Upgrading Volo.Abp.Ddd.Application.Contracts 9 to 10
Breaking9.3.7 → 10.7.0Breaking9Security17Deprecated1New139Changed223Fixed178Other622
BreakingUpgrade verdict
9 breaking changes and 17 security fixes.
In plain terms
- The built-in operation rate limiting feature is removed, so apps relying on it must use another approach.
- Removes StaticTemplateDefinitionChangedEventHandler.
- Repository queries no longer load related details by default, so callers must opt in explicitly.
- Removes `JSRuntime` from `MauiBlazorCachedApplicationConfigurationClient`.
Must act Top 5 of 27 that need code or config changes
Target frameworks requirement changed in 10.0.0-rc.1: .NETStandard2.0, .NETStandard2.1, net8.0, net9.0 → .NETStandard2.0, .NETStandard2.1, net10.0, net8.0, net9.0.
What you must change
Breaking9
Removes Operation Rate Limiting from the framework.
Removes StaticTemplateDefinitionChangedEventHandler.
StaticTemplateDefinitionChangedEventHandlerSets includeDetails default to false in repository methods.
includeDetailsRemoves
JSRuntime from MauiBlazorCachedApplicationConfigurationClient.JSRuntimeMauiBlazorCachedApplicationConfigurationClientUses HttpPost for PermissionIntegrationController.IsGrantedAsync.
PermissionIntegrationControllerIsGrantedAsyncHttpPostRefactors BasicAggregateRoot to use nullable collections for distributed and local events.
BasicAggregateRootReplaces LazyLocalizationPipe with AsyncLocalizationPipe.
LazyLocalizationPipeAsyncLocalizationPipeChanges model properties from init to set.
Refactors TocHeading and TocItem from records to classes.
TocHeadingTocItemSecurity17
Hashes the connection string in unit of work API keys.
Keeps tenant connection strings out of the audit logs.
Validates blob names in the file system provider and blogging file service.
Prevents the OpenIddict client_id from leaking into the interactive auth cookie.
client_idUpgrades vulnerable NuGet packages to patched versions.
Bumps Scriban and System.Security.Cryptography.Xml to patched versions.
ScribanSystem.Security.Cryptography.XmlUpgrades Scriban to 7.2.1 to fix GHSA-24c8-4792-22hx.
ScribanBumps Microsoft.*/System.* packages to 10.0.7 to address CVE-2026-40372.
Requires delete permission for blog posts.
Sanitizes package.json and prevents command injection in ABP CLI.
package.jsonPrevents privilege escalation by adding assignment restrictions for roles and permissions.
Fixes vulnerable npm packages.
Sets a default MaxDepth for all AutoMapper maps to mitigate GHSA-rvv3-g6hj-g44x.
MaxDepthHTML-encodes TagHelper titles and texts for security.
TagHelperChecks user authentication before providing an access token.
Uses a safe redirect after registration in the Account Module.
Updates
Vulnerability packages to latest.VulnerabilityDeprecations to plan for
Deprecated1
Adds AsyncLocalizationPipe and deprecates LazyLocalizationPipe.
AsyncLocalizationPipeLazyLocalizationPipe