- One namespace no longer spans two assemblies now that they live in the domain layer
- The Data Protection purpose keeps its old string, so outstanding 2FA codes stay valid
- Match the ASP.NET Core provider, which keeps the key id and key ring location out of the log
- Assert the provider the manager uses, not only the one the key's descriptor hands out
- The public ProviderType is the last type registered under a key, not the one the manager uses
- Add cross-host coverage for a second user type and for both hosts opting out
- Register them in AbpIdentityDomainModule so both ends of a distributed flow use the same provider
- Add AbpIdentityTokenProviderOptions.UseAbpTokenProviders to opt out on every host
Adjust release documentation for ABP 10.6 by updating the release notes date to 2026-07-27 and removing the Angular 22 upgrade guide entry from the migration guides index.
Document the upgrade path from ABP 10.5 to 10.6, including background job infrastructure changes, upload/proxy generation updates, Angular 22 adoption, antiforgery and authentication behavior fixes, and dependency version bumps. Also add the new guide to the migration guide index.
- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member