version:8.8.0

Enhancements

Java Client

• Support handling GET requests with empty responses in the java client (#37243)
• Use OffsetDateTime for date-time fields in java client (#33678)
• Empty responses should not result in a null future in the client (#23075)

Misc

• Implement cursor pagination for V2 API (#33975)
• Support advanced state filtering in search user tasks API (#32717)
• Cover the entire user task lifecycle in secondary storage (#32562)
• I can search for users by a list of user names (#32373)
• Respond job kind and listener event type when activating jobs (#31905)
• Support advanced filtering in process definitions search endpoint (#31831)
• Align V2 REST variable endpoints regarding value (#31636)
• Agentic AI: implement fromAi FEEL wrapper function (#31258)
• Extend process definition search endpoint to include start form key in the item response (#31048)
• Add a new cluster change operation that updates the RequestHandling in RoutingState (#31010)
• Create and execute Benchmarking tests for Zeebe Batch operations (#29942)
• Batch operation observability through grafana dashboards (#29941)
• Enrich BatchOperation creation, scheduling and execution with necessary metrics (#29940)
• Enable operators to resume a suspended batch operation (#29891)
• Enable operators to pause (aka suspend) an ongoing batch operation (#29889)
• Enable operators to cancel an ongoing batch operation (#29888)
• Support cancel process instance batch operation execution (#29886)
• Support migrate process instances batch operation execution (#29885)
• Support resolve incidents batch operation execution (#29880)
• Rest APIs to Cancel/Pause/Resume Batch Operations (#29712)
• Rest API to create MigrateProcessInstance Batch (#29709)
• Rest API to create ModifyProcessInstance Batch (#29708)
• Extend RDBMS Exporter and SearchClient to support BatchOperation Monitoring (#29701)
• Add standalone backup manager to 8.8 release (main) (#29668)
• Pause command distribution retrying (#29495)
• Pass task headers to Execution Listeners (#29460)
• Support corrections on creating listener (#29124)
• Support resolving incident on creating listener (#29123)
• Continue flow after completing the creating listener (#29122)
• Take over changes made in 8.6 for the Standalone Schema Manager to the main (8.8) branch (#28989)
• Support corrections on canceling listeners (#28577)
• Support resolving incident on canceling listener job (#28576)
• Continue flow after completing the canceling listener (#28570)
• Trigger canceling task listeners on user task cancelation (#28568)
• [CPT] I can connect to a remote runtime (#25708)
• Improve Tasklist UX when listener blocks operation (#25421)
• [CPT] I can complete a user task (#25362)
• [CPT] I can complete a job (#25360)
• [CPT] Assert that a message was correlated to a process instance (#23291)
• [CPT] Assert that a process instance is not waiting for a message (#23257)
• [CPT] Assert that a process instance is waiting for a message (#23256)
• [CPT] Assert that a process instance has any incident (#23250)
• [CPT] Assert that a process instance has no incidents (#23249)
• [CPT] Assert that a process instance completed the given elements in order (#23191)
• [CPT] Generate a process coverage diagram (#23153)
• [CPT] I can mock business rule tasks (#23141)
• [CPT] I can mock call activities (#23140)
• Allow configurable backoff of retryCycle when a job fails (#21455)
• Cluster health endpoint (#20921)
• [CPT] I can mock job workers (#19262)
• [CPT] Generate a process coverage JSON report (#19257)

Bug Fixes

Broker

• Restoring from snapshot is not guaranteed to be durable (#28407)
• BpmnProcessingException: Expected to activate the none start event of the process but not found (#7669)

Java Client

• CI Fails Due to Deserialization Error from Added Field in /v2 Response (#34704)
• Client failure handling ends in Stackoverflow (#34597)
• [JavaClient] The Camunda cloud client builder sets the wrong REST address (#32759)
• Spring-SDK: camunda.client.tenant-id(s) is not picked up for worker setup in 8.7 (#32464)
• Zeebe client is not applying default ttl of 1h to REST request (#32320)
• Disabling camunda/zeebe client in SDK causes spring autoconfigure to fail (#32104)
• Unauthorized REST requests are retried forever when OAuth is used (#26012)

Misc

• Intermediate message event gets correlated even when a user doesn't have permissions (#39301)
• Incident icon and status not updated after resolving the incidents in Operate (#39267)
• Identity Migration should not lowercase tenantIds (#39260)
• Identity Migration app does not create MappingRule Authorizations for the Identity read/write permission in OIDC (#39250)
• User cannot filter tasks by Processes inside custom filters of tasklist using V2 API (#39197)
• Tasklist v2 tasks not loaded when includes large variable (#39189)
• Tasklist User loosing Task Read/Update Permission after Upgrade when RBA enabled (#39154)
• Identity Migration for SM uses user email instead of username for Role and Authorization assignment (#39088)
• When using MS Entra, tokens are always treated as clients due to complete intersecting claims (#39049)
• Required API response field 'tags' in process instance result should not be required (#38988)
• Cannot take native filesystem backup in an empty state (#38957)
• Gateway fails to load OpenAPI spec (#38875)
• Camunda Client IncidentFilter#creationTime is of type String instead of OffsetDateTime (#38827)
• Camunda Client ProcessInstanceSequenceFlow does not offer field sequenceFlowId (#38789)
• Camunda Client Process Definition Filter does not offer complex query for process definition name, but api does (#38780)
• Orchestration Identity Connectors role not enough permissions to create process instances (#38751)
• Bug: exporter args are not being set when created from the first time (#38731)
• Exporter disabled while it is failing keeps retrying to open (#38724)
• FNI and Variable aliases are used for V1 task search (#38696)
• Get decision instance by ID does not return evaluatedInputs and matchedRules (#38634)
• Dual region deployment would not work because camunda exporter cannot be disabled (#38593)
• Tasklist OpenSearch Archiver Missing Size Configuration in BucketSort Aggregation (#38520)
• No qualifying bean of type 'gatewayRestObjectMapper' error after recent JacksonConfig changes (#38487)
• Snapshot can be taken at processed position 0 only if forced exception is thrown unexpectedly (#38484)
• Write limit exhaustion blocks whitelisted commands from being written (#38454)
• Operate/Tasklist Zeebe ES/OS Clients and Importer modules are not disabled by default (#38342)
• [ad-hoc sub-process] Throwing BPMN error for AHSP job worker job is rejected (#38276)
• With disabled secondary storage, authorization assigned to groups are not applied (#38251)
• User Role permissions override RBA permission after 8.7 -> 8.8 cluster migration (#38227)
• BatchOperation Initialization fails on test clusters as unable to find a matching ResourceAccessController (#38214)
• Incorrect Swagger BasicAuth Visibility And 'Enable Swagger' Toggle Inconsistencies (#38206)
• Camunda Client doesn't use default tenant id for correlating messages (#38157)
• Rolling update test is failing when partition scaling is enabled (#38140)
• 404 on showing flownode instance popover details (#38131)
• Tasklist v1 API swagger UI is not accessible (#38114)
• Sort by Version fails after applying Process Instance filter (#38103)
• User creation fails in identity (#38094)
• Prefix Migration affects Zeebe indices (#38068)
• Failure to apply retention policy with too_long_http_line_exception error (#38033)
• Prevent storing sessions when using OIDC for API calls (#37983)
• CSRF is not supported in Swagger SaaS (#37950)
• Creating cancellation batch operations does not work for active process instances (#37928)
• Process message subscription events are not exported holistically (#37916)
• Partition join cannot complete in some failure cases (#37892)
• Regression: NPE in BrokerBasedPropertiesOverride when configuring exporter without args (#37880)
• REST API Gateway accepts invalid types and unspecified properties (#37865)
• spring-boot-starter-camunda-sdk 8.8 violates Spring behavior (#37808)
• Tasklist v1 task search: alwaysReturnFullValue ignored for variables >8 KB (value returned as null) (#37767)
• hasVariableSatisfies assertion fails on deserializing values written with a customized ObjectMapper (#37758)
• Zeebe replay fails on EvaluatedDecisionRecord after adding decisionEvaluationInstanceKey (PR #36772) (#37668)
• Unable to add a client ID to a role when it contains a valid characters (#37665)
• Zeebe batch operations can't be triggered from Operate due to API format change (#37631)
• I cannot log out of the Identity UI with a non-root servlet context path (#37616)
• restore primary storage fail due to missing BrokerBasedProperties (#37544)
• authentications is not refresh with api calls using the session cookie (#37539)
• Partition scaling is stuck with NullPointerException (#37495)
• Unknown Operation in cluster status response after partition scaling request (#37492)
• The workflow engine only applies an authorization if the owning entity is assigned to the tenant (#37489)
• A request matching both the configured user and the client claim should be treated as a client request (#37473)
• Some Java Client commands enable sending the request without providing all mandatory parameters (#37389)
• Incompatible Awaitlity version in dependency tree of Camunda Process Test Spring (#37384)
• Partially completed batch operations are not shown properly in Operate (#37365)
• OpenSearch ISM policy min_index_age is not updated after configuration change (#37361)
• Exporting backlog from 8.7 should exclude 8.8 fields from being serialized (#37343)
• Move filter criteria of V2 batch endpoints under a new filter root-level request attribute (#37332)
• User cannot filter by unassigned tasks inside custom filters of tasklist using V2 API (#37294)
• QueryBatchOperationTest is flaky (#37289)
• Unnecessary index template settings updates cause redundant PUT requests and startup overhead (#37240)
• MigrationSnapshotDirector should be closed and re-installed during role changes (#37234)
• Camunda Java Client obfuscates underlying 403 error in case of using an invalid path (#37232)
• With tasklist V2 API completed banner is not displayed (#37218)
• Camunda User Task with an incident cannot be migrated (#37190)
• C8Run Developer Quickstart authentication and authentication broken (#37179)
• Reduce the noise in schema-manager logs for nominal cases (#37164)
• Sorting doesn't work on some pages in FE (#37101)
• Identity Header redirects to 404 (#37100)
• [8.6][8.7] Investigate failing test ExporterDisableTest.exporterStaysDisabledAfterRestart (#37046)
• API without /v2 prefix returns 403 instead of 404 (#37041)
• Empty exporter record metdata prevents the ES/OS exporters resuming successfully (#37014)
• Scaling is marked as completed before all partitions update their routing state (#37004)
• Update error message for Modeler-to-Operate diagram access. (#36934)
• “Whitelabel Error Page” when navigating to Operate or Tasklist (#36932)
• NullPointerException when evaluating DMN with missing rule id (ruleId) (#36900)
• ScriptTask elements are missing in StraightThroughProcessingLoopValidator (#36895)
• NullPointerException in ExporterDirector (#36621)
• Operate/Tasklist API doesn't apply tenancy checks when configuring tenancy properties using kebab case (#36597)
• When we try to save a custom filter on Task List, it gives error "TypeError: crypto.randomUUID is not a function" (#36540)
• Incorrect Token Movement and Display in Multi-Instance Process (#36481)
• Mark undocumented v2 endpoint as @hidden (#36467)
• Optimize Public API does not deserialize export DTOs (#36419)
• UserController incorrectly implements specification (#36404)
• Migration app is not working with BYOG enabled (#36379)
• The error message is not displayed under the text field after deleting existing variable value (#36375)
• Changed variable value is not updated (#36368)
• An error message is not displayed when user inserts incorrect value into "Edit Variable" modal window (#36367)
• NPE in AuthorizationEntity.getResourceMatcher() (#36343)
• Initialize RoutingInfo when desired state is not present (#36219)
• Flaky test: UnassignUserTaskMigrationIT#shouldUnAssign88JobWorkerV1 (#36139)
• Identity doesn't display favicon in non-root context path deployments (e.g. SaaS) (#36134)
• Identity OIDC UI is not displayed in non-root context path deployments (e.g. SaaS) (#36130)
• An authenticated User-less principal may be granted randomly with authorizations (#36080)
• Align RESOURCE ValueType enum between 8.7 and 8.8 (#36057)
• Mapping errors on flow node instance APIs involving ad-hoc sub-processes (#36049)
• Race condition can result in error response to Tasklist V1 API operations (#36027)
• Batch Operation Search request returns error after performing Add Variable operation (#35998)
• [Authorizations] Enum value is not updated for the mapping rule (#35981)
• Batch Resource Authorizations are not created in the SaaS migration (#35749)
• SM Deleting One Mapping Also Deletes Other Mappings (#35673)
• Avoid recursion when building the element tree path to prevent StackOverflowException (#35661)
• Partitions are not bootstrapped after purge operation (#35650)
• Usage Metrics getActiveBucket NPE (#35642)
• When deploying forms with the same formId across different tenants, a wrong start form is returned (#35608)
• When a user is not authorized to get an entity by id/key, the response codes are not aligned (#35595)
• C8Run does not start when Opensearch is used (#35584)
• Overlapping IDs for child docs causing overwriting of records (#35549)
• CSRF token is not set on login response (#35482)
• No Explicit Error Mapping for Document Handling Endpoint: ${credentials.zeebeUrl}/v2/documents/${documentId}?contentHash (#35464)
• Identity Migration for keycloak is failing when resource based authorizations are disabled (#35451)
• userKey and tenantKey returned in GET endpoints of users/:username and tenants/:tenant (#35439)
• Identity Migration App fails on Console and Web Modeler Client Migration (#35431)
• When deleting a user, the user is not deleted from the column family storing users by key (#35404)
• When not being a member of any tenant, users can query all tenant-owned without any tenant check (#35403)
• V2 Authentication Endpoint returns userid and userkey instead of username (#35378)
• [Tenants UI] Hide Tenants tab and references in SaaS (#35326)
• [Tenants UI] Inconsistent error handling (#35289)
• Record#getAuthorizations is invoked by ElasticsearchExporter when exporting (#35178)
• Authorization field is printed in the log when an error is raised when processing a record (#35177)
• Parent instance not shown when call activity has incident in child process (#35169)
• Camunda exporter not catching up (#35080)
• WebApplicationAuthorizationCheckFilter registered too often (#35059)
• Tasklist V2 API does not return process name (#34961)
• Zeebe dashboard API panels only support global-view as data source (#34953)
• Changes to application authorizations, groups, roles, and tenants take only effect after re-login (#34698)
• When creating a user with username admin, any search query returns everything (#34677)
• [Authorizations] Permission picker does not reset after changing resource type (#34663)
• Batch Operation in Operate Doesn't Apply to All Selected Processes (#34610)
• Error message not shown on first form submission of creating initial admin user (#34496)
• [Tenants UI] Missing error banner on create request failure (#34479)
• Index validation wrongly applied to dynamic properties (#34478)
• Mapping Rules UI should not be displayed in SaaS deployments (#34475)
• Regression in metric zeebe_incident_events_total (#34342)
• /v2/deployments endpoint fails with >10 files in multipart request (#34322)
• handle PathNotFoundException when groupsClaim path is not found (#34292)
• Test SchemaManagerConcurrencyIT Fails When Run by Maven (#34229)
• RandomizedRaftTest.livenessTestWithSnapshotAndSingleRestart failure (#34209)
• NPE at evaluation of job worker properties of Send Task with Publish Message implementation (#34190)
• Failure to start if OIDC provider is unavailable (#34189)
• [Tenants UI] Missing input field validation for the Tenant ID (#34152)
• [Authorizations] RPA role has an Unspecified OwnerType (#34144)
• ExporterDirectorTransitionStep does not shut down gracefully when startup process is interrupted (#34142)
• Concurrency problem in CommandRedistributor (#34083)
• Operate v1 API is not returning result field in search responses (#34069)
• Missing Routing Column family in bootstrapped snapshot (#33978)
• Distributed commands are not distributed once a partition becomes active (#33960)
• S3 Backup store does not limit the number of concurrent downloads (#33957)
• Process instances get started from non-start event instead of signal event (#33952)
• [Authorizations UI] Batch operation permission list is incomplete (#33914)
• Missing RepositorySettings.location error in Optimize backups (#33905)
• Leader does not replicate the snapshot to follower (#33889)
• Backport the fix for ES templates getting overwritten during rolling update (#33881)
• Identity Group Users Response does not contain email addresses (#33860)
• Remove text-overflow: ellipsis from users table under roles in Identity (#33772)
• Thread starvation risk when taking backup on S3 (#33726)
• Include all states in PI stats OR filter (#33700)
• Unable to deploy process with boundary event without outgoing flows (#33589)
• Operate cannot deserialize IN_PROGRESS snapshot state in Opensearch (#33516)
• Zeebe's backup fails if a new snapshot is created before the snapshot is reserved (#33499)
• Cannot re-add variable with the same name after failed ADD_VARIABLE operation using Operate UI/REST-API (#33337)
• Process execution listener jobs are not cleaned up correctly (#33237)
• App switcher doesn't work in Operate/Tasklist/Identity (#33212)
• User owner type hidden incorrectly in authorization creation modal (OIDC mode) (#33211)
• CommandDistributionIdempotencyTest results in a segmentation fault (#33186)
• User tasks cannot be completed through the Tasklist V1 API when authentication with an M2M client. (#33185)
• BpmnProcessingException on activating boundary event of ad-hoc sub-process (#33146)
• Failed to dispatch message due to class ProtocolRequest cannot be cast to class ProtocolReply (#33127)
• Spring Boot Starter Camunda SDK ignores ZEEBE_CLIENT_CONFIG_PATH (#33120)
• Canceling user task during transition does not reject ongoing request, leading to timeout exception on a client side (#33024)
• Rawdata report settings tab is not scrollable (#32775)
• Optimize variable importer only parsing dates nested in objects (#32714)
• [Groups UI] Table assign user button does nothing (#32577)
• java.lang.ClassCircularityError: jdk/internal/misc/VirtualThreads thrown by grpc-virtual-executor (#32572)
• [Groups/Tenants] All existing users are getting assigned to the entity (#32534)
• Extra Backslashes Escaping Variable Values in Operate (Regression from 8.8) (#32439)
• Process KPI not showing when an end even is selected (#32432)
• [Tenants] Cannot assign users to default Tenant due to illegal character in tenantId (#32421)
• Backup restore fails due to lost+found (#32393)
• [Tenants UI] delete tenant prompt message is malformed in modal dialog (#32377)
• Security filter chain conflict (#32368)
• [Tenants] Demo user cannot delete tenant (#32340)
• Performance issue with v1 tasks search (#32336)
• Outputs of multi-instance expanded sub-process are executed twice for each iteration (#32318)
• Identity index IDs are not unique enough (#32252)
• Optimize focus accessibility not working properly with Actionable Notification component (#32245)
• Wrong selection of process instances in process instance migration (#32201)
• Role key is returned from the Role API (#32175)
• Operate Opensearch importer throws IllegalFormatConversionException (#32122)
• OpenAPI spec for cluster api contains wrong Accept-Content header (#32023)
• UI: Incorrect user search prevents assignment in OIDC setups (#32021)
• SchemaManager does not update mappings and settings of archive indices (#32018)
• Spring SDK: Job Worker tenantIds values are overridden by global defaults (#32015)
• CamundaExporter starts exporting before being opened (#32009)
• OpenSearch AWS auth config can't be disabled (#32007)
• Add all ScaleUpOperation to operations of ScaleRequestTransformer (#31994)
• Active tokens on a migrated process instance are not displayed in process instance page (#31985)
• [Tenant] AuthorizationRequest constructor provides wrong tenant id for tenant ownership check (#31977)
• Member types for roles are not filtered correctly in the gateway (#31960)
• identity UI doesn't consider context path. (#31956)
• ProcessDefinitionController#getStartProcessForm does not handle missing forms (#31935)
• Deserialization errors in Exporter are retried to aggressively (#31919)
• [CPT] Invocation of close method failed on bean with name 'proxiedCamundaClient' (#31860)
• Multi-Instance body does not complete if the amount of items in the input collection is changed dynamically (#31837)
• Export JOB records by default (#31798)
• Canceling process instance via CamundaClient(REST) doesn't propagate operationReference to Zeebe (#31758)
• Date and Time seconds are ommited in certain expressions (#35658)
• Process cancel operations in Operate remain in "SENT" state when user task has "canceling" listeners (#31701)
• [Groups] Search user by group throws ClassCastException (#31630)
• [Tenants] New user cannot read users of a Tenant (#31621)
• [Authorizations] Incorrect error message on deploy (#31620)
• App visible to all users regardless of roles (starting from 8.8) (#31600)
• [Groups API] groupKey is set to '-1' after update request (#31578)
• I can deploy an ad-hoc sub-process with an intermediate catch event without outgoing sequence flows (#31576)
• Exception message on unexpected instance migration error displays the wrong key (#31541)
• Failed to install partition: partitionCount <= 0 in RoutingInfo.MessageCorrelation (#31534)
• Dead partition because of duplicated keys in Column Family (#31512)
• NPE in ProcessInstanceBatchActivateProcessor.createChildInstanceRecord (#31511)
• RaftException$AppendFailureException: Leader stepping down (#31436)
• Dependency update broke the navigation flow for Identity (#31434)
• Command batching issue - Error handling mechanism doesn't work when used in follow-up commands (#31335)
• [Authorizations UI] Success message is shown on the failed request (#31282)
• [Authorizations UI] userKey is used and shown as Owner ID instead of username/userId on creation (#31280)
• Incidents in incident notifier does not include process version (#31192)
• [C8 API] PI search & PD statistics incidentErrorHashCode is not working with $or filters (#31180)
• Segfault in CommandRedistributor (#31151)
• First retried task listener after EXTRACT_VALUE_ERROR incident loses original command context (#31089)
• High memory usage for batch file upload in GCP (#30930)
• [C8 API] Operate PI List requires filtered flow nodes (#30906)
• Exception in archiving of batch operations (#30877)
• Warnings related to bean is not eligible for getting processed by all BeanPostProcessors and MeterFilter is being configured after a Meter has been registered to this registry. (#30812)
• Rolling update can result in a temporarily DEAD partition (#30727)
• [Groups UI] Error banner on the create modal does not reappear after dismissal (#30717)
• Variables add/update operations in Operate remain in "SENT" state when user task has "updating" listeners (#30686)
• Infinite redirects between Optimize and Identity if too many groups used (#30637)
• [Tenant] Wildcard permission grants user read access to the tenant's specific resources in Tasklist (#30551)
• Do not use KeyGenerator in scheduled task (#30536)
• Search Process Definition does not filter by version tag (v1 API) (#30374)
• Create group endpoint doesn't handle properly the description = null (#30371)
• [Pagination UI] Adjust counter value for the pagination visibility check (#30369)
• Tasklist SNAPSHOT is unhealthy on INT (#30275)
• Instance view table is not working for grouped by process reports (#30167)
• Snapshot replication from a diverged cluster can overwrite committed data (#30057)
• Variable updates with "propagate" semantic are not supported for User Task elements (#30053)
• Inter-partition message correlation failing when the partition count is changed in the configuration (#29612)
• Access to tenant is hardcoded for all users and mappings (#29518)
• Elasticsearch REST client resource leak (#29146)
• User Task Restrictions Not Working as Expected (#28976)
• [Spring SDK] Bring back ZeebeWorkerValueCustomizer class (#28657)
• webapps_backups thread are not stopped gracefully when terminating the application (#28464)
• Tasklist is not handling rejection/delays of listeners (#27846)
• Operate doesn't indicate the presence of incidents in collapsed subprocesses (#27309)
• Unable to scroll through long list of listeners in Operate (#26828)
• Tenant assignments via groups are not included in authorization checks (#26574)
• BPMN model with missing element ID fails with NPE during deployment (#26248)
• ElasticsearchExporterException: Failed retrieving mappings from index/index templates with pattern (#25811)
• RuntimeException: Expected to activate jobs of type '..', but no jobs available and at least one broker returned 'RESOURCE_EXHAUSTED' (#25806)
• U is not a function Error displaying when deleting a Report (#25078)
• Delete process definition button is not shown when a specific tenant is selected (#25068)
• Unrecoverable errors when updating state are not handled correctly (#24675)
• Applying Index setting index.routing.allocation.require._name blocks Optimize start up (#24642)
• Output mappings applied before updating multi instance body output collection (#23658)
• Backups use partition count from ClusterConfiguration (#21470)
• Unexpected error while transforming resource (#14040)
• Retry and cancel options can apply in all the processes via the operations menu. (#32971)

Maintenance

• Refactor BatchOperation Scheduler for better modularity (#36751)
• CI: migrate rdbms-integration-tests GHA workflow into Unified CI (#30822)
• Adjust C8 OpenAPI from flow node to element (#30737)
• Remove default empty string from RoleRecord.roleId property (#30140)
• Remove default empty string from GroupRecord.groupId property (#30139)
• Remove default empty value from UserRecord.username, TenantRecord.tenantId and MappingRecord.mappingId (#30137)
• RDBMS Exporter should work with roleId (#30127)
• Support removing tenants from roles (#30123)
• Support adding tenants to roles (#30122)
• Support removing roles from groups (#30121)
• Support assigning roles to groups (#30120)
• Remove entity processor/applier works with roleId (#30117)
• Add entity processor/applier should work with roleId (#30116)
• Delete role processor/applier should work with roleId (#30114)
• Update role processor/applier should work with roleId (#30113)
• Remove the entityKey property from the RoleRecord (#30111)
• Create role processor/applier work with roleId and description (#30109)
• Validate role id in gateway (#30089)
• Remove role from tenant by id (#30088)
• Add role to tenant by id (#30087)
• TenantRemoveEntityProcessor allows removal of tenants from Groups (#30054)
• Remove a group from a mapping using ids instead of keys (#30048)
• Unassign group from role using ids (#30039)
• Unassign mapping from role using mapping id and role id (#30037)
• Unassign user from role using username and role id (#30036)
• Assign role to group using id instead of key (#30035)
• Assign mapping to role by id instead of key (#30034)
• Assign user to role by role id and username (#30031)
• Delete role using id instead of key (#30023)
• Update role by id instead of key (#30018)
• Get role by id instead of key (#30016)
• Create Role including roleId and respond with full Role object on Role creation (#30014)
• Improve observability of importer completion (#29913)
• Remove distribution from the IdentitySetupInitializeProcessor (#29810)
• Reject correcting assignee on creating listener with assignee defined in model (#29126)
• Reject completion of creating listener job with denied (#29125)
• Set assignee on the creating event (#29121)
• [After 8.7 Release] Enable Update Tests (#27333)
• [CPT] Run integration tests with current Docker image (#26612)
• Unknown channel option 'SO_SNDBUF' (#26396)
• Display REST API server metrics in Zeebe dashboard (#17442)

Documentation

• Document intellij workaround for large GatewayOuterClass file size (#36041)
• Metrics : getting started guide for dev handbook (#34027)
• [OpenAPI] Add/Improve the description of batch document uploads (#31027)
• Update the contributing guide with info for Apple silicone chip (#30898)

Merged Pull Requests

• test: integrate migration with management identity 8.8-SNAPSHOT (#39199)
• fix: archiver blocking flag being reapplied (#39192)
• fix: retry condition (#39184)
• fix: grant taskuser wildcard permissions even if RBA was enabled (#39156)
• pg/fix-retry-condition (#39149)
• pg/split-prefix-migration (#39126)
• fix: do not log at error for known ClassCastException related to 8.7 heartbeats (#39125)
• feat: implement preference configuration for username clientid claim (#39068)
• feat: do not flood the logs with ClassCastException, but only log it once every 5 minutes (#39042)
• fix: add rest-api.yaml to JAR for swagger (#39023)
• feat: remove scaling_enabled feature flag (#38969)
• Fix error when taking a backup with the native file system store (#38959)
• fix: add missing default value for grpc address in unified configuration (#38944)
• fix: second PVC Disk usage panel fixed with benchmark PVC name (#38932)
• fix: send a request to all partitions before marking scaling as completed (#38894)
• fix: expose advanced filters for ProcessDefinitionFilter (#38891)
• fix: reserve latest snapshot as soon as possible (#38882)
• fix: restore app can start successfully (#38866)
• fix: add usage metric archiving partition ID handling (#38863)
• ci: run zeebe-client-java unit tests (#38856)
• Allow default connectors role to create process instances (#38834)
• fix: do not enforce write limits for whitelisted commands (#38812)
• deps: update spring and spring-security (#38811)
• Add missing sequenceFlowId in the response (#38800)
• test: fix flaky PrefixMigrationIT (#38797)
• [Backport stable/8.8] perf: reduce the max terms count to 10_000 (#38760)
• fix: unified config: Camunda exporter args are not set when created for the first time (#38732)
• fix: do not retry opening disable exporter (#38729)
• ci: increase timeout for changelog generation (#38722)
• fix: FNI and Variable aliases are used for V1 task search (#38707)
• fix: match on base package of target type not context class (#38706)
• perf: reduce the max terms count to 10_000 (#38695)
• refactor: remove C8 Orchestration Cluster E2E Tests Release Validatio… (#38658)
• fix: refresh token exchange should build client assertion when client auth method is private_key_jwt (#38651)
• fix: Get decision instance by ID does not return evaluatedInputs and matchedRules (#38648)
• Adding redirect to / to avoid error on concurrent login (#38637)
• fix: skip snapshot when nothing processed and not forced (#38624)
• test: Identity e2e As an Admin user I can unassign role from user (#38611)
• [Backport stable/8.8] Fix: Add network configuration for localhost (#38609)
• Fix: Add network configuration for localhost (#38608)
• feat: unified config: add option not to enable the camunda exporter (#38604)
• Remove enableIdentitySetup flag (#38599)
• ci: update release-e2e-tests workflow (#38571)
• fix: conditional jackson converter setup (#38566)
• pg/tenant-based-importer-completion (#38541)
• fix: align operate/tasklist usage metrics search with new api (#38533)
• test: use 8.7-SNAPSHOT for migration tests (#38531)
• [Backport stable/8.8] fix: enable archiving and ILM applying for usage metrics indices (#38522)
• [Backport stable/8.8] Only username and password should be mandatory on user creation (#38514)
• Close resources when schema is not ready (#38502)
• Reuse clients in BackgroundManager Repositories (#38499)
• Close HTTP clients used for Incident update tasks (#38496)
• Close virtualThreadPool in SchemaManager (#38495)
• fix: show validation error on empty variable modification value (#38485)
• [Backport stable/8.8] fix: change session creation to never in security filter for api path in oidc (#38483)
• feat: unified config: do not patch zeebe OS client with DB URL (#38477)
• [Backport stable/8.8] feat: unified config: do not patch zeebe client with DB URL (#38471)
• fix: enable archiving and ILM applying for usage metrics indices (#38467)
• [Backport stable/8.8] fix: prevent 404 when showing flownode instance popover details (#38465)
• feat: unified config: do not patch zeebe client with DB URL (#38459)
• fix: prefer client claim over username claim in GRPC code paths (#38448)
• [CPT] feat: Improve process coverage (#38445)
• [Backport stable/8.8] fix: determine element incident status from incident field (#38442)
• Add the strong specification into the monorepo (#38440)
• On user update ensure only mandatory fields are verified (#38429)
• fix: map correctly operation in pendingOperations.completedChange (#38422)
• ci: adjust API codeowners (#38420)
• fix: use LAX concurrency policy to mitigate stackoverflow in client (#38402)
• fix: use new orchestration value (#38398)
• refactor: add more info to API header (#38397)
• deps: Update swagger-parser to 2.1.22 (#38396)
• ci: reenable optimize e2e tests (#38366)
• fix: usage metrics date example and description (#38363)
• Add additional log for root causing (#38355)
• fix: prevent 404 when showing flownode instance popover details (#38352)
• fix: apply default client config to all commands (#38351)
• fix: change session creation to never in security filter for api path in oidc (#38347)
• test: evaluate decision definition (#38346)
• test: get decision definition (#38345)
• test: search decision definition (#38344)
• Only username and password should be mandatory on user creation (#38338)
• [CPT] Remove client config options (#38283)
• fix: allow throwing a BPMN error from an ad-hoc sub-process job (#38281)
• fix: identity: add context path handling in client (#38278)
• fix: null-checks in OptimizeElasticsearchClient (#38271)
• fix: refactor usage metrics (#38270)
• [CPT] Minor improvements for multi-tenancy (#38262)
• build: add testing/.gitignore to exclude node modules (#38252)
• [CPT] test: Improve the stability of test case (#38246)
• fix: ensure groups claim value is included in broker request auth (#38236)
• refactor: provide broker request authorization (#38232)
• fix: Elasticsearch Memory Leak (#38231)
• fix: change tenant check logic in engine to match search layer behaviour (#38229)
• fix: configure ResourceAccessController beans regardless of having the gateway embedded (#38225)
• Add tenant and authorization checks on job push (#38224)
• fix: disable destroy method for proxy clients (#38223)
• fix: handle StartPartitionScaleUp conversion to response (#38222)
• feat: create CPT metadata for autocompletion (#38219)
• fix: Failure to apply retention policy with too_long_http_line_exception error (#38218)
• feat: bubble JsonProcessingException to the caller so that assertion errors are more informative (#38217)
• fix: incorrect Swagger BasicAuth Visibility And 'Enable Swagger' Toggle Inconsistencies (#38207)
• feat: improved error messages for when clock api is disabled and fail fast if remote runtime is unhealthy (#38197)
• fix: update logic for mutation request body building (#38189)
• fix: make RoutingState backward compatible between 8.8 and 8.7 (#38184)
• fix: failing to create user due to broken API call (#38162)
• feat: default number of ES replicas to 1. (#38160)
• fix: json mapping errors in cpt due to ignored mapping configuration (#38147)
• [CPT] Complete user task by BPMN element ID (#38122)
• fix: show missing permissions in modal (#38102)
• [CPT] feat: Improve process instance selector description (#38101)
• test: add version for filtering (#38100)
• fix: add RoleValidator and use jwt decoder in ID token filter (#38097)
• feat: implement private_key_jwt client assertion customization (#38079)
• Adding ~ char to default ID regex (#38076)
• ci: remove unused PR labeler rules for component/... labels (#38069)
• fix: allow taking forced snapshot at position zero (#38053)
• El aws config (#38052)
• test: skip tests until bugs are fixed (#38038)
• feat: handle es/os meta properties (#38037)
• refactor: cleanup created users and roles after tests (#38036)
• Test and fix OIDC client and anonymous access to Operate/Tasklist V1 APIs (#38000)
• refactor: add logging for terms aggregation bucket count warnings (#37995)
• fix: synthesize missing ruleId to prevent NPE during decision evaluation (#37992)
• fix: search clients proxy is not injected to broker when no embedded-gateway is configured (#37991)
• [CPT] feat: Add example for multi-tenancy test (#37987)
• feat: enable partition scaling feature by default (#37978)
• fix: ensure completing retry of join request to a single member cluster (#37977)
• [CPT] Improve message assertions (#37973)
• fix: shade Awaitility 4.3 to prevent version conflicts with Spring Boot (#37968)
• fix: c8run dont override connector upstream config (#37941)
• fix: export and support correlated and deleted subscriptions (#37927)
• fix: handle partially completed and failed batch operation states in Operate UI (#37907)
• fix: don't rewrap client exceptions (#37906)
• fix: correct zeebe incident events metric name (#37900)
• feat: added correlated message assertions (#37897)
• fix: configure jackson mapper to fail for unknown properties in the REST request and disable coercion (#37895)
• fix: uc: allow null exporter arguments (#37887)
• deps: Update dependency io.netty:netty-bom to 4.1.127.Final (#37883)
• refactor: cleanup created groups after tests (#37879)
• feat: camunda spring boot starter: respect prototype beans (#37878)
• fix: update operate application yml with the new config structure (#37875)
• fix: support compensation of ad-hoc sub-process (#37873)
• test: increase timeout in docker test (#37872)
• test: ensure that backup doesn't fail due to snapshot on leader change (#37868)
• feat: accept create documents metadata in req (#37860)
• fix: set missing Zeebe OpenSearch/Elasticsearch URL in unified config (#37842)
• Fix unassign group from tenant command to follow the agreed pattern (#37835)
• test: fix network disconnect test (#37834)
• feat: remove gateway address (#37817)
• feat: add csrf support for swagger (#37812)
• fix: determine element incident status from incident field (#37805)
• test: fix flakiness in SchemaUpdateIT (#37802)
• Add correlated message search to Java SDK (#37801)
• fix: Fix Flaky OpenSearch IT (#37775)
• fix: handle >8KB vars with full value (#37771)
• refactor: use v1 endpoint for incident resolution (#37765)
• fix: log code and reason on camunda client completed exceptionally response (#37760)
• fix: update diagram, history and variables panels behavior (#37759)
• feat: add executor queueCapacity to unified configuration (#37742)
• Fix Zeebe replay EvaluatedDecisionRecord (#37716)
• Ensure one principle identifier is set (#37686)
• Create V2 correlated message search API (#37685)
• fix: add missing monaco editor contributions (#37679)
• refactor: create and own executor service as part of store (#37677)
• Split zeebe-client-java and camunda-client-java into individual modules (#37638)
• fix: update batch operation request format (#37635)
• fix: incident resolutiona and cancellation batch operations schemas (#37634)
• test: clean-up SchemaUpdateIT after the upgrade to 8.9.0-SNAPSHOT (#37633)
• Java Client: ensure all mandatory parameters are provided for the commands (#37629)
• Catch straight through processing loops with script tasks (#37627)
• ci: fix tasklist makefile (#37624)
• feat: enable multitenancy for CPT tests (#37623)
• Prevent NPE during snapshot bootstrap (#37605)
• Export correlated messages to RDBMS (#37604)
• ci: ensure credentials are available to allow pushing (#37601)
• build: update docker file for OC test suite (#37589)
• add default.yaml config to c8run (#37568)
• fix: refresh session's authentication on api calls (#37563)
• feat: all selectors (of the same type) can now be combined (#37560)
• build: remove unused identity spring boot starter from operate/tasklist (#37555)
• fix: update identity image configuration to the latest (#37546)
• feat: add parent process instance selector (#37540)
• feat: support multiple OIDC providers (#37534)
• refactor: moved some classes to generic client package to enable later adoption for other enterprise frameworks (#37529)
• refactor: replace @vzeta/camunda-api-zod-schemas with @camunda/camunda-api-zod-schemas (#37523)
• Support RFC 8707 (#37522)
• Export correlated messages in ES/OS (#37500)
• All in one migration application (#37491)
• fix: update request filters calculation logic (#37488)
• ci: disable conistently failing optimize e2e sm test (#37481)
• fix: fix unassigned and tenant filters on Tasklist v2 (#37474)
• fix: opensearch ism policy min_ingex_age change (#37471)
• Camunda User Task with an incident cannot be migrated (#37470)
• fix: enhance usage metrics processing and state management (#37467)
• fix: prevent setup oidc when the auth method is set to basic. (#37461)
• feat: filter runtime backups by prefix (#37460)
• fix: fix task completion notification on V2 Tasklist (#37453)
• Feature/23153 generate process coverage diagram (#37451)
• ci: support tasklist v2 mode (#37438)
• fix: remove confusing enum type and API tag (#37437)
• test: cleanup IncidentNotifierIT resources (#37409)
• test: stabilize flaky role migration acceptance tests (#37397)
• fix: protect api resource only and not all (#37395)
• ci: allow SNAPSHOT upload on future stable branches (#37372)
• fix: adjust camunda repo with latest identity changes (#37352)
• feat: enhance v2 tasklist api with processName (#37348)
• Exclude 8.8 fields from being serialized for 8.7 records (#37346)
• 35673 ensure identity entities are returned as a copy (#37344)
• feat: adjust CI test names and consolidate CI files (#37338)
• fix: move filter criteria of v2 batch endpoints under a new filter root level request attribute (#37336)
• fix: re-install MigrationSnapshotDirector on each role transition (#37333)
• test: fix flaky TasklistV1ApiUserTaskPermissionsIT (#37329)
• ci: add OC workflow for 8.8 releases (#37326)
• feat: implement private_key_jwt client authentication for the OIDC authorization code flow (#37322)
• Disable importers in 8.8 (#37300)
• fix: map batch operation types correctly (#37290)
• feat: support handling get requests with empty responses in the java client (#37244)
• Feature/35308 cpt client configuration (#37239)
• fix: ensure backup manager uses dynamic partition count (#37229)
• fix: add missing metadata name to Maven module (#37227)
• fix: update index template settings only when they change (#37217)
• fix: Reduce the noise in schema-manager logs for nominal cases (#37215)
• [Backport main] test: remove pre-condition that snapshot do not exists (#37208)
• UC: secondary storage properties (#37207)
• test: remove pre-condition that snapshot do not exists (#37203)
• feat: add cluster health endpoint (#37189)
• 32400 remove unused operate v1 internal (#37182)
• fix: hasDuplicateElementsToActivate should be removed in AdHocSubProcessInstructionActivateProcessor (#37177)
• refactor: improve OperateMetricMigrator & extract common logic (#37174)
• Ensure snapshots can be committed after migration (#37165)
• feat: implement CamundaClient test for private key JWT auth mechanism (#37154)
• refactor: do not print out record in error responses (#37152)
• test: cannot start a process instance inside of a ahsp (#37077)
• feat: enhance OpenAPI documentation for usage metrics endpoints (#37071)
• fix: add RoleValidator and use jwt decoder in cookie filter (#37039)
• fix: handle exporter opening if record counters are not present in me… (#37012)
• feat: reduce number of unneeded put settings calls greatly (#36961)
• feat: Make command distribution retry intervals configurable (#36790)
• Show ad-hoc sub-process inner instances in instance history (#36782)
• [CPT] fest: Improve connectors integration test (#36744)
• feat: Add task migration submodule (#36699)
• Use new thread pool from ApiServicesExecutorProvider (#36517)
• feat: unified config: migrate secondary-storage database properties: type and URL (#36514)
• feat: merge user RocksDB config with our defaults (#36502)
• Introduce dedicated process instance permissions for cancel and modify (#36437)
• Set owner type on authorizations of default RPA role (#36252)
• feat: Enable configurable priority for zeebe-record Index templates (#36207)
• fix: prevent NPE for SendTask with publish message implementation (#35880)
• [Backport stable/8.7] Golden event appliers (#35688)
• [Backport stable/optimize-8.6] deps: upgrade spring version to fix CVE-2025-41234 (#35672)
• fix: Qualify Operate's OpenSearchAsyncClient in OpensearchArchiverRepsitory (#35587)
• feat: Rename batchOperationId to batchOperationKey (#34772)
• refactor: add feature flag for Listeners component in Operate (#34212)
• Test on-demand workflow eight six (#34207)
• fix: added result to Operate v1 DecisionInstance response (#34076)
• fix: skip deserialize when verifyRepositoryExists (#33906)
• [Backport stable/8.7] Resurrect Operate and Tasklist backup restore CI (#33751)
• Resurrect Operate and Tasklist backup restore CI (#33621)
• fix: Operate cannot deserialize IN_PROGRESS snapshot state in Opensearch (#33520)
• [Backport stable/8.6] Golden event appliers (#32787)
• [Backport main] perf: improve v1 tasks search by variables (#32591)
• [Backport stable/8.5] Golden event appliers (#32584)
• ci: run operate importer tests on PR (#32570)
• [stable/8.7] fix: assemble worker default tenant id config correctly (#32475)
• feat: when a migration is performed try to perform a snapshot immediately (#32388)
• perf: improve v1 tasks search by variables (#32346)
• fix: make publishMessage via REST pickup the default timeToLive (#32326)
• fix: Operate Opensearch importer throws IllegalFormatConversionException (#32123)
• Perform Incident notification on the background (#31937)
• feat: Snapshot reservation can be persisted locally in the node (#31936)
• Use job key in migration error message (#31552)
• [stable/8.6] fix: removal of meter registry workaround (#31168)
• [Backport stable/8.7] fix: Quote changelog variable (#28426) (#31101)
• In operate's backup repositoryName and snapshotName are swapped (#30878)
• feat: add pattern queryparam to BackupController list API to filter snapshots in ES/OS (#30833)
• add verbose flag to operate backup list API to improve performance if verbose=false (#30730)
• fix: switch to n2-standard-4-stable (#30722)
• Improve archiving performance (#30684)
• fix: do not set the commitIndex to be greater than biggest logIndex (#30354)
• Backport 25280 to stable (#27487)