Upgrading Volo.Abp.Ddd.Application 9 to 10
Breaking9.3.7 → 10.7.0Breaking9Security18Deprecated1New141Changed223Fixed178Other619
BreakingUpgrade verdict
9 breaking changes and 18 security fixes.
In plain terms
- The built-in operation rate limiting feature is no longer part of ABP.
- Removes StaticTemplateDefinitionChangedEventHandler.
- Repository methods no longer include related details by default, so you must opt in explicitly.
- Removes `JSRuntime` from `MauiBlazorCachedApplicationConfigurationClient`.
Must act Top 5 of 28 that need code or config changes
Target frameworks requirement changed in 10.0.0-rc.1: .NETStandard2.0, .NETStandard2.1, net8.0, net9.0 → .NETStandard2.0, .NETStandard2.1, net10.0, net8.0, net9.0.
What you must change
Breaking9
Removes Operation Rate Limiting from the framework.
Removes StaticTemplateDefinitionChangedEventHandler.
StaticTemplateDefinitionChangedEventHandlerSets includeDetails default to false in repository methods.
Removes
JSRuntime from MauiBlazorCachedApplicationConfigurationClient.JSRuntimeMauiBlazorCachedApplicationConfigurationClientChanges PermissionIntegrationController.IsGrantedAsync to use HttpPost.
PermissionIntegrationController.IsGrantedAsyncHttpPostRefactors BasicAggregateRoot to use nullable collections for distributed and local events.
BasicAggregateRootReplaces LazyLocalizationPipe with AsyncLocalizationPipe.
LazyLocalizationPipeAsyncLocalizationPipeChanges model properties from init to set.
Refactors TocHeading and TocItem from records to classes.
TocHeadingTocItemSecurity18
Hashes the connection string in unit of work API keys.
Keeps tenant connection strings out of the audit logs.
Validates blob names in the file system provider and blogging file service.
Prevents OpenIddict client_id from leaking into the interactive auth cookie.
client_idUpgrade vulnerable NuGet packages to patched versions.
Bump Scriban and System.Security.Cryptography.Xml to patched versions.
ScribanSystem.Security.Cryptography.XmlRestricts dynamic sorting selectors to property or field access.
Upgrades Scriban to 7.2.1 to fix GHSA-24c8-4792-22hx.
ScribanBumps Microsoft.*/System.* packages to 10.0.7 to address CVE-2026-40372.
Requires delete permission for blog posts.
Sanitizes package.json and prevents command injection in ABP CLI.
package.jsonPrevents privilege escalation by adding assignment restrictions for roles and permissions.
Fixes vulnerable npm packages.
Sets a default MaxDepth for all AutoMapper maps to mitigate GHSA-rvv3-g6hj-g44x.
MaxDepthHTML-encodes TagHelper titles and texts for security.
TagHelperChecks user authentication before providing an access token.
Uses a safe redirect after registration in the Account Module.
Updates
Vulnerability packages to the latest versions.Deprecations to plan for
Deprecated1
Adds AsyncLocalizationPipe and deprecates LazyLocalizationPipe.
AsyncLocalizationPipeLazyLocalizationPipe