Merge pull request #25772 from abpframework/auto-merge/rel-10-6/4697

Merge branch dev with rel-10.6

docs/en/Blog-Posts/2026-07-07 v10_6_Preview/POST.md

@@ -0,0 +1,180 @@
+# ABP Platform 10.6 RC Has Been Released
+
+We are happy to release [ABP](https://abp.io) version **10.6 RC** (Release Candidate). This blog post introduces the new features and important changes in this new version.
+
+Try this version and provide feedback for a more stable version of ABP v10.6! Thanks to you in advance.
+
+## Get Started with the 10.6 RC
+
+You can check the [Get Started page](https://abp.io/get-started) to see how to get started with ABP. You can either download [ABP Studio](https://abp.io/get-started#abp-studio-tab) (**recommended**, if you prefer a user-friendly GUI application - desktop application) or use the [ABP CLI](https://abp.io/docs/latest/cli).
+
+By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:
+
+![studio-switch-to-preview](studio-switch-to-preview.png)
+
+## Migration Guide
+
+You can check the migration guide if you are upgrading from v10.5 or earlier: [ABP Version 10.6 Migration Guide](https://abp.io/docs/10.6/release-info/migration-guides/abp-10-6).
+
+## What's New with ABP v10.6?
+
+In this section, I will introduce some major features released in this version.
+Here is a brief list of titles explained in the next sections:
+
+- Background Jobs: Dedicated Workers, Parallel Execution, and Successful Job Retention
+- API Definition and Proxy Improvements for Content Types and Multipart Uploads
+- Angular UI: Upgrade to Angular 22
+- Antiforgery and OpenIddict Security Improvements
+- OpenIddict: Generate Access Token from the UI
+- Dependency Updates
+
+### Background Jobs: Dedicated Workers, Parallel Execution, and Successful Job Retention
+
+ABP v10.6 adds three opt-in enhancements to the default background job worker. All of them are disabled by default, so existing applications keep the current behavior unless you enable them explicitly.
+
+**Storing successful jobs**
+
+By default, a job is deleted as soon as it runs successfully. You can now set `StoreSuccessfulJobs = true` to keep completed jobs in the store. A new `CompletionTime` column marks completed jobs, and a cleanup worker prunes them after `SuccessfulJobRetentionTime` (default: 7 days).
+
+**Dedicated workers per job type**
+
+`AddDedicatedWorker(...)` registers a worker that processes only the configured job argument types, each with its own distributed lock. The default worker continues handling all remaining job types.
+
+**Parallel job execution**
+
+Set `MaxParallelJobExecutionCount` greater than 1 to execute multiple jobs in the same poll cycle. In this mode, each job is claimed with its own distributed lock so different application instances can process different jobs concurrently without running the same job twice.
+
+Example configuration:
+
+```csharp
+Configure<AbpBackgroundJobWorkerOptions>(options =>
+{
+    options.StoreSuccessfulJobs = true;
+    options.SuccessfulJobRetentionTime = TimeSpan.FromDays(30);
+
+    options.AddDedicatedWorker<EmailJobArgs, SmsJobArgs>("NotificationWorkerLock");
+    options.AddDedicatedWorker<ReportJobArgs>("ReportWorkerLock");
+
+    options.MaxParallelJobExecutionCount = 4;
+});
+```
+
+These options are useful when you need better isolation between job types, higher throughput in clustered deployments, or an audit trail of successfully completed jobs.
+
+> See the [Background Jobs](https://abp.io/docs/10.6/framework/infrastructure/background-jobs) documentation and [#25742](https://github.com/abpframework/abp/pull/25742) for details.
+
+### API Definition and Proxy Improvements for Content Types and Multipart Uploads
+
+ABP v10.6 improves API definition generation and client proxies for file upload scenarios and non-JSON response types.
+
+The API definition now exposes response `ContentTypes` and an `IsRemoteStream` flag. C#, jQuery, and Angular proxies can use the declared media type instead of collapsing everything to `application/json` and `text/plain`.
+
+For upload DTOs containing `IRemoteStreamContent`, generated Angular and jQuery proxies now forward `FormData` as multipart requests instead of silently dropping the file payload or trying to serialize the stream as JSON.
+
+Server-side setup still follows the existing ABP pattern:
+
+```csharp
+Configure<AbpAspNetCoreMvcOptions>(options =>
+{
+    options.ConventionalControllers.FormBodyBindingIgnoredTypes.Add(typeof(UploadFileDto));
+});
+```
+
+Angular client example after proxy regeneration:
+
+```typescript
+const fd = new FormData();
+fd.append('Name', 'logo');
+fd.append('File', fileInput.files[0], 'logo.png');
+this.fileService.uploadFile(fd).subscribe(result => ...);
+```
+
+This closes long-standing gaps in generated proxies for stream-based uploads and improves support for text, blob, and custom response types.
+
+> See [#25639](https://github.com/abpframework/abp/pull/25639) for details.
+
+### Angular UI: Upgrade to Angular 22
+
+ABP v10.6 upgrades the Angular UI stack to **Angular 22.0.x**.
+
+This release also improves the locale loading mechanism with a fallback path, so culture resources load more reliably when optional locale files are missing or partially available.
+
+If you maintain a custom Angular UI on top of ABP, plan for the Angular 22 upgrade together with your ABP package update and regenerate proxies after upgrading.
+
+> See [#25690](https://github.com/abpframework/abp/pull/25690) and [#25734](https://github.com/abpframework/abp/pull/25734) for details.
+
+### Antiforgery and OpenIddict Security Improvements
+
+ABP v10.6 includes several security-focused fixes for mixed authentication scenarios.
+
+**Antiforgery claim issuer normalization**
+
+When an application serves a token-authenticated SPA and cookie-authenticated MVC pages on the same origin, antiforgery validation could fail because the user id claim issuer differed between JWT and cookie authentication schemes. ABP now normalizes the user id claim issuer while generating and validating antiforgery tokens.
+
+This behavior is enabled by default through `AbpAntiForgeryOptions.NormalizeUserIdClaimIssuer`. Razor Pages antiforgery validation was also aligned with the same normalization logic, which fixes failures in modules such as Setting Management.
+
+**Prevent OpenIddict `client_id` from leaking into the interactive auth cookie**
+
+ABP fixed a case where an OpenIddict authorization request could stamp the requested `client_id` into the interactive authentication cookie during security-stamp refresh. That could corrupt audit logs and make later cookie-authenticated requests appear to belong to the OAuth client.
+
+The fix strips `client_id` when the interactive cookie is refreshed. Tokens are unaffected, and cookies that were already corrupted self-heal on the next refresh.
+
+**Forward the current access token for authenticated client requests**
+
+`HttpContextAbpAccessTokenProvider` now forwards the incoming access token whenever the request is authenticated, including `client_credentials` requests. This prevents unnecessary fallback to configured identity clients in machine-to-machine scenarios.
+
+> See [#25655](https://github.com/abpframework/abp/pull/25655), [#25669](https://github.com/abpframework/abp/pull/25669), [#25711](https://github.com/abpframework/abp/pull/25711), and [#25740](https://github.com/abpframework/abp/pull/25740) for details.
+
+### OpenIddict: Generate Access Token from the UI
+
+ABP Commercial v10.6 RC adds a **Generate Access Token** action to OpenIddict application management pages across MVC, Blazor, MudBlazor, and Angular UIs.
+
+Administrators can request a token for an OpenIddict application directly from the UI. The backend forwards a `client_credentials` request to `/connect/token` and returns the generated access token to the caller.
+
+This is especially useful for testing integrations, validating scopes, and troubleshooting machine-to-machine authentication without leaving the admin UI.
+
+### Dependency Updates
+
+ABP v10.6 RC includes several dependency and package updates:
+
+- Angular packages upgraded to **22.0.x**
+- `Microsoft.*` and `System.*` packages upgraded to **10.0.9**
+- `Microsoft.Data.SqlClient` upgraded to **7.0.2**
+- `Swashbuckle.AspNetCore` upgraded to **10.2.3**
+
+> Check the [Package Version Changes](https://abp.io/docs/10.6/package-version-changes) document for all updates.
+
+### Other Improvements and Enhancements
+
+- **Permission management**: Skip dynamic permission initialization during migration runs to avoid noisy logs when the database is unavailable ([#25743](https://github.com/abpframework/abp/pull/25743)).
+- **Security / principal access**: `ThreadCurrentPrincipalAccessor` now returns an anonymous principal instead of `null` in non-web contexts ([#25752](https://github.com/abpframework/abp/pull/25752)).
+- **Angular proxy generation**: Array parameters are now generated as `readonly` in Angular proxies ([#25687](https://github.com/abpframework/abp/pull/25687)).
+- **Date/time normalization**: Removed misleading warnings when normalizing `Unspecified` `DateTime` values near range boundaries ([#25703](https://github.com/abpframework/abp/pull/25703)).
+- **AI Management**: Indexing is more resilient under memory pressure in the commercial module.
+
+## Community News
+
+### New ABP Community Articles
+
+As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:
+
+- [ABP 10.5.0 Expands Blazor UI Options with MudBlazor Support](https://abp.io/community/articles/abp-10.5.0-expands-blazor-ui-options-with-mudblazor-support-03rzmlpm) by [Liming Ma](https://abp.io/community/members/maliming)
+- [Angular 22 State Management: Signals, SignalStore, or NgRx?](https://abp.io/community/articles/angular-22-state-management-signals-signalstore-or-ngrx-yq8zg0nw) by [Sumeyye Kurtulus](https://abp.io/community/members/sumeyye.kurtulus)
+- [Working with Dapr Workflows in the ABP Framework](https://abp.io/community/articles/working-with-dapr-workflows-in-the-abp-framework-6476or18) by [Engincan Veske](https://abp.io/community/members/EngincanV)
+- [My Speaker's View of CONVEX Summit 2026](https://abp.io/community/articles/my-speakers-view-of-convex-summit-2026-ai-net-conference-3uk6ln1l) by [Alper Ebiçoğlu](https://abp.io/community/members/alper)
+
+Thanks to the ABP Community for all the content they have published. You can also [post your ABP related (text or video) content](https://abp.io/community/posts/create) to the ABP Community.
+
+### ABP Summer Campaign: Get Up To 20% Off + $300 in AI Credits
+
+![summer-sale](summer-sale.png)
+
+Summer is a great time to start building with ABP. From **July 6 to July 20**, we're offering exclusive summer savings on **ABP licenses and renewals**: **20% off new licenses**, **10% off renewals**, and **up to $300 in AI credits** for the **ABP AI Agent** in **ABP Studio**. Whether you're starting a new project or upgrading your development workflow, this limited-time offer helps you save on your license while accelerating development with AI.
+
+> You can read the announcement here: [ABP Summer Campaign: Get Up To 20% Off + $300 in AI Credits](https://abp.io/community/announcements/abp-summer-campaign-get-up-to-20-off-300-in-ai-credits-r5lqtpg9).
+
+## Conclusion
+
+This version comes with some new features and a lot of enhancements to the existing features. You can see the [Road Map](https://abp.io/docs/10.6/release-info/road-map) documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.6 RC and provide feedback to help us release a more stable version.
+
+Thanks for being a part of this community!

docs/en/release-info/migration-guides/abp-10-6.md

@@ -0,0 +1,237 @@
+```json
+//[doc-seo]
+{
+    "Description": "Upgrade your ABP solutions from v10.5 to v10.6 with this migration guide covering important behavior and integration changes."
+}
+```
+
+# ABP Version 10.6 Migration Guide
+
+This document is a guide for upgrading ABP v10.5 solutions to ABP v10.6. There are some important changes that may require action in specific application scenarios.
+
+> **Package Version Changes:** Before upgrading, review the [Package Version Changes](../../package-version-changes.md) document to see version changes on dependent NuGet and NPM packages and align your project with ABP's internal package versions.
+
+## Open-Source (Framework)
+
+This version contains the following changes on the open-source side:
+
+### Background Jobs Infrastructure Extensions
+
+**Who is affected**
+
+- Applications using the default background job worker and wanting dedicated workers, parallel execution, or successful job retention.
+- Applications with a custom `IBackgroundJobStore` implementation.
+- Applications using the Background Jobs module with EF Core and enabling successful job retention.
+
+**What changed**
+
+- ABP adds opt-in support for:
+  - storing successfully completed jobs (`StoreSuccessfulJobs`)
+  - dedicated workers per job argument type (`AddDedicatedWorker(...)`)
+  - parallel job execution (`MaxParallelJobExecutionCount`)
+- `IBackgroundJobStore`, `IBackgroundJobWorker`, and related infrastructure gained new members.
+- EF Core stores add a `CompletionTime` column to background job records for retention scenarios.
+- All new runtime features are disabled by default.
+
+**What to do**
+
+No action is required if you do not enable the new options and do not maintain a custom background job store.
+
+If you maintain a custom `IBackgroundJobStore`, implement the new interface members so your solution compiles.
+
+If you enable `StoreSuccessfulJobs`, add/review the EF Core migration for the `CompletionTime` column and configure retention options explicitly:
+
+```csharp
+Configure<AbpBackgroundJobWorkerOptions>(options =>
+{
+    options.StoreSuccessfulJobs = true;
+    options.SuccessfulJobRetentionTime = TimeSpan.FromDays(7);
+});
+```
+
+If you enable dedicated workers or parallel execution, configure the options consistently across all application instances and use a real distributed lock provider in clustered deployments.
+
+> See the [Background Jobs](../../framework/infrastructure/background-jobs/index.md) document and [#25742](https://github.com/abpframework/abp/pull/25742) for details.
+
+### API Definition and Proxy Generation for Uploads and Content Types
+
+**Who is affected**
+
+- Applications using generated Angular, jQuery, or C# proxies for upload endpoints.
+- Applications returning non-JSON response types from application services.
+- Applications that customized generated upload proxy signatures.
+
+**What changed**
+
+- API definition now exposes response `ContentTypes` and `IsRemoteStream`.
+- Generated Angular and jQuery proxies forward upload DTOs containing `IRemoteStreamContent` as multipart `FormData`.
+- Generated Angular upload method signatures may collapse the upload argument to `FormData`.
+- `RestService` now unwraps ABP error envelopes more consistently for text and blob response modes.
+
+**What to do**
+
+- Keep upload DTO types in `FormBodyBindingIgnoredTypes` as before.
+- Regenerate client proxies after upgrading.
+- Update custom client code that assumed upload proxies accepted the original DTO type instead of `FormData`.
+- Re-test file upload flows in Angular, MVC/jQuery, and C# client integrations.
+
+> See [#25639](https://github.com/abpframework/abp/pull/25639) for details.
+
+### Angular 22 Upgrade
+
+**Who is affected**
+
+- Applications using the ABP Angular UI.
+- Applications with custom Angular code, third-party Angular libraries, or CI pipelines pinned to Angular 21.
+
+**What changed**
+
+- ABP Angular packages and templates now target **Angular 22.0.x**.
+- Locale loading was improved with a fallback mechanism for missing or partial locale resources.
+
+**What to do**
+
+- Upgrade your Angular application dependencies together with ABP NPM packages.
+- Follow the official Angular update guidance for your current Angular version.
+- Re-run UI tests and rebuild custom Angular libraries after the upgrade.
+- Regenerate Angular proxies after upgrading backend packages.
+
+> See [#25690](https://github.com/abpframework/abp/pull/25690) and [#25734](https://github.com/abpframework/abp/pull/25734) for details.
+
+### Antiforgery User Id Claim Issuer Normalization
+
+**Who is affected**
+
+- Applications that serve a token-authenticated SPA and cookie-authenticated MVC/Razor Pages on the same origin.
+- Applications using Razor Pages modules such as Setting Management with antiforgery-protected POST handlers.
+
+**What changed**
+
+- ABP normalizes the user id claim issuer while generating and validating antiforgery tokens.
+- Razor Pages now use ABP's antiforgery validation path instead of only the built-in ASP.NET Core filter.
+- The behavior is enabled by default through `AbpAntiForgeryOptions.NormalizeUserIdClaimIssuer`.
+
+**What to do**
+
+- Re-test SPA + MVC mixed authentication flows, especially pages that POST immediately on load.
+- If you implemented custom antiforgery logic that depends on the raw claim issuer, review it after upgrading.
+- Disable the behavior only if you intentionally rely on the previous issuer-specific antiforgery identity:
+
+```csharp
+Configure<AbpAntiForgeryOptions>(options =>
+{
+    options.NormalizeUserIdClaimIssuer = false;
+});
+```
+
+> See [#25655](https://github.com/abpframework/abp/pull/25655) and [#25669](https://github.com/abpframework/abp/pull/25669) for details.
+
+### OpenIddict Interactive Cookie `client_id` Fix
+
+**Who is affected**
+
+- Applications using OpenIddict authorization-code flows together with interactive cookie authentication.
+- Applications relying on audit logs or current-client resolution from cookie-authenticated requests.
+
+**What changed**
+
+- ABP removes `client_id` from the interactive authentication cookie when the cookie principal is refreshed.
+- Access tokens are unaffected.
+- Cookies that were already corrupted self-heal on the next refresh.
+
+**What to do**
+
+No action is required. Re-test authorization, account, and audit-log scenarios if you previously observed intermittent incorrect `ClientId` values in cookie-authenticated requests.
+
+> See [#25711](https://github.com/abpframework/abp/pull/25711) for details.
+
+### Access Token Forwarding for Authenticated Client Requests
+
+**Who is affected**
+
+- Applications using `HttpContextAbpAccessTokenProvider`.
+- Machine-to-machine integrations that authenticate with `client_credentials` and then call other protected APIs from the same request pipeline.
+
+**What changed**
+
+- The provider now forwards the incoming access token whenever the request is authenticated, not only when there is an interactive user.
+- `client_credentials` requests no longer fall back to configured identity clients in that scenario.
+
+**What to do**
+
+- Re-test service-to-service calls that rely on the current HTTP context access token.
+- Verify downstream API authorization when the caller authenticates as a client rather than a user.
+
+> See [#25740](https://github.com/abpframework/abp/pull/25740) for details.
+
+### Thread Current Principal Accessor Behavior
+
+**Who is affected**
+
+- Background jobs, hosted services, and other non-web code that reads `ICurrentPrincipalAccessor.Principal`.
+- Code that explicitly checks for `null` principals in non-web contexts.
+
+**What changed**
+
+- `ThreadCurrentPrincipalAccessor` now returns an anonymous `ClaimsPrincipal` instead of `null` when `Thread.CurrentPrincipal` is not set.
+
+**What to do**
+
+- Re-test background jobs and hosted services that branch on `Principal == null`.
+- Prefer checking authentication/identity state through claims or ABP's current user/client abstractions instead of relying on a `null` principal.
+
+> See [#25752](https://github.com/abpframework/abp/pull/25752) for details.
+
+### Dependency Updates
+
+**Who is affected**
+
+- Applications that pin ABP transitive dependencies directly.
+- Applications using `Microsoft.Data.SqlClient`, Swashbuckle, or Angular with fixed versions.
+
+**What changed**
+
+- `Microsoft.*` and `System.*` packages were upgraded to **10.0.9**.
+- `Microsoft.Data.SqlClient` was upgraded to **7.0.2**.
+- `Swashbuckle.AspNetCore` was upgraded to **10.2.3**.
+- ABP Angular packages were upgraded to **Angular 22.0.x**.
+
+**What to do**
+
+- Review your direct package references and align them with ABP's package versions where needed.
+- Rebuild and run database/integration tests if you directly use `Microsoft.Data.SqlClient`.
+- Re-test Swagger/OpenAPI integration if you customized Swashbuckle configuration.
+
+## Pro
+
+There are no explicitly marked breaking changes on the PRO side in this release scope. However, check the following if they apply to your application.
+
+### OpenIddict Generate Access Token UI
+
+**Who is affected**
+
+- Applications using OpenIddict application management UIs in ABP Commercial.
+
+**What changed**
+
+- Administrators can generate access tokens for OpenIddict applications from MVC, Blazor, MudBlazor, and Angular UIs.
+- The backend forwards `client_credentials` requests to `/connect/token`.
+
+**What to do**
+
+- Re-test OpenIddict application administration pages after upgrading.
+- Review who can access the new token-generation action in your authorization setup.
+
+### AI Management Indexing Resilience
+
+**Who is affected**
+
+- Applications using the AI Management module with document indexing enabled.
+
+**What changed**
+
+- Indexing is more resilient under memory pressure.
+
+**What to do**
+
+- Re-test document indexing on large datasets or memory-constrained environments after upgrading.

docs/en/release-info/migration-guides/index.md

@@ -9,6 +9,7 @@
 
 The following documents explain how to migrate your existing ABP applications. We write migration documents only if you need to take an action while upgrading your solution. Otherwise, you can easily upgrade your solution using the [abp update command](../upgrading.md).
 
+- [10.5 to 10.6](abp-10-6.md)
 - [10.4 to 10.5](abp-10-5.md)
 - [10.3 to 10.4](abp-10-4.md)
 - [10.x to 10.3](abp-10-3.md)