Document the upgrade path from ABP 10.5 to 10.6, including background job infrastructure changes, upload/proxy generation updates, Angular 22 adoption, antiforgery and authentication behavior fixes, and dependency version bumps. Also add the new guide to the migration guide index.
- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member
The ReverseMap methods will map the destination type back to the source type, but the "source" object will be of type TDestination. In other words, the "TDestination source" object is copied to the "TSource destination" object.
Added a section to the ABP 10.0 migration guide warning users about limited MySQL provider support for .NET 10.0 and recommending to delay upgrades until stable releases are available.
Clarified the addition of failure retry policy options to AbpEventBusBoxesOptions and noted required database migration due to changes in IncomingEventRecord fields for Entity Framework Core users.