Hotfix/2.1.1

.github/workflows/build.yml

@@ -42,16 +42,16 @@ jobs:
     name: 'codeql: ${{ matrix.language }}'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up JDK 25
         if: ${{ matrix.language == 'java-kotlin' }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'zulu'
           java-version: 25
           cache: 'maven'
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -60,7 +60,7 @@ jobs:
         if: ${{ matrix.language == 'java-kotlin' }}
         run: mvn package $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{matrix.language}}"
 
@@ -73,9 +73,9 @@ jobs:
       main: ${{ steps.main.outputs.main }}
     steps:
       - name: Checkout repository 
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'zulu'
           java-version: 25
@@ -106,7 +106,7 @@ jobs:
         id: version
         run: echo "version=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive org.codehaus.mojo:exec-maven-plugin:3.6.3:exec)" >> $GITHUB_OUTPUT
       - name: Checkout main branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
       - name: Check if ref is main HEAD
@@ -142,14 +142,14 @@ jobs:
     timeout-minutes: 8
     steps:
       - name: Checkout repository 
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download quick-build results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: quick_build
           path: ./
       - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'zulu'
           java-version: 25
@@ -178,25 +178,25 @@ jobs:
     name: 'trivy: ${{ matrix.image.name }}'
     steps:
       - name: Checkout repository 
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download quick-build results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: quick_build
           path: ./
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Build Docker image
         run:  docker build -t ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}:${{ github.sha }} ${{ matrix.image.context }}
       - name: Scan Docker image with Trivy
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}:${{ github.sha }}
           format: 'sarif'
           output: 'trivy-results-${{ matrix.image.name }}.sarif'
           trivyignores: './.trivyignore'
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         if: always()
         with:
           sarif_file: 'trivy-results-${{ matrix.image.name }}.sarif'
@@ -225,24 +225,24 @@ jobs:
     name: 'docker-deploy: ${{ matrix.image.name }}'
     steps:
       - name: Checkout repository 
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download quick-build results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: quick_build
           path: ./
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker metadata
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:
           images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
@@ -257,7 +257,7 @@ jobs:
           # latest only for stable releases
           # develop builds
       - name: Build and Push
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: push
         with:
           push: true
@@ -273,7 +273,7 @@ jobs:
       - name: Generate SBOM
         run: syft ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}@${DIGEST} -o cyclonedx-json > sbom.json
       - name: Set up cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Attach SBOM
         run: cosign attest --yes --predicate sbom.json --type cyclonedx ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}@${DIGEST}
       - name: Sign image
@@ -287,14 +287,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository 
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download quick-build results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: quick_build
           path: ./
       - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'zulu'
           java-version: 25

.trivyignore

@@ -1,3 +1,19 @@
+#
+# Copyright 2018-2025 Heilbronn University of Applied Sciences
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
 # Ignore reason: Vulnerable code not used in DSF
 # CVE title: FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
 CVE-2026-34361

CITATION.cff

@@ -24,8 +24,8 @@ preferred-citation:
   doi: 10.3233/SHTI210060
   type: proceedings
 title: "Data Sharing Framework (DSF)"
-version: 2.1.0
-date-released: 2026-04-14
+version: 2.1.1
+date-released: 2026-08-04
 url: https://dsf.dev
 repository-code: https://github.com/datasharingframework/dsf
 repository-artifact: https://github.com/datasharingframework/dsf/releases

dsf-bpe/dsf-bpe-process-api-v1-base/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api-v1-impl/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api-v1-operaton/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api-v1/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api-v2-impl/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api-v2-impl/src/main/java/dev/dsf/bpe/v2/activity/MessageSendTaskDelegate.java

@@ -47,13 +47,7 @@ public void execute(DelegateExecution execution) throws Exception
 		// do not stop process execution
 		catch (ErrorBoundaryEvent event)
 		{
-			MessageSendTaskErrorHandler handler = delegate.getErrorHandler();
-			if (handler != null)
-				event = handler.handleErrorBoundaryEvent(api, variables, event);
-
-			if (event != null)
-				throw new BpmnError(event.getErrorCode(), event.getErrorMessage(), event);
-			// else, do nothing if event was absorbed by error handler
+			handleErrorBoundaryEvent(variables, event);
 		}
 		// stop process execution if exception not absorbed by error handler
 		catch (Exception exception)
@@ -62,10 +56,25 @@ public void execute(DelegateExecution execution) throws Exception
 			if (handler != null)
 				exception = handler.handleException(api, variables, sendTaskValues, exception);
 
-			if (exception != null)
+			// do not stop process execution if exception translated to error boundary event
+			if (exception instanceof ErrorBoundaryEvent event)
+				handleErrorBoundaryEvent(variables, event);
+
+			else if (exception != null)
 				execution.getProcessEngine().getRuntimeService().deleteProcessInstance(execution.getProcessInstanceId(),
 						exception.getMessage());
 			// else, do nothing if exception was absorbed by error handler
 		}
 	}
+
+	private void handleErrorBoundaryEvent(Variables variables, ErrorBoundaryEvent event)
+	{
+		MessageSendTaskErrorHandler handler = delegate.getErrorHandler();
+		if (handler != null)
+			event = handler.handleErrorBoundaryEvent(api, variables, event);
+
+		// do nothing if event was absorbed by error handler
+		if (event != null)
+			throw new BpmnError(event.getErrorCode(), event.getErrorMessage(), event);
+	}
 }

dsf-bpe/dsf-bpe-process-api-v2-impl/src/main/java/dev/dsf/bpe/v2/variables/JsonHolder.java

@@ -19,19 +19,33 @@
 
 public class JsonHolder
 {
-	private final String dataClassName;
-	private final byte[] data;
-
 	/**
 	 * @param dataClassName
 	 *            not <code>null</code>
 	 * @param data
 	 *            not <code>null</code>
+	 * @return
 	 */
-	public JsonHolder(String dataClassName, byte[] data)
+	public static JsonHolder of(String dataClassName, byte[] data)
+	{
+		Objects.requireNonNull(dataClassName, "dataClassName");
+		Objects.requireNonNull(data, "data");
+
+		return new JsonHolder(dataClassName, data);
+	}
+
+	public static JsonHolder empty()
+	{
+		return new JsonHolder(null, null);
+	}
+
+	private final String dataClassName;
+	private final byte[] data;
+
+	private JsonHolder(String dataClassName, byte[] data)
 	{
-		this.dataClassName = Objects.requireNonNull(dataClassName, "dataClassName");
-		this.data = Objects.requireNonNull(data, "data");
+		this.dataClassName = dataClassName;
+		this.data = data;
 	}
 
 	public String getDataClassName()
@@ -43,4 +57,9 @@ public byte[] getData()
 	{
 		return data;
 	}
+
+	public boolean isEmpty()
+	{
+		return dataClassName == null || data == null;
+	}
 }

dsf-bpe/dsf-bpe-process-api-v2-impl/src/main/java/dev/dsf/bpe/v2/variables/JsonHolderSerializer.java

@@ -52,7 +52,8 @@ public JsonHolderValue readValue(ValueFields valueFields, boolean asTransientVal
 		String dataClassName = valueFields.getTextValue();
 		byte[] data = valueFields.getByteArrayValue();
 
-		return JsonHolderValues.create(new JsonHolder(dataClassName, data));
+		return JsonHolderValues.create(
+				dataClassName == null || data == null ? JsonHolder.empty() : JsonHolder.of(dataClassName, data));
 	}
 
 	@Override

dsf-bpe/dsf-bpe-process-api-v2-impl/src/main/java/dev/dsf/bpe/v2/variables/VariablesImpl.java

@@ -107,12 +107,15 @@ public VariablesImpl(DelegateExecution execution, ObjectMapper objectMapper, Dsf
 
 	private JsonHolder toJsonHolder(Object json)
 	{
+		if (json == null)
+			return JsonHolder.empty();
+
 		try
 		{
 			byte[] data = objectMapper.writeValueAsBytes(json);
 			String dataClassName = json.getClass().getName();
 
-			return new JsonHolder(dataClassName, data);
+			return JsonHolder.of(dataClassName, data);
 		}
 		catch (JsonProcessingException e)
 		{
@@ -123,11 +126,15 @@ private JsonHolder toJsonHolder(Object json)
 	@SuppressWarnings("unchecked")
 	private <T> T fromJsonHolder(JsonHolder holder)
 	{
+		if (holder.isEmpty())
+			return null;
+
 		try
 		{
 			byte[] data = holder.getData();
-			Class<?> dataClass = getClassLoader().loadClass(holder.getDataClassName());
+			String dataClassName = holder.getDataClassName();
 
+			Class<?> dataClass = getClassLoader().loadClass(dataClassName);
 			return (T) objectMapper.readValue(data, dataClass);
 		}
 		catch (ClassNotFoundException | IOException e)

dsf-bpe/dsf-bpe-process-api-v2/pom.xml

@@ -23,7 +23,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>

dsf-bpe/dsf-bpe-process-api/pom.xml

@@ -25,7 +25,7 @@
 	<parent>
 		<groupId>dev.dsf</groupId>
 		<artifactId>dsf-bpe-pom</artifactId>
-		<version>2.1.0</version>
+		<version>2.1.1-SNAPSHOT</version>
 	</parent>
 
 	<properties>