Deployment guidelines v5.5.0

After upgrading to a new platform version, always ensure that your installed component versions match the versions specified in the release notes. To verify this, navigate to FlowX.AI Designer > Platform Status.

Component versions

Component	5.5.0	5.4.0	5.3.0	5.2.0	5.1.1	5.1.0
process-engine	10.60.0	10.38.0	10.29.0	10.12.0	9.64.3	9.63.0
admin	10.53.0	10.38.0	10.26.1	10.12.0	9.66.5	9.65.0
designer	10.91.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
cms-core	10.35.0	10.22.0	10.16.0	10.7.0	9.36.3	9.35.0
scheduler-core	10.25.0	10.15.0	10.11.1	10.4.1	9.26.1	9.25.0
events-gateway	10.27.0	10.17.0	10.12.1	10.4.1	9.26.1	9.25.0
notification-plugin	10.35.0	10.22.0	10.17.0	10.7.0	9.29.1	9.28.0
document-plugin	10.35.0	10.23.0	10.16.0	10.6.0	9.35.1	9.34.0
task-management-plugin	10.35.0	10.25.0	10.18.0	10.7.0	9.34.2	9.33.0
data-search	10.25.0	10.14.0	10.10.1	10.4.1	9.23.1	9.22.0
audit-core	10.31.0	10.21.0	10.15.1	10.6.0	9.30.1	9.29.1
advancing-controller	10.27.0	10.16.0	10.11.0	10.4.1	9.25.1	9.24.0
integration-designer	10.63.0	10.38.0	10.24.0	10.8.0	9.50.0	9.49.1
application-manager	10.53.0	10.37.0	10.24.0	10.11.0	9.73.6	9.72.0
runtime-manager	10.53.0	10.37.0	10.24.0	10.11.0	9.73.6	9.72.0
data-sync	10.31.1	10.20.1	10.14.1	10.3.1	9.22.1	9.21.0
authorization-system	10.42.1	10.28.0	10.18.1	10.7.0	9.34.2	9.33.0
nosql-db-runner	10.27.0	10.17.0	10.10.1	10.4.1	9.22.1	9.21.0
email-gateway	10.24.0	10.9.0	-	-	-	-
organization-manager	10.19.2	-	-	-	-	-

Embedded components

• SpiceDB
• DGraph

Renderers

Component	5.5.0	5.4.0	5.3.0	5.2.0	5.1.1	5.1.0
@flowx/angular-sdk	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/angular-theme	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/angular-ui-toolkit	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/react-sdk	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/react-theme	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/react-ui-toolkit	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/core-sdk	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
@flowx/core-theme	10.68.0	10.59.1	10.32.4	10.12.1	9.159.5	9.153.6
iOS renderer	10.3.0	10.2.0	10.1.0	10.0.0	9.0.5	9.0.4
Android renderer	10.3.0	10.2.0	10.1.0	10.0.0	9.0.3	9.0.2

Plugins

Component	5.5.0	5.4.0	5.3.0	5.2.0	5.1.1	5.1.0
ocr-plugin	1.0.17	1.0.17	1.0.17	1.0.17	1.0.17	1.0.17
reporting-plugin	0.2.3	0.2.3	0.2.3	0.2.3	0.2.3	0.2.3

AI Platform

Component	5.5.0	5.4.0	5.3.0	5.2.0	5.1.1	5.1.0
ai-assistant	10.1.2	10.1.2	10.1.1	10.0.1	9.2.5	9.2.4
di-platform	10.2.6	10.2.5	10.2.5	10.2.0	9.3.1	9.3.1
ai-platform-ai-developer	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-connected-graph	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-knowledge-graph	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-agents	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-conversations	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-models	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-tenants	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-planner	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-ai-analyst	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-ai-designer	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-agent-builder	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
ai-platform-binaries	TBD	10.1.3	10.1.3	10.0.1	9.4.2	9.3.0
knowledgebase	TBD	-	-	-	-	-
knowledgebase-rag	10.2.0	-	-	-	-	-
knowledgebase-indexer-v2	10.2.0	-	-	-	-	-
mcp	10.2.0	-	-	-	-	-

Third-party supported component versions

FlowX.AI Version	3rd Party Dependency	Supported Versions
5.5.0	Keycloak	26+
5.5.0	Kafka	3.8 - 3.9
5.5.0	PostgreSQL	16 - 17
5.5.0	Oracle Database	21c, 23ai
5.5.0	MongoDB	7 - 8
5.5.0	Redis	7.4 - 8.0
5.5.0	Elasticsearch	8 - 9
5.5.0	Angular (Web SDK)	20
5.5.0	React (Web SDK)	18.x

Starting FlowX 5.0, the following versions of 3rd Party Dependencies are no longer supported:

• Keycloak versions older than 26
• Kafka versions older than 3.8
• Redis versions older than 7.4

New in v5.5.0

Key features and updates

Chat Component Enhancements

New subcomponents (reasoning, error, suggestions), display modes, and mobile support

UI Flows Improvements

Process renderer component, start workflow action, and on load events

Microsoft Outlook Integration

Native MS Graph data source for reading and sending Outlook emails

Send Notification Action

Send emails and reply to received emails directly from processes via SMTP

Knowledge Base v2

Updated Knowledge Base with audit, resource management, and improved UI

User Management Updates

Password policy, DISABLED status, resend invitations, workspace environment types

Upgrading from v5.4.0

Breaking changes

FlowX.AI 5.5.0 introduces a breaking change to the default authentication mechanism across most platform services. If you rely on the default SECURITY_TYPE value or opaque-token introspection, action is required before upgrading.

Authentication mechanism change

The default value of SECURITY_TYPE has changed from oauth2 to jwt-public-key across 14 of 19 platform services. This reflects a shift from opaque-token introspection to JWT-based authentication as the default security mechanism.

Removed environment variables:

The following environment variables have been removed and are no longer supported:

Environment Variable	Description	Previously Used By
SPRING_SECURITY_OAUTH2_RESOURCE_SERVER_OPAQUE_TOKEN_INTROSPECTION_URI	Opaque-token introspection endpoint	14 services
SPRING_SECURITY_OAUTH2_RESOURCE_SERVER_OPAQUE_TOKEN_CLIENT_ID	Client ID for opaque-token introspection	14 services
SPRING_SECURITY_OAUTH2_RESOURCE_SERVER_OPAQUE_TOKEN_CLIENT_SECRET	Client secret for opaque-token introspection	14 services
SECURITY_OAUTH2_REALM	OAuth2 realm name	13 services
SECURITY_OAUTH2_CLIENT_CLIENT_ID	OAuth2 client ID	13 services
SECURITY_OAUTH2_CLIENT_CLIENT_SECRET	OAuth2 client secret	13 services
SECURITY_OAUTH2_SERVICE_ACCOUNT_ADMIN_CLIENT_ID	Service account admin client ID	8 services
SECURITY_OAUTH2_SERVICE_ACCOUNT_ADMIN_CLIENT_SECRET	Service account admin client secret	8 services

Changed default values:

Environment Variable	Old Default	New Default	Affected Services
SECURITY_TYPE	oauth2	jwt-public-key	14/19 services
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_MAINIDENTITY_CLIENT_ID	${security.oauth2.service-account.admin.client-id}	flowx-${spring.application.name}-sa	8 services
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_MAINIDENTITY_CLIENT_SECRET	${security.oauth2.service-account.admin.client-secret}	-	8 services
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_MAINAUTHPROVIDER_TOKEN_URI	Uses ${security.oauth2.realm}	Uses ${security.oauth2.sa-realm}	8 services

A new security.oauth2.sa-realm property has been introduced to separate the service account realm from the main authentication realm. This property is used by the token URI for inter-service communication across 11 services.

Migration steps:

1. Update SECURITY_TYPE if explicitly set

   If you explicitly set SECURITY_TYPE=oauth2 in your deployment configuration, update it to jwt-public-key or remove it to use the new default.

2. Remove deprecated opaque-token variables

   Remove all SPRING_SECURITY_OAUTH2_RESOURCE_SERVER_OPAQUE_TOKEN_* variables from your Helm values, environment configs, or deployment manifests.

3. Update service account client IDs

   Service account client IDs now follow the flowx-{service-name}-sa pattern (e.g., flowx-admin-sa, flowx-process-engine-sa). Update your Keycloak service account configurations accordingly.

4. Configure the service account realm

   Add the security.oauth2.sa-realm property to your configuration if your service account realm differs from the default.

5. Remove legacy OAuth2 client variables

   Remove SECURITY_OAUTH2_REALM, SECURITY_OAUTH2_CLIENT_CLIENT_ID, SECURITY_OAUTH2_CLIENT_CLIENT_SECRET, and SECURITY_OAUTH2_SERVICE_ACCOUNT_ADMIN_* variables from your configuration.

---

Key changes

• Authentication: Default SECURITY_TYPE changed from oauth2 to jwt-public-key (breaking change — see above)
• Organization Manager: New microservice for organization and tenant management
• Chat Component: Enhanced with new subcomponents (reasoning, error, suggestions), display modes, and mobile support
• UI Flows: New process renderer component, start workflow action, and on load UI event
• Microsoft Outlook: New MS Graph data source for Outlook email integration
• Send Notification: New action type for sending/replying to emails via SMTP
• Knowledge Base v2: Updated UI, audit trail, and resource management
• Container Apps: Enhanced authentication flow and landing page
• File Upload: Improved progress indicators, drag and drop, and large file support
• File Encrypt/Decrypt: New document plugin actions for file encryption and decryption
• User Management: Password policy updates, DISABLED status, resend invitations, workspace environment type
• Process Variables Compare: Monaco diff editor for comparing variable values
• New Kafka topics: Multiple new topics added across document-plugin, integration-designer, admin, application-manager, email-gateway, authorization-system, and notification-plugin

---

New microservice: Organization Manager

Available starting with FlowX.AI 5.5.0

The Organization Manager is a new microservice responsible for organization and tenant management, including user registration, organization lifecycle, and platform component health monitoring.

Infrastructure requirements:

Dependency	Details
PostgreSQL	Dedicated database for organization data
Redis	Caching and session management
Kafka	Event publishing (organization events topic)
Keycloak/IAM	Authentication and realm management
SpiceDB	Authorization via CAS lib

Organization Manager Setup

Complete setup and configuration guide for the Organization Manager microservice

---

New Kafka topics

FlowX.AI 5.5.0 introduces new Kafka topics across multiple services.

Document-plugin Kafka topics

New topics for file encryption, decryption, bulk document persistence, and UI Flow session document persistence operations.

Input topics (document-plugin consumes from these topics):

Topic Name	Description
ai.flowx.plugin.document.trigger.decrypt.file.v1	Triggers file decryption operations
ai.flowx.plugin.document.trigger.encrypt.file.v1	Triggers file encryption operations
ai.flowx.plugin.document.trigger.persist.document.bulk.v1	Triggers bulk document persistence operations
ai.flowx.plugin.document.trigger.persist.document.session.v1	Triggers UI Flow session document persistence; result delivered via SSE through events-gateway

Output topics (document-plugin publishes to these topics):

Topic Name	Description
ai.flowx.engine.receive.plugin.document.decrypt.file.results.v1	Results from file decryption operations
ai.flowx.engine.receive.plugin.document.encrypt.file.results.v1	Results from file encryption operations
ai.flowx.engine.receive.plugin.document.persist.document.bulk.results.v1	Results from bulk document persistence
ai.flowx.eventsgateway.receive.document.v1	Document upload progress notifications sent to events-gateway for SSE delivery

Integration-designer Kafka topics

New topics for integration-designer in 5.5.0. Integration-designer now participates in the application sync mechanism for system and workflow resources.

The sync.out.v1 and correction-after-app-operation.response.v1 topics already exist since 5.1.x (used by admin). In 5.5.0, integration-designer becomes an additional producer on these shared response topics.

New topics:

Topic Name	Description	Direction
ai.flowx.application-version.sync.system.in.v1	System resource sync requests	Inbound
ai.flowx.application-version.sync.workflow.in.v1	Workflow resource sync requests	Inbound
ai.flowx.application-version.correction-after-app-operation.system.request.v1	System resource correction requests	Inbound
ai.flowx.application-version.correction-after-app-operation.workflow.request.v1	Workflow resource correction requests	Inbound
ai.flowx.build.runtime-data.v1	Build runtime data	Outbound
ai.flowx.license.usage.v1	License usage tracking	Outbound

Existing topics (new producer in 5.5.0):

Topic Name	Description	Direction
ai.flowx.application-version.sync.out.v1	Sync operation responses	Outbound
ai.flowx.application-version.correction-after-app-operation.response.v1	Correction operation responses	Outbound

Admin Kafka topics

New topics for UI flow synchronization and correction operations in 5.5.0.

The sync.process.in.v1, sync.business-rule.in.v1, sync.reusable-template.in.v1, sync.out.v1, and correction-after-app-operation topics for process, business-rule, and reusable-template already exist since 5.1.x. Only the UI flow topics below are new in 5.5.0.

Topic Name	Description	Direction
ai.flowx.application-version.sync.ui-flow.in.v1	UI flow sync requests	Inbound
ai.flowx.application-version.correction-after-app-operation.ui-flow.request.v1	UI flow correction requests	Inbound

Application-manager Kafka topics

New outbound topics for resource synchronization and correction of system, workflow, and UI flow resources in 5.5.0.

Application-manager already produces sync and correction topics for process, business-rule, and reusable-template since 5.1.x. The topics below extend the same mechanism to system, workflow, and UI flow resources.

Topic Name	Description	Direction
ai.flowx.application-version.sync.system.in.v1	System resource sync	Outbound
ai.flowx.application-version.sync.workflow.in.v1	Workflow resource sync	Outbound
ai.flowx.application-version.sync.ui-flow.in.v1	UI flow resource sync	Outbound
ai.flowx.application-version.correction-after-app-operation.system.request.v1	System correction requests	Outbound
ai.flowx.application-version.correction-after-app-operation.workflow.request.v1	Workflow correction requests	Outbound
ai.flowx.application-version.correction-after-app-operation.ui-flow.request.v1	UI flow correction requests	Outbound

Email-gateway Kafka topics

Topic Name	Description	Direction
ai.flowx.core.trigger.save.audit.v1	Audit event logging	Outbound
ai.flowx.core.trigger.start-for-event.process.v1	Trigger process start from email events	Outbound

Authorization-system Kafka topics

Topic Name	Description	Direction
ai.flowx.organization.events.v1	Organization lifecycle events	Outbound

Notification-plugin Kafka topics

Topic Name	Description	Direction
ai.flowx.application-version.resources-usages.refresh.v1	Resource usages refresh events	Inbound
ai.flowx.application-version.resources-usages.sub-res-validation.response.v1	Sub-resource validation responses	Outbound
ai.flowx.application-version.resources-usages.operations.bulk.v1	Bulk resource usage operations	Outbound

These topics are automatically created if your Kafka cluster has auto-topic creation enabled. For production environments, it is recommended to create them manually with appropriate partition counts and replication factors.

---

New environment variables

Platform-wide variables

The following new environment variables are available across multiple services:

Environment Variable	Description	Default Value	Component
KAFKA_MESSAGE_MAX_BYTES	Maximum Kafka producer message size in bytes	52428800 (50 MB)	process-engine, admin, application-manager, integration-designer, events-gateway, email-gateway, notification-plugin, document-plugin
REDIS_TTL	Redis cache time-to-live in milliseconds	5000000	admin, application-manager, cms-core, integration-designer, task-management-plugin, notification-plugin
KAFKA_OAUTH_CLIENT_ID	OAuth client ID for Kafka SASL authentication	kafka	events-gateway, email-gateway, notification-plugin, document-plugin
LOGGING_LEVEL_APP	Application-specific logging level	INFO	Most services (12/19)
LOGGING_LEVEL_OAUTH2_EXC	OAuth2 autoconfiguration exception logging level	OFF	Most services (12/19)
LOGGG_LEVEL_MONGO_DRIVER	MongoDB driver logging level	INFO	admin, application-manager, cms-core

Document-plugin variables

Environment Variable	Description	Default Value	Component
MULTIPART_MAX_ENTITY_SIZE	Maximum size for multipart uploads at server level	52428800 (50 MB)	document-plugin

This setting affects all file uploads handled by the document-plugin. Configure alongside the existing Spring multipart settings (SPRING_SERVLET_MULTIPART_MAXFILESIZE, SPRING_SERVLET_MULTIPART_MAXREQUESTSIZE) for consistent upload limits. See Documents Plugin Setup.

Authorization-system variables

Environment Variable	Description	Default Value	Component
SPRING_LIQUIBASE_PARAMETERS_ALLOWED_REDIRECT_URIS	Comma-separated list of valid redirect URI patterns for the flowx-platform-authenticate Keycloak client. Required for new deployments.	(empty)	authorization-system

New deployments only: If this variable is not set, the flowx-platform-authenticate Keycloak client will have no redirect URIs and OAuth2 login will fail. Set this to your Designer and app URLs (e.g., https://designer.yourcompany.com/*,https://app.yourcompany.com/*).

Existing deployments upgrading to 5.5.0 are not affected — the Liquibase migration that uses this variable has already run.

Authorization System Setup

See the full redirect URI configuration details

Email-gateway variables

Environment Variable	Description	Default Value	Component
EMAIL_GATEWAY_IMAP_CONNECTION_TIMEOUT	IMAP server connection timeout in milliseconds	10000	email-gateway
EMAIL_GATEWAY_IMAP_MAX_CONCURRENT_POLLS	Maximum number of concurrent IMAP polling operations	30	email-gateway
EMAIL_GATEWAY_IMAP_MAX_MESSAGES_PER_POLL	Maximum messages to fetch per polling cycle	50	email-gateway
EMAIL_GATEWAY_IMAP_POLLING_INTERVAL	Interval between IMAP polling cycles in seconds	30	email-gateway
EMAIL_GATEWAY_IMAP_READ_TIMEOUT	IMAP read timeout in milliseconds	30000	email-gateway
EMAIL_GATEWAY_MASTER_ELECTION_CRON	Cron expression for master election checks	*/5 * * * * *	email-gateway
EMAIL_GATEWAY_MASTER_ELECTION_TTL	Master election TTL in seconds	15	email-gateway
EMAIL_GATEWAY_MAX_EMAILS_PER_INSTANCE	Maximum email accounts per service instance for load balancing	100	email-gateway
EMAIL_GATEWAY_REBALANCING_CRON	Cron expression for email account rebalancing	*/30 * * * * *	email-gateway
EMAIL_GATEWAY_STALE_TIMEOUT_SECONDS	Timeout in seconds before marking an instance as stale	90	email-gateway
EMAIL_GATEWAY_MS_GRAPH_MAX_MESSAGES_PER_POLL	Maximum messages to fetch per MS Graph polling cycle	50	email-gateway
EMAIL_GATEWAY_MS_GRAPH_CLIENT_CACHE_TTL	TTL for cached MS Graph client instances	1d	email-gateway

For complete email-gateway configuration including database, Redis, and Kafka settings, see the Email Gateway Setup guide.

---

Compatibility

• Authentication: Default SECURITY_TYPE changed to jwt-public-key — deployments using opaque-token introspection require migration (see breaking changes)
• Renderer Updates: Web and mobile SDKs include new Chat component features and UI Flows enhancements
• Database: No schema changes required for this upgrade
• Mobile Support: Chat component now available on iOS and Android renderers
• New Service: Organization Manager requires PostgreSQL, Redis, Kafka, and Keycloak infrastructure

Support

For technical support, deployment assistance, or feature questions, please contact your FlowX.AI support representative.

Support channels

• Technical issues: Contact your FlowX.AI support representative
• Feature questions: Reach out through your designated support channel
• Documentation: Report documentation issues or suggestions