15.4.2 Service Pack

Review Cycle Scheduling

• Fixed an issue where completing a review could assign an incorrect start date to the next review cycle when no initial start date was defined. In these cases, the system did not correctly apply the configured review interval from advanced settings, resulting in a shorter-than-expected cycle.

Document Preview Zoom

• Fixed an issue where zooming in on a document in the preview window caused the first page to disappear. The preview now maintains all pages regardless of zoom level.

Map Transitions Visibility

• Fixed an issue in a process diagram’s Saved Layout view where a transition between two tasks could disappear if a boundary event on the first task also had a transition to the second task.

Diagram Map Download

• Fixed an issue where downloading a process map from the diagram view resulted in extra spacing around shapes and inconsistent formatting in the PNG file.

Diagram Editor

• Fixed an issue where users could move a process shortcut to another lane in a process diagram.

Security

• Updated an internal dependency to address a potential memory usage issue under specific conditions.
• Addressed a vulnerability in the Signature container where the jackson-core library (version 2.19.4) could be exploited. The dependency has been upgraded to 3.1.0 to resolve this issue.
• Addressed a vulnerability in the multer Node.js library (CVE-2026-2359) used in the WebApp container. In versions prior to 2.1.0, file uploads could be interrupted in a way that affects system resources. The multer dependency has been upgraded to 2.1.0.
• Resolved an additional vulnerability in multer (CVE-2026-3520) where versions prior to 2.1.1 could allow a denial-of-service during file uploads. The dependency has been upgraded from 2.0.2 to 2.1.1.
• Updated the tar library used in the WebApp container to versions 7.5.10 and 7.5.11, fixing potential issues with symlinks or hardlinks during file extraction.
• Upgraded tootallnate/once from 2.0.0 to 3.0.1 to address a rare condition where certain promises could hang indefinitely if aborted.