mirror of https://github.com/abpframework/abp.git
Enis Necipoglu
4 months ago
committed by
GitHub
GitHub
9 changed files with 422 additions and 8 deletions
@ -0,0 +1,168 @@ |
|||||
|
# ABP Platform 10.5 RC Has Been Released |
||||
|
|
||||
|
We are happy to release [ABP](https://abp.io) version **10.5 RC** (Release Candidate). This blog post introduces the new features and important changes in this new version. |
||||
|
|
||||
|
Try this version and provide feedback for a more stable version of ABP v10.5! Thanks to you in advance. |
||||
|
|
||||
|
## Get Started with the 10.5 RC |
||||
|
|
||||
|
You can check the [Get Started page](https://abp.io/get-started) to see how to get started with ABP. You can either download [ABP Studio](https://abp.io/get-started#abp-studio-tab) (**recommended**, if you prefer a user-friendly GUI application - desktop application) or use the [ABP CLI](https://abp.io/docs/latest/cli). |
||||
|
|
||||
|
By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI: |
||||
|
|
||||
|
 |
||||
|
|
||||
|
## Migration Guide |
||||
|
|
||||
|
There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please check the migration guide if you are upgrading from v10.4 or earlier: [ABP Version 10.5 Migration Guide](https://abp.io/docs/10.5/release-info/migration-guides/abp-10-5). |
||||
|
|
||||
|
## What's New with ABP v10.5? |
||||
|
|
||||
|
In this section, I will introduce some major features released in this version. |
||||
|
Here is a brief list of titles explained in the next sections: |
||||
|
|
||||
|
- S3-Compatible Blob Storage Support |
||||
|
- OpenIddict: Default Scope Fallback Options |
||||
|
- Dynamic Background Worker Capability Markers |
||||
|
- Account: Single-Active Token Provider Improvements |
||||
|
- CMS Kit: CodeMirror 6 Update |
||||
|
- Shared User Accounts: Remove Users from Tenants |
||||
|
- Dependency Updates |
||||
|
|
||||
|
### S3-Compatible Blob Storage Support |
||||
|
|
||||
|
ABP v10.5 improves the AWS Blob Storing provider so it can work with S3-compatible storage services such as Cloudflare R2, MinIO, Backblaze B2, Wasabi, and DigitalOcean Spaces. |
||||
|
|
||||
|
Two new AWS blob provider configuration options are available: |
||||
|
|
||||
|
- `ServiceURL`: Sets the custom S3-compatible service endpoint. |
||||
|
- `DisablePayloadSigning`: Sends `UNSIGNED-PAYLOAD` instead of streaming chunked signing when the target provider does not support AWS SDK v4's default payload signing behavior. |
||||
|
|
||||
|
Example configuration: |
||||
|
|
||||
|
```csharp |
||||
|
Configure<AbpBlobStoringOptions>(options => |
||||
|
{ |
||||
|
options.Containers.ConfigureDefault(container => |
||||
|
{ |
||||
|
container.UseAws(aws => |
||||
|
{ |
||||
|
aws.AccessKeyId = "your-access-key"; |
||||
|
aws.SecretAccessKey = "your-secret-key"; |
||||
|
aws.ServiceURL = "https://<account-id>.r2.cloudflarestorage.com"; |
||||
|
aws.ContainerName = "my-container"; |
||||
|
aws.DisablePayloadSigning = true; |
||||
|
}); |
||||
|
}); |
||||
|
}); |
||||
|
``` |
||||
|
|
||||
|
This is especially useful if you want to keep ABP's blob storing abstraction while using an S3-compatible provider instead of AWS S3 itself. |
||||
|
|
||||
|
> See [#22962](https://github.com/abpframework/abp/pull/22962) for details. |
||||
|
|
||||
|
### OpenIddict: Default Scope Fallback Options |
||||
|
|
||||
|
ABP v10.5 adds opt-in default scope fallback options for OpenIddict token grants. |
||||
|
|
||||
|
For `client_credentials`, `password`, and token-exchange grants, you can now configure ABP to use the scopes registered on the client application when the token request does not include a `scope` parameter. |
||||
|
|
||||
|
The new options are disabled by default: |
||||
|
|
||||
|
```csharp |
||||
|
Configure<AbpOpenIddictAspNetCoreOptions>(options => |
||||
|
{ |
||||
|
options.UseDefaultScopesForClientCredentials = true; |
||||
|
options.UseDefaultScopesForPassword = true; |
||||
|
options.UseDefaultScopesForTokenExchange = true; |
||||
|
}); |
||||
|
``` |
||||
|
|
||||
|
This gives applications more flexibility for machine-to-machine and integration scenarios while keeping the existing behavior unchanged unless you explicitly enable it. |
||||
|
|
||||
|
> See [#25356](https://github.com/abpframework/abp/pull/25356) for details. |
||||
|
|
||||
|
### Dynamic Background Worker Capability Markers |
||||
|
|
||||
|
ABP v10.5 improves the dynamic background worker infrastructure with provider capability markers. |
||||
|
|
||||
|
Consumers can now detect whether the active `IDynamicBackgroundWorkerManager` supports runtime registration and cron scheduling by checking marker interfaces: |
||||
|
|
||||
|
- `ISupportsRuntimeRegistration` |
||||
|
- `ISupportsCronScheduling` |
||||
|
|
||||
|
Hangfire and Quartz dynamic worker managers support both runtime registration and cron scheduling. The default in-memory manager supports runtime registration only, and now rejects cron expressions with a clearer error message. TickerQ's dynamic worker manager does not expose runtime dynamic scheduling support. |
||||
|
|
||||
|
This is useful for modules and tools that need to adapt their UI or behavior based on the active background worker provider. |
||||
|
|
||||
|
> See [#25397](https://github.com/abpframework/abp/pull/25397) for details. |
||||
|
|
||||
|
### Account: Single-Active Token Provider Improvements |
||||
|
|
||||
|
ABP continues improving token security in the [Account PRO module](https://abp.io/modules/account-pro). |
||||
|
|
||||
|
In v10.5, the link-user token provider now uses ABP's single-active token infrastructure. Only the latest generated link-user token remains valid, and applications can configure the token lifetime through dedicated options. |
||||
|
|
||||
|
 |
||||
|
|
||||
|
The default ASP.NET Core Identity token provider used by ABP has also been replaced with an ABP single-active variant. Password-flow challenge tokens, such as two-factor and password-change challenge flows, are now single-active per user and purpose with a short default lifetime. |
||||
|
|
||||
|
These changes help reduce the risk of old tokens remaining usable after a newer token has been issued. |
||||
|
|
||||
|
> See [#25450](https://github.com/abpframework/abp/pull/25450) and [#25525](https://github.com/abpframework/abp/pull/25525) for details. |
||||
|
|
||||
|
### CMS Kit: CodeMirror 6 Update |
||||
|
|
||||
|
ABP v10.5 updates the `@abp/codemirror` package to CodeMirror 6. |
||||
|
|
||||
|
The package keeps compatibility with existing ABP and CMS Kit integrations through a `window.CodeMirror.fromTextArea(...)` adapter while serving the updated bundled CodeMirror assets from the ABP package. |
||||
|
|
||||
|
This modernizes the editor infrastructure used by CMS Kit and related UI features without requiring typical applications to change their CMS Kit usage. |
||||
|
|
||||
|
> See [#25358](https://github.com/abpframework/abp/pull/25358) for details. |
||||
|
|
||||
|
### Shared User Accounts: Remove Users from Tenants |
||||
|
|
||||
|
ABP Commercial v10.5 RC improves shared user account administration with a new tenant-side removal action. |
||||
|
|
||||
|
Administrators can now remove a shared user from the current tenant directly from the user management UI. This provides an admin-managed counterpart to the self-service leave flow and keeps shared-account administration easier to handle in multi-tenant systems. |
||||
|
|
||||
|
 |
||||
|
|
||||
|
### Dependency Updates |
||||
|
|
||||
|
ABP v10.5 RC includes several dependency and package updates: |
||||
|
|
||||
|
- Blazorise packages upgraded to **2.1.3** |
||||
|
- MongoDB.Driver upgraded to **3.9.0** |
||||
|
- CodeMirror updated to **6.0.2** through `@abp/codemirror` |
||||
|
|
||||
|
> Check the [Package Version Changes](https://abp.io/docs/10.5/package-version-changes) document for all updates. |
||||
|
|
||||
|
### Other Improvements and Enhancements |
||||
|
|
||||
|
- **Permission Management + MySQL**: Fixed the `ResourcePermissionGrant` index length problem that could cause MySQL initial migration failures ([#25495](https://github.com/abpframework/abp/pull/25495)). |
||||
|
- **Distributed locking**: Removed a redundant cancellation-token fallback call in `MedallionAbpDistributedLock` ([#25497](https://github.com/abpframework/abp/pull/25497)). |
||||
|
- **Documentation and tooling**: Added a docs syntax check workflow for `docs/en` Markdown files ([#25415](https://github.com/abpframework/abp/pull/25415)). |
||||
|
|
||||
|
## Community News |
||||
|
|
||||
|
### New ABP Community Articles |
||||
|
|
||||
|
As always, exciting articles have been contributed by the ABP community. I will highlight some of them here: |
||||
|
|
||||
|
- [Fahri Gedik](https://abp.io/community/members/fahrigedik) has published 2 new articles: |
||||
|
- [New Look for ABP React Native: NativeWind, Modernization & Two Sample Apps](https://abp.io/community/articles/new-abp-modern-react-native-template-rxjiyrpb) |
||||
|
- [The Antidote to Vibe Architecting: ABP Studio AI Agent](https://abp.io/community/articles/the-antidote-to-vibe-architecting-abp-studio-ai-agent-mpdeh3gr) |
||||
|
- [Template In, Product Out: Building Hanova with the ABP AI Agent](https://abp.io/community/articles/template-in-product-out-building-hanova-with-the-abp-ai-hcntpk3j) by [Sumeyye Kurtulus](https://abp.io/community/members/sumeyye.kurtulus) |
||||
|
- [Empowering AI Agents with ABP Framework: A Comprehensive Skill Collection](https://abp.io/community/articles/abp-framework-ai-agent-skills-qccn87tu) by [Burak Demir](https://abp.io/community/members/burakdemir) |
||||
|
- [Google Pomelli: How to Market Your App Without Being a Designer](https://abp.io/community/articles/google-pomelli-how-to-market-your-app-1hu48pda) by [Engincan Veske](https://abp.io/community/members/EngincanV) |
||||
|
- [DevDays 2026 Conf From a Speaker's View](https://abp.io/community/articles/devdays-2026-conference-from-a-speakers-view-39d007hs) by [Alper Ebiçoğlu](https://abp.io/community/members/alper) |
||||
|
|
||||
|
Thanks to the ABP Community for all the content they have published. You can also [post your ABP related (text or video) content](https://abp.io/community/posts/create) to the ABP Community. |
||||
|
|
||||
|
## Conclusion |
||||
|
|
||||
|
This version comes with some new features and a lot of enhancements to the existing features. You can see the [Road Map](https://abp.io/docs/10.5/release-info/road-map) documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.5 RC and provide feedback to help us release a more stable version. |
||||
|
|
||||
|
Thanks for being a part of this community! |
||||
|
After Width: | Height: | Size: 480 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
|
After Width: | Height: | Size: 17 KiB |
@ -0,0 +1,238 @@ |
|||||
|
```json |
||||
|
//[doc-seo] |
||||
|
{ |
||||
|
"Description": "Upgrade your ABP solutions from v10.4 to v10.5 with this migration guide covering important behavior and integration changes." |
||||
|
} |
||||
|
``` |
||||
|
|
||||
|
# ABP Version 10.5 Migration Guide |
||||
|
|
||||
|
This document is a guide for upgrading ABP v10.4 solutions to ABP v10.5. There are no explicitly marked breaking changes in this release scope, but there are some important changes that may require action in specific application scenarios. |
||||
|
|
||||
|
> **Package Version Changes:** Before upgrading, review the [Package Version Changes](../../package-version-changes.md) document to see version changes on dependent NuGet and NPM packages and align your project with ABP's internal package versions. |
||||
|
|
||||
|
## Open-Source (Framework) |
||||
|
|
||||
|
This version contains the following changes on the open-source side: |
||||
|
|
||||
|
### Identity Token Providers Use Single-Active Token Semantics |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using Identity link-user flows. |
||||
|
- Applications using password-flow challenge tokens, such as two-factor and password-change challenge flows. |
||||
|
- Applications that customize or replace ASP.NET Core Identity token providers. |
||||
|
- Applications that expect multiple previously generated tokens for the same user and purpose to remain valid at the same time. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- `LinkUserTokenProvider` now derives from ABP's single-active token infrastructure. |
||||
|
- ABP replaces ASP.NET Core Identity's default `DataProtectorTokenProvider` registered under `TokenOptions.DefaultProvider` with `AbpDefaultTokenProvider`. |
||||
|
- Tokens issued by these providers are single-active per user and purpose. Generating a new token invalidates the previous token for the same user and purpose. |
||||
|
- The default lifetime for the new providers is 10 minutes and can be configured. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- Re-test login, two-factor, forced password change, periodic password change, and link-user flows after upgrading. |
||||
|
- If your application sends multiple tokens for the same purpose and expects older tokens to remain valid, update that flow to use only the latest token. |
||||
|
- If your application needs a different lifetime, configure the related provider options: |
||||
|
|
||||
|
```csharp |
||||
|
Configure<AbpDefaultTokenProviderOptions>(options => |
||||
|
{ |
||||
|
options.TokenLifespan = TimeSpan.FromMinutes(10); |
||||
|
}); |
||||
|
|
||||
|
Configure<AbpLinkUserTokenProviderOptions>(options => |
||||
|
{ |
||||
|
options.TokenLifespan = TimeSpan.FromMinutes(10); |
||||
|
}); |
||||
|
``` |
||||
|
|
||||
|
> See [#25450](https://github.com/abpframework/abp/pull/25450), [#25525](https://github.com/abpframework/abp/pull/25525), and the [Identity Token Providers](../../modules/identity/token-providers.md) document for details. |
||||
|
|
||||
|
### OpenIddict Default Scope Fallback Options |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using OpenIddict with `client_credentials`, `password`, or token-exchange grants. |
||||
|
- Applications that want tokens to use the client application's registered scopes when the request omits the `scope` parameter. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- ABP adds opt-in default scope fallback switches to `AbpOpenIddictAspNetCoreOptions`. |
||||
|
- The new behavior is disabled by default, so existing applications keep their current behavior unless they enable these options. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
No action is required if you do not enable the new options. |
||||
|
|
||||
|
If you want the fallback behavior, configure the options explicitly: |
||||
|
|
||||
|
```csharp |
||||
|
Configure<AbpOpenIddictAspNetCoreOptions>(options => |
||||
|
{ |
||||
|
options.UseDefaultScopesForClientCredentials = true; |
||||
|
options.UseDefaultScopesForPassword = true; |
||||
|
options.UseDefaultScopesForTokenExchange = true; |
||||
|
}); |
||||
|
``` |
||||
|
|
||||
|
After enabling the options, re-test token issuance for the affected grant types and confirm the resulting scopes/resources match your authorization expectations. |
||||
|
|
||||
|
> See [#25356](https://github.com/abpframework/abp/pull/25356) for details. |
||||
|
|
||||
|
### Dynamic Background Worker Capability Markers |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications or modules that use `IDynamicBackgroundWorkerManager` directly. |
||||
|
- Applications that allow users or administrators to configure dynamic background workers at runtime. |
||||
|
- Applications that assume cron expressions work with every dynamic background worker provider. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- Dynamic background worker managers now expose support through marker interfaces: |
||||
|
- `ISupportsRuntimeRegistration` |
||||
|
- `ISupportsCronScheduling` |
||||
|
- Hangfire and Quartz managers implement both markers. |
||||
|
- The default in-memory manager implements runtime registration support only and rejects cron expressions with a clearer error message. |
||||
|
- TickerQ's dynamic manager does not expose runtime dynamic scheduling support. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- If you build UI or integration logic on top of `IDynamicBackgroundWorkerManager`, check provider capabilities before showing or accepting runtime registration and cron scheduling options. |
||||
|
- Use Hangfire or Quartz if your application needs runtime cron scheduling for dynamic background workers. |
||||
|
- Re-test dynamic worker add/update flows that use `CronExpression`. |
||||
|
|
||||
|
> See [#25397](https://github.com/abpframework/abp/pull/25397) for details. |
||||
|
|
||||
|
### S3-Compatible Blob Storage Provider Configuration |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using `Volo.Abp.BlobStoring.Aws`. |
||||
|
- Applications that want to use S3-compatible providers such as Cloudflare R2, MinIO, Backblaze B2, Wasabi, or DigitalOcean Spaces. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- The AWS blob provider now supports `ServiceURL` for custom S3-compatible endpoints. |
||||
|
- The provider also supports `DisablePayloadSigning` for providers that do not support AWS SDK v4 streaming payload signing. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
No action is required for existing AWS S3 configurations. |
||||
|
|
||||
|
If you use an S3-compatible provider, configure the provider-specific endpoint and payload-signing behavior: |
||||
|
|
||||
|
```csharp |
||||
|
Configure<AbpBlobStoringOptions>(options => |
||||
|
{ |
||||
|
options.Containers.ConfigureDefault(container => |
||||
|
{ |
||||
|
container.UseAws(aws => |
||||
|
{ |
||||
|
aws.ServiceURL = "https://<account-id>.r2.cloudflarestorage.com"; |
||||
|
aws.DisablePayloadSigning = true; |
||||
|
}); |
||||
|
}); |
||||
|
}); |
||||
|
``` |
||||
|
|
||||
|
Keep `DisablePayloadSigning` disabled for providers that support the default AWS SDK signing behavior. |
||||
|
|
||||
|
> See [#22962](https://github.com/abpframework/abp/pull/22962) for details. |
||||
|
|
||||
|
### Permission Management MySQL Index Length Fix |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using the Permission Management module with EF Core and MySQL. |
||||
|
- Applications that create new migrations including the `ResourcePermissionGrant` model. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- For MySQL only, ABP shortens `ResourcePermissionGrant.ResourceName` and `ResourcePermissionGrant.ResourceKey` max lengths to avoid exceeding MySQL's `utf8mb4` index key length limit. |
||||
|
- Other database providers keep the previous length. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- If you are creating a new MySQL solution or generating fresh migrations, regenerate/review your migrations after upgrading. |
||||
|
- If you already have a custom migration for `ResourcePermissionGrant`, compare it with the updated model and adjust the affected column lengths for MySQL if needed. |
||||
|
|
||||
|
> See [#25495](https://github.com/abpframework/abp/pull/25495) for details. |
||||
|
|
||||
|
### Dependency Updates |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications that pin ABP transitive dependencies directly. |
||||
|
- Applications that use Blazorise, MongoDB.Driver, or CodeMirror directly with fixed versions. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- Blazorise packages were upgraded to **2.1.3**. |
||||
|
- MongoDB.Driver was upgraded to **3.9.0**. |
||||
|
- `@abp/codemirror` was updated to CodeMirror **6.0.2**. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- Review your direct package references and align them with ABP's package versions where needed. |
||||
|
- Rebuild and run relevant UI/integration tests if you directly use upgraded packages. |
||||
|
- If you customize CMS Kit editor resources, re-test editor pages after the CodeMirror update. |
||||
|
|
||||
|
## Pro |
||||
|
|
||||
|
There are no explicitly marked breaking changes on the PRO side in this release scope. However, check the following if they apply to your application. |
||||
|
|
||||
|
### Account Linking and Shared User Account Flows |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using Account Pro account-linking flows. |
||||
|
- Applications using shared user accounts across tenants. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- Account linking has been hardened by binding link tokens to source-side consent data. |
||||
|
- Shared user account administration includes fixes for host admin actions and tenant removal scenarios. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- Re-test account linking, linked account switching, tenant user invitation, tenant removal, and host/tenant user administration flows. |
||||
|
- If you customized account-linking pages or flows, verify they still follow the expected consent and token lifecycle. |
||||
|
|
||||
|
### LowCode Dynamic Uploads and Admin Console Designer |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using the LowCode module. |
||||
|
- Applications using the Admin Console LowCode designer. |
||||
|
- Applications with LowCode dynamic upload scenarios. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- The LowCode designer has been integrated into the Admin Console experience. |
||||
|
- LowCode dynamic uploads now support `IRemoteStreamContent`. |
||||
|
- LowCode React demo/template behavior was aligned with generated template behavior. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- Re-test the LowCode designer in Admin Console. |
||||
|
- Re-test dynamic file upload scenarios generated or managed through LowCode. |
||||
|
- If you customized generated LowCode templates, compare your customizations with the latest template output. |
||||
|
|
||||
|
### AI Management Proxy Updates |
||||
|
|
||||
|
**Who is affected** |
||||
|
|
||||
|
- Applications using the AI Management module with generated client proxies. |
||||
|
|
||||
|
**What changed** |
||||
|
|
||||
|
- Missing proxy generations for AI Management were added. |
||||
|
|
||||
|
**What to do** |
||||
|
|
||||
|
- Regenerate/update client proxies after upgrading if your application consumes AI Management APIs from a UI or remote client. |
||||
|
- Re-test AI Management screens and client integrations that depend on generated proxies. |
||||
Loading…
Reference in new issue