Camunda 7 Community Edition is End of Life
Camunda 7 has stopped.
Your business processes haven't.
When the core contributors ended support for Camunda 7, AlurKerja chose to fork it and maintain it ourselves. The same BPMN engine — now more secure, better tested, and Spring Boot 4 ready.
Data as of 5 November 2026
269
Internal commits since the fork
3
Fork releases (7.24.0 – 7.24.2)
A
SonarQube Security Rating, up from E
A
SonarQube Security Review Rating, up from E
Why we forked instead of moving on
AlurKerja is built on Camunda 7, and so are the systems of many of our clients in state-owned enterprises, banking, and government. Abandoning a stable engine just because the vendor changed focus is not a responsible choice.
Your processes don't retire with it
BPMN and DMN definitions already in production don't need rewriting. The fork keeps the Camunda 7.24 Java API, REST API, and database schema.
Camunda 8 is not just an upgrade
Camunda 8 uses the Zeebe engine, a different API, and a different license model. For many organizations that means a new migration project, not a version bump.
Security patches keep coming
The AlurKerja team tracks CVEs, upgrades dependencies, and ships new releases — without waiting on a vendor and without an Enterprise license.
Quality you can audit
Every change is measured with SonarQube and Trivy, and verified with more than 16,000 engine tests.
Camunda 7 legacy vs the AlurKerja fork
SonarQube analysis of the unmodified upstream Camunda 7.24 code, compared with the AlurKerja fork after our fixes.
Security Rating
Security Review Rating
Reliability Rating
| SonarQube metric | Camunda 7 legacy | AlurKerja fork | Result |
|---|---|---|---|
| Bugs | 329 | 0 | All cleared |
| Vulnerabilities | 9 | 0 | All cleared |
| Security Hotspots | 15 | 0 | All cleared |
| Blocker severity issues | 272 | 10 | 96% fewer |
| High severity issues | 850 | 173 | 80% fewer |
| Code Smells | 11,330 | 831 | 93% fewer |
| Technical Debt | 2,254 hours | 938 hours | 58% lighter |
Source: Javan's internal SonarQube, fork analysis as of 4 November 2026. Figures come from the master branch on Javan's internal GitLab; the GitHub copy may lag behind master. The fork analysis excludes modules that are not distributed
(qa/ fixtures, example applications, and WildFly/Java EE application server integrations) — those modules are still built and tested as usual.
Dependency fixes are measured separately with Trivy: on 25 September 2026, 23 CRITICAL and 121 HIGH down to 0. Re-scan on 5 November 2026 of master: distributed modules 0 CRITICAL and 0 HIGH; the whole reactor 1 CRITICAL and 5 HIGH, all in the undistributed qa/ test fixtures.
These fixes apply to master code, not to releases 7.24.0–7.24.2.
Real bugs, not cosmetics
Every finding is reviewed one by one and verified against the full test suite before it is merged. Some had been in Camunda 7 for years.
35
Behavioral bugs
Swallowed InterruptedExceptions, Strings compared with ==, static SimpleDateFormat that is not thread-safe, leaking ThreadLocals.
28
Concurrency & arithmetic
Double-checked locking without volatile, integer rounding that threw job acquisition backoff levels off.
16
NullPointerException
Invalid BPMN now produces a clear error message instead of a NullPointerException.
13
Engine logic
Stale process engine registrations that were never cleaned up, collection lookups with the wrong key type.
7
Regex, locks & precision
A FEEL list parser that hit StackOverflow at 5,000 entries now finishes in under 1 ms; synchronized on the wrong monitor.
4
XML External Entity (XXE)
XML parsers and writers in Spin, model-api, and the external task client are closed to external entities.
The fork so far
- 2026
-
4 Nov 2026
Coverage 90% and clean dependencies on master
More tests lift SonarQube coverage to 90.1%. The 5 Nov Trivy scan of master: 0 CRITICAL and 0 HIGH in the distributed modules. These fixes are on master, not yet in the 7.24.2 release.
-
29 Oct 2026
Test coverage expansion
Dozens of new tests across engine, engine-rest, juel, external-task-client, starter-client, and jobexecutor-ra lift coverage to 88%.
-
23 Oct 2026
Reliability Rating A — 0 bugs
The last 21 bugs fixed, hundreds of code smells closed, and new tests across engine-spring, engine-cdi, juel, and smaller modules lift coverage to 86%.
-
25 Sep 2026
Trivy: 0 CRITICAL, 0 HIGH
Jackson, Spring Framework, Logback, Tomcat, and npm dependencies upgraded. Previously 23 CRITICAL and 121 HIGH.
-
23 Sep 2026
Code smell cleanup across every severity
INFO through BLOCKER, verified with the full test suite across the whole Maven reactor.
-
30 Aug 2026
SonarQube joins the pipeline
Analysis and coverage across 47 modules run from a single Maven command; hundreds of bugs are reviewed and fixed.
-
23 Aug 2026
Releases 7.24.1 and 7.24.2 — Spring Boot 4
The starter, Camunda Run, and QA are adapted to Spring Boot 4.0, then 4.1 (Spring Framework 7, Jersey 4).
-
22 Aug 2026
AlurKerja fork 7.24.0
Artifacts are published as alurkerja.camunda.* to our own Maven repository. Java packages are unchanged, so migrating only means changing the groupId.
- 2025
-
Nov 2025
Upstream README marked EoL
Core contributors point users to Camunda 8 — a different engine, API, and license.
-
Oct 2025
Camunda 7.24 — the last Community Edition release
Camunda 7 CE is declared End of Life. No more bug fixes or security patches for the open source version.
Still running Camunda 7?
We can help move your systems to an actively maintained fork, or run your business processes directly on AlurKerja — on-premise or in the cloud.