* Fall back to GetEntityByIdAsync when a by-id query can not be created
* Expose IQueryProjectionMapper implementations like IObjectMapper does
* Document query projection and cover EF Core, MongoDB and Mapperly
- IBlobPipelineContributor pipeline; encryption runs innermost with an authenticated end check
- Adapt FileSystem/AWS to forward-only streams; fail early on unsupported AES-GCM
- Introduced IByteArrayEncryptionService interface for encrypting and decrypting binary data with authenticated encryption.
- Implemented methods for encrypting and decrypting byte arrays and streams, including options for passphrase and salt.
- Enhanced blob storing tests to cover encryption scenarios, including tenant-specific passphrases and custom pipeline contributors.
- Added FakeInMemoryBlobProvider and various test containers to facilitate testing of blob storage with encryption.
- Created unit tests for ByteArrayEncryptionService to validate encryption and decryption functionality, including edge cases for tampered data and oversized chunks.
- Treat QUERY as a safe method like GET: excluded from audit logging and non-transactional UOW
- Add HTTP verb constants and Is* helpers to HttpMethodHelper
- Clear configuration entry when Region or ServiceURL is set to null
- Annotate DeleteObjectsAsync prefix and continuationToken as nullable
- Replace vague Region placeholder in aws.md example
- Skip container wiring in test module when AWS credentials are absent
- Dispose AmazonS3Client in test cleanup
- Validate Region or ServiceURL early in DefaultAmazonS3ClientFactory
- Normalize trailing slash in ServiceURL test assertions
- Clarify Region and ServiceURL coupling in XML docs and aws.md
- Add DisablePayloadSigning configuration to send UNSIGNED-PAYLOAD instead of streaming chunked signature, required by R2
- Make CreateS3ClientConfig async to allow subclasses to do I/O
- Document trailing-slash behavior of ServiceURL
- Extend test module to use external bucket with per-run prefix cleanup
- Document DisablePayloadSigning in aws.md and link from index.md
Update the image-manipulation reference to list SkiaSharp alongside
ImageSharp and Magick.NET, and add a SkiaSharp Provider section with
installation steps and the SkiaSharpResizerOptions /
SkiaSharpCompressOptions configuration knobs.
- Soften IsSandboxed XML doc as a best-effort marker
- Replace #XXXXX placeholders with #25399
- Set Scriban MemberFilter to allowlist public properties only,
blocking method/field access and reflection escape paths
- Update Razor and Scriban safe-runtime docs to match
- Add reflection-escape, method-invocation and nested-property
tests for Scriban
ITemplateRenderingEngine exposes a new IsSandboxed property so callers can
decide whether editing a template requires elevated trust.
- TemplateRenderingEngineBase provides a virtual default of false (secure-by-default)
- RazorTemplateRenderingEngine declares IsSandboxed=false (compiles to .NET assembly via Roslyn)
- ScribanTemplateRenderingEngine declares IsSandboxed=true (DSL without .NET interop)
- Razor integration docs and TextTemplateManagement docs document the implications
- Migration guide for ABP 10.4 documents the new abstraction member