Add ABP 10.4 RC release docs

Made-with: Cursor

docs/en/Blog-Posts/2026-04-29 v10_4_Preview/POST.md

@@ -0,0 +1,197 @@
+# ABP Platform 10.4 RC Has Been Released
+
+We are happy to release [ABP](https://abp.io) version **10.4 RC** (Release Candidate). This blog post introduces the new features and important changes in this new version.
+
+Try this version and provide feedback for a more stable version of ABP v10.4! Thanks to you in advance.
+
+## Get Started with the 10.4 RC
+
+You can check the [Get Started page](https://abp.io/get-started) to see how to get started with ABP. You can either download [ABP Studio](https://abp.io/get-started#abp-studio-tab) (**recommended**, if you prefer a user-friendly GUI application - desktop application) or use the [ABP CLI](https://abp.io/docs/latest/cli).
+
+By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:
+
+![studio-switch-to-preview.png](studio-switch-to-preview.png)
+
+## Migration Guide
+
+There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please check the migration guide if you are upgrading from v10.3 or earlier: [ABP Version 10.4 Migration Guide](https://abp.io/docs/10.4/release-info/migration-guides/abp-10-4).
+
+## What's New with ABP v10.4?
+
+In this section, I will introduce some major features released in this version.
+Here is a brief list of titles explained in the next sections:
+
+- URL-Based Localization
+- Localization File Splitting
+- Blazor UI: MudBlazor Support
+- Identity: Single-Use Email/SMS 2FA Token Providers
+- Account Pro: Passwordless Email Login
+- QA Module: AI Suggest
+- AI Management: MCP Server Enhancements
+- LeptonX: URL-Based Localization and Theme Improvements
+- Dependency and Security Updates
+
+### URL-Based Localization
+
+ABP v10.4 introduces URL-based localization support. You can now embed the culture directly in the URL path, such as `/tr/products` or `/en/about`.
+
+This is especially useful for public websites, documentation sites, e-commerce applications, and any application that needs SEO-friendly and shareable localized URLs. Instead of relying only on query string, cookie, or browser language detection, the selected culture can be part of the URL itself.
+
+You can enable it with a single configuration:
+
+```csharp
+Configure<AbpRequestLocalizationOptions>(options =>
+{
+    options.UseRouteBasedCulture = true;
+});
+```
+
+When enabled, ABP automatically handles route registration, URL generation, menu links, and language switching for MVC, Razor Pages, Blazor Server, Blazor WebAssembly, and Angular applications.
+
+For Angular applications, route trees can be wrapped with `withOptionalRouteCulturePrefix` so the same route configuration can handle both `/identity/users` and `/en/identity/users`:
+
+```typescript
+import { Routes } from '@angular/router';
+import { withOptionalRouteCulturePrefix } from '@abp/ng.core';
+
+const appRoutesCore: Routes = [
+  // ... your routes
+];
+
+export const appRoutes = withOptionalRouteCulturePrefix(appRoutesCore);
+```
+
+For Blazor applications, ABP built-in module pages already include culture-aware route variants. If you have your own Blazor pages, add culture route variants manually:
+
+```razor
+@page "/Products"
+@page "/{culture}/Products"
+```
+
+> See the [URL-Based Localization](https://abp.io/docs/10.4/framework/fundamentals/url-based-localization) documentation and [#25174](https://github.com/abpframework/abp/pull/25174) for details.
+
+### Localization File Splitting
+
+ABP localization resources can now use multiple JSON files for the same culture. This is useful for large modules or applications where keeping all localization texts in a single `en.json` file becomes difficult to maintain.
+
+For example, you can split a resource by feature:
+
+```text
+Localization/
++-- MyResource/
+    +-- en.json
+    +-- en_Authors.json
+    +-- en_Books.json
+    +-- en_Users.json
+```
+
+ABP merges these files into the same localization dictionary. Files are sorted by name before merging, and if the same key exists in multiple files, the value from the last file wins.
+
+> See the [Localization](https://abp.io/docs/10.4/framework/fundamentals/localization) documentation and [#25227](https://github.com/abpframework/abp/pull/25227) for details.
+
+### Blazor UI: MudBlazor Support
+
+ABP v10.4 starts the MudBlazor integration work for the Blazor UI stack.
+
+This release adds MudBlazor-based package infrastructure, template integration, and module/theme support needed to build ABP Blazor applications with MudBlazor. The existing Blazorise-based UI remains available, while MudBlazor support provides a new path for modern Blazor UI development.
+
+This is a major UI foundation change, so we especially encourage Blazor users to try the RC and share feedback before the stable release.
+
+> See [#25235](https://github.com/abpframework/abp/pull/25235) for details.
+
+### Identity: Single-Use Email/SMS 2FA Token Providers
+
+ABP v10.4 improves the security model for email and SMS two-factor authentication codes.
+
+Email and phone verification codes now use ABP's single-use token providers. Generated codes are encrypted, stored with an absolute expiration time, and consumed after successful validation. Generating a new code invalidates the previous one.
+
+You can configure token lifetime and code length:
+
+```csharp
+Configure<AbpEmailTwoFactorTokenProviderOptions>(options =>
+{
+    options.TokenLifespan = TimeSpan.FromMinutes(5);
+    options.CodeLength = 8;
+});
+
+Configure<AbpPhoneNumberTwoFactorTokenProviderOptions>(options =>
+{
+    options.TokenLifespan = TimeSpan.FromMinutes(2);
+});
+```
+
+The authenticator app provider is not affected and continues to use the standard TOTP approach.
+
+> See the [Two Factor Authentication](https://abp.io/docs/10.4/modules/identity/two-factor-authentication) documentation and [#25316](https://github.com/abpframework/abp/pull/25316) for details.
+
+### Account Pro: Passwordless Email Login
+
+ABP Commercial v10.4 RC introduces passwordless email login for the Account Pro module.
+
+Users can sign in by receiving an email login link and/or a one-time password (OTP), depending on the configured login type. Administrators can enable the feature, choose the login mode, and configure token lifetime from the account settings.
+
+The feature is designed with security in mind:
+
+- Login links and OTPs are single-use.
+- Resending a login email invalidates previous tokens.
+- Token operations respect the current tenant context.
+- Rate limiting helps protect against brute-force and email spam scenarios.
+- Email enumeration behavior follows the existing account security setting.
+
+This feature is especially useful for applications that want a smoother sign-in experience without removing the tenant-aware and security-focused account flow of ABP.
+
+### QA Module: AI Suggest
+
+The QA module now includes an AI Suggest feature for answer writers.
+
+When enabled, authorized users can generate a suggested answer based on the question content and existing answers. The generated text is inserted into the editor so the user can review, edit, and submit it manually.
+
+Administrators can enable the feature from QA settings, configure the prompt and character limits, and control access through the new AI Suggest permission.
+
+### AI Management: MCP Server Enhancements
+
+The AI Management module continues to improve its MCP (Model Context Protocol) support.
+
+In this release, MCP server configuration has been enhanced for `stdio` transport scenarios and workspace relationships. This makes it easier to connect local or process-based MCP servers to AI workspaces and use their tools from the chat playground.
+
+### LeptonX: URL-Based Localization and Theme Improvements
+
+LeptonX has been updated to work with the new URL-based localization flow across UI types, including Angular language switching and culture-aware navigation.
+
+This release also includes several theme improvements and fixes, such as PathBase-safe menu links, improved custom select synchronization, sidebar menu re-binding after async rendering, and MudBlazor-related theme support.
+
+### Dependency and Security Updates
+
+ABP v10.4 RC includes several dependency updates and security-related package bumps:
+
+- OpenIddict upgraded to **7.5.0**
+- MongoDB.Driver upgraded to **3.8.0**
+- Microsoft/System package updates for CVE-2026-40372
+- `System.Security.Cryptography.Xml` upgraded to **10.0.6**
+- `@abp/lodash` lodash dependency updated
+
+### Other Improvements and Enhancements
+
+- **Virtual File System**: `ReplaceEmbeddedByPhysical` can now receive exclusion filters, which gives developers more control over included/excluded physical files during development ([#25284](https://github.com/abpframework/abp/pull/25284)).
+- **Exception logging**: Complex objects in exception data are now serialized more clearly in logs ([#25267](https://github.com/abpframework/abp/pull/25267)).
+- **Feature management**: Improved batch state checker performance and added `RequireFeaturesSimpleBatchStateChecker` ([#25276](https://github.com/abpframework/abp/pull/25276)).
+- **RabbitMQ**: Fixed a potential hang while acquiring a closed channel after RabbitMQ restart ([#25311](https://github.com/abpframework/abp/pull/25311)).
+- **Shared user accounts**: Improved shared-user lookup and two-factor authentication flows for shared user scenarios.
+- **Account and SaaS modules**: Improved shared-user invitation and account-page flows in tenant user sharing scenarios.
+
+## Community News
+
+### New ABP Community Articles
+
+As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:
+
+- [URL-Based Localization](https://abp.io/community/posts/urlbased-localization-3ivzinbb)
+- [Automatically Validate Your Documentation: How We Built an AI Tutorial Validator](https://abp.io/community/articles/automatically-validate-your-documentation-m3ozgkhv)
+
+Thanks to the ABP Community for all the content they have published. You can also [post your ABP related (text or video) content](https://abp.io/community/posts/create) to the ABP Community.
+
+## Conclusion
+
+This version comes with some new features and a lot of enhancements to the existing features. You can see the [Road Map](https://abp.io/docs/10.4/release-info/road-map) documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.4 RC and provide feedback to help us release a more stable version.
+
+Thanks for being a part of this community!

docs/en/release-info/migration-guides/abp-10-4.md

@@ -0,0 +1,228 @@
+```json
+//[doc-seo]
+{
+    "Description": "Upgrade your ABP solutions from v10.3 to v10.4 with this migration guide covering important behavior and integration changes."
+}
+```
+
+# ABP Version 10.4 Migration Guide
+
+This document is a guide for upgrading ABP v10.3 solutions to ABP v10.4. There are no explicitly marked breaking changes in this release scope, but there are some important changes that may require action in specific application scenarios.
+
+> **Package Version Changes:** Before upgrading, review the [Package Version Changes](../../package-version-changes.md) document to see version changes on dependent NuGet packages and align your project with ABP's internal package versions.
+
+## Open-Source (Framework)
+
+This version contains the following changes on the open-source side:
+
+### URL-Based Localization
+
+**Who is affected**
+
+- Applications that enable the new URL-based localization option.
+- Blazor applications with custom routable pages.
+- Angular applications that need culture-prefixed URLs.
+
+**What changed**
+
+- ABP now supports embedding the culture in the URL path, such as `/en/products` or `/tr/identity/users`.
+- The feature is opt-in and disabled by default.
+- MVC and Razor Pages are handled automatically when enabled.
+- ABP built-in Blazor module pages include culture-aware routes, but your own Blazor pages need manual route variants.
+- Angular applications should wrap routes and culture-aware links with the new Angular helpers.
+
+**What to do**
+
+If you do not enable URL-based localization, no action is required.
+
+If you enable it, configure `AbpRequestLocalizationOptions`:
+
+```csharp
+Configure<AbpRequestLocalizationOptions>(options =>
+{
+    options.UseRouteBasedCulture = true;
+});
+```
+
+For custom Blazor pages, add culture route variants:
+
+```razor
+@page "/Products"
+@page "/{culture}/Products"
+```
+
+For Angular applications, wrap your route tree with `withOptionalRouteCulturePrefix` from `@abp/ng.core`, and use the route-culture URL helpers/pipes for menu links, breadcrumbs, and language switching.
+
+> See the [URL-Based Localization](../../framework/fundamentals/url-based-localization.md) document and [#25174](https://github.com/abpframework/abp/pull/25174) for details.
+
+### Localization JSON Files Can Be Split by Culture
+
+**Who is affected**
+
+- Applications/modules that want to split a large localization resource into multiple JSON files for the same culture.
+- Applications that already have duplicate culture JSON files under the same localization resource path.
+
+**What changed**
+
+- ABP now allows multiple JSON files with the same `culture` value under the same localization resource.
+- Files are merged in ordinal name order.
+- If the same localization key exists in multiple files, the value from the last file wins.
+
+**What to do**
+
+No action is required for existing applications.
+
+If you split localization files, choose deterministic file names and avoid unintended duplicate keys:
+
+```text
+Localization/
++-- MyResource/
+    +-- en.json
+    +-- en_Authors.json
+    +-- en_Books.json
+```
+
+> See [#25227](https://github.com/abpframework/abp/pull/25227) for details.
+
+### Email/SMS 2FA Codes Are Single-Use
+
+**Who is affected**
+
+- Applications using the Identity module's email or phone 2FA providers.
+- Applications with custom flows around phone-number change tokens.
+- Applications that replace or customize ASP.NET Core Identity token providers.
+
+**What changed**
+
+- ABP replaces the default email and phone 2FA providers with DataProtector-backed single-use providers.
+- Generated codes are encrypted, persisted with an absolute expiration, and removed after successful validation.
+- Generating a new code invalidates the previous one.
+- `UserManager.GenerateChangePhoneNumberTokenAsync` / `VerifyChangePhoneNumberTokenAsync` also inherit the new stored-token semantics because ASP.NET Core Identity uses the default phone provider for phone-number changes.
+- Phone-change tokens issued before upgrading may stop working after the upgrade.
+
+**What to do**
+
+- Re-test login, email 2FA, SMS 2FA, and phone-number change flows.
+- If your application needs a different code lifetime or length, configure the new provider options:
+
+```csharp
+Configure<AbpEmailTwoFactorTokenProviderOptions>(options =>
+{
+    options.TokenLifespan = TimeSpan.FromMinutes(5);
+    options.CodeLength = 8;
+});
+
+Configure<AbpPhoneNumberTwoFactorTokenProviderOptions>(options =>
+{
+    options.TokenLifespan = TimeSpan.FromMinutes(2);
+});
+```
+
+- If your application requires custom token behavior, replace the token provider by registering your own provider under `TokenOptions.DefaultEmailProvider` and/or `TokenOptions.DefaultPhoneProvider`.
+
+> See the [Two Factor Authentication](../../modules/identity/two-factor-authentication.md) document and [#25316](https://github.com/abpframework/abp/pull/25316) for details.
+
+### MudBlazor Support for Blazor UI
+
+**Who is affected**
+
+- Blazor applications that want to try the new MudBlazor-based ABP UI support.
+- Module authors who build Blazor UI packages and want to support MudBlazor.
+
+**What changed**
+
+- ABP v10.4 introduces the initial MudBlazor integration packages, templates, bundling infrastructure, and module/theme support.
+- Existing Blazorise-based applications are not automatically migrated to MudBlazor.
+
+**What to do**
+
+- No action is required for existing Blazorise-based applications.
+- If you want to try MudBlazor support, create a new v10.4 RC solution/template or add the related MudBlazor packages according to the target UI type and test the UI carefully before production usage.
+
+> See [#25235](https://github.com/abpframework/abp/pull/25235) for details.
+
+### Dependency Updates
+
+**Who is affected**
+
+- Applications that pin ABP transitive dependencies directly.
+- Applications that use OpenIddict, MongoDB, or Microsoft/System packages directly with fixed versions.
+
+**What changed**
+
+- OpenIddict was upgraded to **7.5.0**.
+- MongoDB.Driver was upgraded to **3.8.0**.
+- Several Microsoft/System packages were upgraded to **10.0.7** for CVE-2026-40372.
+- `System.Security.Cryptography.Xml` was upgraded to **10.0.6**.
+
+**What to do**
+
+- Review your direct package references and align them with ABP's package versions where needed.
+- Rebuild and run integration tests if you directly use upgraded packages.
+
+## Pro
+
+There are no explicitly marked breaking changes on the PRO side in this release scope. However, check the following if they apply to your application.
+
+### Account Pro Passwordless Email Login
+
+**Who is affected**
+
+- Applications using the Account Pro module that want to enable passwordless email login.
+
+**What changed**
+
+- Account Pro now supports email login by one-time link, one-time password (OTP), or both.
+- The feature is disabled unless configured.
+- Tokens are single-use, expire according to the configured lifetime, and respect tenant-scoped settings.
+
+**What to do**
+
+- No action is required if you do not enable passwordless email login.
+- If you enable it, review account settings, email templates, token lifetime, rate limiting, and `PreventEmailEnumeration` behavior.
+- Re-test login flows for host and tenant users.
+
+### QA Module AI Suggest
+
+**Who is affected**
+
+- Applications using the QA module and enabling AI-assisted answer suggestions.
+
+**What changed**
+
+- Authorized users can generate AI-suggested answers based on question context and existing answers.
+- The feature is controlled by settings and permissions.
+
+**What to do**
+
+- No action is required unless you enable the feature.
+- If enabled, configure the QA AI Suggest settings, prompt, character limits, and permissions.
+
+### AI Management MCP Server Enhancements
+
+**Who is affected**
+
+- Applications using the AI Management module's MCP server integration.
+
+**What changed**
+
+- MCP server configuration was enhanced for `stdio` transport scenarios and workspace relationships.
+
+**What to do**
+
+- Re-test MCP server connection, tool listing, and workspace chat flows after upgrading.
+
+### LeptonX URL-Based Localization Support
+
+**Who is affected**
+
+- Applications using LeptonX with URL-based localization.
+
+**What changed**
+
+- LeptonX has been updated for culture-aware navigation and language switching, including Angular support.
+- Several menu, select, sidebar, and PathBase-related fixes were included.
+
+**What to do**
+
+- If you enable URL-based localization, re-test language switching, menu links, breadcrumbs, and PathBase deployments for your UI type.

docs/en/release-info/migration-guides/index.md

@@ -9,6 +9,7 @@
 
 The following documents explain how to migrate your existing ABP applications. We write migration documents only if you need to take an action while upgrading your solution. Otherwise, you can easily upgrade your solution using the [abp update command](../upgrading.md).
 
+- [10.x to 10.4](abp-10-4.md)
 - [10.x to 10.3](abp-10-3.md)
 - [10.x to 10.2](abp-10-2.md)
 - [10.0 to 10.1](abp-10-1.md)