SpiffWorks

April 2026

2026-04-01T00:00:00+00:00

Dan here. This has been one of the most productive months I've ever seen from our team, with sweeping performance improvements that make workflows dramatically faster and more efficient, significant enhancements to our editor, and a growing team bringing new expertise and energy to the project. From a 5x speedup in workflow parsing to new recording and testing capabilities in the editor, we are delivering real operational gains while continuing to invest in the reliability, security, and ease of use that your teams depend on.</p>

Performance</h1>
To put it simply, things just got a lot faster.</em></p>
We have made a multitude of major performance improvements across our full application stack. While we are certainly getting some help from LLMs to identify areas for improvement, we are working carefully, critically, and surgically. We have reduced workflow parsing time to 1/5th of what it was. Compression now delivers an 88% reduction in serialized workflow size, with a new serialization method adding a further 43% on top of that. Running workflows are now serialized 4x faster, with a 10x improvement in the memory footprint for workflow state and history — meaning your workflows run faster, cost less to operate, and scale further. We work as a team, but want to call out Jon Herron for one of the most prolific periods of performance and feature additions we've seen in a while.</p>

The Team Is Growing</h1>
Tim Stevens is joining us in a fractional advisory role as we look for new ways to build a sustainable open source project and mature our commercial offerings to more directly address the needs of organizations like yours.</p>
Jacob Armstrong also joins the team this month as a new software engineer. He fixed several issues in our editor and will be introducing some optional AI enhancements to help make building workflows faster and more intuitive. We are eager to make our editor easier to use, while allowing you to remain fully in control of your business workflows. Looking forward to seeing what you develop, Jacob!</p>
Editor Enhancements</h1>
We added support for recording the execution of a process in our editor. Use the new record button to capture form responses and API calls as your workflow runs. These recordings let you jump directly to any point in a workflow for faster iteration, or serve as automated tests that verify your workflows complete as expected. This started as a small addition, but a valuable one, and we've put substantial effort into making it feel intuitive, fast, and dependable.</p>
Connector Improvements</h1>
We are continuing to refine our long-running service tasks and callbacks, improving reliability when integrating SpiffWorkflow with external systems and services.</p>
Spiff-Arena Updates</h1>
We updated the code editor in Arena, moving from Monaco to CodeMirror, for a better overall scripting experience. We've also improved the display of error messages in the Arena editor, making it easier to identify and resolve issues quickly.</p>
Community Contributions</h1>
Many thanks to Chris Bisom</a> (again!) for tracking down and addressing security vulnerabilities as part of his team's security due diligence.</p>

March 2026

2026-03-01T00:00:00+00:00

Dan here. We have made major enhancements to the editor that make it 10x easier to use. We've also made changes to our core library that bring about major performance improvements while drastically reducing storage size. I had the pleasure of presenting at OSCON this past week. Read on for more information.</p>
Upcoming Q2 Release: Ed Editor</h1>
The Ed Editor continues to move toward an official release and is the most significant area of development this quarter.</p>

Recording and Playback</strong> — Record and replay steps in the Ed Editor. Worth seeing in action.</li>
JSON Data Stores</strong> — Create and use JSON Data Stores directly within the editor.</li>
File System Sync for Chrome</strong> — Sync directly with files on your local hard drive from within the editor.</li>
Additional enhancements</strong> — Better record sorting in the display, improved dropdown filtering, and automated test coverage can now be linked up to run automatically when you push diagram changes to GitHub.</li> </ul>
Enhancements</h1>

Performance Improvements</strong> — Drastically reduced duplicate data storage in the core library by modifying how SpiffWorkflow serializes data (fully backwards compatible and opt-in). Pulled into Spiff Arena to support larger workflows and tasks looping hundreds of times. Thanks to Maciej Kycler for identifying the underlying issues.</li>
Message Search and Filters</strong> — Search and filter messages directly, making it easier to debug complex process communications.</li>
Dynamic Task Assignment</strong> — Assign multiple groups to tasks in a lane; assignments update automatically when group membership changes.</li>
Bug Fixes: Correlation Properties</strong> — Bug resolved in the panel. Multi-Instance Output: fixed an issue that complicated syncing inputs and outputs when using multi-instance tasks.</li> </ul> OSCON</h1>
Dan presented at the Open Source Conference (OSCON)</a> on March 23 where the theme was "Building Cities, Not Empires". He shared what it actually looks like to run a lean team and an open source project at the same time. If you missed it, follow the link above to watch.</p>
Community Contributions</h1>

Christopher Bisom</strong> (@Mwindo</a>) — contributed a Potential Owners API endpoint, enabling custom applications to display the list of users assigned to a task</li>
Bret Mogilefsky</strong> (@mogul</a>) — patched a potential security vulnerability in GitHub Actions that prevents hackerbot-claw style exploits</li>
Christian Fischer</strong> (@vcodx</a>) — fixed a typo in the core library</li> </ul>

February 2026

2026-02-01T00:00:00+00:00

Building and executing BPMN diagrams with SpiffWorkflow keeps getting faster and easier. We've shipped dozens of improvements since early January — here are three highlights worth knowing about.</p>
Easier, Faster BPMN Development with Auto-Complete of Variables</h1>
We've added intelligent code completion for user tasks, manual tasks and script tasks — making it far easier to pick up existing variables and use them in follow-on steps. Check out our demo video</a>.</p>
Simpler, Cleaner Connections to All of Your Other Systems</h1>
Connecting to external services just got simpler. Service tasks can now wait for async callbacks natively — no more pairing a service task with a separate message receive task. There is a video of this as well.</a></p>
More Secure Integration Layer</h1>
Added an optional API key authentication for connector proxy calls. You can still secure API calls at the individual connector level, but this enhancement allows you to secure all of your connectors at once through a single configuration.</p>
More Features, Bug Fixes, Docs and Updates</h2>

Testing BPMN Messages from your Browser</strong> — Some of our users work heavily with messages. This quick video</a> explains how to send messages into a BPMN process from another tab in your browser.</li>
Extracted BPMN Editor from Spiff Arena into Separate Package</strong> — We extracted the BPMN editor, viewer and debugger from Spiff Arena into a standalone package. Improves code modularity and reusability and makes it easier for others to develop and integrate BPMN editors into their own systems. While most of our effort is in the new ED Editor, this package is available for adoption and extension for the open source community. spiff-arena #2684</a></li>
Human Task Webhook Notifications</strong> — Sends webhook events when human tasks are created or removed. Enables real-time task change monitoring. spiff-arena #2697</a></li>
GitLab Sync Integration</strong> — Adds GitLab support to sync functionality. Enables version control with GitLab repositories. aggregate-connector-proxy #167</a></li>
Fix Parallel Human Task Submission</strong> — Fixes race condition in parallel task submission with processor-level locking. Adds load testing for parallel tasks. spiff-arena #2678</a></li>
Add Connector and Editor Docs</strong> — Adds comprehensive documentation for Connector Proxy deployment and ED Editor BPMN editing features. spiff-arena #2671</a></li>
Data Item Name Validation</strong> — Incorporates data item name validation from bpmn-js-spiffworkflow library. Prevents invalid variable names. spiff-arena #2689</a></li>
Cancel Unused Message Models</strong> — Marks message models as cancelled when process instances stop listening. Cleans up orphaned messages in database. spiff-arena #2682</a></li>
Refresh Call Activity DMN</strong> — Ensures DMN from first-level call activities stay current. Prevents stale decision model data. aggregate-connector-proxy #185</a></li>
Display Step Error Information</strong> — Shows detailed step information when errors occur. Improves error debugging experience. aggregate-connector-proxy #177</a></li>
Validate Data Item IDs</strong> — Validates data input/output and object IDs, preventing dashes and invalid Python variable names. Auto-converts dashes to underscores on creation. bpmn-js-spiffworkflow #140</a></li>
Link Subworkflows in Event Logs</strong> — Adds variables to event logs connecting subworkflows with parent processes. Improves process hierarchy tracking. spiff-arena #2681</a></li>
Move Test Runner to Common</strong> — Migrates BPMN unit test runner and task coverage to common package. spiff-arena #2691</a></li>
Add Unit Test Strategy</strong> — Introduces unittest strategy that completes tasks when test fixtures exist. Supports upcoming CI/CD diagram testing. spiff-arena #2688</a></li>
Filter Files During Sync</strong> — Adds file filtering during sync operations. Prevents unwanted files from syncing. aggregate-connector-proxy #175</a></li>
Fix PNPM Installation Issue</strong> — Allows pnpm install without deleting node_modules first. Simplifies dependency management. aggregate-connector-proxy #170</a></li> </ul>

January 2026

2026-01-01T00:00:00+00:00

Happy New Year!</p>
Over the past few months, we shipped 50+ improvements across performance, security, task management, and BPMN editing.</p>
To start the year, we want to highlight the most impactful technical enhancements, give thanks to our community contributors (Tyler Burton, William Jolivet and Christopher Bisom), and share how we're helping organizations run more efficiently.</p>
What's New and Improved</h1>
1. Faster, More Reliable Execution</h2>
We made targeted performance and reliability improvements that reduce operational overhead in production environments:</p>

Reduced database load by optimizing message correlation queries</li>
Faster local service task execution by bypassing unnecessary HTTP calls</li>
Improved multi-threaded task handling to prevent orphaned tasks and race conditions</li>
More reliable boundary event processing for deterministic error handling</li> </ul>
Result: workflows execute more predictably at scale, with fewer production surprises.</p>
2. Improved Security & Identity</h2>
Security improvements focused on authentication, authorization, and task data isolation:</p>

Expanded authentication support, including Login.gov</li>
Stronger OAuth flows with PKCE and improved token refresh handling</li>
Clearer task data boundaries limiting human task access to configured variables</li>
Improved OpenID provider documentation for multi-provider environments</li> </ul>
Result: safer defaults and a clearer security posture for regulated and enterprise deployments.</p>
3. Custom Applications with SpiffWorkflow</h2>
If you are building your own frontends and want the ability to add custom details to user tasks — such as setting priority ("This is High Priority!") or a due date for a form — it is now possible to configure all user tasks system-wide to allow BPMN authors to specify these values as they create their diagrams.</p>
Result: a seamless connection between your application's user interface and the BPMN authoring tool that drives it. Everything is aligned.</p>
4. A More Productive BPMN Editor</h2>
The BPMN editor (code-named "ED") continues to mature with usability and debugging improvements:</p>

Cross-tab copy/paste for faster diagram creation</li>
Clearer debugging with precise script error line numbers</li>
Improved previews and form rendering</li>
Fixes for issues that previously interrupted modeling flow</li> </ul>
Results: faster iteration, fewer context switches, and less friction while building and debugging workflows.</p>
Community Spotlight</h1>
This release includes standout contributions from community members solving real deployment challenges:</p>

Tyler Burton</strong></a> — Added Login.gov authentication support, enabling government agency deployments</li>
William Jolivet</strong></a> — Contributed French translations, expanding SpiffWorkflow's international reach</li>
Christopher Bisom</strong></a> — Implemented PKCE security for OAuth flow with multiple access token refresh support — critical for short-lived token configurations</li> </ul>
Thank you to everyone contributing code, documentation, and feedback. Your work directly shapes SpiffWorkflow's direction and your fellow developers.</p>

SpiffWorks

April 2026

Connector Improvements</h1> We are continuing to refine our long-running service tasks and callbacks, improving reliability when integrating SpiffWorkflow with external systems and services.</p>

Spiff-Arena Updates</h1> We updated the code editor in Arena, moving from Monaco to CodeMirror, for a better overall scripting experience. We've also improved the display of error messages in the Arena editor, making it easier to identify and resolve issues quickly.</p>

Community Contributions</h1> Many thanks to Chris Bisom</a> (again!) for tracking down and addressing security vulnerabilities as part of his team's security due diligence.</p>

March 2026

Upcoming Q2 Release: Ed Editor</h1> The Ed Editor continues to move toward an official release and is the most significant area of development this quarter.</p>

February 2026

Easier, Faster BPMN Development with Auto-Complete of Variables</h1> We've added intelligent code completion for user tasks, manual tasks and script tasks — making it far easier to pick up existing variables and use them in follow-on steps. Check out our demo video</a>.</p>

Simpler, Cleaner Connections to All of Your Other Systems</h1> Connecting to external services just got simpler. Service tasks can now wait for async callbacks natively — no more pairing a service task with a separate message receive task. There is a video of this as well.</a></p>

January 2026

What's New and Improved</h1>

1. Faster, More Reliable Execution</h2> We made targeted performance and reliability improvements that reduce operational overhead in production environments:</p>

2. Improved Security & Identity</h2> Security improvements focused on authentication, authorization, and task data isolation:</p>

Connector Improvements</h1>
We are continuing to refine our long-running service tasks and callbacks, improving reliability when integrating SpiffWorkflow with external systems and services.</p>

Spiff-Arena Updates</h1>
We updated the code editor in Arena, moving from Monaco to CodeMirror, for a better overall scripting experience. We've also improved the display of error messages in the Arena editor, making it easier to identify and resolve issues quickly.</p>

Community Contributions</h1>
Many thanks to Chris Bisom</a> (again!) for tracking down and addressing security vulnerabilities as part of his team's security due diligence.</p>

Easier, Faster BPMN Development with Auto-Complete of Variables</h1>
We've added intelligent code completion for user tasks, manual tasks and script tasks — making it far easier to pick up existing variables and use them in follow-on steps. Check out our demo video</a>.</p>

Simpler, Cleaner Connections to All of Your Other Systems</h1>
Connecting to external services just got simpler. Service tasks can now wait for async callbacks natively — no more pairing a service task with a separate message receive task. There is a video of this as well.</a></p>