elsa-workflows · Copilot · May 3, 2026
diff --git a/doc/changelogs/3.7.0-rc1.md b/doc/changelogs/3.7.0-rc1.md
@@ -0,0 +1,103 @@
+Compare: `3.6.0...3.7.0-rc1`
+
+### ⚠️ Breaking changes / upgrade notes
+
+- **Authentication contracts**: `IAuthenticationProvider`, `IAuthenticationProviderManager`, and `TokenNames` moved out of `Elsa.Studio.Core` into `Elsa.Studio.Login` namespaces. Consumers importing these APIs from `Elsa.Studio.Core` should update package references/usings to `Elsa.Studio.Login`. (2192884a48) (#723)
+- **UI dependencies**: `MudBlazor` was upgraded from `8.15.0` to `9.0.0`, `Radzen.Blazor` from `8.3.5` to `9.0.5`, and `CodeBeam.MudBlazor.Extensions` from `8.3.0` to `9.0.0-rc.1`. Applications customizing Elsa Studio UI components should validate compatibility with these major versions. (04b858a8d0) (#760)
+
+### ✨ New features
+
+#### Authentication
+
+- **Modern authentication modules**: Added a new authentication framework with dedicated Elsa Identity and OpenID Connect modules for Blazor Server and Blazor WASM hosts, including token providers, JWT accessors, unauthorized components, and SignalR connection option configurators. (2192884a48) (#723)
+- **Elsa Identity UI feature**: Added `ElsaIdentityUIFeature` and switched the WASM host default authentication provider from legacy `ElsaLogin` to `ElsaIdentity`. (7ffc15a591)
+- **Legacy Elsa Login compatibility**: Added explicit legacy `ElsaLogin` support for WASM host configuration, preserving an upgrade path for existing host apps. (8612d5b195)
+
+#### Workflow instance diagnostics
+
+- **Activity call stack visualization**: Added `IActivityExecutionService.GetCallStackAsync`, an `ActivityCallStack` component, execution details drawer, and activity selection/highlighting in the workflow instance viewer. (691d373bbd) (#750)
+- **Incident count badge**: Displays incident counts on the workflow instance details `Incidents` tab. (b3ca85f818) (#739)
+- **Pending instance filter**: Added `Pending` as a workflow instance sub-status filter and updated translations. (9af41aebb2) (#737)
+
+#### Extensibility and UI composition
+
+- **Custom theme provider**: Added `IThemeProvider` so host applications can supply a custom `MudTheme` more directly. (07e94f58a7) (#754)
+- **DataPanel rendering extensibility**: Added `DataPanelItemFormat`, custom `ValueTemplate`, reusable value component support, and dedicated renderers for timestamp/code/text values. (2b55e410d2) (#740)
+- **Activity tabs**: Extended `IActivityTab` with optional icon, icon color, visibility, and scroll-wrapping customization hooks, plus a reusable `ActivityTab` implementation. (2192884a48) (#723)
+
+### 🔧 Improvements
+
+- **Workflow materializer UI**: Improved workflow materializer handling and activity selection so workflows-as-activity instances load more reliably. (71f5dfa783) (#731)
+- **Fallback designer UX**: Added a warning alert when the fallback designer is active, helping users understand when no specific designer is registered for an activity type. (db6695073b) (#741)
+- **Fallback designer cleanup**: Simplified fallback designer internals and root activity initialization. (e63a6ab760)
+- **Query table initialization**: Streamlined `QueryTableComponentBase` query state handling and initialization logic. (91868f273b)
+- **Activity properties panel**: Made `ExpressionDescriptorProvider` mutable in `ActivityPropertiesPanel` and cleaned up formatting. (918dd8c862)
+
+### 🐛 Fixes
+
+- **Custom Elements host SignalR authentication**: Registered `IHttpConnectionOptionsConfigurator` in `Elsa.Studio.Host.CustomElements` so `WorkflowInstanceObserverFactory` resolves correctly when rendering custom-element viewers with API key or access-token attributes. (797449faf1) (#800)
+- **OIDC configuration errors**: Fixed OpenID Connect setup so missing service registrations and token-exchange failures surface as errors instead of causing repeated login loops. (a2941daec4) (#779)
+- **OIDC error hardening**: Bounded diagnostic logging for token-exchange failures, reduced user-facing error detail, and preserved consumer-provided `IAuthenticationProviderManager` registrations via `TryAddScoped`. (9799d93b3c) (#792)
+- **Activity property syntax restore**: Prevented activity property child content from rendering until `ExpressionDescriptorProvider` is initialized, fixing syntax values such as JavaScript reverting to literal/default on reopen. (880525fd18) (#780)
+
+### 🔒 Security
+
+- **OIDC failure handling**: Avoids exposing raw token endpoint responses in the UI and bounds error payload handling while retaining diagnostic logging. (9799d93b3c) (#792)
+- **Custom Elements authenticated SignalR**: Bridges custom-element `api-key` / `access-token` credentials into SignalR `HttpConnectionOptions`, allowing secured workflow viewers to connect without pulling in a full login module. (797449faf1) (#800)
+
+### 🧩 Developer-facing changes
+
+- Added `IAnonymousBackendApiClientProvider` and default implementation for anonymous backend API access. (2192884a48) (#723)
+- Added `ISingleFlightCoordinator` and default scoped registration to coordinate concurrent operations. (2192884a48) (#723)
+- Added `IHttpConnectionOptionsConfigurator` in authentication abstractions for modules/hosts to customize SignalR connection authentication. (2192884a48) (#723)
+- Added authentication architecture documentation covering the new auth model. (2192884a48) (#723)
+- Added contributor-focused pull request guidelines and a pull request template. (d40ba61245) (5991d33219) (c90cdf522a)
+
+### 🔁 CI / Build
+
+- Updated package workflow base version to `3.7.0`. (c5656de073)
+- Updated `.NET 8.0` and `.NET 9.0` package version entries and removed outdated entries. (18bfa1a5db)
+- Added release notes agent documentation and changelog output guidance. (f42cb0e860) (ae16458221)
+
+### 📦 Dependencies
+
+- **Elsa.Api.Client**: Updated to `3.7.0-preview.4451`, with a later dependency bump commit included in the release range. (c4f9c11cc8) (e1ba926444)
+- **MudBlazor**: `8.15.0` → `9.0.0`. (04b858a8d0) (#760)
+- **Radzen.Blazor**: `8.3.5` → `9.0.5`. (04b858a8d0) (#760)
+- **CodeBeam.MudBlazor.Extensions**: `8.3.0` → `9.0.0-rc.1`. (04b858a8d0) (#760)
+- **FluentValidation**: `12.1.0` → `12.1.1`. (04b858a8d0) (#760)
+- **Microsoft.SourceLink.GitHub**: `8.0.0` → `10.0.103`. (04b858a8d0) (#760)
+- **Wrappers npm dependencies**: Updated `js-yaml`, `brace-expansion`, `glob`, `lodash`, `picomatch`, `yaml`, `storybook`, `vite`, `handlebars`, and `tar`. Notable major updates include `lodash` `4.17.21` → `4.18.1`, `tar` `6.2.1` → `7.5.11`, and `vite` `6.3.5` → `6.4.2`. (aa2584b011) (#790)
+- **Wrappers npm dependencies**: Updated `follow-redirects` `1.15.11` → `1.16.0` and `axios` `1.12.0` → `1.15.0`. (50d09a4613) (#794)
+
+### 📦 Full changelog (short)
+
+- Refactor Authentication Framework and implement OpenID Connect. (2192884a48) (#723)
+- Enhances Elsa Studio with workflow materializer UI updates. (71f5dfa783) (#731)
+- Add legacy Elsa Login authentication support and update related configurations and project references. (8612d5b195)
+- Introduce `ElsaIdentityUIFeature`, update service registrations, and replace legacy authentication references with `ElsaIdentity`. (7ffc15a591)
+- Add pending filter for instances. (9af41aebb2) (#737)
+- Displays incident count on workflow instance details. (b3ca85f818) (#739)
+- Add warning alert for fallback mechanism in designer. (db6695073b) (#741)
+- Enhances DataPanel with flexible rendering options. (2b55e410d2) (#740)
+- Simplify Fallback Designer by removing unused imports and redundant components. (e63a6ab760)
+- Refactor `QueryTableComponentBase`: streamline query state handling and improve initialization logic. (91868f273b)
+- Create Release Notes Agent for Elsa packages. (f42cb0e860)
+- Update base version to `3.7.0` in GitHub Actions workflow configuration. (c5656de073)
+- Simplify custom theme instalment. (07e94f58a7) (#754)
+- Add and revise contributing guidelines and PR template. (d40ba61245) (5991d33219) (c90cdf522a)
+- Update package versions for .NET 8.0 and 9.0, and remove outdated entries. (18bfa1a5db)
+- Update Elsa.Api.Client package version to `3.7.0-preview.4451`. (c4f9c11cc8)
+- Adds activity call stack visualization. (691d373bbd) (#750)
+- Document output location for release notes. (ae16458221)
+- Weblate translation updates across Arabic, Azerbaijani, Catalan, Czech, Dutch, German, Italian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese, and Chinese locales. (992b45d8de) (39521ca311)
+- Update `ShowMessageBox` to `ShowMessageBoxAsync` and upgrade package versions. (04b858a8d0) (#760)
+- Fix/OIDC error handling. (a2941daec4) (#779)
+- Prevent rendering of the child element until the `ExpressionDescriptorProvider` is fully initialized. (880525fd18) (#780)
+- Bump the npm_and_yarn group across 1 directory with 10 updates. (aa2584b011) (#790)
+- Fix Copilot review comments from PR #779. (9799d93b3c) (#792)
+- Merge release/3.6.1 into the release branch. (b91dabe445)
+- chore(deps): bump Elsa.Api.Client. (e1ba926444)
+- Bump the npm_and_yarn group across 1 directory with 2 updates. (50d09a4613) (#794)
+- Make `ExpressionDescriptorProvider` mutable in `ActivityPropertiesPanel.razor.cs` and fix formatting. (918dd8c862)
+- fix: register `IHttpConnectionOptionsConfigurator` in Host.CustomElements. (797449faf1) (#800)