What's Changed

• build: merge back Optimize 8.7.30 release into stable/optimize-8.7 by @OmranAbazid in #67154
• [Backport stable/optimize-8.7] fix: distrust emSign Root CA - G1 in optimize image (CVE-2026-114820) by @monorepo-devops-automation[bot] in #68038
• [Backport stable/optimize-8.7] ci: run Optimize backend tests on pom.xml changes by @monorepo-devops-automation[bot] in #68387
• deps: bump Zeebe and Identity for Optimize 8.7.31 release by @OmranAbazid in #68546

Full Changelog: 8.7.30-optimize...8.7.31-optimize

What's Changed

• build: merge back Optimize 8.6.28 release into stable/optimize-8.6 by @OmranAbazid in #67915
• fix: distrust emSign Root CA - G1 in optimize 8.6 image (CVE-2026-114820) by @konstantinos-mylosis in #67894
• fix: stop double gzip decoding in OpenSearch client by @danielkelemen in #67933
• ci: run Optimize backend tests on pom.xml changes by @OmranAbazid in #67926
• deps: bump Zeebe and Identity for Optimize 8.6.29 release by @OmranAbazid in #68545

Full Changelog: 8.6.28-optimize...8.6.29-optimize

version:8.10.9

Bug Fixes

Misc

• Default camunda.operate.tasklist-url resolves to //tasklist when the context path is / (#68030)
• Stream transport logs every stream open and remove twice at DEBUG, dominating broker log volume (#68029)
• Optimize collections, reports and dashboards are missing after SaaS upgrade to 8.10 (#67927)
• Closing a document stream early does not end the download when the server sends nothing more (#67791)
• Closing a document download stream early does not stop the download (#67657)
• Camunda exporter cannot keep up with DMN decision evaluations: exporter thread is CPU-bound in DecisionEvaluationRecord.getEvaluatedDecisions() (cost grows quadratically with the number of evaluated decisions) (#67630)
• Breadcrumb switcher links render in Carbon blue in Optimize and Operate (#67596)
• Time-range restore is rejected when no secondary storage is configured (#67593)
• Operate: Prevent selecting a multi-instance subprocess as a move target from outside its body (#67592)
• Cached DMN decisions retain the whole DMN XML model in memory (#66972)
• Leftover bootstrap snapshot directory makes new partitions start without global state (#66656)
• Usage metrics TU statistics request fails with NPE when search response has no aggregations (#66409)
• [Flaky] Operate E2E miSubprocessModifications.spec.ts: prevent moving elements into a multi-instance body (#66068)
• Job activation runs up to three sequential RocksDB prefix scans per poll (#65772)
• Batch suspend, resume and cancel discard caller-supplied state and parent key filters (#64566)
• Batch operation execution heartbeat log message is missing the partition number (#64277)
• Batch cancel, modify, migrate and incident-resolution apply the state filters the API documents as ignored (#60874)
• OpenAPI v2 spec fails oas3-schema linting: duplicate "page" in required of Job Statistics result schemas (#55782)
• It should not be possible to assign/unassign mapping rules from roles/groups in SaaS (#38193)
• Create incident when timer duration is too large (#13880)

Task

• [API Governance] Require x-eventually-consistent on every operation in the OpenAPI spec (#66951)
• Prevent the pending subscription checkers from acting on stale entries (#65928)
• Refactor archive by id code related to streaming out a list of documents from indexes using a query (#64444)
• Make job-related processors PROCESS on resuming (#62715)
• Translate RDBMS connection failures into CamundaSearchException (#61220)

Merged Pull Requests

• ci: record build status and resource usage for more jobs (#67948)
• deps: Update jdx/mise-action action to v5.2.4 (main) (#67811)
• fix: restore by time range when no secondary storage is configured (#67609)
• [Backport stable/8.8] test: cover incident endpoint authorization for under-privileged users (#67488)
• fix: stream documents larger than maxMessageSize to readers slower than the network (#67423)
• fix: hide and reject managing role and group mapping rules where they can't be managed (#66734)
• fix: default Operate tasklist-url when Tasklist is served in-app (#65257)
• fix: reject conflicting top-level state in batch modify, migrate and resolve-incident (#64070)
• deps: update Surefire plugin version to 3.5.6 (#61630)

version:8.9.28

Bug Fixes

Misc

• Default camunda.operate.tasklist-url resolves to //tasklist when the context path is / (#68030)
• Closing a document stream early does not end the download when the server sends nothing more (#67791)
• Closing a document download stream early does not stop the download (#67657)
• Camunda exporter cannot keep up with DMN decision evaluations: exporter thread is CPU-bound in DecisionEvaluationRecord.getEvaluatedDecisions() (cost grows quadratically with the number of evaluated decisions) (#67630)
• Operate accepts process instance modifications that reference keys of another process instance (#67164)
• User task commands are not exempt from backpressure, unlike the equivalent job commands (#66772)
• Leftover bootstrap snapshot directory makes new partitions start without global state (#66656)
• Usage metrics TU statistics request fails with NPE when search response has no aggregations (#66409)
• Standalone restore truncates partitions at the next backup instead of the resolved marker checkpoint (#65814)
• Batch operation execution heartbeat log message is missing the partition number (#64277)
• OpenAPI v2 spec fails oas3-schema linting: duplicate "page" in required of Job Statistics result schemas (#55782)
• [Identity] Search authorization endpoint returns 500 error status code for non-admin user (#39235)
• ZeebeDbInconsistentException Key in ColumnFamily INCIDENT_JOBS already exists (#27183)
• Create incident when timer duration is too large (#13880)

Task

• [API Governance] Require x-eventually-consistent on every operation in the OpenAPI spec (#66951)
• Prevent the pending subscription checkers from acting on stale entries (#65928)
• Refactor archive by id code related to streaming out a list of documents from indexes using a query (#64444)
• Translate RDBMS connection failures into CamundaSearchException (#61220)
• Derive routing state from backup metadata (#58402)

Merged Pull Requests

• deps: Update jdx/mise-action action to v5.2.4 (main) (#67811)
• [Backport stable/8.8] test: cover incident endpoint authorization for under-privileged users (#67488)
• fix: stream documents larger than maxMessageSize to readers slower than the network (#67423)
• fix: default Operate tasklist-url when Tasklist is served in-app (#65257)

version:8.8.46

Bug Fixes

Misc

• Closing a document stream early does not end the download when the server sends nothing more (#67791)
• Closing a document download stream early does not stop the download (#67657)
• Operate accepts process instance modifications that reference keys of another process instance (#67164)
• User task commands are not exempt from backpressure, unlike the equivalent job commands (#66772)
• Leftover bootstrap snapshot directory makes new partitions start without global state (#66656)
• Usage metrics TU statistics request fails with NPE when search response has no aggregations (#66409)
• Variable operations accept a scope of another process instance (#65911)
• Batch operation execution heartbeat log message is missing the partition number (#64277)
• Some endpoints don't fully validate authorization for secondary resource identifiers (#64062)
• [Identity] Search authorization endpoint returns 500 error status code for non-admin user (#39235)
• It should not be possible to assign/unassign mapping rules from roles/groups in SaaS (#38193)
• ZeebeDbInconsistentException Key in ColumnFamily INCIDENT_JOBS already exists (#27183)
• Create incident when timer duration is too large (#13880)

Task

• Prevent the pending subscription checkers from acting on stale entries (#65928)
• Refactor archive by id code related to streaming out a list of documents from indexes using a query (#64444)

Merged Pull Requests

• test: fix race in archiver ILM cache test (#67878)
• deps: Update jdx/mise-action action to v5.2.4 (main) (#67811)
• Reject modifications that target another process instance (#67757)
• refactor: drop the security core library and BPMN model from zeebe-protocol-impl (#67753)
• refactor: move micrometer, caffeine, guava and BPMN helpers out of zeebe-util (#67752)
• feat: decode log records without the broker's modules (#67744)
• [Backport stable/8.8] test: cover incident endpoint authorization for under-privileged users (#67488)
• fix: stream documents larger than maxMessageSize to readers slower than the network (#67423)
• fix: stop 8.6 Zeebe and Camunda images trusting compromised eMudhra CAs (#66827)
• fix: don't fail authorization search on a non-key AUTHORIZATION resource id (#66709)
• fix: reject variable operations on a scope of another process instance (#65914)

version:8.7.45

Merged Pull Requests

• fix: stop 8.6 Zeebe and Camunda images trusting compromised eMudhra CAs (#66827)

version:8.6.42

version:8.11.0-alpha1

Enhancements

Java Client

• Allow multiple invocations of variable() on CreateProcessInstanceCommandBuilder to build a map entry by entry (#15352)

Misc

• [CPT] I can provide cluster secrets (camunda.secrets) in managed mode (#64871)
• Add public cluster API for upgrade-completeness (#61619)
• Type-safe per-index shard configuration with validation (#56246)
• Replication lag monitoring for Oracle Dataguard (#51485)

Bug Fixes

Broker

• Zeebe metrics missing from /actuator/prometheus in 8.4.21 (#63754)

Java Client

• Job worker's shared capacity semaphore is non-fair (#59734)
• Poll response jobs are dispatched one at a time while blocking on maxJobsActive, so the tail of a batch expires before it runs (#59634)
• Streaming job worker stops polling permanently after activated jobs are rejected at maxJobsActive (#59633)
• Job worker poll requests ignore pushed jobs, so a streaming worker repeatedly activates jobs it has no capacity to accept (#59632)

Misc

• Flaky ToolResultMessage unit test: Monaco dynamic import fails in vitest browser mode (#67177)
• Job stays FAILED forever when its backoff is checked at exactly the recurring time (#67169)
• [FLAKY] ExporterConfigInstantiationIT floods the fork's logs and stalls later tests (ClusteredDataDeletionTest cluster start timeout) (#67150)
• Batch cancel from "View all called instances" cancels every running root instance in the cluster (#66999)
• Unified Operate: Decisions date filter request fails and bulk Cancel skips suspended instances (#66896)
• Actor scheduler timers fire very late or never on busy or idle threads (#66823)
• Top nav breadcrumb shows cluster icon for the environment crumb (#66669)
• Partition scale-up stuck in PARTITION_BOOTSTRAP when the bootstrap snapshot has large files (#66654)
• Operate: edited variable shows stale value after 'Variable updated' notification (nightly c8Run-8.8) (#66364)
• [CPT] Default connectors-bundle image tag follows the Camunda version on 8.10+, but no tag is published for 8.10.1+ (#66291)
• Batch operation suspension is lost when SUSPEND is processed before initialization finishes (#66284)
• Operate: saving a variable edit hangs forever when the value contains a small or large decimal number (#66175)
• 8.10 entity non-null guards fail v2 searches with 500 on pre-8.8/8.9 legacy data (#66159)
• ExporterCfg.toString() logs exporter args unmasked, leaking credentials (e.g. Elasticsearch password) on broker startup failure (#66051)
• Cluster configuration sync stops permanently if a broker sees no peer at a sync tick, and forced zone removal then stalls (#66014)
• Optimize Docker image never shuts down gracefully because optimize.sh starts the JVM without exec (#65977)
• c8run start delays physical tenant Connectors runtimes until the default Connectors runtime is healthy (#65972)
• Optimize startup fails and the pod stays unready when Elasticsearch returns 503 for the metadata document (#65890)
• Standalone restore without --tenantId/--allTenants silently leaves other physical tenants empty (#65816)
• Standalone restore truncates partitions at the next backup instead of the resolved marker checkpoint (#65814)
• Terminate instruction in process instance modification accepts elements of other process instances (#65800)
• C8Run: --physical-tenants ignores saved settings and enables a persistent default login (#65781)
• Process instance migration does not check permissions on the target process definition (#65754)
• Call hierarchy endpoint returns process instances the caller is not authorized to read (#65685)
• Named OIDC providers do not inherit the global username, client-id and prefer-username claims (#65633)
• Browser login uses the default tenant's OIDC claim and ID-token settings for physical tenants (#65607)
• gRPC uses the default physical tenant's security config for broker request claims (#65582)
• Ad-hoc activities activation is not routed to the partition of the ad-hoc sub-process and fails with 404 (#65571)
• gRPC Basic auth throws on a malformed Authorization header instead of returning UNAUTHENTICATED (#65515)
• Physical-tenant config validation normalizes provider ids and tenant ids with dashes or capital letters (#65503)
• Physical tenants: gRPC ignores the claim settings of a tenant's assigned OIDC provider (#65501)
• Job push YIELD is rejected with NOT_FOUND when multi-tenancy checks are enabled, leaving jobs ACTIVATED until timeout (#65336)
• Optimize agentTotalTokens excludes cache tokens (#65273)
• Operate agent "Tokens used" total excludes cache tokens (#65272)
• Operate Details tab omits the Tasklist link — and on 8.9 all user task fields — because camunda.operate.tasklist-url is unset (#65161)
• Process definition search with isLatestVersion fetches full bpmnXml of every latest definition, risking OOM (#65144)
• REST job workers stop polling forever on HTTP/2 with httpclient5 5.6.1+ because the response timeout is not enforced (#65131)
• GET /cluster/v2/status/upgrade returns 503 after 30 seconds when the JVM sees one CPU (#65118)
• SequentialRebalanceRunnerTest.shouldReportNoPendingPartitionAsCompletedWhenTheRunFinishes is flaky: gauge value is NaN (#65091)
• EnumMeterTest.shouldRegisterGaugeForAllValues is flaky: gauge value is NaN (#65064)
• Brokers restarted while all physical tenants are recovering stay unready, so the restore cannot be requested through the API (#65040)
• Cluster-wide restore silently ignores an unknown physical tenant in overrides instead of returning 404 (#65039)
• Flaky test: InstancesTable "should fail instead of spinning forever if the target state is never observed" (#65020)
• PR benchmark compares a REST run with the gRPC daily reference (#65005)
• c8run: TestProbeWaitsForSecondaryStorage is flaky (#64994)
• c8run: wrapper name rewriting corrupts names containing $ and dynamic paths (#64958)
• Tasklist header shows "Non-Production License" instead of "Non-production license" for invalid licenses (#64925)
• Preserve deployment prefixes in Operations Log entity and details-modal links (#64882)
• Preserve deployment prefixes in Processes batch-operation notification navigation (#64881)
• Flaky webapp-client/unit: Monaco editor tests hang or fail on unhandled "Canceled" (INC-8463) (#64854)
• NullPointerException when completing a sub-process that has a compensation boundary event without a resolved handler (#64836)
• Tasklist task card priority label text is cut off (#64834)
• REST API rejects bearer tokens of a physical tenant's own IdP with 401 while gRPC accepts them (#64685)
• Load tester: failed read benchmark queries are not recorded in metrics (#64677)
• Process instance modification of a terminating instance leav...

version:8.10.8

Enhancements

Misc

• [CPT] I can provide cluster secrets (camunda.secrets) in managed mode (#64871)

Bug Fixes

Misc

• Exporter enabled at runtime is skipped when its director started with no enabled exporter (#67872)
• Zone-aware clusters lose known node versions with the dynamic node ID provider (#67668)
• Partition fails to install after a leader change during scale-up: the bootstrap snapshot replaces the latest snapshot (#67622)
• Document download fails when a document larger than maxMessageSize is read slower than the network (#67421)
• Document download blocks the reader forever when the response ends without the full body (#67420)
• Operate Listeners tab no longer shows the element's own job (BPMN_ELEMENT) in 8.9+ (#67321)
• Zeebe Version Compatibility CI job fails on transient GitHub API 502/429 during release lookup (#67269)
• Job stays FAILED forever when its backoff is checked at exactly the recurring time (#67169)
• Deleting a process version breaks version tag lookup for other versions with the same tag (#66953)
• Schema init blocks startup forever when one index has an unexpected setting (replica-drift read since 8.8.40) (#66929)
• Define what a resource ID means for the AUTHORIZATION resource: reads, writes and RDBMS disagree (#66713)
• Document content download intermittently corrupts the HTTP response under concurrent load (#66423)
• Document download can block forever when the response body stalls (no read deadline) (#66418)
• DB migration summary log reports negative executed count and wrong total (#64893)
• NullPointerException in ProcessInstanceMigrationSequenceFlowBehavior when target sequence flow mapping is missing (#63290)
• /actuator/configprops hides the entire zeebe.broker.processing config subtree (#61290)
• Call hierarchy endpoint throws IllegalStateException on duplicate process instance entity during merge (#61227)
• Force configure is forgotten on the initiating member if it restarts before the force-leaving configuration commits (#61177)
• Noisy metrics: 'Timer measurements cannot be negative' warning in Zeebe (#46139)
• [Identity] Search authorization endpoint returns 500 error status code for non-admin user (#39235)
• ZeebeDbInconsistentException Key in ColumnFamily INCIDENT_JOBS already exists (#27183)

Task

• Explore using oasdiff to find breaking changes in the REST API specification (#66829)
• Add integration coverage for cluster secrets in connectors and mockJobWorker (#66619)
• Reduce heap memory used per physical tenant by RDBMS MyBatis session factories (#66208)
• Add API regression analysis to CI quality gate (#46876)

Merged Pull Requests

• refactor: drop the security core library and BPMN model from zeebe-protocol-impl (#67753)
• refactor: move micrometer, caffeine, guava and BPMN helpers out of zeebe-util (#67752)
• feat: decode log records without the broker's modules (#67744)
• refactor: move member id classes into the cluster module (#67645)
• fix: ignore unrelated index settings when reading shard counts (#67365)
• test: reduce time interval in AbstractBatchOperationTest (#67293)
• test: fix flaky time-lag async replication ITs (#66762)
• fix: wake blocked document stream readers when the response is released (#66071)
• feat: provide cluster secrets in managed CPT runtime (#64872)

version:8.9.27

Bug Fixes

Misc

• Exporter enabled at runtime is skipped when its director started with no enabled exporter (#67872)
• Partition fails to install after a leader change during scale-up: the bootstrap snapshot replaces the latest snapshot (#67622)
• Document download fails when a document larger than maxMessageSize is read slower than the network (#67421)
• Document download blocks the reader forever when the response ends without the full body (#67420)
• Operate Listeners tab no longer shows the element's own job (BPMN_ELEMENT) in 8.9+ (#67321)
• Zeebe Version Compatibility CI job fails on transient GitHub API 502/429 during release lookup (#67269)
• Job stays FAILED forever when its backoff is checked at exactly the recurring time (#67169)
• [FLAKY] ExporterConfigInstantiationIT floods the fork's logs and stalls later tests (ClusteredDataDeletionTest cluster start timeout) (#67150)
• Deleting a process version breaks version tag lookup for other versions with the same tag (#66953)
• Schema init blocks startup forever when one index has an unexpected setting (replica-drift read since 8.8.40) (#66929)
• Actor scheduler timers fire very late or never on busy or idle threads (#66823)
• Operate V1 process instance deletion can fail with 409 version conflict on OpenSearch (#66750)
• Operate returns a variable of another process instance when requested by its id (#66510)
• Document content download intermittently corrupts the HTTP response under concurrent load (#66423)
• Document download can block forever when the response body stalls (no read deadline) (#66418)
• Variable operations accept a scope of another process instance (#65911)
• Optimize startup fails and the pod stays unready when Elasticsearch returns 503 for the metadata document (#65890)
• DB migration summary log reports negative executed count and wrong total (#64893)
• NullPointerException in ProcessInstanceMigrationSequenceFlowBehavior when target sequence flow mapping is missing (#63290)
• /actuator/configprops hides the entire zeebe.broker.processing config subtree (#61290)
• Call hierarchy endpoint throws IllegalStateException on duplicate process instance entity during merge (#61227)
• Force configure is forgotten on the initiating member if it restarts before the force-leaving configuration commits (#61177)
• Login fails with HttpMessageNotReadableException when userinfo endpoint returns a non-JSON response (#55732)
• Noisy metrics: 'Timer measurements cannot be negative' warning in Zeebe (#46139)
• It should not be possible to assign/unassign mapping rules from roles/groups in SaaS (#38193)
• Partitions gets unhealthy if many timers are scheduled (#8991)

Task

• Explore using oasdiff to find breaking changes in the REST API specification (#66829)
• Repeat delete of a draining process definition answers 200 or 409 depending on instance placement (#66023)
• Add API regression analysis to CI quality gate (#46876)

Merged Pull Requests

• refactor: drop the security core library and BPMN model from zeebe-protocol-impl (#67753)
• refactor: move micrometer, caffeine, guava and BPMN helpers out of zeebe-util (#67752)
• feat: decode log records without the broker's modules (#67744)
• fix: ignore unrelated index settings when reading shard counts (#67365)
• test: run timer burst reproducer with the due date fix (#66534)
• test: reproduce partition stall under timer bursts (#66525)
• fix: wake blocked document stream readers when the response is released (#66071)