Skip to content

Upgrading Volo.Abp.Http.Client 9 to 10

Breaking9.3.7 → 10.7.0Breaking8Security18Deprecated1New138Changed226Fixed179Other619

Full comparisonBack to Volo.Abp.Http.Client
BreakingUpgrade verdict

8 breaking changes and 18 security fixes.

In plain terms
  • The built-in operation rate limiting feature is no longer part of the framework.
  • Removes StaticTemplateDefinitionChangedEventHandler.
  • Repository methods no longer load related details by default, so you must opt in when you need them.
  • Removes `JSRuntime` from `MauiBlazorCachedApplicationConfigurationClient`.
Must act Top 5 of 27 that need code or config changes

Target frameworks requirement changed in 10.0.0-rc.1: .NETStandard2.0, .NETStandard2.1, net8.0, net9.0 → .NETStandard2.0, .NETStandard2.1, net10.0, net8.0, net9.0.

What you must change

Breaking8
Removes Operation Rate Limiting from the framework.
10.3.0GitHub ReleaseSummarizedView source
Removes StaticTemplateDefinitionChangedEventHandler.
StaticTemplateDefinitionChangedEventHandler
10.0.2GitHub ReleaseSummarizedView source
Sets includeDetails default to false in repository methods.
includeDetails
10.0.0GitHub ReleaseSummarizedView source
Removes JSRuntime from MauiBlazorCachedApplicationConfigurationClient.
JSRuntimeMauiBlazorCachedApplicationConfigurationClient
10.0.0GitHub ReleaseSummarizedView source
Uses HttpPost for PermissionIntegrationController.IsGrantedAsync.
PermissionIntegrationControllerIsGrantedAsyncHttpPost
10.3.0GitHub ReleaseSummarizedView source
Refactors BasicAggregateRoot to use nullable collections for distributed and local events.
BasicAggregateRoot
10.1.0GitHub ReleaseSummarizedView source
Changes model properties from init to set.
10.0.0GitHub ReleaseSummarizedView source
Refactors TocHeading and TocItem from records to classes.
TocHeadingTocItem
10.0.0GitHub ReleaseSummarizedView source
Security18
Hashes the connection string in unit of work API keys.
10.7.0GitHub ReleaseSummarizedView source
Keeps tenant connection strings out of the audit logs.
10.7.0GitHub ReleaseSummarizedView source
Validates blob names in the file system provider and blogging file service.
10.7.0GitHub ReleaseSummarizedView source
Prevents the OpenIddict client_id from leaking into the interactive auth cookie.
client_id
10.6.0GitHub ReleaseSummarizedView source
Upgrades vulnerable NuGet packages to patched versions.
10.6.0GitHub ReleaseSummarizedView source
Bumps Scriban and System.Security.Cryptography.Xml to patched versions.
ScribanSystem.Security.Cryptography.Xml
10.6.0GitHub ReleaseSummarizedView source
Restricts dynamic sorting selectors to property or field access in DDD.
10.5.0GitHub ReleaseSummarizedView source
Upgrades Scriban to 7.2.1 to fix GHSA-24c8-4792-22hx.
Scriban
10.4.1GitHub ReleaseSummarizedView source
Bumps Microsoft.*/System.* packages to 10.0.7 addressing CVE-2026-40372.
10.4.0GitHub ReleaseSummarizedView source
Requires delete permission for blog posts.
10.2.1GitHub ReleaseSummarizedView source
Sanitizes package.json and prevents command injection in ABP CLI.
package.json
10.2.1GitHub ReleaseSummarizedView source
Prevents privilege escalation by adding assignment restrictions for roles and permissions.
10.2.0GitHub ReleaseSummarizedView source
Fixes vulnerable npm packages.
10.2.0GitHub ReleaseSummarizedView source
Sets default MaxDepth for all AutoMapper maps to mitigate GHSA-rvv3-g6hj-g44x.
AutoMapperMaxDepth
10.2.0GitHub ReleaseSummarizedView source
HTML-encodes TagHelper titles and texts for security.
TagHelper
10.0.2GitHub ReleaseSummarizedView source
Checks user authentication before providing an access token.
10.0.0GitHub ReleaseSummarizedView source
Uses a safe redirect after registration in the Account Module.
10.0.0GitHub ReleaseSummarizedView source
Updates Vulnerability packages to the latest versions.
10.0.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated1
Adds AsyncLocalizationPipe and deprecates LazyLocalizationPipe.
AsyncLocalizationPipeLazyLocalizationPipe
10.1.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published .NET assemblies. Not mixed with prose notes.

  • added: protected method ClientProxyBase.AddAcceptHeaders(ActionApiDescriptionModel action, HttpRequestMessage requestMessage, ApiVersionInfo apiVersion): void
  • added: protected method ClientProxyBase.GetAcceptForActionReturn(ActionApiDescriptionModel action): string
  • added: protected method ClientProxyBase.RequestAsyncEnumerable<T>(string methodName, ClientProxyRequestTypeValue arguments = …): IAsyncEnumerable<T>
  • added: protected method ClientProxyBase.UnwrapStringResponse(string body, string contentType): string
  • added: protected property ClientProxyBase.SystemTextJsonSerializerOptions: IOptions<AbpSystemTextJsonSerializerOptions> { get; }
  • added: protected static method ClientProxyBase.NormalizeMediaType(string mediaType): string