Adjust release documentation for ABP 10.6 by updating the release notes date to 2026-07-27 and removing the Angular 22 upgrade guide entry from the migration guides index.
Add v10.6 release notes (stable, dated 2026-07-07) and update roadmap from v10.6 to v10.7 focus (planned for August 2026). Includes reorganized feature priorities, updated issue links, and corrected v10.5 announcement URL.
Document the upgrade path from ABP 10.5 to 10.6, including background job infrastructure changes, upload/proxy generation updates, Angular 22 adoption, antiforgery and authentication behavior fixes, and dependency version bumps. Also add the new guide to the migration guide index.
- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member
Refreshes next version details for May 2026, removes a delivered v10.3 backlog item, and aligns roadmap focus with current 10.4 preview work.
Made-with: Cursor