Background Jobs: Dedicated Workers, Parallel Execution, and Successful Job Retention
Added three opt-in enhancements to the default background job worker. All of them are disabled by default, so existing applications keep the current behavior unless you enable them explicitly:
Storing successful jobs:
By default, a job is deleted as soon as it runs successfully. You can now set StoreSuccessfulJobs = true to keep completed jobs in the store. A new CompletionTime column marks completed jobs, and a cleanup worker prunes them after SuccessfulJobRetentionTime (default: 7 days).
Dedicated workers per job type:
AddDedicatedWorker(...) registers a worker that processes only the configured job argument types, each with its own distributed lock. The default worker continues handling all remaining job types.
Parallel job execution:
Set MaxParallelJobExecutionCount greater than 1 to execute multiple jobs in the same poll cycle. In this mode, each job is claimed with its own distributed lock so different application instances can process different jobs concurrently without running the same job twice.
API Definition and Proxy Improvements for Content Types and Multipart Uploads
The API definition now exposes response ContentTypes and an IsRemoteStream flag. C#, jQuery, and Angular proxies can use the declared media type instead of collapsing everything to application/json and text/plain.
For upload DTOs containing IRemoteStreamContent, generated Angular and jQuery proxies now forward FormData as multipart requests instead of silently dropping the file payload or trying to serialize the stream as JSON.
Angular UI: Upgrade to Angular 22
Improved the locale loading mechanism with a fallback path, so culture resources load more reliably when optional locale files are missing or partially available.
Antiforgery and OpenIddict Security Improvements
Includes several security-focused fixes for mixed authentication scenarios:
Antiforgery claim issuer normalization:
When an application serves a token-authenticated SPA and cookie-authenticated MVC pages on the same origin, antiforgery validation could fail because the user id claim issuer differed between JWT and cookie authentication schemes. ABP now normalizes the user id claim issuer while generating and validating antiforgery tokens.
This behavior is enabled by default through AbpAntiForgeryOptions.NormalizeUserIdClaimIssuer. Razor Pages antiforgery validation was also aligned with the same normalization logic, which fixes failures in modules such as Setting Management.
Prevent OpenIddict client_id from leaking into the interactive auth cookie:
ABP fixed a case where an OpenIddict authorization request could stamp the requested client_id into the interactive authentication cookie during security-stamp refresh. That could corrupt audit logs and make later cookie-authenticated requests appear to belong to the OAuth client.
The fix strips client_id when the interactive cookie is refreshed. Tokens are unaffected, and cookies that were already corrupted self-heal on the next refresh.
Forward the current access token for authenticated client requests:
HttpContextAbpAccessTokenProvider now forwards the incoming access token whenever the request is authenticated, including client_credentials requests. This prevents unnecessary fallback to configured identity clients in machine-to-machine scenarios.
OpenIddict: Generate Access Token from the UI
Added a Generate Access Token action to OpenIddict application management pages across MVC, Blazor, MudBlazor, and Angular UIs.
Administrators can request a token for an OpenIddict application directly from the UI. The backend forwards a client_credentials request to /connect/token and returns the generated access token to the caller.
This is especially useful for testing integrations, validating scopes, and troubleshooting machine-to-machine authentication without leaving the admin UI.
Dependency Updates
Angular packages upgraded to 22.0.x.
Microsoft.* and System.* packages upgraded to 10.0.9.
Microsoft.Data.SqlClient upgraded to 7.0.2.
Swashbuckle.AspNetCore upgraded to 10.2.3.
ABP Platform 10.5メジャーバージョン2026年6月2日
機能
S3-Compatible Blob Storage Support
Improved the AWS Blob Storing provider so it can work with S3-compatible storage services such as Cloudflare R2, MinIO, Backblaze B2, Wasabi, and DigitalOcean Spaces.
Two new AWS blob provider configuration options are available:
ServiceURL: Sets the custom S3-compatible service endpoint.
DisablePayloadSigning: Sends UNSIGNED-PAYLOAD instead of streaming chunked signing when the target provider does not support AWS SDK v4's default payload signing behavior.
For client_credentials, password, and token-exchange grants, you can now configure ABP to use the scopes registered on the client application when the token request does not include a scope parameter.
Dynamic Background Worker Capability Markers
Improved the dynamic background worker infrastructure with provider capability markers.
Consumers can now detect whether the active IDynamicBackgroundWorkerManager supports runtime registration and cron scheduling by checking marker interfaces:
The link-user token provider now uses ABP's single-active token infrastructure. Only the latest generated link-user token remains valid, and applications can configure the token lifetime through dedicated options.
CMS Kit: CodeMirror 6 Update
This modernizes the editor infrastructure used by CMS Kit and related UI features without requiring typical applications to change their CMS Kit usage.
Shared User Accounts: Remove Users from Tenants
Improved shared user account administration with a new tenant-side removal action.
Administrators can now remove a shared user from the current tenant directly from the user management UI. This provides an admin-managed counterpart to the self-service leave flow and keeps shared-account administration easier to handle in multi-tenant systems.
Dependency Updates
Blazorise packages upgraded to 2.1.3.
MongoDB.Driver upgraded to 3.9.0.
CodeMirror updated to 6.0.2 through @abp/codemirror.
ABP Platform 10.4メジャーバージョン2026年5月14日
機能
URL-Based Localization
You can now embed the culture directly in the URL path, such as /tr/products or /en/about.
Localization File Splitting
ABP localization resources can now use multiple JSON files for the same culture. This is useful for large modules or applications where keeping all localization texts in a single en.json file becomes difficult to maintain.
Blazor UI: MudBlazor Support
Added MudBlazor-based package infrastructure, template integration, and module/theme support needed to build ABP Blazor applications with MudBlazor. Blazorise and MudBlazor are now supported side by side, the LeptonX theme works with both UI libraries, and when creating a new Blazor project you can pick which UI library to use.
Improved the security model for email and SMS two-factor authentication codes.
Email and phone verification codes now use ABP's single-use token providers. Generated codes are encrypted, stored with an absolute expiration time, and consumed after successful validation. Generating a new code invalidates the previous one.
Account Pro: Passwordless Email Login
Introduced passwordless email login for the Account Pro module.
Users can sign in by receiving an email login link and/or a one-time password (OTP), depending on the configured login type. Administrators can enable the feature, choose the login mode, and configure token lifetime from the account settings.
The feature is designed with security in mind:
Login links and OTPs are single-use.
Resending a login email invalidates previous tokens.
Token operations respect the current tenant context.
Rate limiting helps protect against brute-force and email spam scenarios.
Email enumeration behavior follows the existing account security setting.
AI Management: MCP Server Enhancements
MCP server configuration has been enhanced for stdio transport scenarios and workspace relationships. This makes it easier to connect local or process-based MCP servers to AI workspaces and use their tools from the chat playground.
LeptonX: URL-Based Localization and Theme Improvements
LeptonX has been updated to work with the new URL-based localization flow across UI types, including Angular language switching and culture-aware navigation.
Dependency and Security Updates
OpenIddict upgraded to 7.5.0.
MongoDB.Driver upgraded to 3.8.0.
Microsoft/System package updates for CVE-2026-40372.
System.Security.Cryptography.Xml upgraded to 10.0.6.
Introduced end-to-end support for OpenIddict private_key_jwt client authentication.
Instead of using a shared client_secret, clients can now authenticate with an asymmetric key pair: keep the private key on the client, and register the public key (JWKS) on the authorization server.
On the open-source side, ABP CLI now includes the abp generate-jwks command (and the OpenIddict demo was updated accordingly). On the Pro side, OpenIddict application management now supports storing and validating JWKS for confidential applications.
This is especially useful for machine-to-machine and compliance-focused environments where shared secrets are not preferred.
Event Bus: String-Based Event Publishing with Dynamic Payload.
When you do not know event types at compile time, you can now publish and handle events by name without introducing extra wrapper contracts up front. This is especially useful for plugin ecosystems, partner integrations, and metadata-driven application flows.
This is not a separate eventing model. Dynamic events run through the same ABP infrastructure (including outbox/inbox when configured), can be handled through DynamicEventData, and can coexist with typed handlers for the same event name. Distributed providers support this approach except Dapr, which requires startup-time topic declarations.
Background Jobs/Workers: String-Based Publishing with Dynamic Payload.
With these APIs, you can now enqueue jobs with dynamic payloads, register handler delegates at startup, and add/update/remove recurring workers at runtime. This is especially useful for plugin architectures, metadata-driven workflows, and tenant-specific scheduling scenarios where task types are not known at compile time.
Dynamic background jobs work through ABP's existing typed job pipeline (including provider integrations), while dynamic workers support runtime schedule management (period/cron depending on provider).
API Definition Endpoint: Descriptions and Documentation Support.
The API definition endpoint can now optionally return richer metadata such as summary/description fields for controllers, actions, and parameters.
This is particularly useful for dynamic client generation, API explorers, and tooling that consumes ABP API metadata directly without requiring OpenAPI parsing.
Entity Cache: New Batch APIs (FindMany* / GetMany*).
Extends IEntityCache with batch retrieval APIs so you can resolve multiple entities in a single cache/database flow instead of looping over FindAsync/GetAsync.
It includes both list-based APIs (FindManyAsync / GetManyAsync) and dictionary-based APIs (FindManyAsDictionaryAsync / GetManyAsDictionaryAsync) so you can choose the shape that best matches your access pattern.
Angular: User/Tenant Sharing and Tenant Switch Experience.
Enhances Angular UX for shared-user multi-tenancy scenarios, including invitation flows, tenant switch UX, and related identity/account integrations.
This improves the out-of-the-box experience for applications using tenant user sharing.
Angular: Upgrade to 21.2 + TypeScript 5.9.
Upgraded Angular to 21.2 and TypeScript to 5.9, bringing the Angular UI stack to the latest ABP-supported frontend baseline.
Introducing the Volo.Abp.LuckyPenny.AutoMapper Provider.
Introduced Volo.Abp.LuckyPenny.AutoMapper as a new optional provider integration for projects that want to use the LuckyPenny-maintained AutoMapper package.
The existing Volo.Abp.AutoMapper package remains unchanged, and migration is straightforward: replace AbpAutoMapperModule with AbpLuckyPennyAutoMapperModule in your module dependencies while keeping the same ABP-facing namespaces and APIs.
Security Improvements (Account Pro Module).
Optional CAPTCHA for forgot-password flow:
You can enable CAPTCHA for forgot-password flows to reduce automated reset attempts.
Operation-based rate limiting policies for account confirmation/token operations (including updated/default policies for reset and token endpoints):
Token/confirmation/reset operations now rely on policy-based limits, so you can centralize and customize limits per operation.
Session revocation after sensitive credential operations (password change/reset/admin reset):
Password changes/resets now revoke sessions to reduce risk from stolen or long-lived sessions.
Stronger profile picture upload validation (allowed extensions, max size, and magic-bytes checks):
Uploads are checked by extension, size, and file signature (magic bytes), not only by client-provided metadata.
ABP Platform 10.2メジャーバージョン2026年3月31日
機能
Multi-Tenant Account Usage: Shared User Accounts:
Introduced Shared User Accounts: a single user account can belong to multiple tenants, and the user can choose or switch the active tenant when signing in. This enables a "one account, multiple tenants" experience - for example, inviting the same email address into multiple tenants.
When you use Shared User Accounts:
Username/email uniqueness becomes global (Host + all tenants).
Users are prompted to select the tenant at login if they belong to multiple tenants.
Users can switch between tenants using the tenant switcher in the user menu.
Tenant administrators can invite existing or new users to join a tenant.
Prevent Privilege Escalation: Assignment Restrictions for Roles and Permissions:
Implemented a unified privilege escalation prevention model to address security vulnerabilities where users could assign themselves or others roles or permissions they do not possess:
Role Assignment Restriction: Users can only assign or remove roles they currently have. Users cannot add new roles to themselves (removal only) and cannot assign or remove roles they do not possess.
Permission Grant/Revoke Authorization: Users can only grant or revoke permissions they currently have. Validation applies to both grant and revoke operations.
Incremental Permission Protection: When updating user or role permissions, permissions the current user does not have are treated as non-editable and are preserved as-is during updates.
Users with the admin role can assign any role and grant/revoke any permission. All validations are enforced on the backend — the UI is not a security boundary.
ClientResourcePermissionValueProvider for OAuth/OpenIddict:
Added ClientResourcePermissionValueProvider, extending resource-based authorization to OAuth clients. When using IdentityServer or OpenIddict, clients can now have resource permissions aligned with the standard user and role permission model.
This allows you to control which OAuth clients can access which resources, providing fine-grained authorization for API consumers. The implementation integrates with ABP's existing resource permission infrastructure.
Angular: Hybrid Localization Support:
Introduced Hybrid Localization for Angular applications, combining server-side and client-side localization strategies. This gives you flexibility in how translations are loaded and resolved — you can use server-provided localization, client-side fallbacks, or a mix of both.
This feature is useful when you want to reduce initial load time, support offline scenarios, or have environment-specific localization behavior. The Angular packages have been updated to support the hybrid approach seamlessly.
Angular: Extensible Table Row Detail:
Added the ExtensibleTableRowDetailComponent for expandable row details in extensible tables. You can now display additional information for each row in a collapsible detail section.
The feature supports row detail templates via both direct input and content child component. It adds toggle logic and emits rowDetailToggle events, making it easy to customize the behavior and appearance of expandable rows in your data tables.
Angular: CMS Kit Module Features:
Brought CMS Kit features to Angular, completing the cross-platform UI coverage for the CMS Kit module. The Angular implementation includes: Blogs, Blog Posts, Comments, Menus, Pages, Tags, Global Resources, and CMS Settings.
Together with the CMS Kit Pro Angular implementation (FAQ, Newsletters, Page Feedbacks, Polls, Url forwarding), ABP now provides full Angular UI coverage for both the open-source CMS Kit and CMS Kit Pro modules.
Blazor: Upgraded to Blazorise 2.0:
Upgraded the Blazorise library to version 2.0 for Blazor UI. If you are upgrading your project to v10.2 RC, please ensure that all Blazorise-related packages are updated to v2.0 in your application.
Blazorise 2.0 includes various improvements and changes. Please refer to the Blazorise 2.0 Release Notes and the ABP Blazorise 2.0 Migration Guide for upgrade instructions.
Identity: Single Active Token Providers:
Introduced a single active token policy for password reset, email confirmation, and change-email flows. Three new token providers are available: AbpPasswordResetTokenProvider, AbpEmailConfirmationTokenProvider, and AbpChangeEmailTokenProvider.
When a new token is generated, it invalidates any previously issued tokens for that purpose. This improves security by ensuring that only the most recently issued token is valid. Token lifespan can be customized via the respective options classes for each provider.
TickerQ Package Upgrade to 10.1.1:
If you are using the TickerQ integration packages (Volo.Abp.TickerQ, Volo.Abp.BackgroundJobs.TickerQ, or Volo.Abp.BackgroundWorkers.TickerQ), you need to apply breaking changes when upgrading to ABP 10.2. TickerQ has been upgraded from 2.5.3 to 10.1.1, which only targets .NET 10.0 and contains several API changes.
Key changes include:
UseAbpTickerQ moved from IApplicationBuilder to IHost — use context.GetHost().UseAbpTickerQ() in your module
Scheduler and dashboard configuration APIs have changed
New helpers: context.GetHost(), GetWebApplication(), GetEndpointRouteBuilder()
AI Management: MCP (Model Context Protocol) Support:
The AI Management Module now supports MCP (Model Context Protocol), enabling AI workspaces to use external MCP servers as tools. MCP allows AI models to interact with external services, databases, APIs, and more through a standardized protocol.
You can create and manage MCP servers via the AI Management UI. Each MCP server supports one of the following transport types: Stdio (runs a local command), SSE (Server-Sent Events), or StreamableHttp. For HTTP-based transports, you can configure authentication (API Key, Bearer token, or custom headers). Once MCP servers are defined, you can associate them with workspaces. When a workspace has MCP servers associated, the AI model can invoke tools from those servers during chat conversations — tool calls and results are displayed in the chat interface.
You can test the connection to an MCP server after creating it to verify connectivity and list available tools before use:
When a workspace has MCP servers associated, the AI model can invoke tools from those servers during chat conversations. Tool calls and results are displayed in the chat interface.
AI Management: RAG with File Upload:
The AI Management module supports RAG (Retrieval-Augmented Generation) with file upload, which enables workspaces to answer questions based on the content of uploaded documents. When RAG is configured, the AI model searches the uploaded documents for relevant information before generating a response.
To enable RAG, configure an embedder (e.g., OpenAI, Ollama) and a vector store (e.g., PgVector) on the workspace.
You can then upload documents (PDF, Markdown, or text files, max 10 MB) through the workspace management UI. Uploaded documents are automatically processed - their content is chunked, embedded, and stored in the configured vector store:
When you ask questions in the chat interface, the AI model uses the uploaded documents as context for accurate, grounded responses.
AI Management: OpenAI-Compatible Chat Endpoint:
The AI Management module exposes an OpenAI-compatible REST API at the /v1 path. This allows any application or tool that supports the OpenAI API format — such as AnythingLLM, Open WebUI, Dify, or custom scripts using the OpenAI SDK — to connect directly to your AI Management instance.
Each AI Management workspace appears as a selectable model in the client application. The workspace's configured AI provider handles the actual inference transparently. Available endpoints include /v1/chat/completions, /v1/models, /v1/embeddings, /v1/files, and more. All endpoints require authentication via a Bearer token in the Authorization header.
File Management: Resource-Based Authorization:
The File Management Module now supports resource-based authorization. You can control access to individual files and folders per user, role, or client. Permissions can be granted at the resource level via the UI, and the feature integrates with ABP's resource permission infrastructure.
This feature is implemented for all three supported UIs: MVC/Razor Pages, Blazor, and Angular, providing a consistent experience across your application regardless of the UI framework you use.
Other Improvements and Enhancements:
Angular signal APIs: ABP Angular packages migrated to signal queries, output functions, and signal input functions for alignment with Angular 21.
Angular Vitest: ABP Angular templates now use Vitest as the default testing framework instead of Karma/Jasmine.
Ambient auditing: Programmatic disable/enable of auditing via IAuditingHelper.DisableAuditing() and IsAuditingEnabled().
Complex property auditing: Entity History and ModifierId now support EF Core complex properties.
RabbitMQ correlation ID: Correlation ID support added to RabbitMQ JobQueue for distributed tracing.
Concurrent config retrieval: MvcCachedApplicationConfigurationClient now fetches configuration and localization concurrently for faster startup.
Environment localization fallback: Angular can use environment.defaultResourceName when the backend does not provide it.
JS proxy namespace fix: Resolved namespace mismatch for multi-segment company names in generated proxies.
Audit Logging max length: Entity/property type full names increased to 512 characters to reduce truncation.
AI guidelines: Cursor and Copilot AI guideline documents added for ABP development.
ABP Platform 10.1.1メジャーバージョン2026年3月3日
機能
Docs: Added AI provider installation reminder to AI Management module.
Bumped Semantic Kernel packages to 1.71.0.
Docs: CMS Kit Pro package requirements.
'ASP.NET Zero vs ABP' comparison table updated.
Set page title in Account Manage page.
Updated ABP Studio release-note docs for new versions.
Now use static proxy to get ApplicationConfiguration.
Updated workflow to merge rel-10.2 with rel-10.1.
Docs: Added Swashbuckle.AspNetCore v10 upgraded section to v10.1 migration guide.