ASP.NET Zero v15.4 upgrades the underlying ASP.NET Boilerplate packages to ABP 11.3.0.
This update includes several important framework-level improvements:
Redis Configuration Improvements:
Added Redis ConfigurationOptions customization hooks, making it easier to support advanced Redis scenarios such as Azure managed identity authentication with Microsoft Azure StackExchangeRedis.
Mapperly Projection Support:
Improved ObjectMapper.ProjectTo support for Mapperly projection mappers and added clearer guidance when a projection mapper is missing.
EF Core cascade Soft Delete:
Added opt-in cascade soft delete support for EF Core relationships.
EF Core Update Optimization:
Added opt-in support for skipping updates when entities are unchanged, together with fixes for edge cases around update detection.
Dynamic Sorting Hardening:
Restricted dynamic sorting selectors to property and field access to avoid unsafe or unsupported sorting expressions.
Soft-Delete Query:
Improved soft-delete DbFunction handling and added regression coverage for literal mapping scenarios.
Updated related dependencies and cleaned up package references, including SourceLink.GitHub and ConfigureAwait.Fody updates.
Customizable Default Email Templates:
Host administrators can now customize the default email templates directly from the application. This makes it much easier to adapt system emails to your brand without manually changing embedded HTML resources.
The new feature allows you to:
View the built-in application email templates.
Edit template HTML with a code editor.
Preview the email before saving.
Enable or disable a customized template.
Reset a customized template back to its default version.
This feature covers common application emails such as account activation, password reset, login without password, password changed, email change, chat notification, and subscription notification emails.
Power Tools Global .NET Tool with Web UI
ASP.NET Zero Power Tools now has a new Global .NET Tool option with a Web UI.
This gives developers a modern, cross-platform way to use Power Tools without depending only on the Visual Studio extension. It is especially useful for teams working on macOS, Linux, CI environments, or mixed development setups.
With the new Power Tools experience, you can also use the Regenerate All feature to regenerate all Power Tools definitions in a single flow instead of regenerating entities one by one. This is helpful after upgrading ASP.NET Zero, updating Power Tools templates, or applying project-wide code generation changes.
Migrated from Yarn to pnpm
Migrated frontend package management from Yarn v1/classic to pnpm.
Yarn classic is deprecated and yarn audit is no longer reliable for modern projects. With this change, ASP.NET Zero now uses pnpm@9.15.4 across the Angular app, React app, MVC/Public web projects, Web.Host frontend resources, and Playwright UI tests.
This provides:
Faster and more deterministic dependency installation.
A modern replacement for deprecated Yarn classic workflows.
More consistent frontend tooling across ASP.NET Zero UI projects.
Package Updates
This release includes package upgrades across the backend and frontend stacks.
Highlights Include:
Upgraded NuGet packages, including ABP package upgrades.
Updated NPM packages.
Updated abp-web-resources.
Migrated package manager scripts and lock files to pnpm.
General dependency cleanup for a more maintainable solution.
Elsa v3 Integration Resources
Published new resources for integrating Elsa v3 with ASP.NET Zero.
Elsa v3 is a powerful workflow engine for .NET applications. The new integration content explains how to use Elsa with ASP.NET Zero, including backend setup, authentication, multi-tenancy, and UI integration points.
v15.4 includes an important security improvement for OpenID Connect authorization code flow.
Previously, the Angular login callback used the frontend OpenID Connect library flow in a way that could load the discovery document and attempt to exchange the authorization code from the browser. That behavior is acceptable for frontend-only applications, but ASP.NET Zero applications have a backend and can use a more secure confidential-client style flow.
With this update, when OpenID Connect is configured with ResponseType set to code, the Angular app no longer calls loadDiscoveryDocumentAndTryLogin() in the callback path. Instead, it sends the authorization code, PKCE verifier, redirect URI, and return URL to the backend. The backend then exchanges the code with the identity provider and uses the configured OpenID Connect settings, including ClientId, ClientSecret, Authority, ValidateIssuer, and claims mapping.
This improves security by keeping token endpoint communication on the server side and avoiding access token exposure in the browser. It also works better with identity providers such as Azure AD where a Web application registration requires a client secret at the token endpoint.
Security Improvements
Hardened GetProfilePictureByUser so profile pictures cannot be retrieved across tenants without proper access checks.
Improved OpenID Connect authorization code flow handling by moving the code exchange to the backend.
Addressed security issues found during white-box testing.
Added framework-level dynamic sorting hardening through ABP 11.3.0.
Angular UI
Improved stacked alert behavior.
Continued package and tooling updates after the Angular 21 upgrade.
General Enhancements
Improved role name handling and role management behavior.
Improved ObjectMapper.ProjectTo behavior after the Mapperly migration.
Updated cache documentation for Redis configuration.
Improved generated and framework package references.
修正
Angular U
Restored missing AccountRouteGuard protection for account routes.
Fixed continuous API calls and reloading in Organization Unit members and roles grids.
Fixed permission tree search filtering behavior with PrimeNG 21.
General Fixes
Fixed EF Core skip-update change detection edge cases.
Applied general UI, backend, and tooling fixes based on reported issues.
ASP.NET Zero v15.3.02026年5月12日
機能
Upgraded to ABP 11.2:
ASP.NET Zero v15.3 upgrades the core backend infrastructure to ABP v11.2.
Keeping the underlying framework up-to-date ensures that your applications benefit from the latest performance optimizations, bug fixes, and core capabilities provided by the ABP framework, keeping your foundation rock solid and secure.
Rate Limiting & Throttling:
To help you protect your applications from abuse and manage API traffic effectively, ASP.NET Zero have introduced a built-in Rate Limiting and Throttling feature.
This highly anticipated enhancement allows you to control the frequency of requests a user or client can make to your endpoints within a given timeframe. It provides a crucial layer of security to safeguard your backend resources against brute-force attacks, DDoS attempts, and unintentional traffic spikes.
External Login Linking:
Significantly improved authentication flexibility by adding support for linking an existing membership account to a social login.
Previously, users signing in via external providers (like Google, Microsoft, or Twitter) were treated as new users if they didn't already have a specifically linked account. Now, users who already have a local account can seamlessly link their preferred external/social login methods to their existing profiles, ensuring a unified and frictionless login experience.
Elsa 3.0 Integration Sample:
For teams relying on workflow automation, ASP.NET Zero have updated the ecosystem by adding an Elsa 3.0 integration sample.
Elsa is a powerful workflow library that enables running native .NET workflows
Providing you with a modern, up-to-date reference architecture to easily integrate complex, visually designed workflows directly into your ASP.NET Zero applications.
React UI Tests & Enhancements:
UI Tests: Created and implemented UI tests for the React frontend. This ensures ongoing stability, prevents regressions during future updates, and provides a reliable testing foundation for your own custom React code.
Subdomain-based Multi-Tenancy: Fully implemented subdomain-based multi-tenancy support for React, including the PreventNotExistingTenantSubdomains feature. Tenants can now have their own dedicated URLs (e.g., tenant1.yourdomain.com).
Security & Session Improvements:
Security and user flow consistency have received several important upgrades:
Password Reset Security: Enhanced the password reset flow's security and usability by introducing code expiration to prevent the reuse of old reset tokens.
Session Timeout: Improved session timeout detection to work seamlessly across multiple inactive tabs and handle device lock scenarios more reliably.
OpenID Connect Return URL: Preserved the returnUrl during the OpenID Connect login flow, ensuring users are correctly redirected back to their requested page after a successful login.
Dynamic Dashboard Permissions: Introduced a new permission to strictly control dashboard edit modes, allowing administrators to dictate who can customize drag-and-drop layouts.
Developer Experience & Strict Code Quality:
v15.3 brings powerful new tooling and strictness constraints to the frontend to help teams write cleaner code:
Full TypeScript Strict Mode: Enabled full strict options for TypeScript and Angular, enforcing better type safety and helping catch potential bugs at compile time.
Prettier & Husky Pre-commit Checks: Added a pre-commit hook integrating ESLint, Prettier, and Husky into the monorepo to ensure all committed code is automatically formatted and verified.
General Fixes: Addressed mobile UI sidebar issues on iOS, fixed Recaptcha validation bugs in email activation flows, and resolved minor Mapperly runtime mapping regressions.
ASP.NET Zero v15.2.02026年3月16日
機能
Added AI Skills, Rules and Workflows:
Added AI skills and context files tailored for Claude and Cursor.
These guidelines help your AI assistants understand ASP.NET Zero's architecture, naming conventions, and best practices, making AI driven development smoother and more accurate.
Added active user sessions feature.
Allows users to monitor their active sessions across different devices and browsers.
It includes a complete UI redesign for session management and introduces conditional session revocation.
If an account is compromised or a user simply forgot to log out from a public device, they can now easily view and revoke those active sessions directly from their security settings, preventing unauthorized access and session hijacking.
Implemented Health Check UI:
Health Checks UI has been completely reimplemented and restored, providing you with a clean, visual dashboard to monitor the health and status of your application's databases, APIs, and microservices.
Upgraded to ABP 11.1:
Migrated from AutoMapper to Mapperly:
Mapperly is now deeply integrated, including inside the ASP.NET Zero Power Tools.
This means all your generated code will now utilize Mapperly's fast, compile time mapping generation, drastically reducing runtime overhead.
Upgraded to Angular 21 & Zoneless Change Detection
This provides a significant boost to frontend performance, reduces bundle sizes, and modernizes the application lifecycle.
Additionally migrated to new routing configurations and removed deprecated modules.
React UI Enhancements:
Social Login: Seamlessly integrate third-party authentication providers into your React app.
QR Code Login: Added QR code login support powered by SignalR integration for a faster authentication flow.
Dynamic Entity Property Management: This powerful management feature is now fully supported in the React frontend.
Customizable Dashboards: Introduced a new drag-and-drop functionality, allowing users to easily customize their dashboard layouts.
Excel Export Selection: Added a new modal allowing users to select specific Excel columns before exporting data.
UI & Styling:
View Notification Modal: Added a dedicated message detail view modal to the Notifications page for both Angular and MVC.
Refactored Components: Updated file upload components to use PrimeNG and converted PrimengTableHelper to use modern Angular signal structures.
Framework & Tooling Improvements:
Swashbuckle Upgrade: Swagger UI has been upgraded to Swashbuckle v10.x.
Power Tools on ARM: Added robust support for the Power Tools GUI on ARM based platforms (like Apple Silicon MacBooks).
修正
UI & Styling:
Cross Browser Consistency: Fixed Safari sidebar background alignments and resolved vertical scrolling issues on macOS.
ASP.NET Zero v15.1.02026年1月20日
機能
Introduced React UI
A modern, fast, and developer-friendly ASP.NET Zero experience - redesigned with the power of the React ecosystem.