- Replace FormattedStringValueExtracter.Extract with LastIndexOf in
PermissionGrantCacheItem and ResourcePermissionGrantCacheItem to
eliminate repeated string tokenization and object allocations on
every cache key parse (~12,000 calls per request with 4000+ permissions)
- Add fast-path in SimpleStateCheckerManager.InternalIsEnabledAsync to
skip DI scope creation when both StateCheckers and GlobalStateCheckers
are empty, avoiding thousands of unnecessary scope allocations
- Optimize PermissionChecker.IsGrantedAsync(string[]) and
ResourcePermissionChecker.IsGrantedAsync(string[], resourceName, resourceKey)
to load all permission definitions once via GetPermissionsAsync /
GetResourcePermissionsAsync instead of N individual GetOrNullAsync calls,
and use batch StateCheckerManager.IsEnabledAsync for state checking
- Optimize AbpApplicationConfigurationAppService.GetAuthConfigAsync to
pre-load all permission names into a HashSet for O(1) lookup instead
of N async GetOrNullAsync calls inside the loop
- Fix GetResourcePermissionsAsync to deduplicate by (ResourceName, Name)
instead of Name only, matching the actual uniqueness constraint of
resource permissions defined in PermissionDefinitionContext
Production impact (customer with 4000+ permissions): 10s+ -> ~682ms
- WriteInitLogs now uses ILoggerFactory to flush all InitLogger
categories with their original category name instead of only
flushing AbpApplicationBase
- Add CategoryName to AbpInitLogEntry, recorded automatically by
DefaultInitLogger<T> using typeof(T).FullName
- Add GetAllEntries/ClearAllEntries to IInitLoggerFactory interface
- Add GetReferencedAssemblies filter to skip non-ABP assemblies
- Handle ReflectionTypeLoadException separately from other exceptions
- Add CategoryName null/empty fallback in WriteInitLogs
- Skip DisablePropertyInjection types from orphaned module detection
When a type's assembly contains an ABP module but is not part of the
module dependency chain, Autofac's property injection is silently
skipped. This causes LazyServiceProvider and other injected properties
to remain null, leading to NullReferenceException at runtime.
This change detects the misconfiguration at startup and logs a warning
with the affected assembly name, module type, and a fix suggestion.
Remove the ownership-based fallback that allowed post creators to delete their own posts in Detail.cshtml. Deletion now strictly requires BloggingPermissions.Posts.Delete, centralizing authorization on explicit permissions to enforce consistent access control.
Refreshes next version details for May 2026, removes a delivered v10.3 backlog item, and aligns roadmap focus with current 10.4 preview work.
Made-with: Cursor
Alper Ebiçoğlu
Engincan VESKE
maliming
Volosoft Agent
selman koc
selmankoc
Enis Necipoglu
voloagent
github-actions[bot]
Yağmur Çelik
Ahmet Çelik