

Commits 147
Pull requests 51
Files touched 966 (+76,024 / −1,860)
New modules 18 (plus 11 new test projects)
New contributors 2
Compare 3.7.1...3.8.0-rc2

Highlights

1. The home page is now an operational dashboard

/ used to be a static welcome page. It now renders metric cards, a needs-attention list, workflow trends, recent activity, a diagnostics snapshot and optional hotspots, backed by the new /dashboard/* endpoints in Core. Unauthorized and backend-unavailable states degrade gracefully rather than erroring.

The part worth knowing about is what happened underneath. The first version hardcoded workflow and diagnostics content into the dashboard page. #​879 and #​886 replaced that with a widget composition model: descriptors, semantic zones, a registry with validation, and cascading widget context. The dashboard page now renders whatever widgets are registered, and the dashboard module no longer references the workflows module at all.

Widgets ship in companion modules — Elsa.Studio.Workflows.Dashboard, Elsa.Studio.Diagnostics.ConsoleLogs.Dashboard, Elsa.Studio.Diagnostics.StructuredLogs.Dashboard, Elsa.Studio.Diagnostics.OpenTelemetry.Dashboard — each gated on its backend feature being present. So the dashboard shows what your server actually has, and your own modules can contribute panels without the dashboard knowing they exist.

#​871 · #​879 · #​886 · #​887

Studio dashboard showing operational health, execution trend, recent activity and needs-attention findings


2. Three diagnostics workspaces

Core 3.8 made an Elsa host observable. Studio 3.8 is where you look at it.

/diagnostics/structured-logs — backend server logs with an authenticated SignalR subscription for live updates. Filters for level, text, category, workflow instance, tenant, trace and correlation ID, time and source. Merged clustered views plus source-specific focus for individual pods, processes or containers, with source health indicators and source-change handling. Pause/resume, reconnect, clear, auto-scroll, wrapping, compact mode, copy selected or visible rows, and deep links from the workflow instance viewer. Trace metadata filters were added in #​821. (#​810 · #​816)

/diagnostics/console — raw stdout/stderr capture with its own REST and SignalR clients, URL state mapping, export and highlight helpers. And usefully, a Console tab inside the workflow instance viewer: the viewer was extracted into a reusable component and given a workflow-scoped filter, so you can read what one specific run printed instead of searching a shared stream. (#​822 · #​831 · #​833)

/diagnostics/opentelemetry — views over the OTEL data Core now emits, with live updates, setup helpers and cross-links to the other two diagnostics surfaces. (#​834)

OpenTelemetry diagnostics workspace with a connected collector, trace and metric counts, and top operations


3. Two new designers, and a third canvas implementation

StateMachine designer. Core 3.8 added a StateMachine activity; Studio can now draw one. A dedicated diagram provider and canvas wrapper with graph models, a JSON mapper, a validation service and activity-slot drag/drop. (#​818)
... (truncated)

3.8.0-rc1

Elsa Studio 3.8.0-rc1

Studio grew from a workflow editor into an operations console. A dashboard on the home page, three diagnostics workspaces, an alterations designer, SSO and user management, and two new designers — Sequence and StateMachine — alongside an opt-in React Flow rewrite of the flowchart canvas.

This is the release candidate for 3.8.0, covering everything since 3.7.1: 51 pull requests and 18 new modules. It pairs with elsa-core 3.8.0-rc1, which shipped the backend half of most of what's here — the dashboard API, the diagnostics endpoints, the secrets store, the external authentication broker and Weaver. Upgrade both together. Studio 3.8 talks to APIs that 3.7 servers don't expose, and most new screens are gated on a backend feature being present, so against an older server they simply won't appear.

Commits 139
Pull requests 51
Files touched 953 (+75,902 / −1,846)
New modules 18 (plus 11 new test projects)
New contributors 2
Compare 3.7.1...3.8.0-rc1

Highlights

1. The home page is now an operational dashboard

/ used to be a static welcome page. It now renders metric cards, a needs-attention list, workflow trends, recent activity, a diagnostics snapshot and optional hotspots, backed by the new /dashboard/* endpoints in Core. Unauthorized and backend-unavailable states degrade gracefully rather than erroring.

The part worth knowing about is what happened underneath. The first version hardcoded workflow and diagnostics content into the dashboard page. #​879 and #​886 replaced that with a widget composition model: descriptors, semantic zones, a registry with validation, and cascading widget context. The dashboard page now renders whatever widgets are registered, and the dashboard module no longer references the workflows module at all.

Widgets ship in companion modules — Elsa.Studio.Workflows.Dashboard, Elsa.Studio.Diagnostics.ConsoleLogs.Dashboard, Elsa.Studio.Diagnostics.StructuredLogs.Dashboard, Elsa.Studio.Diagnostics.OpenTelemetry.Dashboard — each gated on its backend feature being present. So the dashboard shows what your server actually has, and your own modules can contribute panels without the dashboard knowing they exist.

#​871 · #​879 · #​886 · #​887

Studio dashboard showing operational health, execution trend, recent activity and needs-attention findings


2. Three diagnostics workspaces

Core 3.8 made an Elsa host observable. Studio 3.8 is where you look at it.

/diagnostics/structured-logs — backend server logs with an authenticated SignalR subscription for live updates. Filters for level, text, category, workflow instance, tenant, trace and correlation ID, time and source. Merged clustered views plus source-specific focus for individual pods, processes or containers, with source health indicators and source-change handling. Pause/resume, reconnect, clear, auto-scroll, wrapping, compact mode, copy selected or visible rows, and deep links from the workflow instance viewer. Trace metadata filters were added in #​821. (#​810 · #​816)

/diagnostics/console — raw stdout/stderr capture with its own REST and SignalR clients, URL state mapping, export and highlight helpers. And usefully, a Console tab inside the workflow instance viewer: the viewer was extracted into a reusable component and given a workflow-scoped filter, so you can read what one specific run printed instead of searching a shared stream. (#​822 · #​831 · #​833)

/diagnostics/opentelemetry — views over the OTEL data Core now emits, with live updates, setup helpers and cross-links to the other two diagnostics surfaces. (#​834)

OpenTelemetry diagnostics workspace with a connected collector, trace and metric counts, and top operations


3. Two new designers, and a third canvas implementation

StateMachine designer. Core 3.8 added a StateMachine activity; Studio can now draw one. A dedicated diagram provider and canvas wrapper with graph models, a JSON mapper, a validation service and activity-slot drag/drop. (#​818)
... (truncated)

3.8.0-preview1

What's Changed

New Contributors

Full Changelog: elsa-workflows/elsa-studio@3.7.0...3.8.0-preview1

3.7.1

Compare: 3.7.0...origin/release/3.7.1


Highlights

  • Elsa API client alignment: Updates Studio's Elsa.Api.Client dependency from the 3.7.0 preview build to the published Elsa Core 3.7.1 package so Studio 3.7.1 consumes the matching patch-level API client.

Upgrade notes

  • No breaking changes are expected. This release is a dependency-alignment patch for Elsa 3.7.1.

Dependencies

  • Elsa.Api.Client: 3.7.0-preview.4523 -> 3.7.1

Full changelog

  • abcf9b76a0 - Update Elsa API client to 3.7.1

3.7.0

Elsa Studio 3.7.0

Compare: 3.6.1...3.7.0


⚠️ Breaking changes / upgrade notes

  • Authentication contracts: IAuthenticationProvider, IAuthenticationProviderManager, and TokenNames moved out of Elsa.Studio.Core into Elsa.Studio.Login namespaces. Consumers importing these APIs from Elsa.Studio.Core should update package references/usings to Elsa.Studio.Login. (2192884a48) (#​723)
  • UI dependencies: MudBlazor was upgraded from 8.15.0 to 9.0.0, Radzen.Blazor from 8.3.5 to 9.0.5, and CodeBeam.MudBlazor.Extensions from 8.3.0 to 9.0.0-rc.1. Applications customizing Elsa Studio UI components should validate compatibility with these major versions. (04b858a8d0) (#​760)

✨ New features

Authentication

  • Modern authentication modules: Added a new authentication framework with dedicated Elsa Identity and OpenID Connect modules for Blazor Server and Blazor WASM hosts, including token providers, JWT accessors, unauthorized components, and SignalR connection option configurators. (2192884a48) (#​723)
  • Elsa Identity UI feature: Added ElsaIdentityUIFeature and switched the WASM host default authentication provider from legacy ElsaLogin to ElsaIdentity. (7ffc15a591)
  • Legacy Elsa Login compatibility: Added explicit legacy ElsaLogin support for WASM host configuration, preserving an upgrade path for existing host apps. (8612d5b195)

Workflow instance diagnostics

  • Activity call stack visualization: Added IActivityExecutionService.GetCallStackAsync, an ActivityCallStack component, execution details drawer, and activity selection/highlighting in the workflow instance viewer. (691d373bbd) (#​750)
  • Incident count badge: Displays incident counts on the workflow instance details Incidents tab. (b3ca85f818) (#​739)
  • Pending instance filter: Added Pending as a workflow instance sub-status filter and updated translations. (9af41aebb2) (#​737)

Extensibility and UI composition

  • Custom theme provider: Added IThemeProvider so host applications can supply a custom MudTheme more directly. (07e94f58a7) (#​754)
  • DataPanel rendering extensibility: Added DataPanelItemFormat, custom ValueTemplate, reusable value component support, and dedicated renderers for timestamp/code/text values. (2b55e410d2) (#​740)
  • Activity tabs: Extended IActivityTab with optional icon, icon color, visibility, and scroll-wrapping customization hooks, plus a reusable ActivityTab implementation. (2192884a48) (#​723)

🔧 Improvements

  • Workflow materializer UI: Improved workflow materializer handling and activity selection so workflows-as-activity instances load more reliably. (71f5dfa783) (#​731)
  • Fallback designer UX: Added a warning alert when the fallback designer is active, helping users understand when no specific designer is registered for an activity type. (db6695073b) (#​741)
  • Fallback designer cleanup: Simplified fallback designer internals and root activity initialization. (e63a6ab760)
  • Query table initialization: Streamlined QueryTableComponentBase query state handling and initialization logic. (91868f273b)
  • Activity properties panel: Made ExpressionDescriptorProvider mutable in ActivityPropertiesPanel and cleaned up formatting. (918dd8c862)

🐛 Fixes

  • Custom Elements host SignalR authentication: Registered IHttpConnectionOptionsConfigurator in Elsa.Studio.Host.CustomElements so WorkflowInstanceObserverFactory resolves correctly when rendering custom-element viewers with API key or access-token attributes. (797449faf1) (#​800)
  • OIDC configuration errors: Fixed OpenID Connect setup so missing service registrations and token-exchange failures surface as errors instead of causing repeated login loops. (a2941daec4) (#​779)
  • OIDC error hardening: Bounded diagnostic logging for token-exchange failures, reduced user-facing error detail, and preserved consumer-provided IAuthenticationProviderManager registrations via TryAddScoped. (9799d93b3c) (#​792)
    ... (truncated)

3.7.0-rc1

Compare: 3.6.0...3.7.0-rc1

⚠️ Breaking changes / upgrade notes

  • Authentication contracts: IAuthenticationProvider, IAuthenticationProviderManager, and TokenNames moved out of Elsa.Studio.Core into Elsa.Studio.Login namespaces. Consumers importing these APIs from Elsa.Studio.Core should update package references/usings to Elsa.Studio.Login. (2192884a48) (#​723)
  • UI dependencies: MudBlazor was upgraded from 8.15.0 to 9.0.0, Radzen.Blazor from 8.3.5 to 9.0.5, and CodeBeam.MudBlazor.Extensions from 8.3.0 to 9.0.0-rc.1. Applications customizing Elsa Studio UI components should validate compatibility with these major versions. (04b858a8d0) (#​760)

✨ New features

Authentication

  • Modern authentication modules: Added a new authentication framework with dedicated Elsa Identity and OpenID Connect modules for Blazor Server and Blazor WASM hosts, including token providers, JWT accessors, unauthorized components, and SignalR connection option configurators. (2192884a48) (#​723)
  • Elsa Identity UI feature: Added ElsaIdentityUIFeature and switched the WASM host default authentication provider from legacy ElsaLogin to ElsaIdentity. (7ffc15a591)
  • Legacy Elsa Login compatibility: Added explicit legacy ElsaLogin support for WASM host configuration, preserving an upgrade path for existing host apps. (8612d5b195)

Workflow instance diagnostics

  • Activity call stack visualization: Added IActivityExecutionService.GetCallStackAsync, an ActivityCallStack component, execution details drawer, and activity selection/highlighting in the workflow instance viewer. (691d373bbd) (#​750)
  • Incident count badge: Displays incident counts on the workflow instance details Incidents tab. (b3ca85f818) (#​739)
  • Pending instance filter: Added Pending as a workflow instance sub-status filter and updated translations. (9af41aebb2) (#​737)

Extensibility and UI composition

  • Custom theme provider: Added IThemeProvider so host applications can supply a custom MudTheme more directly. (07e94f58a7) (#​754)
  • DataPanel rendering extensibility: Added DataPanelItemFormat, custom ValueTemplate, reusable value component support, and dedicated renderers for timestamp/code/text values. (2b55e410d2) (#​740)
  • Activity tabs: Extended IActivityTab with optional icon, icon color, visibility, and scroll-wrapping customization hooks, plus a reusable ActivityTab implementation. (2192884a48) (#​723)

🔧 Improvements

  • Workflow materializer UI: Improved workflow materializer handling and activity selection so workflows-as-activity instances load more reliably. (71f5dfa783) (#​731)
  • Fallback designer UX: Added a warning alert when the fallback designer is active, helping users understand when no specific designer is registered for an activity type. (db6695073b) (#​741)
  • Fallback designer cleanup: Simplified fallback designer internals and root activity initialization. (e63a6ab760)
  • Query table initialization: Streamlined QueryTableComponentBase query state handling and initialization logic. (91868f273b)
  • Activity properties panel: Made ExpressionDescriptorProvider mutable in ActivityPropertiesPanel and cleaned up formatting. (918dd8c862)

🐛 Fixes

  • Custom Elements host SignalR authentication: Registered IHttpConnectionOptionsConfigurator in Elsa.Studio.Host.CustomElements so WorkflowInstanceObserverFactory resolves correctly when rendering custom-element viewers with API key or access-token attributes. (797449faf1) (#​800)
  • OIDC configuration errors: Fixed OpenID Connect setup so missing service registrations and token-exchange failures surface as errors instead of causing repeated login loops. (a2941daec4) (#​779)
  • OIDC error hardening: Bounded diagnostic logging for token-exchange failures, reduced user-facing error detail, and preserved consumer-provided IAuthenticationProviderManager registrations via TryAddScoped. (9799d93b3c) (#​792)
  • Activity property syntax restore: Prevented activity property child content from rendering until ExpressionDescriptorProvider is initialized, fixing syntax values such as JavaScript reverting to literal/default on reopen. (880525fd18) (#​780)

🔒 Security

  • OIDC failure handling: Avoids exposing raw token endpoint responses in the UI and bounds error payload handling while retaining diagnostic logging. (9799d93b3c) (#​792)
  • Custom Elements authenticated SignalR: Bridges custom-element api-key / access-token credentials into SignalR HttpConnectionOptions, allowing secured workflow viewers to connect without pulling in a full login module. (797449faf1) (#​800)

🧩 Developer-facing changes

  • Added IAnonymousBackendApiClientProvider and default implementation for anonymous backend API access. (2192884a48) (#​723)
    ... (truncated)

Commits viewable in compare view.

Updated Elsa.Studio.Agents from 3.6.3 to 3.8.4.

Release notes

Sourced from Elsa.Studio.Agents's releases.

3.8.4

Compare: 3.8.2...3.8.4

Elsa Extensions 3.8.4 — Release Notes

Patch release paired with elsa-core 3.8.4 and elsa-studio 3.8.4 for version alignment after the Studio 3.8.3 restore integrity issue (#​1052).

No Extensions product-behavior changes vs 3.8.2 beyond package reference bumps to the 3.8.4 train. Mongo/Dapper continue to ship the 3-param TryMarkInterruptedAsync surface from the 3.8.2 integrity fix (#​205).


🌟 Highlights

  • Aligned 3.8.4 train: ElsaVersion / ElsaStudioVersion track Core and Studio 3.8.4.

⚠️ Breaking changes / upgrade notes

  • Upgrade with elsa-core 3.8.4 and elsa-studio 3.8.4 when taking this patch.

🐛 Fixes

  • Package reference alignment only vs 3.8.2 (see Studio #​1052 / Core notes).

3.8.2

Compare: 3.8.1...3.8.2

Elsa Extensions 3.8.2 — Release Notes

Critical patch for hosts using MongoDB or Dapper workflow-instance persistence with elsa-core 3.8.1+.

The NuGet packages published as Extensions 3.8.1 were built from a tip that still exposed the older two-parameter TryMarkInterruptedAsync. Core 3.8.1 requires the three-parameter shape, so AddElsa() fails at startup with TypeLoadException before the host runs (#​205).

Source on the 3.8.1 git tag was already correct; nuget.org versions are immutable, so this 3.8.2 republish ships the corrected assemblies.


🌟 Highlights

  • Mongo/Dapper hosts start again: MongoWorkflowInstanceStore and DapperWorkflowInstanceStore implement the Core 3.8.1+ TryMarkInterruptedAsync signature so AddElsa() no longer TypeLoadExceptions. (#​205)

⚠️ Breaking changes / upgrade notes

  • Required if you hit #​205: bump elsa-extensions (at least Elsa.Persistence.MongoDb / Elsa.Persistence.Dapper) to 3.8.2, and prefer aligning elsa-core / elsa-studio to 3.8.2 as well.
  • Do not expect a fixed 3.8.1 on nuget.org — that version cannot be overwritten.

🐛 Fixes

  • Republish Mongo and Dapper persistence packages so TryMarkInterruptedAsync matches Core’s three-parameter interface. (#​205)

3.8.1

Compare: 3.8.0...3.8.1

Elsa Extensions 3.8.1 — Release Notes

Patch release for Extensions 3.8.0: MongoDB persistence regressions, interruption-store companions for Core 3.8.1, and a Dapper filter bug that restarted live workflows.

Consume with elsa-core 3.8.1 (Management / runtime changes).


🌟 Highlights

  • MongoDB variables persist again: VariableSerializer resolves storage drivers against the real registry so StorageDriverType is not dropped. (#​8047, #​185)
  • MongoDB JsonNode state loads: JsonObject / JsonArray / JsonValue deserialize correctly instead of failing with missing parameterless constructors. (#​8048, #​186)
  • Interrupted marking on Mongo + Dapper: TryMarkInterruptedAsync companions keep Extensions stores aligned with Core’s interruption API. (#​187, #​188)
  • Dapper no longer restarts healthy work: BeforeLastUpdated is honored in the workflow instance filter so RestartInterruptedWorkflowsTask does not treat every executing instance as interrupted. (#​183, #​189)

⚠️ Breaking changes / upgrade notes

  • Required with Core 3.8.1: Hosts using Mongo or Dapper IWorkflowInstanceStore must take this Extensions patch (or implement TryMarkInterruptedAsync themselves) when bumping Management packages from Core 3.8.1.

🐛 Fixes

  • Fix MongoDB VariableSerializer dropping StorageDriverType when resolving against an empty default registry. (#​8047, #​185)
  • Register BSON converters for concrete JsonNode types so persisted workflow state round-trips. (#​8048, #​186)
  • Implement TryMarkInterruptedAsync on Mongo and Dapper workflow instance stores. (#​187, #​188)
  • Honor WorkflowInstanceFilter.BeforeLastUpdated in the Dapper store. (#​183, #​189)

3.8.0

Compare: 3.7.1...3.8.0


🌟 Highlights

  • Stable package alignment: Extensions consumes Elsa Core and Elsa Studio 3.8.0 stable packages. (66861ae082)

  • Package discovery: Extension manifests now identify their runtime as Server, helping platform tooling distinguish server packages. (d407e96217)

  • Webhooks: Webhook modules are consumed as packages instead of being built from this repository. (335a264953)

  • Publishing: Stable NuGet publishing uses the account that created the Trusted Publishing policy. (a44e2b09af)


⚠️ Breaking changes / upgrade notes

  • Source integrations: Elsa.Http.Webhooks and Elsa.Studio.Http.Webhooks sources have moved out of Extensions. Custom solutions that referenced these projects by path should use the corresponding package references, as the bundled hosts and OrchardCore integration now do. (335a264953)

🧩 Developer-facing changes

  • Manifests: Modules with shell features use Elsa.Platform.PackageManifest.Generator 0.0.1-preview.50 and include a Server runtime hint. (d407e96217)
  • Repository tooling: Local codebase-memory artifacts are excluded from Git. (224c81a222)

🔁 CI / Build

  • NuGet: The build project uses NuGet.Packaging 7.9.0. Trusted Publishing login selects the policy creator account. (7cfbea6234, a44e2b09af)

📦 Dependencies

  • Elsa: Core and Studio package references move from 3.8.0-rc2 to 3.8.0. (66861ae082)

🔒 Known dependency advisories

  • Hangfire SQLite storage: The existing Hangfire.Storage.SQLite dependency chain includes SQLitePCLRaw.lib.e_sqlite3 2.0.4, which is affected by GHSA-2m69-gcr7-jv3q. The SQLite backend is selected through UseSqliteStorage. This release does not remediate that dependency; deployments using it should review the advisory. The dependency's presence is not proof that the vulnerable SQL pattern is reachable through Hangfire.
  • MongoDB: Restore may report GHSA-6c8g-7p36-r338 for transitive SharpCompress 0.30.1. MongoDB's maintainer assessment states that the driver uses in-memory ZLib compression and does not call the affected archive-extraction API.

📦 Full changelog (short)

  • Add platform manifest runtime kind hints (d407e96217)
  • Add .codebase-memory/ to .gitignore (224c81a222)
    ... (truncated)

3.8.0-rc2

Full Changelog: elsa-workflows/elsa-extensions@3.7.1...3.8.0-rc2

3.7.1

Compare: 3.7.0...origin/release/3.7.1


Highlights

  • Quartz scheduling reliability: Ensures the durable Quartz job exists before scheduling workflow triggers, preventing trigger storage failures in Quartz-backed scheduling deployments. (#​7033, #​162)
  • Azure Service Bus entity-name pressure reduced: Shortens temporary MassTransit endpoint suffixes used by distributed cache change-token signals, workflow definition updates, and workflow cancellation messages so stable application instance names have more room within Azure Service Bus entity-name limits.
  • Elsa 3.7.1 package alignment: Updates Extensions to consume Elsa Core and Elsa Studio 3.7.1 packages.

Upgrade notes

  • No breaking changes are expected. Deployments using Quartz-backed scheduling should pick up the durable-job scheduling fix automatically.
  • Azure Service Bus deployments should combine this Extensions update with Elsa Core 3.7.1 stable application instance names to reduce restart-driven entity buildup and endpoint-name length pressure.

Fixes

  • Quartz: Creates or verifies the durable Quartz workflow job before scheduling a trigger so durable trigger scheduling no longer fails when the job has not been stored yet. (#​162)
  • MassTransit distributed cache: Shortens the change-token signal temporary endpoint suffix to elsa-tct to leave more room for configured application instance names. (e1ba7249b4)
  • MassTransit workflow messaging: Shortens temporary workflow definition update and workflow cancellation endpoint suffixes to reduce Azure Service Bus subscription-name pressure. (8ebaede7de)

Dependencies

  • ElsaVersion: 3.7.0 -> 3.7.1
  • ElsaStudioVersion: 3.7.0 -> 3.7.1

Tests

  • Added/updated Quartz scheduler tests covering durable job creation before trigger scheduling. (#​162)

Full changelog

  • e0142b576b - Ensure durable Quartz job exists before scheduling its trigger
  • 172669a945 - address greptile review feedback (greploop iteration 1)
  • 02de01c507 - Merge pull request #​162 from elsa-workflows/sfmskywalker-port-quartz-durable-job-370
  • e1ba7249b4 - Shorten change-token signal endpoint name
  • 8ebaede7de - Shorten temporary workflow endpoint names
  • 4e1658d4a7 - Update Elsa packages to 3.7.1

3.7.0

Compare: 3.6.1...origin/release/3.7.0


🌟 Highlights

  • Persistence providers now expose activity execution-chain lookups across Dapper and MongoDB, with additional activity execution record fields and migrations for diagnostics and runtime inspection. (d060d3acb8, 48abd83098, c34a90f991)
  • Shell feature support was expanded across MassTransit, Quartz, Webhooks, and related service configuration paths. (8c3999279b, a3bc531cda, f2b9b96dfb, 60e109d5a6)
  • Quartz scheduling received safer job deletion behavior, lifecycle ordering improvements, and focused test coverage for job key handling and service registration. (f5439bdcef, 889aaf41c5, 763e2f3c70, 2dfca8a2ca, 40cee1f372)
  • Package manifest metadata was added for extension packages, including infrastructure attributes used by package catalog tooling. (efec4a0d10, 9398b9409a)
  • Release packaging now consumes the stable Elsa Core and Elsa Studio 3.7.0 packages and applies the requested release version during dotnet pack. (52ba48b07a)

✨ New features

Persistence

  • Added GetExecutionChainAsync to Dapper and MongoDB activity execution record stores. (d060d3acb8)
  • Added activity execution and summary record fields plus migrations for the expanded record shape, including AggregateFaultCount. (48abd83098, c34a90f991, 22ee4208b4)
  • Added Dapper bookmark queue ID filtering. (52ac651377)

Shells and hosting

  • Added shell feature modules and MassTransit enhancements. (8c3999279b)
  • Added Quartz shell features for multi-database support. (a3bc531cda)
  • Added a Webhooks feature with service and configuration extensions. (f2b9b96dfb)

Package catalog

  • Added package manifest metadata for extension packages. (efec4a0d10)
  • Added infrastructure attributes to manifests. (9398b9409a)

🔧 Improvements

  • Refactored migration configuration to reduce duplication. (2b80470f71)
  • Refactored activity execution chain traversal and fixed infinite-loop risks in execution-chain lookup. (758946ad2d, 6329784d0b)
  • Refactored MassTransit transport configuration and feature setup. (86667fea28)
  • Refactored shell features to use FastEndpoints and updated service configuration flow. (60e109d5a6)
  • Updated Quartz feature dependencies to use QuartzSchedulerFeature and ResilienceFeature where appropriate. (20ff304125, f0ac7a3bb6)
  • Handled assembly load errors during feature discovery. (caa2295e18)

🐛 Fixes

  • Fixed activity execution-chain traversal so cyclic or repeated parent links do not produce infinite loops. (6329784d0b)
  • Added safety checks before deleting Quartz jobs and refined behavior for WorkflowGraphNotFoundException. (f5439bdcef, 889aaf41c5)
    ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Elsa.Studio from 3.6.3 to 3.8.4
Bumps Elsa.Studio.Agents from 3.6.3 to 3.8.4

---
updated-dependencies:
- dependency-name: Elsa.Studio
  dependency-version: 3.8.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: elsa-preview
- dependency-name: Elsa.Studio.Agents
  dependency-version: 3.8.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: elsa-preview
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 21, 2026
@greptile-apps

greptile-apps Bot commented Sep 21, 2026

Copy link
Copy Markdown

PR author is not in the allowed authors list.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants