Release status. .NET 11 isn't released as stable yet. Everything in this article was built and tested on .NET 11 RC1 (SDK 11.0.100-rc.1.26425.128, runtime 11.0.0-rc.1.26425.128, released September 8, 2026). RC1 comes with a go-live license, but it isn't the final release, and .NET 11 GA is expected in November 2026. Compiler messages, serializer behavior, and tooling can still change before then, so rerun the sample's tests against each new SDK before you ship anything.

Almost every C# codebase has at least one switch that lies:

return state switch
{
    Draft => "draft",
    Placed => "placed",
    Paid => "paid",
    _ => throw new InvalidOperationException("Unknown state") // "this can't happen"
};

That last arm is there because the compiler has no idea that Draft, Placed, and Paid are the only states that exist. So we add a default arm to keep it quiet, and that arm quietly turns into a trap. The day someone adds a Refunded state, this code still compiles fine and throws at runtime.

C# 15 fixes this with two features that ship together in .NET 11: union types and closed hierarchies. Both tell the compiler "this is the complete list of possibilities", and in return the compiler checks your switch expressions against that list.

In this article, we'll start with the simplest possible usage of each feature, look at what they actually compile to, compare them with the patterns we use today, and then build a small order API where both features do real work. I built and tested every example on .NET 11 RC1, and I'll share the exact outputs, including a few surprises that ABP developers should know about before they start using these features.

Here's what we'll cover:

• Where .NET 11 and C# 15 stand today
• Closed hierarchies: a simple example and the rules
• Union types: a simple example and what they compile to
• How they compare with enums, abstract base classes, interfaces, and result wrappers
• A realistic scenario: an order API with exhaustive states and results
• Going further: JSON contracts, a generic Result<T>, default values, and versioning
• Using these features in an ABP solution
• RC1 constraints and production readiness
• Adoption and migration guidance
• Running the sample yourself

Where .NET 11 and C# 15 Stand Today

A quick status check first, because it affects everything else in this article:

• .NET 11 RC1 shipped on September 8, 2026. The official release metadata lists the channel in the go-live support phase, with release type STS.
• GA is expected in November 2026. Until then, "stable" isn't the right word, so treat everything here as release-candidate behavior.
• RC1 makes C# 15 the default language version for projects that target net11.0, and it stabilizes union types and closed class hierarchies, along with collection expression arguments, labeled break/continue, and extension indexers. You don't need <LangVersion>preview</LangVersion> anymore. None of the projects in this article set a LangVersion.
• The docs are catching up. At the time of writing, the "What's new in C# 15" page still calls C# 15 "the latest C# preview release" and notes that some features from the union proposal aren't implemented yet. For the language status in RC1, the C# in .NET 11 RC 1 release notes are the more precise source.

For ABP developers: the latest stable ABP release on NuGet at the time of writing is 10.6.1, and ABP 10.x packages target up to net10.0. You need a net11.0 project to use C# 15. As usual, ABP will ship a .NET 11-based ABP 11 release, so you'll get first-class .NET 11 support there. Until then, I tested ABP 10.6.1 packages inside a net11.0 app, and you'll find the results in the ABP section below.

Closed Hierarchies: A Simple Example

Let's start with the easier one. You add the closed modifier to a class (or a record class), and from then on, only code in the same assembly can derive directly from it:

public closed record OrderState;

public sealed record Draft : OrderState;
public sealed record Placed(DateTimeOffset PlacedAt) : OrderState;
public sealed record Paid(DateTimeOffset PlacedAt, string PaymentId) : OrderState;
public sealed record Shipped(string PaymentId, string TrackingNumber) : OrderState;
public sealed record Cancelled(string Reason) : OrderState;

Because the compiler now knows every direct descendant, a switch expression that handles all of them is exhaustive. There's no default arm, and there's no warning:

static string Describe(OrderState state) => state switch
{
    Draft => "draft",
    Placed(var placedAt) => $"placed at {placedAt:HH:mm}",
    Paid(_, var paymentId) => $"paid with {paymentId}",
    Shipped(_, var trackingNumber) => $"shipped, tracking {trackingNumber}",
    Cancelled(var reason) => $"cancelled: {reason}",
};

// Describe(new Paid(now, "pay_7Hq2")) -> "paid with pay_7Hq2"

Here are the rules I think are worth remembering. The ones with error codes are straight from the RC1 compiler; the rest come from the language reference:

• A closed class is implicitly abstract. new OrderState() fails with CS0144: Cannot create an instance of the abstract type or interface 'OrderState'. You also can't combine closed with sealed, static, or an explicit abstract.
• Other assemblies can't derive from it. In the versioning experiment later in this article, declaring public sealed record Lost : ShipmentStatus; in a consumer project failed with CS9382: 'Lost': cannot use a closed type 'ShipmentStatus' from another assembly as a base type.
• It isn't transitive. Only direct descendants are restricted. If Paid were a normal, unsealed record, another assembly could derive from Paid. That's why I seal the leaves. Alternatively, you can mark an intermediate type closed too.
• Classes only. closed interface fails with CS0106: The modifier 'closed' is not valid for this item. The spec lists closed interfaces as a possible future feature, but they aren't in C# 15.
• Nullable inputs need a null arm. A switch over OrderState? isn't exhaustive until you handle null.
• It's a contextual keyword. Existing variables named closed keep compiling.

So what does the compiler actually emit? I checked with reflection. OrderState becomes a regular abstract class marked with [IsClosedType], and its constructors are protected and marked [CompilerFeatureRequired("ClosedClasses")]. That last attribute is how the restriction survives compilation: a compiler that doesn't understand closed classes refuses to call those constructors, so it can't derive from the type either.

Union Types: A Simple Example

A union is a value that is exactly one of a fixed list of case types. The case types already exist, and the union just groups them:

public sealed record OrderPlaced(Guid OrderId, decimal Total);
public sealed record OutOfStock(string ProductCode, int Requested, int Available);
public sealed record CreditLimitExceeded(decimal Limit, decimal Attempted);
public sealed record InvalidOrder(IReadOnlyList<string> Errors);

public union PlaceOrderResult(OrderPlaced, OutOfStock, CreditLimitExceeded, InvalidOrder);

Each case converts to the union implicitly, so you just assign or return the case:

PlaceOrderResult result = new OutOfStock("MONITOR", Requested: 5, Available: 3);

And consuming code pattern-matches on the cases directly, with no default arm:

var message = result switch
{
    OrderPlaced placed => $"Order {placed.OrderId} placed",
    OutOfStock(var product, var requested, var available) => $"Only {available} of {product} left, you asked for {requested}",
    CreditLimitExceeded(var limit, _) => $"Credit limit of {limit} exceeded",
    InvalidOrder(var errors) => string.Join(" ", errors),
};

// "Only 3 of MONITOR left, you asked for 5"

If you forget a case, the compiler tells you which one:

warning CS8509: The switch expression does not handle all possible values of its input type
(it is not exhaustive). For example, the pattern 'OrderDemo.Domain.Orders.InvalidOrder' is not covered.

Now, what is a union at runtime? The compiler turns the union declaration into a struct. The struct is marked with [Union], implements System.Runtime.CompilerServices.IUnion, has one constructor per case type, and stores the active case in a single object? Value property. A few consequences follow from that:

• Patterns unwrap the union. result is OutOfStock tests result.Value, not the struct itself, so it returns true in the example above.
• Value-type cases are boxed. In union IntOrString(int, string), assigning 42 stores a boxed Int32 in Value. For hot paths, the docs describe how to write a custom union with a non-boxing access pattern.
• Case types can be almost anything: records, classes, structs, primitives, interfaces, and even other unions.
• A case type can belong to several unions. In the sample, OutOfStock is also used by union ReserveStockResult(StockReserved, OutOfStock). A closed hierarchy can't do that, because a class has only one base class.
• You can add members to a union body (methods and computed properties), but you can't add instance fields or auto-properties.

Figure: A union groups independent case types (one of them shared by two unions). A closed hierarchy is one inheritance family that other assemblies can't extend.

How They Compare With What We Do Today

We've been modeling "one of several shapes" for years without these features. Here's how the usual suspects behave in a switch expression, based on the diagnostics RC1 actually produced:

| Approach | Exhaustive without _? | New case flagged at compile time? | Unrelated types as cases? | |---|---|---|---| | enum | No (CS8524) | Only if you avoid _ | Not applicable | | Open abstract base class | No (CS8509 on _) | No | No | | Marker interface | No | No | Only types you own | | Result wrapper library | Through Match(...) | Depends on the library | Yes | | closed hierarchy | Yes | Yes (CS8509) | No | | union | Yes | Yes (CS8509) | Yes |

A few notes on this table:

• Enums get halfway there. If you handle every named member, the compiler still warns with CS8524 because an enum can hold unnamed values like (LegacyOrderStatus)3. Most teams silence that with _ => ..., and from then on, adding an enum member is silent. Enums also can't carry per-state data, which is how we end up with a Status enum next to a bag of nullable properties (PaidAt, TrackingNumber, CancelReason) that are only valid in some states.
• Open abstract base classes are what most of us use for this today. Without a default arm, the compiler warns that the pattern '_' is not covered, because any assembly could add a subclass. So you add _ => throw, and you're back to the lying switch from the introduction.
• Result wrappers such as a hand-written Result<T> or OneOf-style libraries work, but exhaustiveness lives in the library's Match API instead of in regular C# patterns, and each library brings its own conventions.

One important limit applies to every row: only switch expressions get exhaustiveness checking. A switch statement that forgets a case compiles without a warning (I tried it with both a union and a closed hierarchy), and so does an if/else chain. If you want the safety net, write switch expressions.

The following decision flow is how I pick between the options now:

A Realistic Scenario: An Order API

Let's put both features to work in a scenario ABP developers will recognize: a small ordering API with an order aggregate, a domain service that places orders, and HTTP endpoints on top. To keep the sample focused on the language features, it's a plain .NET 11 solution with in-memory stores. We'll bring ABP into the picture in a separate section.

OrderDemo.slnx
├── src/OrderDemo.Domain    // OrderState (closed), PlaceOrderResult (union), Order, OrderPlacementService
├── src/OrderDemo.Api       // Minimal API endpoints + DTOs
└── test/OrderDemo.Tests    // xUnit + Shouldly + WebApplicationFactory

Order states as a closed hierarchy

The order moves through a small state machine. Each state carries only the data that makes sense for it: a Paid order has a PaymentId, and a Shipped order has a TrackingNumber. Nothing is nullable "because it depends on the status".

Here's the aggregate. Every transition is a switch expression over the current state:

public sealed class Order
{
    private readonly List<OrderLine> _lines;

    public Guid Id { get; }

    public string CustomerId { get; }

    public IReadOnlyList<OrderLine> Lines => _lines;

    public OrderState State { get; private set; }

    public decimal Total => _lines.Sum(line => line.UnitPrice * line.Quantity);

    public Order(Guid id, string customerId, IEnumerable<OrderLine> lines)
    {
        Id = id;
        CustomerId = customerId;
        _lines = [.. lines];
        State = new Draft();
    }

    public void Place(DateTimeOffset now) => State = State switch
    {
        Draft => new Placed(now),
        Placed or Paid or Shipped or Cancelled => throw InvalidTransition(nameof(Place)),
    };

    public void MarkAsPaid(string paymentId) => State = State switch
    {
        Placed placed => new Paid(placed.PlacedAt, paymentId),
        Draft or Paid or Shipped or Cancelled => throw InvalidTransition(nameof(MarkAsPaid)),
    };

    public void Ship(string trackingNumber) => State = State switch
    {
        Paid paid => new Shipped(paid.PaymentId, trackingNumber),
        Draft or Placed or Shipped or Cancelled => throw InvalidTransition(nameof(Ship)),
    };

    public void Cancel(string reason) => State = State switch
    {
        Draft or Placed => new Cancelled(reason),
        Paid paid => new Cancelled($"{reason} (refund payment {paid.PaymentId})"),
        Shipped => throw new OrderStateException(
            "OrderDemo:CannotCancelShippedOrder",
            "A shipped order can't be cancelled. Create a return instead."),
        Cancelled => State,
    };

    private OrderStateException InvalidTransition(string action) => new(
        "OrderDemo:InvalidOrderStateTransition",
        $"Can't run '{action}' on an order in the '{State.GetType().Name}' state.");
}

Notice that I list the invalid states explicitly (Draft or Paid or Shipped or Cancelled => throw ...) instead of writing _ => throw .... It's a little more typing, but it's the whole point: a discard arm would "handle" any future state automatically, and the compiler would have nothing to warn about. With explicit arms, adding a state forces a decision in every transition. We'll see that in action in a moment.

OrderStateException carries a namespaced error code such as OrderDemo:CannotCancelShippedOrder. In an ABP application, this would simply be a BusinessException with the same code, since ABP's domain services throw business exceptions for rule violations.

Placement outcomes as a union

Placing an order has four expected outcomes, and only one of them is a success. Running out of stock isn't exceptional in an online shop; it happens every day, and the caller must handle it. That's a perfect fit for the PlaceOrderResult union we declared earlier. The domain service returns cases directly, and the implicit conversion works even through Task<PlaceOrderResult>:

public async Task<PlaceOrderResult> PlaceAsync(PlaceOrderInput input, CancellationToken cancellationToken = default)
{
    if (input.Lines.Count == 0)
    {
        return new InvalidOrder(["An order must contain at least one line."]);
    }

    var lines = new List<OrderLine>();
    var errors = new List<string>();

    foreach (var line in input.Lines)
    {
        // ... validation and stock lookup ...

        if (stock.Available < line.Quantity)
        {
            return new OutOfStock(line.ProductCode, line.Quantity, stock.Available);
        }

        lines.Add(new OrderLine(line.ProductCode, line.Quantity, stock.UnitPrice));
    }

    if (errors.Count > 0)
    {
        return new InvalidOrder(errors);
    }

    var order = new Order(Guid.NewGuid(), input.CustomerId, lines);

    var limit = await customerCredit.GetLimitAsync(input.CustomerId, cancellationToken);
    if (order.Total > limit)
    {
        return new CreditLimitExceeded(limit, order.Total);
    }

    order.Place(clock.GetUtcNow());
    await orderRepository.InsertAsync(order, cancellationToken);

    return new OrderPlaced(order.Id, order.Total);
}

The method signature is now honest: it tells every caller exactly what can come back, without try/catch blocks for expected outcomes and without a generic Result whose error part is just a string.

Mapping the union to HTTP responses

At the API boundary, each case gets its own status code. ASP.NET Core's Results<...> type already models "one of these HTTP results", so the two fit together nicely. The switch is target-typed to the endpoint's return type, and it's exhaustive over PlaceOrderResult:

app.MapPost("/orders", async Task<Results<Created<OrderPlaced>, Conflict<OutOfStock>, UnprocessableEntity<CreditLimitExceeded>, ValidationProblem>> (
    PlaceOrderInput input,
    OrderPlacementService service,
    CancellationToken cancellationToken) =>
    await service.PlaceAsync(input, cancellationToken) switch
    {
        OrderPlaced placed => TypedResults.Created($"/orders/{placed.OrderId}", placed),
        OutOfStock outOfStock => TypedResults.Conflict(outOfStock),
        CreditLimitExceeded exceeded => TypedResults.UnprocessableEntity(exceeded),
        InvalidOrder invalid => TypedResults.ValidationProblem(
            new Dictionary<string, string[]> { ["lines"] = [.. invalid.Errors] }),
    });

If someone adds a fifth outcome to PlaceOrderResult, this endpoint stops compiling until they decide which HTTP response it deserves.

Exposing the state as a discriminated DTO

For reading an order, the API returns an OrderDto whose State property is a closed DTO hierarchy with an explicit JSON discriminator. I nest the cases inside the base record to keep the family together (OrderStateDto.Paid), and I give each case an explicit wire name:

[JsonPolymorphic(TypeDiscriminatorPropertyName = "status")]
[JsonDerivedType(typeof(Draft), "draft")]
[JsonDerivedType(typeof(Placed), "placed")]
[JsonDerivedType(typeof(Paid), "paid")]
[JsonDerivedType(typeof(Shipped), "shipped")]
[JsonDerivedType(typeof(Cancelled), "cancelled")]
public closed record OrderStateDto
{
    public sealed record Draft : OrderStateDto;
    public sealed record Placed(DateTimeOffset PlacedAt) : OrderStateDto;
    public sealed record Paid(string PaymentId) : OrderStateDto;
    public sealed record Shipped(string TrackingNumber) : OrderStateDto;
    public sealed record Cancelled(string Reason) : OrderStateDto;
}

public sealed record OrderDto(Guid Id, string CustomerId, decimal Total, OrderStateDto State);

public static class OrderMapper
{
    public static OrderDto ToDto(this Order order) => new(order.Id, order.CustomerId, order.Total, order.State.ToDto());

    public static OrderStateDto ToDto(this OrderState state) => state switch
    {
        Draft => new OrderStateDto.Draft(),
        Placed placed => new OrderStateDto.Placed(placed.PlacedAt),
        Paid paid => new OrderStateDto.Paid(paid.PaymentId),
        Shipped shipped => new OrderStateDto.Shipped(shipped.TrackingNumber),
        Cancelled cancelled => new OrderStateDto.Cancelled(cancelled.Reason),
    };
}

The mapper is exhaustive too. That's a small detail with a big payoff: the domain and the contract can't silently drift apart. (Notice that the DTO intentionally drops PlacedAt from Paid. The contract doesn't have to mirror the domain model; it only has to cover it.)

Does It Actually Work?

Let's run the API and walk through the whole flow. These are the real responses from the sample running on .NET 11 RC1:

dotnet run --project src/OrderDemo.Api --urls http://localhost:5189

Happy path:

curl -i -X POST http://localhost:5189/orders -H "Content-Type: application/json" \
  -d '{"customerId":"acme","lines":[{"productCode":"KEYBOARD","quantity":2},{"productCode":"MOUSE","quantity":1}]}'

HTTP 201
{"orderId":"0757817c-70c7-41db-a5d7-3b8eea41eda2","total":144.30}

The other three union cases, each with its own status code:

POST /orders  {"customerId":"acme","lines":[{"productCode":"MONITOR","quantity":5}]}
HTTP 409
{"productCode":"MONITOR","requested":5,"available":3}

POST /orders  {"customerId":"startup-42","lines":[{"productCode":"MONITOR","quantity":2}]}
HTTP 422
{"limit":500,"attempted":658.00}

POST /orders  {"customerId":"acme","lines":[{"productCode":"LAPTOP","quantity":1},{"productCode":"MOUSE","quantity":0}]}
HTTP 400
{"type":"https://tools.ietf.org/html/rfc9110#section-15.5.1","title":"One or more validation errors occurred.","status":400,
 "errors":{"lines":["Unknown product 'LAPTOP'.","Quantity for 'MOUSE' must be greater than zero."]},"traceId":"..."}

Reading the order and moving it through the state machine:

GET /orders/0757817c-...
HTTP 200
{"id":"0757817c-...","customerId":"acme","total":144.30,"state":{"status":"placed","placedAt":"2026-09-23T08:47:32.0829309+00:00"}}

POST /orders/0757817c-.../ship  {"trackingNumber":"TRK-1"}
HTTP 409
{"type":"https://tools.ietf.org/html/rfc9110#section-15.5.10","title":"Can't run 'Ship' on an order in the 'Placed' state.","status":409,"code":"OrderDemo:InvalidOrderStateTransition"}

POST /orders/0757817c-.../pay  {"paymentId":"pay_7Hq2"}
HTTP 200
{"id":"0757817c-...","customerId":"acme","total":144.30,"state":{"status":"paid","paymentId":"pay_7Hq2"}}

POST /orders/0757817c-.../ship  {"trackingNumber":"TRK-90210"}
HTTP 200
{"id":"0757817c-...","customerId":"acme","total":144.30,"state":{"status":"shipped","trackingNumber":"TRK-90210"}}

POST /orders/0757817c-.../cancel  {"reason":"Customer changed their mind"}
HTTP 409
{"type":"https://tools.ietf.org/html/rfc9110#section-15.5.10","title":"A shipped order can't be cancelled. Create a return instead.","status":409,"code":"OrderDemo:CannotCancelShippedOrder"}

Every state carries its own data, and the status discriminator tells a TypeScript or C# client exactly which shape it's looking at.

On Windows PowerShell 5.1, curl.exe -d '{...}' loses the JSON quotes when it passes arguments to the native process. Save the body to a file and use --data-binary "@body.json", or use PowerShell 7.

The moment it pays off: adding a new state

This is the part I was most curious about. Imagine the business asks for refunds, so we add one line to the domain:

public sealed record Refunded(string PaymentId, decimal Amount) : OrderState;

Then we run dotnet build:

The build fails in all four transition methods of Order. The sample promotes CS8509 to an error (more on that in the migration section), so these aren't warnings you can scroll past. When I built with warnings instead of errors so that the API project could compile too, a fifth location appeared: the OrderState.ToDto() mapper in OrderDemo.Api. That's every place in the solution that needs a decision about refunds, and the compiler found all five. With _ => throw arms, the build would have passed and the first refund would have failed in production.

Going Further

Now that the basics are in place, let's look at the parts that need a bit more care.

Unions and closed hierarchies on the wire

The two features look similar in C#, but they serialize very differently with System.Text.Json in .NET 11:

• A union writes only its active case, with no discriminator. The /orders/preview endpoint in the sample returns PlaceOrderResult as-is, and the body is {"productCode":"MONITOR","requested":5,"available":3} with 200 OK. Nothing in that JSON says "this is an OutOfStock"; the client has to figure it out from the shape.
• Reading a union back needs help when several cases are JSON objects. Deserializing that same body into PlaceOrderResult throws JsonException: JSON value type 'Object' is ambiguous for union type ... because multiple case types can use this value type. Specify a custom type classifier to support deserialization. Adding [JsonUnion(TypeClassifier = typeof(JsonUnionTypeStructuralClassifier))] to the union lets the serializer pick the case by property names. I verified this with a two-case union whose cases have different property names.
• closed alone doesn't change the JSON. To get a discriminator, you opt in with [JsonPolymorphic]. With [JsonPolymorphic(InferClosedTypePolymorphism = true)], the serializer discovers the cases from the closed hierarchy and uses the type names as discriminators. For nested cases, that's the simple name, so you get {"$type":"Paid","paymentId":"pay_123"}. With explicit [JsonDerivedType] names, as in the sample, you control both the property name and the values: {"status":"paid","paymentId":"pay_7Hq2"}.

For public contracts, I prefer the explicit names. Renaming a C# class shouldn't change your API, and the explicit list is easy to review in a pull request.

This lines up with Microsoft's own guidance in Use C# unions and closed hierarchies in ASP.NET Core: for a new contract where you own every case, use a closed hierarchy with a discriminator. Use a union when you must preserve an existing discriminator-free contract, or when the cases can't share a base class (primitives, types you don't own). The same post lists the binding limitations: unions work in JSON request and response bodies, but not in query strings, route values, headers, or form fields, and in SignalR they only work with JsonHubProtocol.

If you want to go deeper on the serializer side (the union contract kind, classifiers, OpenAPI anyOf output, and generated TypeScript clients), my teammate Okan Koca covered it in detail in System.Text.Json in .NET 11: naming policies, union types, and NDJSON streaming.

A generic Result: where the union falls short

Here's the first thing I tried to build with unions, and it's probably the first thing you'll try too:

public sealed record Error(string Code, string Message);

public union Result<T>(T, Error) where T : notnull;

The declaration compiles, and concrete usage like Result<int> with an int value => arm works fine. But the moment you write a generic helper, it breaks:

public static TOut Match<T, TOut>(Result<T> result, Func<T, TOut> onSuccess, Func<Error, TOut> onFailure)
    where T : notnull => result switch
{
    T value => onSuccess(value),      // error CS8780
    Error error => onFailure(error),
};

error CS8780: A variable may not be declared within a 'not' or an 'or' pattern or a union matching
involving matching against either the instance, or its underlying value.

The compiler can't know whether T is itself a union, so it can't decide whether T value should match the union instance or its Value. A where T : class constraint doesn't help (I tried). And there's a second catch: Result<Error> makes both constructors identical, so Result<Error> r = new Error(...) fails with CS0457: Ambiguous user defined conversions.

For a generic result type, a closed generic hierarchy works better. Combined with C# 14 extension members, it reads nicely:

public closed record Result<T>
{
    public static implicit operator Result<T>(T value) => new Success<T>(value);

    public static implicit operator Result<T>(Error error) => new Failure<T>(error);
}

public sealed record Success<T>(T Value) : Result<T>;

public sealed record Failure<T>(Error Error) : Result<T>;

public static class ResultExtensions
{
    extension<T>(Result<T> result)
    {
        public bool IsSuccess => result is Success<T>;

        public TOut Match<TOut>(Func<T, TOut> onSuccess, Func<Error, TOut> onFailure) => result switch
        {
            Success<T>(var value) => onSuccess(value),
            Failure<T>(var error) => onFailure(error),
        };

        public Result<TOut> Map<TOut>(Func<T, TOut> map) => result switch
        {
            Success<T>(var value) => map(value),
            Failure<T>(var error) => error,
        };

        public Result<TOut> Bind<TOut>(Func<T, Result<TOut>> next) => result switch
        {
            Success<T>(var value) => next(value),
            Failure<T>(var error) => error,
        };
    }
}

Every switch here is exhaustive with no default arm, because the closed hierarchies rules also cover generic types: each derived type uses the base's type parameter, so for any Result<T> there is exactly one Success<T> and one Failure<T>. Usage looks like this, and the sample's tests confirm all three paths:

Result<int> ParseQuantity(string input) =>
    int.TryParse(input, out var quantity) && quantity > 0
        ? quantity
        : new Error("OrderDemo:InvalidQuantity", $"'{input}' isn't a valid quantity.");

Result<decimal> PriceFor(int quantity) =>
    quantity <= 10
        ? quantity * 59.90m
        : new Error("OrderDemo:BulkOrder", "Bulk orders need a quote.");

var message = ParseQuantity(input)
    .Bind(PriceFor)
    .Map(total => $"Total: {total}")
    .Match(ok => ok, error => error.Code);

// "2"   -> "Total: 119.80"
// "abc" -> "OrderDemo:InvalidQuantity"
// "50"  -> "OrderDemo:BulkOrder"

My rule of thumb: use a union for concrete, operation-specific outcomes (like PlaceOrderResult), and use a closed generic hierarchy when you need a reusable, generic result type.

default: the value the compiler doesn't see

Unions are structs, and every struct has a default value. For a union, default means Value is null, and none of the cases match it. The compiler doesn't warn you, because a non-nullable union parameter is assumed to hold a value:

var results = new PlaceOrderResult[1]; // results[0] is default

static string Describe(PlaceOrderResult result) => result switch
{
    OrderPlaced => "placed",
    OutOfStock => "out of stock",
    CreditLimitExceeded => "credit",
    InvalidOrder => "invalid",
};

Describe(results[0]); // SwitchExpressionException: Non-exhaustive switch expression failed to match its input.

That's a real test in the sample, and it passes by throwing. Arrays, uninitialized fields, and default(T) in generic code are the usual sources. If a union can reach your code that way, add a null arm. It's allowed, and it catches the default value:

    InvalidOrder => "invalid",
    null => "no result (default value)",

Versioning: exhaustive today, an exception tomorrow

Exhaustiveness is a compile-time check. At runtime, the compiler still emits a fallback that throws SwitchExpressionException for anything unexpected. I wanted to see what that means across assemblies, so I built a tiny experiment:

1. A Shipping library with closed record ShipmentStatus and three cases.
2. A Consumer app with an exhaustive switch over those three cases, compiled against v1.
3. A v2 of the library that adds Returned, dropped into the consumer's output folder without recompiling the consumer.

--- 1) consumer built against v1
in transit with UPS
--- 2) ship Shipping v2 only, no consumer rebuild
Unhandled exception. System.Runtime.CompilerServices.SwitchExpressionException: Non-exhaustive switch expression failed to match its input.
Unmatched value was Returned { Reason = Damaged box }.

So adding a case to a public closed hierarchy (or a public union) is a breaking change. Recompiled consumers get new warnings or errors, and consumers that aren't recompiled get runtime exceptions. The closed hierarchies spec lists this as a drawback too: adding closed to an existing class, or adding a new derived class to a closed one, can be a breaking change. Inside a single solution, that's exactly what you want. For a NuGet package or a reusable module, it's a versioning decision you should make on purpose.

Using These Features in an ABP Solution

This is the section I care about most, because ABP adds its own serialization, caching, and layering conventions on top of plain .NET.

Can you use them today?

ABP 10.x targets up to net10.0. As with every major .NET release, ABP will ship a .NET 11-based version, ABP 11, which is the release to use for production apps on .NET 11. In the meantime, .NET runs net10.0 libraries in net11.0 apps. To check it in practice, I created a net11.0 console app on the RC1 SDK, referenced ABP 10.6.1 packages (Volo.Abp.Ddd.Domain, Volo.Abp.Json.SystemTextJson, Volo.Abp.Caching), and booted it with AbpApplicationFactory. The app initialized fine, and an AggregateRoot<Guid> with a closed state property compiled cleanly and moved from Waiting to OnTheWay as expected:

public closed record ShipmentState;
public sealed record Waiting : ShipmentState;
public sealed record OnTheWay(string Carrier) : ShipmentState;

public class Shipment : AggregateRoot<Guid>
{
    public ShipmentState State { get; private set; } = new Waiting();

    protected Shipment() { }

    public Shipment(Guid id) : base(id) { }

    public Shipment Dispatch(string carrier)
    {
        State = State switch
        {
            Waiting => new OnTheWay(carrier),
            OnTheWay => throw new BusinessException("Shipping:AlreadyDispatched"),
        };
        return this;
    }
}

Scope of this check: it's a smoke test of ABP's core, DDD, JSON, and caching packages. It's not a full ABP solution with EF Core, a UI, or generated client proxies. Persistence in particular is its own topic: mapping a closed hierarchy or a union to EF Core columns is outside this article, and I haven't tested it.

Where each feature fits in ABP's layers

• Domain layer: closed hierarchies fit aggregate states and value objects perfectly. ABP already encourages entities that are valid from creation and change state through meaningful domain methods. A closed state hierarchy makes those methods exhaustive.
• Domain services: keep throwing BusinessException with namespaced codes for rule violations. That's what ABP's exception handling, localization, and auditing are built around. Keep in mind that ABP maps an IBusinessException to HTTP 403 by default unless you register a mapping, for example options.Map("OrderDemo:CannotCancelShippedOrder", HttpStatusCode.Conflict) with AbpExceptionHttpStatusCodeOptions.
• Application layer: use unions for expected outcomes that the caller must branch on (such as OutOfStock), especially when a domain service returns them to an application service that turns them into a DTO. For the application service contract itself, I'd keep regular DTO classes and put any polymorphic part inside a property typed as a closed DTO hierarchy with explicit discriminators, like OrderDto.State in the sample. I haven't verified how ABP's C#, JavaScript, and Angular client proxy generation handle unions or closed hierarchies, so test your proxies before exposing these types from auto API controllers.

Two ABP-specific gotchas I hit

1. IJsonSerializer.Serialize(object) drops the discriminator of a top-level closed hierarchy. ABP's IJsonSerializer.Serialize takes an object, so System.Text.Json serializes the runtime type (InTransit) instead of the declared base type, and the [JsonPolymorphic] metadata on the base is never used. Here's the output from ABP's AbpSystemTextJsonSerializer on RC1:

closed hierarchy                  -> {"carrier":"UPS"}
closed hierarchy as a DTO property -> {"trackingNumber":"TRK-1","state":{"status":"inTransit","carrier":"UPS"}}
union                             -> {"trackingNumber":"TRK-404"}

The discriminator is there when the closed type is a property of another object, because then the declared type is known. It's also there in MVC responses: ABP's MVC pipeline uses the standard SystemTextJsonOutputFormatter, and a plain MVC controller on RC1 that returns Task<ShipmentStateDto> produced {"status":"inTransit","carrier":"UPS"} and bound {"status":"pending"} correctly as input.

2. IDistributedCache<TClosedBase> can write values it can't read back. ABP's default Utf8JsonDistributedCacheSerializer goes through that same IJsonSerializer.Serialize(object) call. So caching a closed base type directly writes JSON without a discriminator, and reading it fails:

cache (base type)        -> NotSupportedException: The JSON payload for polymorphic interface or abstract type
                            'ShipmentStateDto' must specify a type discriminator.
cache (wrapped in a DTO) -> ShipmentDto { TrackingNumber = TRK-1, State = InTransit { Carrier = UPS } }

The fix is simple: cache a regular class that contains the polymorphic value, which is what ABP cache items usually look like anyway. Unions can't be cache items directly either, because IDistributedCache<TCacheItem> requires TCacheItem : class and a union is a struct.

A note for ABP module authors

ABP modules are designed to be extended: virtual methods, replaceable services, and object extensions. closed goes the other way. It tells consumers "you can't add to this". Both are valid, but don't mix them up by accident:

• Use closed freely for internal state and for DTO families that you intend to version deliberately.
• Keep extension points open. If application developers should be able to add their own variants, an open base class plus a default arm is still the right design.
• Treat adding a case to a public closed hierarchy or union as a breaking change in your release notes, for the versioning reasons shown above.

RC1 Constraints and Production Readiness

Here's everything I'd keep in mind before relying on these features in production:

• It's still a release candidate. RC1 has a go-live license, but GA is expected in November 2026. Recheck behavior on RC2 and GA.
• Support lifecycle. .NET 11 is an STS release with two years of support. .NET 10 is LTS and supported until November 14, 2028. If your policy is LTS-only, these features wait for .NET 12. For ABP, the current stable line targets .NET 10, and the .NET 11-based ABP 11 release will follow, as usual.
• The docs are still moving. Some pages still describe C# 15 as a preview, and the "What's new" page says some features from the union proposal aren't implemented yet. Trust the SDK you run, and check the release notes for each new build.
• Only switch expressions are checked. switch statements and if/else chains don't get exhaustiveness warnings.
• default escapes the check. A default union value matches none of its cases (see above).
• It's a compiler guarantee, not a runtime one. Stale binaries throw SwitchExpressionException when they meet a new case.
• Closed interfaces don't exist in C# 15. Only classes and record classes can be closed.
• Generic unions have sharp edges. Type-parameter cases can't be matched with declaration patterns in generic code (CS8780), and some instantiations become ambiguous (CS0457).
• Serialization is opt-in and asymmetric. Unions write without a discriminator and may need a classifier to be read. Closed hierarchies need [JsonPolymorphic] to get a discriminator at all. In ABP, watch out for top-level IJsonSerializer.Serialize(...) calls and cached base types.
• Binding limits. Unions aren't supported for query strings, route values, headers, or form fields, and in SignalR they only work with JsonHubProtocol, not the MessagePack or Newtonsoft protocols.
• Performance. Compiler-generated unions box value-type cases and always store an object?. That's fine for results and messages. For hot paths with value-type cases, the docs show how to write a custom union with the non-boxing access pattern.
• Tooling. You need the .NET 11 SDK (or a Visual Studio version that ships it). Roslyn exposes union cases to analyzers through ITypeSymbol.UnionCaseTypes, so expect analyzer and source-generator support to improve over time.

Adoption and Migration Guidance

Here's the order I'd adopt these features in an existing codebase, from lowest to highest risk.

1. Get on the SDK and pin it. Target net11.0 and pin the SDK with a global.json, so every developer and CI agent uses the same compiler:

{
  "sdk": {
    "version": "11.0.100-rc.1.26425.128"
  }
}

2. Make non-exhaustive switches fail the build. This one line in Directory.Build.props turns the feature from a nice warning into a guarantee. It's what produced the build errors in the Refunded screenshot:

<Project>
  <PropertyGroup>
    <WarningsAsErrors>$(WarningsAsErrors);CS8509</WarningsAsErrors>
  </PropertyGroup>
</Project>

3. Close your internal hierarchies first. Search for abstract base classes and records whose switches end with _ => throw. Add closed, seal the leaves, delete the discard arms, and let the compiler show you what was never handled. This change is invisible to anyone outside the assembly, so it's the safest place to start.

4. Replace enum-plus-nullables with state types. If you have a Status enum and properties that are only valid in some states, move that data into closed state records, like the Order sample does. The invalid combinations simply stop being representable.

5. Turn expected failures into return values. For operations with a fixed set of outcomes (out of stock, credit limit, duplicate name), return a union of records instead of throwing and catching. Keep exceptions, and BusinessException in ABP, for real rule violations and unexpected failures.

6. Pick the right shape for generic results. Use a closed generic hierarchy for a reusable Result<T>. If you already use a result library that works for you, there's no rush to replace it; migrate when you touch the code anyway.

7. Be deliberate at the API boundary. Use closed DTO hierarchies with explicit [JsonDerivedType] names for new contracts. Use unions when you need to preserve an existing discriminator-free contract, add a classifier if you also deserialize them, and test your generated clients.

8. Version public types carefully. For NuGet packages and reusable ABP modules, treat new cases as breaking changes, and only close a public hierarchy when you're sure consumers shouldn't extend it.

A short checklist to go with it:

• [ ] SDK pinned, project targets net11.0, no LangVersion override needed
• [ ] CS8509 promoted to an error
• [ ] No _ => arms in switches over closed hierarchies or unions, unless it's truly intentional
• [ ] Leaves of closed hierarchies are sealed (or intentionally closed)
• [ ] Unions that can be default have a null arm
• [ ] Polymorphic API types have explicit discriminators and are tested with your client generators
• [ ] ABP caches store DTO classes that wrap polymorphic values
• [ ] Release notes mention every new case in a public hierarchy or union

Running the Sample Yourself

Everything shown above comes from one small solution. Here's how to set it up and test it.

Setup

Install the RC1 SDK side by side. This doesn't require admin rights and doesn't touch your existing SDKs:

Invoke-WebRequest https://dot.net/v1/dotnet-install.ps1 -OutFile dotnet-install.ps1
./dotnet-install.ps1 -Version 11.0.100-rc.1.26425.128 -InstallDir "$HOME\.dotnet-rc" -NoPath

$env:DOTNET_ROOT = "$HOME\.dotnet-rc"
$env:PATH = "$env:DOTNET_ROOT;$env:PATH"
dotnet --version   # 11.0.100-rc.1.26425.128

Create the solution:

dotnet new globaljson --sdk-version 11.0.100-rc.1.26425.128
dotnet new sln -n OrderDemo
dotnet new classlib -n OrderDemo.Domain -o src/OrderDemo.Domain
dotnet new web -n OrderDemo.Api -o src/OrderDemo.Api
dotnet new xunit -n OrderDemo.Tests -o test/OrderDemo.Tests
dotnet sln add src/OrderDemo.Domain src/OrderDemo.Api test/OrderDemo.Tests
dotnet add src/OrderDemo.Api reference src/OrderDemo.Domain
dotnet add test/OrderDemo.Tests reference src/OrderDemo.Domain src/OrderDemo.Api
dotnet add test/OrderDemo.Tests package Shouldly
dotnet add test/OrderDemo.Tests package Microsoft.AspNetCore.Mvc.Testing --prerelease
dotnet add test/OrderDemo.Tests package Microsoft.Extensions.TimeProvider.Testing

Then add the code from this article: the domain types, Order, OrderPlacementService, the in-memory stores, the API's Program.cs and DTOs, and the Directory.Build.props from the migration section. The API also needs public partial class Program; at the end of Program.cs, so that WebApplicationFactory<Program> can find it.

Test steps

1. Run dotnet test from the solution folder.
2. Run the API with dotnet run --project src/OrderDemo.Api --urls http://localhost:5189 and replay the requests from the "Does It Actually Work?" section.
3. Add public sealed record Refunded(string PaymentId, decimal Amount) : OrderState; to the domain, run dotnet build, and watch the four CS8509 errors. Then remove the line again.

Results

The test project has 24 tests, covering four areas:

• State transitions: the happy path, invalid transitions, the refund note, the shipped-order rule, and idempotent cancellation.
• Placement outcomes: every union case, the exhaustive consumer switch, and the default trap.
• The generic Result<T>: Map, Bind, Match, and IsSuccess.
• JSON contracts and HTTP: discriminator output and round trips, union output and ambiguity, and status codes from WebApplicationFactory.

All 24 passed on .NET 11 RC1:

Conclusion

Union types and closed hierarchies aren't flashy features. They don't change how your code runs, and at runtime a closed record is just an abstract class and a union is just a struct with an object? inside. What they change is how honest your types are. A method that returns PlaceOrderResult tells you every outcome, an OrderState can't be in a combination that makes no sense, and a new case shows up as a compiler error in every place that needs a decision, instead of as a production incident.

My short version:

• Use closed hierarchies for families of types you own: domain states, events, commands, and DTO families with explicit discriminators.
• Use unions for fixed sets of existing or unrelated types, and for operation-specific results.
• Make CS8509 an error, stop writing _ => throw, and remember the default and versioning edges.

In ABP applications, both features fit naturally into the domain and application layers. Just keep polymorphic values inside DTO properties when they go through IJsonSerializer or the distributed cache, and test your client proxies before exposing these types from your APIs.

Thanks for reading, see you in the next one!

References

• What's new in C# 15
• What's new in .NET 11
• C# in .NET 11 RC 1 release notes
• Union types (C# reference)
• The closed modifier (C# reference)
• Closed hierarchy patterns (C# reference)
• Unions feature specification
• Closed hierarchies feature specification
• Use C# unions and closed hierarchies in ASP.NET Core (.NET Blog)
• .NET and .NET Core support policy
• ABP Framework documentation

We are happy to release ABP version 10.7 RC (Release Candidate). This blog post introduces the new features and important changes in this version.

Try this version and provide feedback to help us deliver a more stable ABP v10.7 release. Thanks in advance!

Get Started with the 10.7 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

Check the ABP Version 10.7 Migration Guide before upgrading from v10.6 or earlier. It covers the services that take new constructor dependencies, the Blazor antiforgery middleware order, the dependency updates, and the AI Management schema change that requires a new EF Core migration.

What's New with ABP v10.7?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• BLOB Encryption at Rest and Content Pipeline
• HTTP QUERY Method Support
• Angular Resource API Proxies
• ABP Suite React CRUD Page Generation
• ABP Suite Decimal Precision
• ABP Studio MCP Configuration
• AI Management Web Page Data Sources
• Dependency Updates
• Other Improvements and Enhancements

BLOB Encryption at Rest and Content Pipeline

ABP v10.7 adds opt-in, transparent encryption at rest for the BLOB Storing system. Encryption uses AES-256-GCM and works on top of the configured storage provider, so application code can continue using IBlobContainer as before. It requires a platform with AES-GCM support and is not available on .NET Standard 2.0 targets.

You can enable encryption per container and configure the passphrase from your application's secure configuration:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.Configure<ProfilePictureContainer>(container =>
    {
        container.UseEncryption();
    });
});

Configure<AbpBlobStoringEncryptionOptions>(options =>
{
    options.DefaultPassPhrase = context.Configuration["MyApp:BlobPassPhrase"];
});

The new BLOB content pipeline lets you transparently transform content when it is saved and read. You can create contributors for compression, validation, watermarking, or other stream transformations without changing the storage provider or the code that uses the container.

Both features are disabled by default. When enabling encryption for a container that already contains plaintext BLOBs, first allow legacy plaintext reads, re-save the existing content, and then remove the legacy option so the container reads encrypted data only.

See the BLOB Encryption and BLOB Content Pipeline documents and #25836 for details.

HTTP QUERY Method Support

ABP now supports the HTTP QUERY method for endpoints that need to send request data without using a query string. A QUERY endpoint is treated as a safe method: like GET, it starts a non-transactional unit of work and is not audited by default. GET, HEAD and QUERY share the AbpAuditingOptions.IsEnabledForGetRequests setting.

To expose an action as a QUERY endpoint, use the ASP.NET Core [AcceptVerbs("QUERY")] attribute. Because the method carries a request body, it still requires an anti-forgery token.

See the Auto API Controllers documentation and #25797 for details.

Angular Resource API Proxies

The Angular proxy generator can now generate the GET endpoints against the Resource API. Pass the --resource-api option and every generated GET member returns an rxResource-based ResourceRef instead of an Observable. An endpoint with parameters takes them as a single Signal, a parameterless endpoint has no signal parameter, and the optional request configuration stays a normal argument. The other HTTP methods keep the Observable-based form.

This option requires Angular 22 or later and is disabled by default, so existing generated proxies continue to work without changes. Regenerate the proxies with the option only when you are ready to consume the resource form in your components.

See the Angular Service Proxies documentation and #25761 for details.

ABP Suite React CRUD Page Generation

ABP Suite now supports generating CRUD pages for the React applications in modern solutions, bringing the same productive code-generation experience available for other ABP UI options to React projects. The generation is template-based and does not use AI.

Generated React pages include list, search, sorting, paging, filtering, export, create, edit, single and bulk delete operations. They also support validation, permissions, localization, file upload, navigation properties, many-to-many relationships, and master-detail pages with child create, edit, delete, and paging operations.

The generator respects the entity and field configuration you define in ABP Suite, including ShowOn*, IsFilterable, and ReadonlyOnEditModal options. Navigation lookups use server-side search.

ABP Suite Decimal Precision

You can now set the precision and scale of a decimal property in ABP Suite. For the relational database providers that support fixed-point columns, the generated entity configuration includes the matching HasPrecision(...) call.

ABP Studio MCP Configuration

ABP Studio provides a simpler experience for configuring Model Context Protocol (MCP) integrations. You can add common integrations through focused configuration forms or manage the complete MCP server list as JSON, with support for secret placeholders and secure platform storage. It is available in ABP Studio v3.0.9 and later.

See the ABP Studio AI Agent configuration documentation and #25870 for details.

AI Management Web Page Data Sources

A workspace data source can now be created from a web page URL, not only from an uploaded file. The page content is converted to markdown and indexed like any other data source, and you can refresh it later to pick up changes to the page.

The model name fields of the workspace configuration can also suggest the available models of the selected provider, so you don't have to remember the exact model names. The OpenAI and Ollama model catalogs are included; a provider without a registered catalog simply has no suggestions.

Dependency Updates

ABP v10.7 RC includes the following dependency updates:

• MudBlazor upgraded to 9.7.0
• MySql.EntityFrameworkCore upgraded to 10.0.9

Check the Package Version Changes document for all updates.

Other Improvements and Enhancements

• BLOB storing: The storage providers have improved support for transformed and non-seekable streams.
• Identity sessions: The inactive session cleanup uses the sign-in time when a session has not recorded a last-accessed time yet, so valid token sessions are not removed too early.
• Identity: The user's last sign-in time is written as a best-effort update in its own unit of work, so a concurrency conflict no longer fails the sign-in request (#25905).
• Blazor templates: UseAntiforgery() is called after UseAuthorization(), which is the order required by ASP.NET Core. Existing solutions keep their own middleware order, so check the migration guide (#25874).
• MySQL: The Guid[] query parameters are mapped correctly, and the passkey and user invitation columns are stored as json.

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• How I Use a Custom AI Skill to Upgrade a Large ABP Solution by Kori Francis
• Why Does My Tiered ABP App Show an Empty Menu While the User Is Still Signed In? by Kori Francis

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.7 RC and provide feedback to help us release a more stable version.

For the complete list of changes, see the ABP 10.7.0-rc.1 release notes.

Thanks for being a part of this community!

We are glad to announce that ABP 10.6 stable version has been released.

What's New With Version 10.6?

All the new features were explained in detail in the 10.6 RC Announcement Post, so there is no need to review them all again. You can check it out for more details.

Here are some of the highlights of this version:

• Background jobs now support dedicated workers, parallel execution, and successful job retention.
• API definition and generated proxies have better support for response content types, remote streams, and multipart uploads.
• Angular UI packages and templates have been upgraded to Angular 22.
• Antiforgery and OpenIddict flows include important security and reliability improvements.
• ABP Commercial adds OpenIddict access-token generation from the UI and React CRUD page generation support in ABP Suite.
• AI Management indexing is more resilient for large or memory-constrained workloads.
• The final release also includes dependency updates and stability fixes collected during the RC period.

Getting Started with 10.6

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

This version includes explicitly marked migration-impacting changes for specific customization scenarios, especially custom background job stores/workers and custom AI Management document chunk repositories. The new background job runtime features are opt-in and existing applications keep the current behavior unless they enable them explicitly.

Please read the migration guide carefully, if you are upgrading from v10.5 or earlier versions: ABP Version 10.6 Migration Guide

If you use the Angular UI, also check the dedicated Angular 22 and ABP 10.6 Upgrade Guide.

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Introducing ABP Low-Code: Build Real ABP Apps in Minutes by Salih Ozkara
• Building a Vendor Onboarding Workflow with ABP Low-Code by Salih Ozkara
• Event Recap - WeAreDevelopers World Congress 2026 by Irem Demirci
• Empathy in the Workplace for Software Companies by Alper Ebicoglu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.7. You can follow the release planning here. Please submit an issue if you have any problems with this version.

We are happy to release ABP version 10.6 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.6! Thanks to you in advance.

Get Started with the 10.6 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

You can check the migration guide if you are upgrading from v10.5 or earlier: ABP Version 10.6 Migration Guide.

What's New with ABP v10.6?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• Background Jobs: Dedicated Workers, Parallel Execution, and Successful Job Retention
• API Definition and Proxy Improvements for Content Types and Multipart Uploads
• Angular UI: Upgrade to Angular 22
• Antiforgery and OpenIddict Security Improvements
• OpenIddict: Generate Access Token from the UI
• Dependency Updates

Background Jobs: Dedicated Workers, Parallel Execution, and Successful Job Retention

ABP v10.6 adds three opt-in enhancements to the default background job worker. All of them are disabled by default, so existing applications keep the current behavior unless you enable them explicitly.

Storing successful jobs

By default, a job is deleted as soon as it runs successfully. You can now set StoreSuccessfulJobs = true to keep completed jobs in the store. A new CompletionTime column marks completed jobs, and a cleanup worker prunes them after SuccessfulJobRetentionTime (default: 7 days).

Dedicated workers per job type

AddDedicatedWorker(...) registers a worker that processes only the configured job argument types, each with its own distributed lock. The default worker continues handling all remaining job types.

Parallel job execution

Set MaxParallelJobExecutionCount greater than 1 to execute multiple jobs in the same poll cycle. In this mode, each job is claimed with its own distributed lock so different application instances can process different jobs concurrently without running the same job twice.

Example configuration:

Configure<AbpBackgroundJobWorkerOptions>(options =>
{
    options.StoreSuccessfulJobs = true;
    options.SuccessfulJobRetentionTime = TimeSpan.FromDays(30);

    options.AddDedicatedWorker<EmailJobArgs, SmsJobArgs>("NotificationWorkerLock");
    options.AddDedicatedWorker<ReportJobArgs>("ReportWorkerLock");

    options.MaxParallelJobExecutionCount = 4;
});

These options are useful when you need better isolation between job types, higher throughput in clustered deployments, or an audit trail of successfully completed jobs.

See the Background Jobs documentation and #25742 for details.

API Definition and Proxy Improvements for Content Types and Multipart Uploads

ABP v10.6 improves API definition generation and client proxies for file upload scenarios and non-JSON response types.

The API definition now exposes response ContentTypes and an IsRemoteStream flag. C#, jQuery, and Angular proxies can use the declared media type instead of collapsing everything to application/json and text/plain.

For upload DTOs containing IRemoteStreamContent, generated Angular and jQuery proxies now forward FormData as multipart requests instead of silently dropping the file payload or trying to serialize the stream as JSON.

Server-side setup still follows the existing ABP pattern:

Configure<AbpAspNetCoreMvcOptions>(options =>
{
    options.ConventionalControllers.FormBodyBindingIgnoredTypes.Add(typeof(UploadFileDto));
});

Angular client example after proxy regeneration:

const fd = new FormData();
fd.append('Name', 'logo');
fd.append('File', fileInput.files[0], 'logo.png');
this.fileService.uploadFile(fd).subscribe(result => ...);

This closes long-standing gaps in generated proxies for stream-based uploads and improves support for text, blob, and custom response types.

See #25639 for details.

Angular UI: Upgrade to Angular 22

ABP v10.6 upgrades the Angular UI stack to Angular 22.0.x.

This release also improves the locale loading mechanism with a fallback path, so culture resources load more reliably when optional locale files are missing or partially available.

If you maintain a custom Angular UI on top of ABP, plan for the Angular 22 upgrade together with your ABP package update and regenerate proxies after upgrading.

See #25690 and #25734 for details.

Antiforgery and OpenIddict Security Improvements

ABP v10.6 includes several security-focused fixes for mixed authentication scenarios.

Antiforgery claim issuer normalization

When an application serves a token-authenticated SPA and cookie-authenticated MVC pages on the same origin, antiforgery validation could fail because the user id claim issuer differed between JWT and cookie authentication schemes. ABP now normalizes the user id claim issuer while generating and validating antiforgery tokens.

This behavior is enabled by default through AbpAntiForgeryOptions.NormalizeUserIdClaimIssuer. Razor Pages antiforgery validation was also aligned with the same normalization logic, which fixes failures in modules such as Setting Management.

Prevent OpenIddict client_id from leaking into the interactive auth cookie

ABP fixed a case where an OpenIddict authorization request could stamp the requested client_id into the interactive authentication cookie during security-stamp refresh. That could corrupt audit logs and make later cookie-authenticated requests appear to belong to the OAuth client.

The fix strips client_id when the interactive cookie is refreshed. Tokens are unaffected, and cookies that were already corrupted self-heal on the next refresh.

Forward the current access token for authenticated client requests

HttpContextAbpAccessTokenProvider now forwards the incoming access token whenever the request is authenticated, including client_credentials requests. This prevents unnecessary fallback to configured identity clients in machine-to-machine scenarios.

See #25655, #25669, #25711, and #25740 for details.

OpenIddict: Generate Access Token from the UI

ABP Commercial v10.6 RC adds a Generate Access Token action to OpenIddict application management pages across MVC, Blazor, MudBlazor, and Angular UIs.

Administrators can request a token for an OpenIddict application directly from the UI. The backend forwards a client_credentials request to /connect/token and returns the generated access token to the caller.

This is especially useful for testing integrations, validating scopes, and troubleshooting machine-to-machine authentication without leaving the admin UI.

Dependency Updates

ABP v10.6 RC includes several dependency and package updates:

• Angular packages upgraded to 22.0.x
• Microsoft.* and System.* packages upgraded to 10.0.9
• Microsoft.Data.SqlClient upgraded to 7.0.2
• Swashbuckle.AspNetCore upgraded to 10.2.3

Check the Package Version Changes document for all updates.

Other Improvements and Enhancements

• Permission management: Skip dynamic permission initialization during migration runs to avoid noisy logs when the database is unavailable (#25743).
• Security / principal access: ThreadCurrentPrincipalAccessor now returns an anonymous principal instead of null in non-web contexts (#25752).
• Angular proxy generation: Array parameters are now generated as readonly in Angular proxies (#25687).
• Date/time normalization: Removed misleading warnings when normalizing Unspecified DateTime values near range boundaries (#25703).
• AI Management: Indexing is more resilient under memory pressure in the commercial module.

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• ABP 10.5.0 Expands Blazor UI Options with MudBlazor Support by Liming Ma
• Angular 22 State Management: Signals, SignalStore, or NgRx? by Sumeyye Kurtulus
• Working with Dapr Workflows in the ABP Framework by Engincan Veske
• My Speaker's View of CONVEX Summit 2026 by Alper Ebiçoğlu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

ABP Summer Campaign: Get Up To 20% Off + $300 in AI Credits

Summer is a great time to start building with ABP. From July 6 to July 20, we're offering exclusive summer savings on ABP licenses and renewals: 20% off new licenses, 10% off renewals, and up to $300 in AI credits for the ABP AI Agent in ABP Studio. Whether you're starting a new project or upgrading your development workflow, this limited-time offer helps you save on your license while accelerating development with AI.

You can read the announcement here: ABP Summer Campaign: Get Up To 20% Off + $300 in AI Credits.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.6 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

We are glad to announce that ABP 10.5 stable version has been released.

What's New With Version 10.5?

All the new features were explained in detail in the 10.5 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 10.5

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please read the migration guide carefully, if you are upgrading from v10.4 or earlier versions: ABP Version 10.5 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Sumeyye Kurtulus has published 2 new articles:
  • Angular 22 State Management: Signals, SignalStore, or NgRx?
  • Customizing the ABP Framework: A Developer's Guide to LeptonX Theme Overrides in Angular and the Transition to React UI
• Working with Dapr Workflows in the ABP Framework by Engincan Veske
• Alper Ebicoglu has published 2 new articles:
  • My Speaker's View of CONVEX Summit 2026
  • AI Isn't Replacing Developers - It's Changing What Good Developers Spend Time On
• Deep Dive on ABP AI Agent: The Complete Series by Berkan Sasmaz
  • We have created a deep-dive series for ABP Studio's AI Coding Agent. You can read this series to learn the main features of the AI Coding Agent and how it can help you while developing ABP-based solutions.

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.6. You can follow the release planning here. Please submit an issue if you have any problems with this version.

Most real business processes don't finish in a single request.

An order gets placed, inventory gets checked, a payment gets charged, and the customer gets notified. Each step can fail, time out, or need a retry. And the whole thing has to survive a process restart without losing its place or charging someone twice.

We usually solve this with a pile of queues, a state table, and a lot of defensive code to track where each process is. It works, but the business logic ends up scattered across handlers and database rows, and nobody can read the flow top to bottom anymore.

I covered Elsa in two earlier articles as one way to handle workflows in ABP. Dapr Workflow takes a different path: instead of an in-app engine, the workflow engine runs in the Dapr sidecar, and you write the process as ordinary C# code that Dapr makes durable. If the host crashes halfway through, the workflow picks up right where it left off.

In this article, we'll build a small Dapr Workflow inside a fresh ABP project and run it end to end. By the time you reach the bottom, you should be able to copy the code, run it, and watch a workflow march through its steps.

Note: Versions matter here, because both ABP and Dapr move fast. This article is written in June 2026 against ABP 10.4 (.NET 10), Dapr 1.18, and the Dapr.Workflow 1.18.x package. The Dapr.Workflow package was rewritten in Dapr 1.17, so older tutorials you find online may use a different API.

What Dapr Workflow Actually Is?

You define a workflow that orchestrates a process, and activities that do the actual work (call a database, hit an API, send an email).

This is orchestration rather than choreography: one place drives the process, instead of services reacting to each other's events. The definitions live in your app, but the engine that executes them runs in the Dapr sidecar next to it.

The key idea is durable execution. Dapr records every step to a state store, so the workflow can be replayed from history at any time. A crash, a deployment, or a scale-out event doesn't lose progress, and a workflow can run for seconds or for months.

⚠️ One rule follows from this: workflow code must be deterministic. No DateTime.Now, no random values, no direct I/O. Anything non-deterministic goes into an activity. Even logging is affected, so inside a workflow you use context.CreateReplaySafeLogger<T>() instead of a normal logger, otherwise every replay repeats your log lines.

Under the hood, this all runs on Dapr actors, which is why the state store has to support actors. The good news is that the default local setup already handles this, as you'll see in a moment.

A Quick Note on ABP and Dapr

ABP already ships a set of Dapr integration packages: Volo.Abp.Dapr (the core package), Volo.Abp.EventBus.Dapr and Volo.Abp.AspNetCore.Mvc.Dapr.EventBus (distributed event bus over Dapr pub/sub), Volo.Abp.Http.Client.Dapr (service invocation), and Volo.Abp.DistributedLocking.Dapr (distributed locking). You can read all about them in the ABP Dapr integration documentation.

These cover pub/sub, service-to-service calls, and locking. Workflows are not part of ABP's Dapr integration, and that's fine. Dapr Workflow has its own first-class .NET SDK (Dapr.Workflow), and you plug it straight into your ABP app like any other .NET library. So in this article we use the Dapr SDK directly, inside an ABP startup template.

Note: If you'd like to see deeper Dapr integration in ABP, or you'd like us to build a dedicated piece around Dapr Workflow, feel free to open a new issue on the ABP GitHub repository. Telling us what you need is the best way to help us prioritize it.

What We'll Build

To keep this concrete, we'll build a small order processing workflow, the classic example for this kind of thing.

The workflow takes an order, checks inventory, charges the customer, then notifies them. If the item is out of stock, it stops early and returns a rejected result. Nothing fancy on the business side, but it's enough to show the parts that matter: how a workflow chains activities, how state survives across steps, and how you start and track an instance.

Here's the flow we're aiming for:

• An order comes in with a product, a quantity, and a price
• Check inventory: if there isn't enough stock, reject the order and stop
• Process payment: charge the customer
• Notify the customer: let them know the order went through
• Return a final result

Each of those steps will be an activity, and the workflow is the code that orchestrates them. Let's set up the project and build it.

Prerequisites

Before we start, make sure you have these installed:

• .NET 10 SDK
• ABP CLI (the current Studio CLI). Install it with dotnet tool install -g Volo.Abp.Studio.Cli (or update with dotnet tool update -g Volo.Abp.Studio.Cli)
• Docker, running on your machine
• Dapr CLI, initialized once with dapr init

That last step matters. When you run dapr init in self-hosted mode, Dapr pulls a few containers (including Redis) and writes a default statestore.yaml component. That default state store already has actorStateStore: "true" set, which is exactly what Dapr Workflow needs. So once dapr init finishes, you can run workflows locally with zero extra configuration.

Pro Tip: If you ever swap the default Redis store for your own component, double-check that it sets actorStateStore: "true". Without it, workflows silently fail to start, and it's the line people forget most often.

Create the Project

In this article I'll create a new layered solution with EF Core as the database provider, using the ABP CLI.

If you already have an ABP project, you don't need a new one. You can apply the following steps to your existing solution and skip this section.

Create a new solution named DaprWorkflowDemo (or whatever you want):

abp new DaprWorkflowDemo

Once the download finishes, your project boilerplate is ready. Open the solution in your IDE and run the DaprWorkflowDemo.Web project once to confirm the app starts and the UI works.

Since, we have created the solution via ABP Studio CLI, it automatically runs the initial-tasks, which init database, seed initial data and run abp install-libs command, so, no need run the *DbMigrator project.

Default admin username is admin and the password is 1q2w3E*. You can use these credentials to login...

We'll do all the workflow work inside the DaprWorkflowDemo.Web project, since that's the running host where the workflow engine connects to the sidecar.

Install the Dapr.Workflow Package

Open a terminal in the DaprWorkflowDemo.Web project folder and add the package:

dotnet add package Dapr.Workflow

-> This single package gives you everything: the base Workflow<TInput, TOutput> and WorkflowActivity<TInput, TOutput> types, the AddDaprWorkflow registration helper, and the DaprWorkflowClient you use to start and query workflows from code.

Define the Workflow and Its Activities

Now let's write the order processing flow we sketched out earlier.

First, create a Workflows folder in the DaprWorkflowDemo.Web project. We'll keep everything there for simplicity.

Every input and output in a workflow gets serialized to the state store, so the types you pass around should be simple, JSON-friendly records (ensure they are serializable!). Let's define them:

namespace DaprWorkflowDemo.Web.Workflows;

public record OrderPayload(string OrderId, string ProductName, int Quantity, decimal TotalPrice);

public record InventoryResult(bool InStock);

public record OrderResult(string OrderId, string Status);

Now the workflow itself. A workflow derives from Workflow<TInput, TOutput> and reads top to bottom like a normal method, even though every step is durably persisted:

using Dapr.Workflow;
using Microsoft.Extensions.Logging;
using System.Threading.Tasks;

namespace DaprWorkflowDemo.Web.Workflows;

public class OrderProcessingWorkflow : Workflow<OrderPayload, OrderResult>
{
    public override async Task<OrderResult> RunAsync(WorkflowContext context, OrderPayload order)
    {
        var logger = context.CreateReplaySafeLogger<OrderProcessingWorkflow>();
        logger.LogInformation("Starting order {OrderId}: {Quantity} x {ProductName}",
            order.OrderId, order.Quantity, order.ProductName);

        // 1. Check inventory
        var inventory = await context.CallActivityAsync<InventoryResult>(
            nameof(CheckInventoryActivity), order);

        if (!inventory.InStock)
        {
            logger.LogWarning("Order {OrderId} rejected: out of stock", order.OrderId);
            return new OrderResult(order.OrderId, "Rejected: out of stock");
        }

        // 2. Process the payment
        await context.CallActivityAsync(nameof(ProcessPaymentActivity), order);

        // 3. Notify the customer
        await context.CallActivityAsync(nameof(NotifyCustomerActivity), order);

        logger.LogInformation("Order {OrderId} completed", order.OrderId);
        return new OrderResult(order.OrderId, "Completed");
    }
}

A couple of things worth pointing out here.

• CallActivityAsync does not invoke the activity directly. It schedules the work with the workflow engine, which records the result once the activity completes. If the process dies right after the payment step, Dapr replays the workflow, feeds it the already-recorded results for the completed steps, and resumes at the notification step. The customer never gets charged twice. This is the task chaining pattern.
• Notice the replay-safe logger too. Because the engine replays the workflow to rebuild its state, a normal logger would print the same lines over and over. context.CreateReplaySafeLogger<T>() logs only on the first real pass.
• Now the activities. An activity is where the real work happens, and the only place you're allowed to be non-deterministic. It derives from WorkflowActivity<TInput, TOutput> and supports constructor injection, so you can pull in your ABP services, repositories, or any registered dependency:

using Dapr.Workflow;
using Microsoft.Extensions.Logging;
using System.Threading.Tasks;

namespace DaprWorkflowDemo.Web.Workflows;

public class CheckInventoryActivity : WorkflowActivity<OrderPayload, InventoryResult>
{
    private readonly ILogger<CheckInventoryActivity> _logger;

    public CheckInventoryActivity(ILogger<CheckInventoryActivity> logger)
    {
        _logger = logger;
    }

    public override Task<InventoryResult> RunAsync(WorkflowActivityContext context, OrderPayload order)
    {
        _logger.LogInformation("Checking inventory for {ProductName}", order.ProductName);

        // Pretend we queried a stock service or a repository here.
        var inStock = order.Quantity <= 100;

        return Task.FromResult(new InventoryResult(inStock));
    }
}

public class ProcessPaymentActivity : WorkflowActivity<OrderPayload, object?>
{
    private readonly ILogger<ProcessPaymentActivity> _logger;

    public ProcessPaymentActivity(ILogger<ProcessPaymentActivity> logger)
    {
        _logger = logger;
    }

    public override Task<object?> RunAsync(WorkflowActivityContext context, OrderPayload order)
    {
        _logger.LogInformation("Charging {TotalPrice:C} for order {OrderId}",
            order.TotalPrice, order.OrderId);

        // Call your real payment provider here.
        return Task.FromResult<object?>(null);
    }
}

public class NotifyCustomerActivity : WorkflowActivity<OrderPayload, object?>
{
    private readonly ILogger<NotifyCustomerActivity> _logger;

    public NotifyCustomerActivity(ILogger<NotifyCustomerActivity> logger)
    {
        _logger = logger;
    }

    public override Task<object?> RunAsync(WorkflowActivityContext context, OrderPayload order)
    {
        _logger.LogInformation("Notifying customer about order {OrderId}", order.OrderId);

        // Send an email, push a notification, publish an event, etc.
        return Task.FromResult<object?>(null);
    }
}

Each activity is isolated, so Dapr can retry a failed one without re-running the whole workflow. The two activities that don't return anything useful use object? as their output type and return null. That's why the workflow calls them with the non-generic CallActivityAsync, which ignores the result.

Here's the shape of the process we just wrote:

Register the Workflow

Workflows and activities need to be registered so the engine knows about them. Open your DaprWorkflowDemoWebModule class and register them in ConfigureServices. Most of the existing code is abbreviated for simplicity:

using DaprWorkflowDemo.Web.Workflows;
using Dapr.Workflow;

public override void ConfigureServices(ServiceConfigurationContext context)
{
    var hostingEnvironment = context.Services.GetHostingEnvironment();
    var configuration = context.Services.GetConfiguration();

    // ... existing ABP configuration ...

    //Configure Dapr Workflows...
    context.Services.AddDaprWorkflow(options =>
    {
        options.RegisterWorkflow<OrderProcessingWorkflow>();

        options.RegisterActivity<CheckInventoryActivity>();
        options.RegisterActivity<ProcessPaymentActivity>();
        options.RegisterActivity<NotifyCustomerActivity>();
    });
}

AddDaprWorkflow does two things for us. It registers a background worker that connects to the sidecar's workflow engine and hosts your workflow definitions, and it registers a DaprWorkflowClient in the dependency injection container so you can start and query workflows from your own code later.

That's all the wiring. There's no component YAML to write, because Dapr ships a built-in workflow component named dapr that runs on top of the actor state store we already have.

Run It With the Dapr Sidecar

Here's the part that's different from a normal dotnet run. The workflow engine lives in the Dapr sidecar, so the app has to run alongside a sidecar. The Dapr CLI handles that for us.

In this section, I assume that you already run dapr init command before, as explained above. If you haven't run it yet, please first run it and then follow the instructions/commands below.

First, make sure your database is migrated (run DaprWorkflowDemo.DbMigrator if you haven't). Then, from the DaprWorkflowDemo.Web project folder, start the app with Dapr:

dapr run --app-id dapr-workflow-demo --dapr-http-port 3500 -- dotnet run

A few notes on this command:

• --app-id is the identity of your app within Dapr. We'll use it nowhere else in this example, but Dapr needs it.
• --dapr-http-port 3500 pins the sidecar's HTTP port so we know where to send requests. You can leave it out and let Dapr pick one, but pinning it keeps the next step simple.
• Everything after -- is the command Dapr runs for your app. dapr run injects the sidecar's connection details (like the gRPC port) as environment variables, and the Dapr.Workflow worker reads them automatically to connect to the engine.

Notice we don't pass --app-port here. That flag is only needed when Dapr has to call into your app (for pub/sub or service invocation). For workflows, your app connects out to the sidecar over gRPC, so we don't need it for this scenario.

Once it's running, you'll see both the ABP app logs and the Dapr sidecar logs in the same terminal.

Does It Actually Work?

The quickest way to test is to talk to the sidecar's Workflow management HTTP API directly. This hits Dapr, not your app, which makes it a clean smoke test with no extra endpoint code.

Start a workflow instance. The component name is dapr (the built-in one), the workflow name is the class name, and we pass our own instance ID so it's easy to query:

curl -i -X POST "http://localhost:3500/v1.0/workflows/dapr/OrderProcessingWorkflow/start?instanceID=order-001" \
  -H "Content-Type: application/json" \
  -d '{"OrderId":"order-001","ProductName":"Mechanical Keyboard","Quantity":2,"TotalPrice":59.90}'

The request body is the workflow input, and Dapr passes it straight through to your OrderPayload. You should get a 202 Accepted back with the instance ID:

{ "instanceID": "order-001" }

Now query the status of that instance:

curl "http://localhost:3500/v1.0/workflows/dapr/order-001"

After the workflow finishes, you'll see a COMPLETED status along with the serialized output:

{
  "instanceID": "order-001",
  "workflowName": "OrderProcessingWorkflow",
  "createdAt": "2026-06-29T15:30:15.038490Z",
  "lastUpdatedAt": "2026-06-29T15:30:15.360885500Z",
  "runtimeStatus": "COMPLETED",
  "properties": {
    "dapr.workflow.input": "{\"ProductName\":\"Mechanical Keyboard\",\"Quantity\":2,\"OrderId\":\"order-001\",\"TotalPrice\":59.9}",
    "dapr.workflow.output": "{\"orderId\":\"order-001\",\"status\":\"Completed\"}"
  }
}

If you check the terminal, you'll also see the log lines from the workflow and each activity in order:

The same management API also lets you terminate, pause, resume, and purge instances, and raiseEvent to send external events into a waiting workflow. For example:

# Permanently delete a finished workflow's state
curl -X POST "http://localhost:3500/v1.0/workflows/dapr/order-001/purge"

The DaprWorkflowClient exposes the same operations in code (terminating, suspending and resuming, purging, and raising external events on an instance), which is the way to go for anything beyond a quick manual test.

Triggering Workflows From Your ABP Code

Hitting the sidecar API by hand is great for a quick check, but in a real app you'll start workflows from your own code, and this is the recommended path. That's what the DaprWorkflowClient is for, and AddDaprWorkflow already registered it for you.

You can inject it anywhere, for example into a controller or an application service. Here's a minimal controller in the DaprWorkflowDemo.Web project that starts an order and reads its status:

using System.Threading.Tasks;
using DaprWorkflowDemo.Web.Workflows;
using Dapr.Workflow;
using Microsoft.AspNetCore.Mvc;

namespace DaprWorkflowDemo.Web.Controllers;

[ApiController]
[Route("api/orders")]
public class OrderController : ControllerBase
{
    private readonly DaprWorkflowClient _workflowClient;

    public OrderController(DaprWorkflowClient workflowClient)
    {
        _workflowClient = workflowClient;
    }

    [HttpPost]
    public async Task<IActionResult> StartAsync(OrderPayload order)
    {
        var instanceId = await _workflowClient.ScheduleNewWorkflowAsync(
            name: nameof(OrderProcessingWorkflow),
            instanceId: order.OrderId,
            input: order);

        return Accepted($"/api/orders/{instanceId}", new { instanceId });
    }

    [HttpGet("{instanceId}")]
    public async Task<IActionResult> GetStatusAsync(string instanceId)
    {
        var state = await _workflowClient.GetWorkflowStateAsync(instanceId);

        if (state is null || !state.Exists)
        {
            return NotFound();
        }

        return Ok(new
        {
            RuntimeStatus = state.RuntimeStatus.ToString(),
            Output = state.ReadOutputAs<OrderResult>()
        });
    }
}

ScheduleNewWorkflowAsync returns immediately and the workflow runs in the background, so this fits the asynchronous request pattern nicely: return 202 Accepted and let the client poll the status endpoint.

One ABP-specific thing to keep in mind: ABP enforces antiforgery validation for unsafe HTTP methods on cookie-authenticated requests. Server-to-server or curl calls without an auth cookie usually pass straight through, but if you call the POST endpoint from a logged-in browser session and get a 400 antiforgery error, you can relax the auto validation for this controller through AbpAntiForgeryOptions, the same way the Elsa articles did for the Elsa endpoints.

Going Further

We built a simple linear flow, but Dapr Workflow supports the patterns you'll actually need in production, all in plain C#:

• Fan-out / fan-in: schedule many activities in parallel and aggregate the results (it's just Select plus Task.WhenAll).
• External events: pause a workflow until a human approves something or another system calls back. This is great for approval flows.
• Timers: durably wait for minutes, days, or months without holding a thread.
• Child workflows: break a big process into smaller workflows with their own history and status.
• Retry policies: give an activity an exponential backoff policy so transient failures recover on their own.

Conclusion

Dapr Workflow gives you durable execution for long-running processes without bolting a heavy orchestration engine into your code. The process is plain C# that reads top to bottom, Dapr makes it fault-tolerant by replaying from the state store, and the orchestration stays deterministic while the side effects live in activities.

The nice part for us is that none of this fights with ABP. You create a normal ABP solution, add the Dapr.Workflow package, register your workflows in a module, and run with dapr run. ABP's own Dapr packages still cover pub/sub, service invocation, and locking, so you can mix all of these in the same solution when you need them.

All the code in this article is self-contained, so you can copy it into a fresh ABP project and follow along from top to bottom.

Thanks for reading, see you in the next one!

There is a pattern I see in almost every real development session.

The interesting part is the code change, but the repeated part is everything around it:

• start the containers,
• build the affected packages,
• add a migration if the model changed,
• regenerate proxies if the API contract changed,
• restart the application,
• run the validation task,
• check the logs when something fails...

When I work alone, I can do those steps manually. When I work with an AI coding agent, I do not want to keep pasting the same checklist into every prompt. I want the tool to understand that this solution has a normal way of preparing, validating, and recovering after changes.

That is the point of ABP Studio AI Agent Workflows.

Workflows let me define repeatable actions around an agent run. The model can focus on the ambiguous part, understanding the requirement and changing the code, while ABP Studio handles the deterministic parts that should happen before or after the work.

That combination is one of the clearest differences between ABP AI Coding Agent and a generic coding assistant. It is not only an editor with a chat panel. It is an agent inside a platform that already knows how to build, run, migrate, generate proxies, manage containers, execute tasks, and inspect runtime signals.

Why Workflows Matter?

LLMs are powerful because they can reason through unclear requirements and modify code across files. But many development steps should not be creative.

If the team always builds a package after an application service change, that should be predictable. If API contract changes require proxy generation, that should not depend on whether I remembered to mention it. If a local run needs containers before the application starts, that setup should not be reinvented in every prompt.

Workflows give ABP Studio a place to encode those repeatable steps.

Choose a Workflow and Scope before sending your prompt:

The selected workflow can be configured through Workflow Settings, where you can create, edit, and manage reusable workflows for common development tasks:

For me, the value is not only automation. It is also consistency.

Instead of asking:

Please implement this, and then build, and maybe regenerate proxies,
and restart the app, and also add a migration if needed.

I can configure the workflow once and let the agent session carry that context.

That makes the prompt cleaner:

Add the missing status filter to the order list.
Use the selected workflow for validation after the change.

The workflow becomes part of the development environment, not a long instruction I repeat manually.

Before And After The Agent Works

An AI Agent workflow has two sides:

• Before steps prepare the environment before the agent starts coding.
• After steps guide the validation and follow-up work after the main task is complete.

Before steps run automatically in Agent mode. They are useful for setup actions that should happen before the model receives control, such as starting containers or running a preparation task.

Plan and Ask modes are read-only, so they do not execute before steps. That separation is important. If I am only asking a question or asking for a plan, I do not want Studio to start applications or run mutation-oriented tooling.

After steps are injected into the agent instructions as post-task guidance. The agent is expected to run the relevant post-steps after completing the work, but it can skip actions that do not apply.

For example, if my workflow includes "Add Migration" but the change does not touch the EF Core model, the agent should not create an empty migration just because the workflow exists. The workflow gives deterministic options, but the agent still uses the actual change to decide what is relevant.

What A Workflow Can Do?

Workflow actions are built around the things ABP developers already do in ABP Studio.

The supported actions include:

• Build the solution, selected modules, selected packages, or configured targets.
• Start Application for selected applications, folders, or all runnable applications.
• Stop Application when validation needs a clean state.
• Restart Application after code changes.
• Start Containers for databases, caches, message brokers, or other dependencies.
• Stop Containers when the workflow needs to clean up.
• Run Task for configured ABP Studio tasks.
• Add Migration when entity changes require a database migration.
• Generate C# Proxies after contract changes.
• Generate Angular Proxies after API changes consumed by Angular clients.

That list is very ABP-specific.

A generic coding tool can run shell commands, and that is useful. But ABP Studio workflows know about ABP Studio concepts: applications, containers, run profile tasks, packages, modules, migrations, and proxy generation. The agent can use those as first-class actions instead of trying to infer everything from terminal commands.

Personal And Shared Workflows

Workflows can be personal or shared.

• A personal workflow is stored locally under the solution workspace. It is useful for my own development habits. Maybe I like restarting a specific app after each agent turn. Maybe I have a local task that only makes sense on my machine.
• A shared workflow is stored with the active run profile. That makes it suitable for source control and team usage.

This is where workflows become more than a convenience feature. A team can encode its normal AI-agent validation path into the solution itself.

For example:

Before:
- Start required containers
- Run the prepare-local-environment task

After:
- Build affected packages
- Generate Angular proxies when contracts changed
- Restart the Web and API applications
- Run the smoke-test task

Every developer using that run profile can work with the same repeatable loop. The workflow does not replace code review or testing, but it raises the baseline for what happens after the agent touches code.

Workflows Make AI More Deterministic Where It Should Be

• I do not want the model to creatively decide whether my team usually runs proxy generation. I want the workflow to encode that.
• I do not want every prompt to include a long validation checklist. I want the workflow to carry it.
• I do not want an agent to guess which applications belong to the local run. I want ABP Studio's run profile to provide that context.

This is why workflows are such a strong fit for ABP Studio AI Coding Agent. The model stays flexible where flexibility helps, and the platform stays deterministic where determinism matters.

The result is a cleaner division of responsibility:

| Responsibility | Best handled by | | --- | --- | | Understanding the requirement | AI Agent | | Finding and editing relevant code | AI Agent | | Starting known containers | Workflow | | Running known tasks | Workflow | | Adding migrations when needed | Agent using workflow action | | Generating proxies when contracts change | Agent using workflow action | | Building affected packages | Workflow / Studio tools | | Investigating runtime failures | Agent using monitoring tools |

Workflows And Scopes Together

Workflows are even better when combined with AI Scopes.

Scopes define where the agent can work. Workflows define what repeatable actions should happen around that work.

For example, I can select a Catalog scope and a workflow that:

• builds the Catalog package,
• regenerates proxies if contracts changed,
• restarts the public web app,
• checks recent exceptions after restart.

That is a focused agent loop. The agent does not need the whole repository, and the validation path does not need to be invented from scratch.

This is the kind of full flow that makes ABP AI Coding Agent feel different from tools that only operate at the file-and-terminal level.

Why This Is Different From Generic Coding Agents

Generic coding agents can be excellent: Cursor, Claude Code, Codex, Windsurf, and similar tools can read code, edit files, run shell commands, and help across many kinds of projects.

But ABP Studio AI Coding Agent is built for a different experience: It works inside ABP Studio, where the solution already has run profiles, applications, containers, tasks, modules, packages, migrations, proxy generation, monitoring, Git integration, and ABP-aware analysis.

Workflows use that platform context.

Instead of saying:

Run whatever commands seem appropriate.

I can say:

Use the selected ABP Studio workflow.

That is a very different contract. The workflow is visible, configurable, repeatable, and tied to the solution.

For ABP teams, this matters because the development process is not only code generation. It is code generation plus build, migration, proxy generation, application restart, runtime observation, and review.

ABP Studio AI Coding Agent is designed for that full loop.

Conclusion

Workflows make ABP Studio AI Coding Agent more practical for real development.

They let me move repeated setup and validation steps out of my prompt and into the platform:

• start what needs to be running,
• build what needs to be built,
• generate what needs to be regenerated,
• migrate when a model change requires it,
• restart the relevant apps,
• and continue the debugging loop with runtime evidence.

That is why I see workflows as one of the features that makes ABP AI Coding Agent feel complete.

The agent is not isolated from the development environment. It works inside ABP Studio, with the same solution structure, run profile, tools, and team workflow that I already use.

That is the difference: not just AI-generated code, but an AI-assisted ABP development flow from change to validation.

When I use an AI coding agent in a real ABP solution, I do not always want it to see everything.

That may sound strange at first. More context usually feels better. But in a large solution, more context can also mean more noise, more unrelated files, and more chances for the agent to drift into an area that is not part of the task.

If I am working on the public side of a modular application, I do not want the agent to redesign the admin side. If I am changing a Catalog module, I do not want it to spend half the session reasoning about Identity, SaaS, or Payment code. If I am fixing one microservice, I do not want the agent to treat the whole platform as editable surface area.

That is where AI Scopes become one of the most important control features in ABP Studio AI Coding Agent.

Why Scopes Matter?

Most AI coding agents are very good at reading a folder and making changes. That is useful, but an ABP solution is rarely just a folder.

An ABP solution can contain modules, packages, applications, gateways, background workers, database projects, shared contracts, UI projects, and infrastructure configuration. In a microservice solution, the repository may contain multiple independently meaningful services. In a modular monolith, a single solution may still have clear business boundaries.

-> In those situations, the question is not only: Can the agent understand the solution? ❌

-> The better question is: Which part of the solution should the agent be allowed to work with for this task? ✅

AI Scopes answer that question directly.

They let me choose the accessible area before the session starts. The agent can then focus on the relevant module, package, solution area, or external folder instead of treating the entire repository as equally relevant.

For me, that changes the feeling of using an AI agent. It is no longer "here is my whole codebase, please be careful." It becomes "here is the part of the system this task belongs to, work inside that boundary."

What An AI Scope Controls?

An AI Scope restricts which directories the agent can access during a session.

Depending on the task, a scope can include:

• the whole solution,
• selected modules,
• selected packages,
• selected external folders,
• or a focused combination of these.

The important part is that this is not only a prompt suggestion. It is part of the session context and file access boundary. File paths used by the agent are validated against the resolved scope. If a file is outside the accessible directories, the agent should not treat it as part of the editable workspace.

Scopes also work together with .abpignore. Even if a file is under an accessible directory, files excluded by .abpignore remain blocked. That gives teams two useful layers:

• Scopes decide which solution areas are relevant to the task.
• .abpignore protects files that should stay inaccessible, such as secrets, certificates, environment files, or other sensitive local data.

This is a practical control model. I can narrow the agent's working area without pretending that the repository is smaller than it really is.

Scope Is Locked To The Session

Another detail I like is that scope belongs to the AI Agent session.

The first message of a session locks the configuration that affects the system prompt, including the active AI Scope. If a background session continues running and I change the foreground scope later, that running session does not silently change its context.

That matters when multiple sessions are active.

Imagine I have one session working on a Catalog module and another session answering questions about the whole solution. Those sessions should not accidentally share a changing boundary. Each one should keep the scope it started with.

This makes scopes more predictable. I can choose the scope intentionally at the beginning of the work and trust that the session is tied to that decision.

Focused Autonomy

Scopes are not about making the agent weaker. They are about making autonomy more focused.

When I narrow the scope, I am not saying the agent is less capable. I am saying the task has a boundary.

For example:

Use the Public AI Scope.
Add a small validation improvement to the public product search flow.
Do not inspect or change the Admin side unless you find a direct contract dependency.

That kind of prompt becomes much stronger when the selected scope already matches the instruction. The agent receives both the natural-language task and the platform-level boundary.

This is especially useful for ABP because ABP applications are built around clear concepts: modules, layers, packages, application services, repositories, DTOs, permissions, localization resources, DbContexts, and run profiles. A scope can follow those boundaries instead of relying only on a long prompt.

What Scopes Help Prevent?

Scopes help reduce a few common AI-agent failure modes.

• First, they reduce unrelated exploration. The agent does not need to spend time discovering files that have nothing to do with the task.
• Second, they reduce accidental edits. When a task belongs to one module, the agent should not casually change another module just because it found a similar type there.
• Third, they improve reviewability. If I scoped the task to Catalog, and the diff changes Identity, that is immediately suspicious. The boundary makes the review easier.
• Fourth, they support parallel work. Different sessions can be scoped to different areas, which is useful when independent tasks are running in the same solution.

This is one of the places where ABP AI Coding Agent feels different from a generic coding tool. The feature is not only "the model can read fewer files." It is integrated into ABP Studio's understanding of the solution.

Scopes And ABP Solution Architecture

ABP already encourages clear boundaries.

In a layered module, the Domain layer should not depend on the Application layer. HTTP API projects should depend on contracts, not implementation projects. Entity Framework Core and MongoDB integrations should stay behind the domain abstractions. A reusable module should be understandable as a module, not only as a set of files.

AI Scopes fit naturally into that mindset.

If I am working on a Domain change, I can keep the scope close to the module and its required shared contracts. If I am working on UI behavior, I can include the UI package and the related contract package. If I am working on a microservice, I can scope the agent to that service and only add external folders when they are truly required.

That means the agent's working area can follow the same mental model I already use as an ABP developer:

What bounded area owns this change?
Which packages are needed to make it safely?
Which parts of the system should stay out of this session?

Scopes And Workflows Work Better Together

• Scopes define where the agent can work.
• Workflows define what deterministic actions should happen around that work.

That combination is powerful. For example, I can scope the agent to the Catalog module and use a workflow that builds the affected package, regenerates proxies if contracts changed, and restarts the related application.

The scope keeps the coding session focused. The workflow keeps the verification loop repeatable.

This is the larger ABP Studio AI story. It is not only an AI chat window. It is an agent inside a platform that already understands ABP solutions, run profiles, tools, workflows, Git state, and runtime signals.

Why This Is Different From Generic Coding Agents?

Tools like Cursor, Claude Code, Codex, and Windsurf are strong general-purpose coding tools. They can read files, edit code, run shell commands, and help with many projects.

ABP AI Coding Agent is different because it is built around ABP Studio's view of an ABP solution.

Scopes are a good example of that difference.

In a generic tool, I can try to simulate scope with a prompt:

Only work in this folder.

That is helpful, but it is still mostly an instruction. In ABP Studio, scope is part of the agent session and file access model. It can be selected intentionally before the work starts, stored with the session, and combined with .abpignore, workflows, tools, plans, and run profile context.

For professional ABP teams, that matters. The goal is not to give an AI agent unlimited access and hope the prompt is clear enough. The goal is to create a controlled development loop where the agent understands the system, works in the right area, uses the right tools, and produces a diff that is easier to trust.

Conclusion

AI Scopes make ABP Studio AI Coding Agent feel more deliberate.

They let me say:

• this is the part of the solution that matters,
• this is the boundary for the current session,
• this is the context the agent should focus on,
• and everything else should stay outside unless we intentionally expand the scope.

That is exactly the kind of control I want when using AI in real ABP solutions.

The agent can still be powerful. It can still plan, edit, build, run tools, and iterate. But with scopes, that power is pointed at the right part of the system.

That is the real value: not just more AI autonomy, but better-shaped AI autonomy for ABP development.

When I use an AI coding agent, there is a point where plain code awareness is not enough.

The agent may understand the project structure. It may read the failing method. It may even guess the most likely cause of an error. But in a real development session, I usually need more than a guess. I need the latest exception, the request that caused it, the logs around it, the application that is running, the containers it depends on, the tasks I can execute, and the build result after a fix.

That is where ABP AI Coding Agent becomes different from a generic coding assistant. It is not only connected to files. It is connected to ABP Studio.

ABP Studio already knows the solution, run profiles, runnable applications, containers, tasks, monitoring data, and build actions. ABP AI Coding Agent can use that context through integrated tools when those tools are enabled. So instead of copying exception details, terminal output, container names, or build logs into the chat manually, I can let the agent work with the same ABP Studio environment I am using.

Note: ABP AI Coding Agent is available directly to ABP license holders. License holders have predefined credits so they can try it without setting up a separate AI workflow first. When those credits run out, they can buy more and continue using the same integrated experience.

Why Integrated Tools Matter

Most coding agents start from the same place: source code.

That is useful, but ABP development is not only source code. A running ABP solution has applications, modules, services, containers, database connections, migrations, logs, exceptions, requests, tasks, and build steps. When these pieces are outside the agent's reach, the developer becomes the bridge:

• Copy this exception.
• Paste that log.
• Run this build.
• Check that container.
• Explain which application is currently running.
• Tell the agent what failed after the last change.

Integrated ABP Studio tools reduce that manual work. They let the agent ask ABP Studio for runtime and solution information directly, within the permission boundary I choose.

The important detail is that this access is still explicit. Tools can be enabled or disabled. If I do not want the agent to use a tool, I can keep it disabled. If I want the agent to troubleshoot with runtime information, I can enable the relevant tools and ask for a more complete investigation.

That gives me a practical balance: the productivity of automation, with a visible boundary around what the agent can use.

Tool Access: What The Agent Is Allowed To Use

The tools view is the control point.

This is where ABP Studio shows the integrated tools that can be used by ABP AI Coding Agent. Some tools are for reading runtime information. Some are for interacting with applications. Some are for containers, tasks, or build actions.

The names are intentionally direct. A monitoring tool that gets exceptions is about exceptions. A build tool is about build validation. A task tool is about ABP Studio tasks. That makes the tool list easy to understand even before using it in a real prompt.

For me, the key idea is not the individual button names. It is the permission model:

• If a tool is disabled, the agent should not act as if it has that information.
• If a tool is enabled, the agent can use it as part of the current session.
• If a task needs runtime evidence, I can enable only the tools needed for that task.

This makes ABP AI Coding Agent feel more intentional than a black box. I can decide when it should stay in code reasoning and when it should use ABP Studio's runtime view of the solution.

Monitoring Tools

Monitoring tools are the first group I reach for when something fails at runtime.

These tools help the agent inspect what happened while the application was running. In practice, this means information like exceptions, logs, events, and request details.

This is a big difference from a generic coding agent. Without monitoring tools, the agent can read the code and make a reasonable guess. With monitoring tools, it can work from the actual failure.

For example, if a page throws an exception, I can ask:

Get the latest exception from ABP Studio Monitoring and explain what failed.

If the exception tool is enabled, the agent can use that runtime signal. It can look at the exception message, stack trace, request context, and related code. Then it can connect the runtime failure to the implementation.

That changes the debugging loop:

1. Trigger the problem.
2. Ask the agent to inspect the runtime evidence.
3. Let it find the related code.
4. Apply the fix.
5. Validate again.

The developer no longer needs to manually copy the exception from one place and paste it into another. ABP Studio becomes part of the agent's working context and give it harness!

Application Tools

Application tools connect the agent to the applications defined in the active ABP Studio run profile.

This matters because ABP solutions often contain more than one runnable application. A layered solution may have a web application, an API host, a DbMigrator, and other executable projects. A microservice solution may have several services with different roles.

ABP Studio already understands these applications through the solution and run profile. When application tools are available, the agent does not need to rediscover everything from file names or ask me which project is running. It can use ABP Studio's view of the solution.

That is useful for prompts like:

Check which application is running and use the relevant runtime information to investigate the problem.

The benefit is not only convenience. It also reduces mistakes. The agent can reason from the same run profile that I use in ABP Studio, instead of guessing from the repository structure alone.

Container Tools

Many ABP applications depend on infrastructure services while running locally.

A solution may need SQL Server, PostgreSQL, Redis, RabbitMQ, OpenIddict-related services, or other containers depending on the template and modules. When something fails, the cause is not always in application code. Sometimes a required container is not running. Sometimes the application cannot reach a dependency. Sometimes the runtime error is only a symptom of an infrastructure problem.

Container tools give the agent a way to include that part of the environment in the investigation.

Instead of asking the agent to guess why a database connection fails, I can let it check the container context that ABP Studio already has. The agent can then distinguish between:

• a code problem,
• a configuration problem,
• a missing or stopped container,
• or a dependency that is running but unhealthy.

This is one of the places where ABP Studio integration is especially valuable. General coding agents can help with Docker files or connection strings, but they usually do not know the current ABP Studio container state unless I copy it into the prompt. ABP AI Coding Agent can work closer to the actual local development environment.

Task Tools

ABP Studio tasks are another part of the development workflow that should not live outside the agent.

Tasks can represent common solution actions. They may run commands, scripts, or workflow steps that are already configured for the solution. If the team uses ABP Studio tasks to standardize local development, the agent should be able to understand and use that same layer.

That means I can ask for a workflow instead of a raw command:

Use the available ABP Studio tasks to validate this change.

The agent can work with the task names and outputs rather than asking me to remember the exact command. This is helpful in larger solutions where the correct validation step is not obvious from a single project file.

It also keeps the agent aligned with the team's development path. If ABP Studio has the task, the agent can follow that path instead of inventing a one-off command.

Build Tools

Build tools close the loop after an implementation or fix.

The agent should not only change files. It should also help verify that the change still builds.

In a generic coding agent flow, validation often depends on shell access and manually chosen commands. That can work, but it leaves more room for guessing. Which project should be built? Which solution file should be used? Is there an ABP Studio-specific build action already configured?

With ABP Studio build tools, the agent can use the build context exposed by the platform. That makes prompts like this more natural:

Apply the fix and run the available build validation.

For small changes, this may simply confirm that the project compiles. For larger changes, it can become part of a broader loop with tasks, application checks, and monitoring tools.

The important part is that the agent can move from implementation to validation without requiring me to manually transfer output between tools.

A Practical Tool Access Walkthrough

Let me make this more concrete with a small debugging scenario.

In the sample application, I deliberately added a runtime exception to the UpdateAsync method of BookAppService.cs:

throw new Exception("Sample exception for demonstrating integrated tools!");

Then I started the application from ABP Studio and triggered the related request from the browser. The only purpose of this setup is to create a real runtime failure that ABP Studio Monitoring can capture.

The interesting part is not the exception itself. The interesting part is how the agent behaves when the monitoring tool is disabled, and how that changes when the tool is enabled.

First, Without The Exception Tool

For the first run, I kept the monitoring tool that retrieves exceptions disabled.

Then I asked:

Can you get the latest exception from ABP Studio Monitoring and explain what failed?

At this point, the agent did not have direct access to the exception tool. So it tried to reason around the problem in other ways. It looked for available information, tried to inspect logs from files, and checked the codebase to understand what might be happening.

That is still useful in some cases, but it is not the best debugging flow. The agent is spending time and context trying to reconstruct a runtime failure indirectly. It may eventually find the suspicious code, but it is working from weaker evidence.

This is exactly why tool access matters. Without the monitoring tool, the agent can reason from files. With the monitoring tool, it can inspect the actual runtime failure.

Then, With The Exception Tool Enabled

For the second run, I enabled the monitoring tool that can retrieve exceptions, such as get_exceptions.

Then I asked:

Now the get_exceptions tool is enabled. Please get the latest exception from ABP Studio Monitoring, identify the failing code path, and suggest the smallest fix.

This time, the behavior was very different. The agent directly used the integrated exception tool, retrieved the exception details from ABP Studio Monitoring, and connected the runtime error to the failing code path.

It also used the enabled logging tool to verify the surrounding context instead of guessing from the source code alone.

That is the workflow I want from an integrated coding agent. It does not only say "this code looks suspicious." It checks the exception, follows the evidence, finds the source of the problem, and proposes the smallest fix.

It is also faster and more efficient. The agent does not need to spend as many tokens searching for indirect clues because ABP Studio can provide the runtime signal directly.

Adding Logs And Requests

After that, I asked the agent to use the available monitoring tools together:

Use the available monitoring tools to check the related logs and recent requests for this failure. Tell me whether they confirm the same root cause.

At this point, the agent used the enabled tools for exceptions, requests, and logs.

This is where the ABP Studio integration becomes even more valuable. A runtime problem is rarely just one line of code. There is usually a request, a log entry, an exception, and a running application context around it.

When these tools are available together, the agent can correlate them. It can say, "this request caused this exception, the logs confirm it, and this code path is responsible."

That is much better than asking the developer to copy each piece manually into the chat.

Validating The Fix

Finally, I asked the agent to validate the result:

Run the available build or application validation tools and confirm that the problem is fixed.

The agent used ABP Studio tools to stop the application, build it, and run it again.

This completes the loop. The agent did not only identify the problem. It used the integrated tools to move through the full flow:

1. Read the runtime exception.
2. Correlate it with logs and requests.
3. Find the failing code path.
4. Apply or suggest the focused fix.
5. Validate the application again.

That is the difference I want to highlight in this article. ABP AI Coding Agent is not only a model that can edit files. When ABP Studio tools are enabled, it can participate in the same development workflow I use: observing the running application, understanding the failure, fixing the code, and validating the result.

Why This Is Different From Generic Coding Agents

Tools like Cursor, Claude Code, and Codex are powerful. They can read code, edit files, run commands, and help with many software projects.

ABP AI Coding Agent has a different advantage: it is built for the ABP development experience.

It is aware of ABP concepts, ABP solution structure, ABP Studio run profiles, application metadata, containers, monitoring, tasks, and build actions. It is also backed by the ABP Platform: ABP Framework, ABP Commercial, ABP Suite, ABP Studio, and the workflows that connect them.

That platform context matters. When I am building an ABP solution, I do not only want a model that can write C# or TypeScript. I want an assistant that understands the way ABP applications are structured and the way ABP Studio runs them.

That makes the starting point simple: open the ABP solution, use ABP Studio, choose the right mode, enable the tools needed for the task, and work with the agent inside the platform.

Conclusion

Integrated tools make ABP AI Coding Agent more than a chat window next to the code. They give it a controlled way to work with the same ABP Studio context I already use: applications, containers, monitoring, tasks, and build actions.

-> That helps the agent move from "I think this might be the problem" to "I checked the runtime evidence, found the related code, applied the fix, and validated it."

That is the real value of this part of ABP Studio AI. It brings the coding agent closer to the full development experience, from understanding the solution to running it, observing it, fixing it, and checking the result.

As ABP Studio evolves, more tools can be added to this workflow. That means the agent can become more useful over time without changing the basic idea: ABP AI Coding Agent works best when it is not isolated from the platform, but integrated into it.

We are happy to release ABP version 10.5 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.5! Thanks to you in advance.

Get Started with the 10.5 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please check the migration guide if you are upgrading from v10.4 or earlier: ABP Version 10.5 Migration Guide.

What's New with ABP v10.5?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• S3-Compatible Blob Storage Support
• OpenIddict: Default Scope Fallback Options
• Dynamic Background Worker Capability Markers
• Account: Single-Active Token Provider Improvements
• CMS Kit: CodeMirror 6 Update
• Shared User Accounts: Remove Users from Tenants
• Dependency Updates

S3-Compatible Blob Storage Support

ABP v10.5 improves the AWS Blob Storing provider so it can work with S3-compatible storage services such as Cloudflare R2, MinIO, Backblaze B2, Wasabi, and DigitalOcean Spaces.

Two new AWS blob provider configuration options are available:

• ServiceURL: Sets the custom S3-compatible service endpoint.
• DisablePayloadSigning: Sends UNSIGNED-PAYLOAD instead of streaming chunked signing when the target provider does not support AWS SDK v4's default payload signing behavior.

Example configuration:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.ConfigureDefault(container =>
    {
        container.UseAws(aws =>
        {
            aws.AccessKeyId = "your-access-key";
            aws.SecretAccessKey = "your-secret-key";
            aws.ServiceURL = "https://<account-id>.r2.cloudflarestorage.com";
            aws.ContainerName = "my-container";
            aws.DisablePayloadSigning = true;
        });
    });
});

This is especially useful if you want to keep ABP's blob storing abstraction while using an S3-compatible provider instead of AWS S3 itself.

See #22962 for details.

OpenIddict: Default Scope Fallback Options

ABP v10.5 adds opt-in default scope fallback options for OpenIddict token grants.

For client_credentials, password, and token-exchange grants, you can now configure ABP to use the scopes registered on the client application when the token request does not include a scope parameter.

The new options are disabled by default:

Configure<AbpOpenIddictAspNetCoreOptions>(options =>
{
    options.UseDefaultScopesForClientCredentials = true;
    options.UseDefaultScopesForPassword = true;
    options.UseDefaultScopesForTokenExchange = true;
});

This gives applications more flexibility for machine-to-machine and integration scenarios while keeping the existing behavior unchanged unless you explicitly enable it.

See #25356 for details.

Dynamic Background Worker Capability Markers

ABP v10.5 improves the dynamic background worker infrastructure with provider capability markers.

Consumers can now detect whether the active IDynamicBackgroundWorkerManager supports runtime registration and cron scheduling by checking marker interfaces:

• ISupportsRuntimeRegistration
• ISupportsCronScheduling

Hangfire and Quartz dynamic worker managers support both runtime registration and cron scheduling. The default in-memory manager supports runtime registration only, and now rejects cron expressions with a clearer error message. TickerQ's dynamic worker manager does not expose runtime dynamic scheduling support.

This is useful for modules and tools that need to adapt their UI or behavior based on the active background worker provider.

See #25397 for details.

Account: Single-Active Token Provider Improvements

ABP continues improving token security in the Account PRO module.

In v10.5, the link-user token provider now uses ABP's single-active token infrastructure. Only the latest generated link-user token remains valid, and applications can configure the token lifetime through dedicated options.

The default ASP.NET Core Identity token provider used by ABP has also been replaced with an ABP single-active variant. Password-flow challenge tokens, such as two-factor and password-change challenge flows, are now single-active per user and purpose with a short default lifetime.

These changes help reduce the risk of old tokens remaining usable after a newer token has been issued.

See #25450 and #25525 for details.

CMS Kit: CodeMirror 6 Update

ABP v10.5 updates the @abp/codemirror package to CodeMirror 6.

The package keeps compatibility with existing ABP and CMS Kit integrations through a window.CodeMirror.fromTextArea(...) adapter while serving the updated bundled CodeMirror assets from the ABP package.

This modernizes the editor infrastructure used by CMS Kit and related UI features without requiring typical applications to change their CMS Kit usage.

See #25358 for details.

Shared User Accounts: Remove Users from Tenants

ABP Commercial v10.5 RC improves shared user account administration with a new tenant-side removal action.

Administrators can now remove a shared user from the current tenant directly from the user management UI. This provides an admin-managed counterpart to the self-service leave flow and keeps shared-account administration easier to handle in multi-tenant systems.

Dependency Updates

ABP v10.5 RC includes several dependency and package updates:

• Blazorise packages upgraded to 2.1.3
• MongoDB.Driver upgraded to 3.9.0
• CodeMirror updated to 6.0.2 through @abp/codemirror

Check the Package Version Changes document for all updates.

Other Improvements and Enhancements

• Permission Management + MySQL: Fixed the ResourcePermissionGrant index length problem that could cause MySQL initial migration failures (#25495).
• Distributed locking: Removed a redundant cancellation-token fallback call in MedallionAbpDistributedLock (#25497).
• Documentation and tooling: Added a docs syntax check workflow for docs/en Markdown files (#25415).

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Fahri Gedik has published 2 new articles:
  • New Look for ABP React Native: NativeWind, Modernization & Two Sample Apps
  • The Antidote to Vibe Architecting: ABP Studio AI Agent
• Template In, Product Out: Building Hanova with the ABP AI Agent by Sumeyye Kurtulus
• Empowering AI Agents with ABP Framework: A Comprehensive Skill Collection by Burak Demir
• Google Pomelli: How to Market Your App Without Being a Designer by Engincan Veske
• DevDays 2026 Conf From a Speaker's View by Alper Ebiçoğlu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.5 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

We are glad to announce that ABP 10.4 stable version has been released.

What's New With Version 10.4?

All the new features were explained in detail in the 10.4 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 10.4

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please read the migration guide carefully, if you are upgrading from v10.3 or earlier versions: ABP Version 10.4 Migration Guide

Community News

Highlights from the ABP Community

There have been some important announcements for the ABP community recently. Here are two highlights you may want to check out:

React UI for ABP Framework Is Finally Here

React support has been one of the most requested topics in the ABP community, and with ABP 10.4, it becomes a first-class UI option in the modern template system. The new React UI is designed for teams that want ABP on the backend and React on the frontend while keeping ABP's built-in application features such as authentication, authorization, localization, multi-tenancy, modularity, runtime configuration, and deployment.

Modern React solutions include your own React application as real source code in the solution, plus the ABP Admin Console for standard module administration screens. This means your product UI stays fully under your control, while ABP still provides a consistent and upgradeable administration experience.

The React stack is built with familiar modern tools, including Vite, TypeScript, TanStack Router, TanStack Query, Axios, Zod, React Hook Form, Tailwind CSS, shadcn/ui, and Vitest. You can create a React UI solution with the --modern flag or by selecting the modern template flow in ABP Studio. You can read the announcement here: React UI for ABP Framework Is Finally Here.

Introducing ABP Studio AI Agent

ABP Studio now introduces ABP Agent, a deeply integrated AI coding assistant that understands ABP solutions as complete systems, not just as files in folders. It is aware of ABP concepts such as modules, layers, aggregate roots, repositories, application services, DTOs, permissions, localization, event bus, distributed cache, background jobs, and module dependencies.

ABP Agent works in three modes: Agent mode for implementation, Plan mode for read-only investigation and planning, and Ask mode for Q&A and explanations. It can use ABP Studio's analysis engine to understand the solution structure, build affected projects, start or restart applications, run tasks, generate proxies, add migrations, and inspect runtime feedback such as exceptions, logs, HTTP requests, and distributed events.

The announcement also highlights the broader development loop around ABP Agent: solution runner integration, custom workflows, task runner support, Git and GitHub integration, AI-generated commit messages, and ABP-aware AI code review. You can read the announcement here: Introducing ABP Studio AI Agent.

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• ABP in the AI Era: Surviving, Evolving, and Staying Relevant by Engincan Veske
• Stop Sprinkling [RequiresFeature] Everywhere — A Centralized Feature Gate for ABP.IO by Mohammad AlMohammad AlMahmoud
• Top AI Coding Models in 2026: Which One Should Developers Actually Use? by Alper Ebiçoğlu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.5. You can follow the release planning here. Please submit an issue if you have any problems with this version.

We are happy to release ABP version 10.4 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.4! Thanks to you in advance.

Get Started with the 10.4 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

The v10.4 RC versions of ABP Studio and the ABP CLI are still being tested and will be released shortly.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please check the migration guide if you are upgrading from v10.3 or earlier: ABP Version 10.4 Migration Guide.

What's New with ABP v10.4?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• URL-Based Localization
• Localization File Splitting
• Blazor UI: MudBlazor Support
• Identity: Single-Use Email/SMS 2FA Token Providers
• Account Pro: Passwordless Email Login
• AI Management: MCP Server Enhancements
• LeptonX: URL-Based Localization and Theme Improvements
• Dependency and Security Updates

URL-Based Localization

ABP v10.4 introduces URL-based localization support. You can now embed the culture directly in the URL path, such as /tr/products or /en/about.

This is especially useful for public websites, documentation sites, e-commerce applications, and any application that needs SEO-friendly and shareable localized URLs. Instead of relying only on query string, cookie, or browser language detection, the selected culture can be part of the URL itself.

You can enable it with a single configuration:

Configure<AbpRequestLocalizationOptions>(options =>
{
    options.UseRouteBasedCulture = true;
});

When enabled, ABP automatically handles route registration, URL generation, menu links, and language switching for MVC/Razor Pages, Blazor, and Angular UIs.

For Angular applications, route trees can be wrapped with withOptionalRouteCulturePrefix so the same route configuration can handle both /identity/users and /en/identity/users:

import { Routes } from '@angular/router';
import { withOptionalRouteCulturePrefix } from '@abp/ng.core';

const appRoutesCore: Routes = [
  // ... your routes
];

export const appRoutes = withOptionalRouteCulturePrefix(appRoutesCore);

For Blazor applications, ABP built-in module pages already include culture-aware route variants. If you have your own Blazor pages, add culture route variants manually:

@page "/Products"
@page "/{culture}/Products"

See the URL-Based Localization documentation and #25174 for details.

Localization File Splitting

ABP localization resources can now use multiple JSON files for the same culture. This is useful for large modules or applications where keeping all localization texts in a single en.json file becomes difficult to maintain.

For example, you can split a resource by feature:

Localization/
+-- MyResource/
    +-- en.json
    +-- en_Authors.json
    +-- en_Books.json
    +-- en_Users.json

ABP merges these files into the same localization dictionary. Files are sorted by name before merging, and if the same key exists in multiple files, the value from the last file wins.

See the Localization documentation and #25227 for details.

Blazor UI: MudBlazor Support

ABP v10.4 starts the MudBlazor integration work for the Blazor UI stack.

This release adds MudBlazor-based package infrastructure, template integration, and module/theme support needed to build ABP Blazor applications with MudBlazor. Blazorise and MudBlazor are now supported side by side, the LeptonX theme works with both UI libraries, and when creating a new Blazor project you can pick which UI library to use.

This is a major UI foundation change, so we especially encourage Blazor users to try the RC and share feedback before the stable release.

Selecting the UI library when creating a new Blazor project in ABP Studio:

MudBlazor-based application home page:

MudBlazor-based Identity management page:

See #25235 for details.

Identity: Single-Use Email/SMS 2FA Token Providers

ABP v10.4 improves the security model for email and SMS two-factor authentication codes.

Email and phone verification codes now use ABP's single-use token providers. Generated codes are encrypted, stored with an absolute expiration time, and consumed after successful validation. Generating a new code invalidates the previous one.

You can configure token lifetime and code length:

Configure<AbpEmailTwoFactorTokenProviderOptions>(options =>
{
    options.TokenLifespan = TimeSpan.FromMinutes(5);
    options.CodeLength = 8;
});

Configure<AbpPhoneNumberTwoFactorTokenProviderOptions>(options =>
{
    options.TokenLifespan = TimeSpan.FromMinutes(2);
});

The authenticator app provider is not affected and continues to use the standard TOTP approach.

See the Two Factor Authentication documentation and #25316 for details.

Account Pro: Passwordless Email Login

ABP Commercial v10.4 RC introduces passwordless email login for the Account Pro module.

Users can sign in by receiving an email login link and/or a one-time password (OTP), depending on the configured login type. Administrators can enable the feature, choose the login mode, and configure token lifetime from the account settings.

The feature is designed with security in mind:

• Login links and OTPs are single-use.
• Resending a login email invalidates previous tokens.
• Token operations respect the current tenant context.
• Rate limiting helps protect against brute-force and email spam scenarios.
• Email enumeration behavior follows the existing account security setting.

This feature is especially useful for applications that want a smoother sign-in experience without removing the tenant-aware and security-focused account flow of ABP.

"Login via email":

Type the One-time Password (OTP) to login:

AI Management: MCP Server Enhancements

The AI Management module continues to improve its MCP (Model Context Protocol) support.

In this release, MCP server configuration has been enhanced for stdio transport scenarios and workspace relationships. This makes it easier to connect local or process-based MCP servers to AI workspaces and use their tools from the chat playground.

LeptonX: URL-Based Localization and Theme Improvements

LeptonX has been updated to work with the new URL-based localization flow across UI types, including Angular language switching and culture-aware navigation.

This release also includes several theme improvements and fixes, such as PathBase-safe menu links, improved custom select synchronization, sidebar menu re-binding after async rendering, and MudBlazor-related theme support.

Dependency and Security Updates

ABP v10.4 RC includes several dependency updates and security-related package bumps:

• OpenIddict upgraded to 7.5.0
• MongoDB.Driver upgraded to 3.8.0
• Microsoft/System package updates for CVE-2026-40372
• System.Security.Cryptography.Xml upgraded to 10.0.6
• @abp/lodash lodash dependency updated

Check Package Version Changes document for all updates.

Other Improvements and Enhancements

• Virtual File System: ReplaceEmbeddedByPhysical can now receive exclusion filters, which gives developers more control over included/excluded physical files during development (#25284).
• Exception logging: Complex objects in exception data are now serialized more clearly in logs (#25267).
• Feature management: Improved batch state checker performance and added RequireFeaturesSimpleBatchStateChecker (#25276).
• RabbitMQ: Fixed a potential hang while acquiring a closed channel after RabbitMQ restart (#25311).
• Shared user accounts: Improved shared-user lookup and two-factor authentication flows for shared user scenarios.
• Account and SaaS modules: Improved shared-user invitation and account-page flows in tenant user sharing scenarios.

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Stop Sprinkling [RequiresFeature] Everywhere — A Centralized Feature Gate for ABP.IO by Mohammad AlMohammad AlMahmoud
• Top AI Coding Models in 2026: Which One Should Developers Actually Use? by Alper Ebiçoğlu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.4 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

We are glad to announce that ABP 10.3 stable version has been released.

What's New With Version 10.3?

All the new features were explained in detail in the 10.3 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 10.3

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are some important changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v10.2 or earlier versions: ABP Version 10.3 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Liming Ma has published 6 new posts:
  • Dynamic Events in ABP
  • Dynamic Background Jobs and Workers in ABP
  • Shared User Accounts in ABP Multi-Tenancy
  • Secure Client Authentication with private_key_jwt in ABP 10.3
  • Operation Rate Limiting in ABP Framework
  • Resource-Based Authorization in ABP Framework
• One Endpoint, Many AI Clients: Turning ABP Workspaces into OpenAI-Compatible Models by Engincan Veske
• Automatically Validate Your Documentation: How We Built a Tutorial Validator by Mansur Besleney
• Automate Localhost Access for Expo: A Guide to Dynamic Cloudflare Tunnels & Dev Builds by Sumeyye Kurtulus

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.4. You can follow the release planning here. Please submit an issue if you have any problems with this version.

We are happy to release ABP version 10.3 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.3! Thanks to you in advance.

Get Started with the 10.3 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are no explicitly marked breaking changes in this version. However, there are still some important migration notes for specific scenarios. Please check the migration guide if you are upgrading from v10.2 or earlier: ABP Version 10.3 Migration Guide.

What's New with ABP v10.3?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• OpenIddict: private_key_jwt Client Authentication + abp generate-jwks
• Event Bus: String-Based Event Publishing with Dynamic Payload
• Background Jobs/Workers: String-Based Publishing with Dynamic Payload
• API Definition Endpoint: Descriptions and Documentation Support
• Entity Cache: New Batch APIs (FindMany* / GetMany*)
• Angular: User/Tenant Sharing and Tenant Switch Experience
• Angular: Upgrade to 21.2 + TypeScript 5.9
• Introducing the Volo.Abp.LuckyPenny.AutoMapper Provider
• Security Improvements (Account Pro Module)

OpenIddict: private_key_jwt Client Authentication + abp generate-jwks

ABP v10.3 introduces end-to-end support for OpenIddict private_key_jwt client authentication.
Instead of using a shared client_secret, clients can now authenticate with an asymmetric key pair: keep the private key on the client, and register the public key (JWKS) on the authorization server.

On the open-source side, ABP CLI now includes the abp generate-jwks command (and the OpenIddict demo was updated accordingly). On the Pro side, OpenIddict application management now supports storing and validating JWKS for confidential applications.

This is especially useful for machine-to-machine and compliance-focused environments where shared secrets are not preferred.

Example - Generate a JWKS with ABP CLI:

abp generate-jwks --alg RS256 --key-size 2048 -o ./keys -f my-client

See the community article Secure Client Authentication with private_key_jwt in ABP 10.3 for a full walkthrough. This approach is especially useful for Pro solutions that manage confidential clients in the administration UI.

Event Bus: String-Based Event Publishing with Dynamic Payload

ABP v10.3 adds string-based publishing and subscription APIs for event-driven integrations.

When you do not know event types at compile time, you can now publish and handle events by name without introducing extra wrapper contracts up front. This is especially useful for plugin ecosystems, partner integrations, and metadata-driven application flows.

This is not a separate eventing model. Dynamic events run through the same ABP infrastructure (including outbox/inbox when configured), can be handled through DynamicEventData, and can coexist with typed handlers for the same event name. Distributed providers support this approach except Dapr, which requires startup-time topic declarations.

Example - Publish by event name:

await _distributedEventBus.PublishAsync(
    "OrderPlaced",
    new { OrderId = input.Id, CustomerEmail = input.Email }
);

Example - Subscribe dynamically at runtime:

eventBus.Subscribe("PartnerOrderReceived",
    new PartnerOrderHandler(context.ServiceProvider));

public class PartnerOrderHandler : IDistributedEventHandler<DynamicEventData>
{
    public Task HandleEventAsync(DynamicEventData eventData)
    {
        // eventData.EventName + eventData.Data
        return Task.CompletedTask;
    }
}

See the community article Dynamic Events in ABP for details.

Background Jobs/Workers: String-Based Publishing with Dynamic Payload

ABP v10.3 introduces Dynamic Background Jobs (IDynamicBackgroundJobManager) and Dynamic Background Workers (IDynamicBackgroundWorkerManager) for runtime registration and execution by name.

With these APIs, you can enqueue jobs with dynamic payloads, register handler delegates at startup, and add/update/remove recurring workers at runtime. This is especially useful for plugin architectures, metadata-driven workflows, and tenant-specific scheduling scenarios where task types are not known at compile time.

Dynamic background jobs work through ABP's existing typed job pipeline (including provider integrations), while dynamic workers support runtime schedule management (period/cron depending on provider).

Example - Enqueue a job by name with dynamic payload:

await _dynamicBackgroundJobManager.EnqueueAsync("emails", new
{
    EmailAddress = input.CustomerEmail,
    Subject = "Order Confirmed",
    Body = $"Your order {input.OrderId} has been placed."
});

Example - Update worker schedule at runtime:

await workerManager.UpdateScheduleAsync(
    "InventorySyncWorker",
    new DynamicBackgroundWorkerSchedule { Period = 10000 } // 10s
);

See #25059 and the community article Dynamic Background Jobs and Workers in ABP for details.

API Definition Endpoint: Descriptions and Documentation Support

The API definition endpoint can now optionally return richer metadata such as summary/description fields for controllers, actions, and parameters.

This is particularly useful for dynamic client generation, API explorers, and tooling that consumes ABP API metadata directly without requiring OpenAPI parsing.

See #25022 for details.

Entity Cache: New Batch APIs (FindMany* / GetMany*)

ABP v10.3 extends IEntityCache with batch retrieval APIs so you can resolve multiple entities in a single cache/database flow instead of looping over FindAsync/GetAsync.

It includes both list-based APIs (FindManyAsync / GetManyAsync) and dictionary-based APIs (FindManyAsDictionaryAsync / GetManyAsDictionaryAsync) so you can choose the shape that best matches your access pattern.

Example - List-based batch retrieval (preserves input order):

var ids = new List<Guid> { id1, id2, id1 };

var products = await _productCache.GetManyAsync(ids);      // throws if any ID is missing
var productsOrNull = await _productCache.FindManyAsync(ids); // null for missing IDs

Example - Dictionary-based batch retrieval (fast lookup by ID):

var productsById = await _productCache.GetManyAsDictionaryAsync(ids);
var nullableProductsById = await _productCache.FindManyAsDictionaryAsync(ids);

if (nullableProductsById.TryGetValue(id1, out var product) && product != null)
{
    // use product
}

All of these methods are optimized for bulk scenarios by internally batching cache misses via distributed cache multi-get/multi-add operations.

See #25088 and #25090 for details.

Angular: User/Tenant Sharing and Tenant Switch Experience

ABP v10.3 enhances Angular UX for shared-user multi-tenancy scenarios, including invitation flows, tenant switch UX, and related identity/account integrations.

This improves the out-of-the-box experience for applications using tenant user sharing.

See #25051 for details.

Angular: Upgrade to 21.2 + TypeScript 5.9

ABP v10.3 upgrades Angular to 21.2 and TypeScript to 5.9, bringing the Angular UI stack to the latest ABP-supported frontend baseline.

This helps you stay current with the modern Angular and TypeScript ecosystem while benefiting from newer compiler/tooling improvements and maintaining compatibility with the ABP Angular packages in this release.

See #25072 for details.

Introducing the Volo.Abp.LuckyPenny.AutoMapper Provider

ABP v10.3 introduces Volo.Abp.LuckyPenny.AutoMapper as a new optional provider integration for projects that want to use the LuckyPenny-maintained AutoMapper package.

The existing Volo.Abp.AutoMapper package remains unchanged, and migration is straightforward: replace AbpAutoMapperModule with AbpLuckyPennyAutoMapperModule in your module dependencies while keeping the same ABP-facing namespaces and APIs.

This update also addresses the AutoMapper 14.x vulnerability context (GHSA-rvv3-g6hj-g44x), and ABP documentation was expanded with installation, usage, and migration guidance. For more information, see the documentation: LuckyPenny AutoMapper Integration.

Security Improvements (Account Pro Module)

ABP Commercial v10.3 RC also includes notable account security hardening:

• Optional CAPTCHA for forgot-password flow
• Operation-based rate limiting policies for account confirmation/token operations (including updated/default policies for reset and token endpoints)
• Session revocation after sensitive credential operations (password change/reset/admin reset)
• Stronger profile picture upload validation (allowed extensions, max size, and magic-bytes checks)

These changes are security-focused and are designed to be practical for real projects. Here are the key points and how you can tune them:

• Forgot-password abuse protection: You can enable CAPTCHA for forgot-password flows to reduce automated reset attempts.
• Operation-level rate limiting: Token/confirmation/reset operations now rely on policy-based limits, so you can centralize and customize limits per operation.
• Safer session behavior: Password changes/resets now revoke sessions to reduce risk from stolen or long-lived sessions.
• Profile picture hardening: Uploads are checked by extension, size, and file signature (magic bytes), not only by client-provided metadata.

Example - Tune profile picture upload restrictions:

Configure<AbpProfilePictureOptions>(options =>
{
    options.AllowedFileExtensions = new[] { ".jpg", ".jpeg", ".png" };
    options.MaxFileSizeInBytes = 2 * 1024 * 1024; // 2 MB
});

Example - Override account operation rate-limiting policies:

Configure<AbpOperationRateLimitingOptions>(options =>
{
    options.ConfigurePolicy(
        AbpAccountOperationRateLimitPolicies.SendPasswordResetCode,
        policy =>
        {
            policy.ClearRules();
            policy.PerHour(5);
            policy.PerDay(20);
        });
});

See the community article Operation Rate Limiting in ABP Framework for conceptual guidance.

Other Improvements and Enhancements

• Permission integration endpoint update: PermissionIntegrationController.IsGrantedAsync now uses HttpPost for large payload scenarios (#25177).
• OpenIddict dependency update: Upgraded to OpenIddict 7.3.0 (#25053).
• Autofac integration update: Upgraded Autofac.Extensions.DependencyInjection to 11.0.0 (#25190).
• MongoDB dependency update: Bumped MongoDB.Driver to 3.7.1 (#25114).
• OIDC auth storage options for Angular UI (pro): OIDC auth storage is now configurable.

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Liming Ma has published 6 new posts:
  • Dynamic Events in ABP
  • Dynamic Background Jobs and Workers in ABP
  • Shared User Accounts in ABP Multi-Tenancy
  • Secure Client Authentication with private_key_jwt in ABP 10.3
  • Operation Rate Limiting in ABP Framework
  • Resource-Based Authorization in ABP Framework
• One Endpoint, Many AI Clients: Turning ABP Workspaces into OpenAI-Compatible Models by Engincan Veske
• Automatically Validate Your Documentation: How We Built a Tutorial Validator by Mansur Besleney
• Automate Localhost Access for Expo: A Guide to Dynamic Cloudflare Tunnels & Dev Builds by Sumeyye Kurtulus

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.3 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

We are glad to announce that ABP 10.2 stable version has been released.

What's New With Version 10.2?

All the new features were explained in detail in the 10.2 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 10.2

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v10.1 or earlier versions: ABP Version 10.2 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Liming Ma has published 6 new posts:
  • Dynamic Events in ABP
  • Dynamic Background Jobs and Workers in ABP
  • Shared User Accounts in ABP Multi-Tenancy
  • Secure Client Authentication with private_key_jwt in ABP 10.3
  • Operation Rate Limiting in ABP Framework
  • Resource-Based Authorization in ABP Framework
• One Endpoint, Many AI Clients: Turning ABP Workspaces into OpenAI-Compatible Models by Engincan Veske
• Automatically Validate Your Documentation: How We Built a Tutorial Validator by Mansur Besleney
• Automate Localhost Access for Expo: A Guide to Dynamic Cloudflare Tunnels & Dev Builds by Sumeyye Kurtulus

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.3. You can follow the release planning here. Please submit an issue if you have any problems with this version.

ABP's AI Management module already makes it easy to define and manage AI workspaces (provider, model, API key/base URL, system prompt, permissions, MCP tools, RAG settings, and more). With ABP v10.2, there is a major addition: you can now expose those workspaces through OpenAI-compatible endpoints under /v1.

That changes the integration story in a practical way. Instead of wiring every external tool directly to a provider, you can point those tools to ABP and keep runtime decisions centralized in one place.

In this post, we will walk through a practical setup with AnythingLLM and show why this pattern is useful in real projects.

Before we get into the details, here's a quick look at the full flow in action:

See It in Action: AnythingLLM + ABP

The demo below shows the full flow: connecting an OpenAI-compatible client to ABP, selecting a workspace-backed model, and sending a successful chat request through /v1.

Why This Is a Big Deal

Many teams end up with AI configuration spread across multiple clients and services. Updating providers, rotating keys, or changing model behavior can become operationally messy.

With ABP in front of your AI traffic:

• Clients keep speaking the familiar OpenAI contract.
• ABP resolves the requested model to a workspace.
• The workspace decides which provider/model settings are actually used.

This gives you a clean split: standardized client integration outside, governed AI configuration inside.

Key Concept: Workspace = Model

OpenAI-compatible clients send a model value. In ABP AI Management, that model maps to a workspace name.

For example:

• Workspace name: SupportAgent
• Client request model: SupportAgent

When the client calls /v1/chat/completions with "model": "SupportAgent", ABP routes the request to that workspace and applies that workspace's provider (OpenAI, Ollama etc.) and model configuration.

This is the main mental model to keep in mind while integrating any OpenAI-compatible tool with ABP.

Endpoints Exposed by ABP v10.2

The AI Management module exposes OpenAI-compatible REST endpoints at /v1.

| Endpoint | Method | Description | | ---------------------------- | ------ | ---------------------------------------------- | | /v1/chat/completions | POST | Chat completions (streaming and non-streaming) | | /v1/completions | POST | Legacy text completions | | /v1/models | GET | List available models (workspaces) | | /v1/models/{modelId} | GET | Get a single model (workspace) | | /v1/embeddings | POST | Generate embeddings | | /v1/files | GET | List files | | /v1/files | POST | Upload a file | | /v1/files/{fileId} | GET | Get file metadata | | /v1/files/{fileId} | DELETE | Delete a file | | /v1/files/{fileId}/content | GET | Download file content |

All endpoints require Authorization: Bearer <token>.

Quick Setup with AnythingLLM

Before configuration, ensure:

1. AI Management is installed and running in your ABP app.
2. At least one workspace is created and active.
3. You have a valid Bearer token for your ABP application.

1) Get an access token

Use any valid token accepted by your app. In a demo-style setup, token retrieval can look like this:

curl -X POST http://localhost:44337/connect/token \
  -d "grant_type=password&username=admin&password=1q2w3E*&client_id=DemoApp_API&client_secret=1q2w3e*&scope=DemoApp"

Use the returned access_token as the API key value in your OpenAI-compatible client.

2) Configure AnythingLLM as Generic OpenAI

In AnythingLLM -> Settings -> LLM Preference, select Generic OpenAI and set:

| Setting | Value | | -------------------- | --------------------------- | | Base URL | http://localhost:44337/v1 | | API Key | <access_token> | | Chat Model Selection | Select an active workspace |

In most OpenAI-compatible UIs, the app adds Bearer automatically, so the API key field should contain only the raw token string.

3) Optional: configure embeddings

If you want RAG flows through ABP, go to Settings -> Embedding Preference and use the same Base URL/API key values. Then select a workspace that has embedder settings configured.

Validate the Flow

List models (workspaces)

curl http://localhost:44337/v1/models \
  -H "Authorization: Bearer <your-token>"

Chat completion

curl -X POST http://localhost:44337/v1/chat/completions \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "MyWorkspace",
    "messages": [
      { "role": "user", "content": "Hello from ABP OpenAI-compatible endpoint!" }
    ]
  }'

Optional SDK check (Python)

from openai import OpenAI

client = OpenAI(
    base_url="http://localhost:44337/v1",
    api_key="<your-token>"
)

response = client.chat.completions.create(
    model="MyWorkspace",
    messages=[{"role": "user", "content": "Hello!"}]
)

print(response.choices[0].message.content)

Where This Fits in Real Projects

This approach is a strong fit when you want to:

• Keep ABP as the central control plane for AI workspaces.
• Let client tools integrate through a standard OpenAI contract.
• Switch providers or model settings without rewriting client-side integration.

If your team uses multiple AI clients, this pattern keeps integration simple while preserving control where it matters.

Learn More

• ABP AI Management Documentation

We are happy to release ABP version 10.2 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.2! Thanks to you in advance.

Get Started with the 10.2 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v10.1 or earlier: ABP Version 10.2 Migration Guide.

What's New with ABP v10.2?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• Multi-Tenant Account Usage: Shared User Accounts
• Prevent Privilege Escalation: Assignment Restrictions for Roles and Permissions
• ClientResourcePermissionValueProvider for OAuth/OpenIddict
• Angular: Hybrid Localization Support
• Angular: Extensible Table Row Detail
• Angular: CMS Kit Module Features
• Blazor: Upgrade to Blazorise 2.0
• Identity: Single Active Token Providers
• TickerQ Package Upgrade to 10.1.1
• AI Management: MCP (Model Context Protocol) Support
• AI Management: RAG with File Upload
• AI Management: OpenAI-Compatible Chat Endpoint
• File Management: Resource-Based Authorization

Multi-Tenant Account Usage: Shared User Accounts

ABP v10.2 introduces Shared User Accounts: a single user account can belong to multiple tenants, and the user can choose or switch the active tenant when signing in. This enables a "one account, multiple tenants" experience — for example, inviting the same email address into multiple tenants.

When you use Shared User Accounts:

• Username/email uniqueness becomes global (Host + all tenants)
• Users are prompted to select the tenant at login if they belong to multiple tenants
• Users can switch between tenants using the tenant switcher in the user menu
• Tenant administrators can invite existing or new users to join a tenant

Enable shared accounts by configuring UserSharingStrategy:

Configure<AbpMultiTenancyOptions>(options =>
{
    options.IsEnabled = true;
    options.UserSharingStrategy = TenantUserSharingStrategy.Shared;
});

See the Shared User Accounts documentation for details.

Prevent Privilege Escalation: Assignment Restrictions for Roles and Permissions

ABP v10.2 implements a unified privilege escalation prevention model to address security vulnerabilities where users could assign themselves or others roles or permissions they do not possess.

Role Assignment Restriction: Users can only assign or remove roles they currently have. Users cannot add new roles to themselves (removal only) and cannot assign or remove roles they do not possess.

Permission Grant/Revoke Authorization: Users can only grant or revoke permissions they currently have. Validation applies to both grant and revoke operations.

Incremental Permission Protection: When updating user or role permissions, permissions the current user does not have are treated as non-editable and are preserved as-is during updates.

Users with the admin role can assign any role and grant/revoke any permission. All validations are enforced on the backend — the UI is not a security boundary.

See #24775 for more details.

ClientResourcePermissionValueProvider for OAuth/OpenIddict

ABP v10.2 adds ClientResourcePermissionValueProvider, extending resource-based authorization to OAuth clients. When using IdentityServer or OpenIddict, clients can now have resource permissions aligned with the standard user and role permission model.

This allows you to control which OAuth clients can access which resources, providing fine-grained authorization for API consumers. The implementation integrates with ABP's existing resource permission infrastructure.

See #24515 for more details.

Angular: Hybrid Localization Support

ABP v10.2 introduces Hybrid Localization for Angular applications, combining server-side and client-side localization strategies. This gives you flexibility in how translations are loaded and resolved — you can use server-provided localization, client-side fallbacks, or a mix of both.

This feature is useful when you want to reduce initial load time, support offline scenarios, or have environment-specific localization behavior. The Angular packages have been updated to support the hybrid approach seamlessly.

See the Hybrid Localization documentation and #24731.

Angular: Extensible Table Row Detail

ABP v10.2 adds the ExtensibleTableRowDetailComponent for expandable row details in extensible tables. You can now display additional information for each row in a collapsible detail section.

The feature supports row detail templates via both direct input and content child component. It adds toggle logic and emits rowDetailToggle events, making it easy to customize the behavior and appearance of expandable rows in your data tables.

See #24636 for more details.

Angular: CMS Kit Module Features

ABP v10.2 brings CMS Kit features to Angular, completing the cross-platform UI coverage for the CMS Kit module. The Angular implementation includes: Blogs, Blog Posts, Comments, Menus, Pages, Tags, Global Resources, and CMS Settings.

Together with the CMS Kit Pro Angular implementation (FAQ, Newsletters, Page Feedbacks, Polls, Url forwarding), ABP now provides full Angular UI coverage for both the open-source CMS Kit and CMS Kit Pro modules.

See #24234 for more details.

Blazor: Upgrade to Blazorise 2.0

ABP v10.2 upgrades the Blazorise library to version 2.0 for Blazor UI. If you are upgrading your project to v10.2 RC, please ensure that all Blazorise-related packages are updated to v2.0 in your application.

Blazorise 2.0 includes various improvements and changes. Please refer to the Blazorise 2.0 Release Notes and the ABP Blazorise 2.0 Migration Guide for upgrade instructions.

See #24906 for more details.

Identity: Single Active Token Providers

ABP v10.2 introduces a single active token policy for password reset, email confirmation, and change-email flows. Three new token providers are available: AbpPasswordResetTokenProvider, AbpEmailConfirmationTokenProvider, and AbpChangeEmailTokenProvider.

When a new token is generated, it invalidates any previously issued tokens for that purpose. This improves security by ensuring that only the most recently issued token is valid. Token lifespan can be customized via the respective options classes for each provider.

See #24926 for more details.

TickerQ Package Upgrade to 10.1.1

If you are using the TickerQ integration packages (Volo.Abp.TickerQ, Volo.Abp.BackgroundJobs.TickerQ, or Volo.Abp.BackgroundWorkers.TickerQ), you need to apply breaking changes when upgrading to ABP 10.2. TickerQ has been upgraded from 2.5.3 to 10.1.1, which only targets .NET 10.0 and contains several API changes.

Key changes include:

• UseAbpTickerQ moved from IApplicationBuilder to IHost — use context.GetHost().UseAbpTickerQ() in your module
• Entity types renamed: TimeTicker → TimeTickerEntity, CronTicker → CronTickerEntity
• Scheduler and dashboard configuration APIs have changed
• New helpers: context.GetHost(), GetWebApplication(), GetEndpointRouteBuilder()

Important: Do not resolve IHost from context.ServiceProvider.GetRequiredService<IHost>(). Always use context.GetHost(). See the ABP Version 10.2 Migration Guide for the complete list of changes.

AI Management: MCP (Model Context Protocol) Support

This is a PRO feature available for ABP Commercial customers.

The AI Management Module now supports MCP (Model Context Protocol), enabling AI workspaces to use external MCP servers as tools. MCP allows AI models to interact with external services, databases, APIs, and more through a standardized protocol.

You can create and manage MCP servers via the AI Management UI. Each MCP server supports one of the following transport types: Stdio (runs a local command), SSE (Server-Sent Events), or StreamableHttp. For HTTP-based transports, you can configure authentication (API Key, Bearer token, or custom headers). Once MCP servers are defined, you can associate them with workspaces. When a workspace has MCP servers associated, the AI model can invoke tools from those servers during chat conversations — tool calls and results are displayed in the chat interface.

You can test the connection to an MCP server after creating it to verify connectivity and list available tools before use:

When a workspace has MCP servers associated, the AI model can invoke tools from those servers during chat conversations. Tool calls and results are displayed in the chat interface.

See the AI Management documentation for details.

AI Management: RAG with File Upload

This is a PRO feature available for ABP Commercial customers.

The AI Management module supports RAG (Retrieval-Augmented Generation) with file upload, which enables workspaces to answer questions based on the content of uploaded documents. When RAG is configured, the AI model searches the uploaded documents for relevant information before generating a response.

To enable RAG, configure an embedder (e.g., OpenAI, Ollama) and a vector store (e.g., PgVector) on the workspace:

| Embedder | Vector Store | | --- | --- | | | |

You can then upload documents (PDF, Markdown, or text files, max 10 MB) through the workspace management UI. Uploaded documents are automatically processed — their content is chunked, embedded, and stored in the configured vector store:

When you ask questions in the chat interface, the AI model uses the uploaded documents as context for accurate, grounded responses.

See the AI Management — RAG with File Upload documentation for configuration details.

AI Management: OpenAI-Compatible Chat Endpoint

This is a PRO feature available for ABP Commercial customers.

The AI Management module exposes an OpenAI-compatible REST API at the /v1 path. This allows any application or tool that supports the OpenAI API format — such as AnythingLLM, Open WebUI, Dify, or custom scripts using the OpenAI SDK — to connect directly to your AI Management instance.

Example configuration from AnythingLLM:

Each AI Management workspace appears as a selectable model in the client application. The workspace's configured AI provider handles the actual inference transparently. Available endpoints include /v1/chat/completions, /v1/models, /v1/embeddings, /v1/files, and more. All endpoints require authentication via a Bearer token in the Authorization header.

See the AI Management — OpenAI-Compatible API documentation for usage examples.

File Management: Resource-Based Authorization

This is a PRO feature available for ABP Commercial customers.

The File Management Module now supports resource-based authorization. You can control access to individual files and folders per user, role, or client. Permissions can be granted at the resource level via the UI, and the feature integrates with ABP's resource permission infrastructure.

This feature is implemented for all three supported UIs: MVC/Razor Pages, Blazor, and Angular, providing a consistent experience across your application regardless of the UI framework you use.

Other Improvements and Enhancements

• Angular signal APIs: ABP Angular packages migrated to signal queries, output functions, and signal input functions for alignment with Angular 21 (#24765, #24766, #24777).
• Angular Vitest: ABP Angular templates now use Vitest as the default testing framework instead of Karma/Jasmine (#24725).
• Ambient auditing: Programmatic disable/enable of auditing via IAuditingHelper.DisableAuditing() and IsAuditingEnabled() (#24718).
• Complex property auditing: Entity History and ModifierId now support EF Core complex properties (#24767).
• RabbitMQ correlation ID: Correlation ID support added to RabbitMQ JobQueue for distributed tracing (#24755).
• Concurrent config retrieval: MvcCachedApplicationConfigurationClient now fetches configuration and localization concurrently for faster startup (#24838).
• Environment localization fallback: Angular can use environment.defaultResourceName when the backend does not provide it (#24589).
• JS proxy namespace fix: Resolved namespace mismatch for multi-segment company names in generated proxies (#24877).
• Audit Logging max length: Entity/property type full names increased to 512 characters to reduce truncation (#24846).
• AI guidelines: Cursor and Copilot AI guideline documents added for ABP development (#24563, #24593).

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Enis Necipoğlu has published 2 new posts:
  • ABP Framework's Hidden Magic: Things That Just Work Without You Knowing
  • Implementing Multiple Global Query Filters with Entity Framework Core
• Suhaib Mousa has published 2 new posts:
  • .NET 11 Preview 1 Highlights: Faster Runtime, Smarter JIT, and AI-Ready Improvements
  • TOON vs JSON for LLM Prompts in ABP: Token-Efficient Structured Context
• Fahri Gedik has published 2 new posts:
  • Building a Multi-Agent AI System with A2A, MCP, and ADK in .NET
  • Async Chain of Persistence Pattern: Designing for Failure in Event-Driven Systems
• Alper Ebiçoğlu has published 2 new posts:
  • NDC London 2026: From a Developer's Perspective and My Personal Notes about AI
  • Which Open-Source PDF Libraries Are Recently Popular? A Data-Driven Look At PDF Topic
• Stop Spam and Toxic Users in Your App with AI by Engincan Veske
• How AI Is Changing Developers by Liming Ma
• JetBrains State of Developer Ecosystem Report 2025 — Key Insights by Tarık Özdemir
• Integrating AI into ABP.IO Applications: The Complete Guide to Volo.Abp.AI and AI Management Module by Adnan Ali

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.2 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

We are glad to announce that ABP 10.1 stable version has been released.

What's New With Version 10.1?

All the new features were explained in detail in the 10.1 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 10.1

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v10.0 or earlier versions: ABP Version 10.1 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Enis Necipoğlu:
  • ABP Framework's Hidden Magic: Things That Just Work Without You Knowing
  • Implementing Multiple Global Query Filters with Entity Framework Core
• Suhaib Mousa:
  • .NET 11 Preview 1 Highlights: Faster Runtime, Smarter JIT, and AI-Ready Improvements
  • TOON vs JSON for LLM Prompts in ABP: Token-Efficient Structured Context
• Fahri Gedik:
  • Building a Multi-Agent AI System with A2A, MCP, and ADK in .NET
  • Async Chain of Persistence Pattern: Designing for Failure in Event-Driven Systems
• Alper Ebiçoğlu:
  • NDC London 2026: From a Developer's Perspective and My Personal Notes about AI
  • Which Open-Source PDF Libraries Are Recently Popular? A Data-Driven Look At PDF Topic
• Engincan Veske:
  • Stop Spam and Toxic Users in Your App with AI
• Liming Ma:
  • How AI Is Changing Developers
• Tarık Özdemir:
  • JetBrains State of Developer Ecosystem Report 2025 — Key Insights
• Adnan Ali:
  • Integrating AI into ABP.IO Applications: The Complete Guide to Volo.Abp.AI and AI Management Module

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.2. You can follow the release planning here. Please submit an issue if you have any problems with this version.

If your application accepts user-generated content (comments, reviews, forum posts) you likely need some form of content moderation. Building one from scratch typically means training ML models, maintaining datasets, and writing a lot of code. OpenAI's omni-moderation-latest model offers a practical shortcut: it's free, requires no training data, and covers 13+ harm categories across text and images in 40+ languages.

In this article, I'll show you how to integrate this model into an ABP application using the AI Management Module. We'll wire it into the CMS Kit Module's Comment Feature so every comment is automatically screened before it's published. The AI Management Module handles the OpenAI configuration (API keys, model selection, etc.) through a runtime UI, so you won't need to hardcode any of that into your appsettings.json or redeploy when something changes.

By the end, you'll have a working content moderation pipeline you can adapt for any entity in your ABP project.

Understanding OpenAI's Omni-Moderation Model

Before diving into the implementation, let's understand what makes OpenAI's omni-moderation-latest model a game-changer for content moderation.

What is it?

OpenAI's omni-moderation-latest is a next-generation multimodal content moderation model built on the foundation of GPT-4o. Released in September 2024, this model represents a significant leap forward in automated content moderation capabilities.

The most remarkable aspect? It's completely free to use through OpenAI's Moderation API, there are no token costs, no usage limits for reasonable use cases, and no hidden fees.

Key Capabilities

The omni-moderation model offers several compelling features that make it ideal for production applications:

• Multimodal Understanding: Unlike text-only moderation systems, this model can process both text and image inputs, making it suitable for applications where users can upload images alongside their comments or posts.
• High Accuracy: Built on GPT-4o's advanced understanding capabilities, the model achieves significantly higher accuracy in detecting nuanced harmful content compared to rule-based systems or simpler ML models.
• Multilingual Support: The model demonstrates enhanced performance across more than 40 languages, making it suitable for global applications without requiring separate moderation systems for each language.
• Comprehensive Category Coverage: Rather than just detecting "spam" or "not spam," the model classifies content across 13+ distinct categories of potentially harmful content.

Content Categories

The model evaluates content against the following categories, each designed to catch specific types of harmful content:

| Category | What It Detects | |----------|-----------------| | harassment | Content that expresses, incites, or promotes harassing language towards any individual or group | | harassment/threatening | Harassment content that additionally includes threats of violence or serious harm | | hate | Content that promotes hate based on race, gender, ethnicity, religion, nationality, sexual orientation, disability, or caste | | hate/threatening | Hateful content that includes threats of violence or serious harm towards the targeted group | | self-harm | Content that promotes, encourages, or depicts acts of self-harm such as suicide, cutting, or eating disorders | | self-harm/intent | Content where the speaker expresses intent to engage in self-harm | | self-harm/instructions | Content that provides instructions or advice on how to commit acts of self-harm | | sexual | Content meant to arouse sexual excitement, including descriptions of sexual activity or promotion of sexual services | | sexual/minors | Sexual content that involves individuals under 18 years of age | | violence | Content that depicts death, violence, or physical injury in graphic detail | | violence/graphic | Content depicting violence or physical injury in extremely graphic, disturbing detail | | illicit | Content that provides advice or instructions for committing illegal activities | | illicit/violent | Illicit content that specifically involves violence or weapons |

API Response Structure

When you send content to the Moderation API (through model or directly to the API), you receive a structured response containing:

• flagged: A boolean indicating whether the content violates any of OpenAI's usage policies. This is your primary indicator for whether to block content.
• categories: A dictionary containing boolean flags for each category, telling you exactly which policies were violated.
• category_scores: Confidence scores ranging from 0 to 1 for each category, allowing you to implement custom thresholds if needed.
• category_applied_input_types: A dictionary containing information on which input types were flagged for each category. For example, if both the image and text inputs to the model are flagged for "violence/graphic", the violence/graphic property will be set to ["image", "text"]. This is only available on omni models.

For more detailed information about the model's capabilities and best practices, refer to the OpenAI Moderation Guide.

The AI Management Module: Your Dynamic AI Configuration Hub

The AI Management Module is a powerful addition to the ABP Platform that transforms how you integrate and manage AI capabilities in your applications. Built on top of the ABP Framework's AI infrastructure, it provides a complete solution for managing AI workspaces dynamically—without requiring code changes or application redeployment.

Why Use the AI Management Module?

Traditional AI integrations often suffer from several pain points:

1. Hardcoded Configuration: API keys, model names, and endpoints are typically stored in configuration files, requiring redeployment for any changes.
2. No Runtime Flexibility: Switching between AI providers or models requires code changes.
3. Security Concerns: Managing API keys across environments is cumbersome and error-prone.
4. Limited Visibility: There's no easy way to see which AI configurations are active or test them without writing code.

The AI Management Module addresses all these concerns by providing:

• Dynamic Workspace Management: Create, configure, and update AI workspaces directly from a user-friendly administrative interface—no code changes required.
• Provider Flexibility: Seamlessly switch between different AI providers (OpenAI, Gemini, Antrophic, Azure OpenAI, Ollama, and custom providers) without modifying your application code.
• Built-in Testing: Test your AI configurations immediately using the included chat interface playground before deploying to production.
• Permission-Based Access Control: Define granular permissions to control who can manage AI workspaces and who can use specific AI features.
• Multi-Framework Support: Full support for MVC/Razor Pages, Blazor (Server & WebAssembly), and Angular UI frameworks.

Built-in Provider Support

The AI Management Module comes with built-in support for popular AI providers through dedicated NuGet packages:

• Volo.AIManagement.OpenAI: Provides seamless integration with OpenAI's APIs, including GPT models and the Moderation API.
• Custom providers can be added by implementing the IChatClientFactory interface. (If you configured the Ollama while creating your project, then you can see the example implementation for Ollama)

Building the Demo Application

Now let's put theory into practice by building a complete content moderation system. We'll create an ABP application with the AI Management Module, configure OpenAI as our provider, set up the CMS Kit Comment Feature, and implement automatic content moderation for all user comments.

Step 1: Creating an Application with AI Management Module

In this tutorial, I'll create a layered MVC application named ContentModeration. If you already have an existing solution, you can follow along by replacing the namespaces accordingly. Otherwise, feel free to follow the solution creation steps below.

The most straightforward way to create an application with the AI Management Module is through ABP Studio. When you create a new project, you'll encounter an AI Integration step in the project creation wizard. This wizard allows you to:

• Enable the AI Management Module with a single checkbox
• Configure your preferred AI provider (OpenAI and Ollama)
• Set up initial workspace configurations
• Automatically install all required NuGet packages

Note: The AI Integration tab in ABP Studio currently only supports the MVC/Razor Pages UI. Support for Angular and Blazor UIs will be added in upcoming versions.

During the wizard, select OpenAI as your AI provider, set the model name as omni-moderation-latest and provide your API key. The wizard will automatically:

1. Install the Volo.AIManagement.* packages across your solution
2. Install the Volo.AIManagement.OpenAI package for OpenAI provider support (you can use any OpenAI compatible model here, including Gemini, Claude and GPT models)
3. Configure the necessary module dependencies
4. Set up initial database migrations

Alternative Installation Method:

If you have an existing project or prefer manual installation, you can add the module using the ABP CLI:

abp add-module Volo.AIManagement

Or through ABP Studio by right-clicking on your solution, selecting Import Module, and choosing Volo.AIManagement from the NuGet tab.

Step 2: Understanding the OpenAI Workspace Configuration

After creating your project and running the application for the first time, navigate to AI Management > Workspaces in the admin menu. Here you'll find the workspace management interface where you can view, create, and modify AI workspaces.

If you configured OpenAI during the project creation wizard, you'll already have a workspace set up. Otherwise, you can create a new workspace with the following configuration:

| Property | Value | Description | |----------|-------|-------------| | Name | OpenAIAssistant | A unique identifier for this workspace (no spaces allowed) | | Provider | OpenAI | The AI provider to use | | Model | omni-moderation-latest | The specific model for content moderation | | API Key | <Your-OpenAI-API-key> | Authentication credential for the OpenAI API | | Description | Workspace for content moderation | A helpful description for administrators |

The beauty of this approach is that you can modify any of these settings at runtime through the UI. Need to rotate your API key? Just update it in the workspace configuration. Want to test a different model? Change it without touching your code.

Step 3: Setting Up the CMS Kit Comment Feature

Now let's add the CMS Kit Module to enable the Comment Feature. The CMS Kit provides a robust, production-ready commenting system that we'll enhance with our content moderation.

Install the CMS Kit Module:

Run the following command in your solution directory:

abp add-module Volo.CmsKit --skip-db-migrations

Also, you can add the related module through ABP Studio UI.

Enable the Comment Feature:

By default, CMS Kit features are disabled to keep your application lean. Open the GlobalFeatureConfigurator class in your *.Domain.Shared project and enable the Comment Feature:

using Volo.Abp.GlobalFeatures;
using Volo.Abp.Threading;

namespace ContentModeration;

public static class ContentModerationGlobalFeatureConfigurator
{
    private static readonly OneTimeRunner OneTimeRunner = new OneTimeRunner();

    public static void Configure()
    {
        OneTimeRunner.Run(() =>
        {
            GlobalFeatureManager.Instance.Modules.CmsKit(cmsKit =>
            {
                //only enable the Comment Feature
                cmsKit.Comments.Enable();
            });
        });
    }
}

Configure the Comment Entity Types:

Open your *DomainModule class and configure which entity types can have comments. For our demo, we'll enable comments on "Article" entities:

using Volo.CmsKit.Comments;

// In your ConfigureServices method:
Configure<CmsKitCommentOptions>(options =>
{
    options.EntityTypes.Add(new CommentEntityTypeDefinition("Article"));
});

Add the Comment Component to a Page:

Finally, let's add the commenting interface to a page. Open the Index.cshtml file in your *.Web project and add the Comment component (replace with the following content):

@page
@using Volo.CmsKit.Public.Web.Pages.CmsKit.Shared.Components.Commenting
@model ContentModeration.Web.Pages.IndexModel

<div class="container mt-4">
    <div class="card">
        <div class="card-header">
            <h3>Welcome to Our Community</h3>
        </div>
        <div class="card-body">
            <p class="lead">
                Share your thoughts in the comments below. Our AI-powered moderation system
                automatically reviews all comments to ensure a safe and respectful environment
                for everyone.
            </p>

            <hr/>

            <h4>Comments</h4>
            @await Component.InvokeAsync(typeof(CommentingViewComponent), new
            {
                entityType = "Article",
                entityId = "welcome-article",
                isReadOnly = false
            })
        </div>
    </div>
</div>

At this point, you have a fully functional commenting system. Users can post comments, reply to existing comments, and interact with the community.

However, there's no content moderation yet and any content, including harmful content, would be accepted. Let's fix that!

Implementing the Content Moderation Service

Now comes the exciting part: implementing the content moderation service that leverages OpenAI's omni-moderation model to automatically screen all comments before they're published.

Understanding the Architecture

Our implementation follows a clean, modular architecture:

1. IContentModerator Interface: Defines the contract for content moderation, making our implementation testable and replaceable.
2. ContentModerator Service: The concrete implementation that calls OpenAI's Moderation API using the configuration from the AI Management Module.
3. MyCommentAppService: An override of the CMS Kit's comment service that integrates our moderation logic.

This separation of concerns ensures that:

• The moderation logic is isolated and can be unit tested independently
• You can easily swap the moderation implementation (e.g., switch to a different provider)
• The integration with CMS Kit is clean and maintainable

Creating the Content Moderator Interface

First, let's define the interface in your *.Application.Contracts project. This interface is intentionally simple and it takes text input and throws an exception if the content is harmful:

using System.Threading.Tasks;

namespace ContentModeration.Moderation;

public interface IContentModerator
{
    Task CheckAsync(string text);
}

Implementing the Content Moderator Service

Now let's implement the service in your *.Application project. This implementation uses the IWorkspaceConfigurationStore from the AI Management Module to dynamically retrieve the OpenAI configuration:

using System.Collections.Generic;
using System.Threading.Tasks;
using OpenAI.Moderations;
using Volo.Abp;
using Volo.Abp.DependencyInjection;
using Volo.AIManagement.Workspaces.Configuration;

namespace ContentModeration.Moderation;

public class ContentModerator : IContentModerator, ITransientDependency
{
    private readonly IWorkspaceConfigurationStore _workspaceConfigurationStore;

    public ContentModerator(IWorkspaceConfigurationStore workspaceConfigurationStore)
    {
        _workspaceConfigurationStore = workspaceConfigurationStore;
    }

    public async Task CheckAsync(string text)
    {
        // Skip moderation for empty content
        if (string.IsNullOrWhiteSpace(text))
        {
            return;
        }

        // Retrieve the workspace configuration from AI Management Module
        // This allows runtime configuration changes without redeployment
        var config = await _workspaceConfigurationStore.GetOrNullAsync<OpenAIAssistantWorkspace>();

        if(config == null)
        {
            throw new UserFriendlyException("Could not find the 'OpenAIAssistant' workspace!");
        }

        var client = new ModerationClient(
            model: config.Model,
            apiKey: config.ApiKey
        );

        // Send the text to OpenAI's Moderation API
        var result = await client.ClassifyTextAsync(text);
        var moderationResult = result.Value;

        // If the content is flagged, throw a user-friendly exception
        if (moderationResult.Flagged)
        {
            var flaggedCategories = GetFlaggedCategories(moderationResult);
            
            throw new UserFriendlyException(
                $"Your comment contains content that violates our community guidelines. " +
                $"Detected issues: {string.Join(", ", flaggedCategories)}. " +
                $"Please revise your comment and try again."
            );
        }
    }

    private static List<string> GetFlaggedCategories(ModerationResult result)
    {
        var flaggedCategories = new List<string>();

        if (result.Harassment.Flagged)
        {
            flaggedCategories.Add("harassment");
        }
        if (result.HarassmentThreatening.Flagged) 
        {
            flaggedCategories.Add("threatening harassment");
        }
        
        //other categories...

        return flaggedCategories;
    }
}

Note: The ModerationResult class from the OpenAI .NET SDK provides properties for each moderation category (e.g., Harassment, Violence, Sexual), each with a Flagged boolean and a Score float (0-1). The exact property names may vary slightly between SDK versions, so check the OpenAI .NET SDK documentation for the latest API.

Integrating with CMS Kit Comments

The final piece of the puzzle is integrating our moderation service with the CMS Kit's comment system. We'll override the CommentPublicAppService to intercept all comment creation and update requests:

using System;
using System.Threading.Tasks;
using ContentModeration.Moderation;
using Microsoft.Extensions.Options;
using Volo.Abp.DependencyInjection;
using Volo.Abp.EventBus.Distributed;
using Volo.CmsKit.Comments;
using Volo.CmsKit.Public.Comments;
using Volo.CmsKit.Users;
using Volo.Abp.SettingManagement;

namespace ContentModeration.Comments;

[Dependency(ReplaceServices = true)]
[ExposeServices(typeof(ICommentPublicAppService), typeof(CommentPublicAppService), typeof(MyCommentAppService))]
public class MyCommentAppService : CommentPublicAppService
{
    protected IContentModerator ContentModerator { get; }

    public MyCommentAppService(
        ICommentRepository commentRepository,
        ICmsUserLookupService cmsUserLookupService,
        IDistributedEventBus distributedEventBus,
        CommentManager commentManager,
        IOptionsSnapshot<CmsKitCommentOptions> cmsCommentOptions,
        ISettingManager settingManager,
        IContentModerator contentModerator)
        : base(commentRepository, cmsUserLookupService, distributedEventBus, commentManager, cmsCommentOptions, settingManager)
    {
        ContentModerator = contentModerator;
    }

    public override async Task<CommentDto> CreateAsync(string entityType, string entityId, CreateCommentInput input)
    {
        // Check for harmful content BEFORE creating the comment
        // If harmful content is detected, an exception is thrown and the comment is not saved
        await ContentModerator.CheckAsync(input.Text);

        return await base.CreateAsync(entityType, entityId, input);
    }

    public override async Task<CommentDto> UpdateAsync(Guid id, UpdateCommentInput input)
    {
        // Check for harmful content BEFORE updating the comment
        // This prevents users from editing approved comments to add harmful content
        await ContentModerator.CheckAsync(input.Text);

        return await base.UpdateAsync(id, input);
    }
}

How This Works:

1. When a user submits a new comment, the CreateAsync method is called.
2. Before the comment is saved to the database, we call ContentModerator.CheckAsync() with the comment text.
3. The moderation service sends the text to OpenAI's Moderation API.
4. If the content is flagged as harmful, a UserFriendlyException is thrown with a descriptive message.
5. The exception is caught by ABP's exception handling middleware and displayed to the user as a friendly error message.
6. If the content passes moderation, the comment is saved normally.

The same flow applies to comment updates, ensuring users can't circumvent moderation by editing previously approved comments.

Here's the full flow in action — submitting a comment with harmful content and seeing the moderation kick in:

The Power of Dynamic Configuration - What AI Management Module Provides to You?

One of the most significant advantages of using the AI Management Module is the ability to manage your AI configurations dynamically. Let's explore what this means in practice.

Runtime Configuration Changes

With the AI Management Module, you can:

• Rotate API Keys: Update your OpenAI API key through the admin UI without any downtime or redeployment. This is crucial for security compliance and key rotation policies.
• Switch Models: Want to test a newer moderation model? Simply update the model name in the workspace configuration. Your application will immediately start using the new model.
• Adjust Settings: Fine-tune settings like temperature or system prompts (for chat-based workspaces) without touching your codebase.
• Enable/Disable Workspaces: Temporarily disable a workspace for maintenance or testing without affecting other parts of your application.

Multi-Environment Management

The dynamic configuration approach shines in multi-environment scenarios:

• Development: Use a test API key with lower rate limits
• Staging: Use a separate API key for integration testing
• Production: Use your production API key with appropriate security measures

All these configurations can be managed through the UI or via data seeding, without environment-specific code changes.

Actively Maintained & What's Coming Next

The AI Management Module is actively maintained and continuously evolving. The team is working on exciting new capabilities that will further expand what you can do with AI in your ABP applications:

• MCP (Model Context Protocol) Support — Coming in v10.2, MCP support will allow your AI workspaces to interact with external tools and data sources, enabling more sophisticated AI-powered workflows.
• RAG (Retrieval-Augmented Generation) System — Also planned for v10.2, the built-in RAG system will let you ground AI responses in your own data, making AI features more accurate and context-aware.
• And More — Additional features and improvements are on the roadmap to make AI integration even more seamless.

Since the module is built on ABP's modular architecture, adopting these new capabilities will be straightforward — you can simply update the module and start using the new features without rewriting your existing AI integrations.

Permission-Based Access Control

The AI Management Module integrates with ABP's permission system, allowing you to:

• Restrict who can view AI workspace configurations
• Control who can create or modify workspaces
• Limit access to specific workspaces based on user roles

This ensures that sensitive configurations like API keys are only accessible to authorized administrators.

Conclusion

In this comprehensive guide, we've built a production-ready content moderation system that combines the power of OpenAI's omni-moderation-latest model with the flexibility of ABP's AI Management Module. Let's recap what makes this approach powerful:

Key Takeaways

1. Zero Training Required: Unlike traditional ML approaches that require collecting datasets, training models, and ongoing maintenance, OpenAI's Moderation API works out of the box with state-of-the-art accuracy.
2. Completely Free: OpenAI's Moderation API has no token costs, making it economically viable for applications of any scale.
3. Comprehensive Detection: With 13+ categories of harmful content detection, you get protection against harassment, hate speech, violence, sexual content, self-harm, and more—all from a single API call.
4. Dynamic Configuration: The AI Management Module allows you to manage API keys, switch providers, and adjust settings at runtime without code changes or redeployment.
5. Clean Integration: By following ABP's service override pattern, we integrated moderation seamlessly into the existing CMS Kit comment system without modifying the original module.
6. Production Ready: The implementation includes proper error handling, graceful degradation, and user-friendly error messages suitable for production use.

Resources

• AI Management Module Documentation
• OpenAI Moderation Guide
• CMS Kit Comments Feature
• ABP Framework AI Infrastructure

We are happy to release ABP version 10.1 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v10.1! Thanks to you in advance.

Get Started with the 10.1 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v10.0 or earlier: ABP Version 10.1 Migration Guide.

What's New with ABP v10.1?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• Resource-Based Authorization
• Introducing the TickerQ Background Worker Provider
• Angular UI: Improving Authentication Token Handling
• Angular Version Upgrade to v21
• File Management Module: Public File Sharing Support
• Payment Module: Public Page Implementation for Blazor & Angular UIs
• AI Management Module: Blazor & Angular UIs
• Identity PRO Module: Password History Support
• Account PRO Module: Introducing WebAuthn Passkeys

Resource-Based Authorization

ABP v10.1 introduces Resource-Based Authorization, a powerful feature that enables fine-grained access control based on specific resource instances. This enhancement addresses a long-requested feature (#236) that allows you to implement authorization logic that depends on the resource being accessed, not just static roles or permissions.

What is Resource-Based Authorization?

Unlike traditional permission-based authorization where you check if a user has a general permission (like "CanEditDocuments"), resource-based authorization allows you to make authorization decisions based on the specific resource instance. For example:

• Allow users to edit only their own blog posts
• Grant access to documents based on ownership or sharing settings
• Implement complex authorization rules that depend on resource properties

How It Works?

1. Define resource permissions (AddResourcePermission):

public class MyPermissionDefinitionProvider : PermissionDefinitionProvider
{
    public override void Define(IPermissionDefinitionContext context)
    {
        //other permissions...

        context.AddResourcePermission(
            name: BookManagementPermissions.Manage.Resources.Consume,
            resourceName: BookManagementPermissions.Manage.Resources.Name,
            managementPermissionName: BookManagementPermissions.Manage.ManagePermissions,
            L("LocalizedPermissionDisplayName")
        );
    }
}

2. Use IResourcePermissionChecker.IsGrantedAsync in your code to perform the resource permission check:

protected IResourcePermissionChecker ResourcePermissionChecker { get; }

public async Task MyService()
{
    if(await ResourcePermissionChecker.IsGrantedAsync(
        BookManagementPermissions.Manage.Resources.Consume, 
        BookManagementPermissions.Manage.Resources.Name,
        workspaceConfiguration.WorkspaceId!.Value.ToString()))
        {
            return;
        }

        //...
}

3. Use the relevant ResourcePermissionManagementModel in your UI:

The following code block demonstrates its usage in the Blazor UI, but the same component is also implemented for MVC & Angular UIs (however, component name might be different, please refer to the documentation before using the component).

<ResourcePermissionManagementModal @ref="PermissionManagementModal" />

@code {
    ResourcePermissionManagementModal PermissionManagementModal { get; set; } = null!;

    private Task OpenResourcePermissionModel()
    {
        await PermissionManagementModal.OpenAsync(
            resourceName: BookManagementPermissions.Manage.Resources.Name, 
            resourceKey: entity.Id.ToString(), 
            resourceDisplayName: entity.Name
        );
    }
}

This feature integrates perfectly with ABP's existing authorization infrastructure and provides a standard way to implement complex, context-aware authorization scenarios in your applications.

Introducing the TickerQ Background Worker Provider

ABP v10.1 now includes TickerQ as a new background job and background worker provider option. TickerQ is a fast, reflection-free background task scheduler for .NET — built with source generators, EF Core integration, cron + time-based execution, and a real-time dashboard. It offers reliable job execution with built-in retry mechanisms, persistent job storage, and efficient resource usage.

To use TickerQ in your ABP-based solution, refer to the following documentation:

• TickerQ Background Job Integration
• TickerQ Background Worker Integration

Angular UI: Improving Authentication Token Handling

ABP v10.1 brings significant improvements to Angular authentication token handling, making token refresh more reliable and providing better error handling for expired or invalid tokens.

What's Improved?

Prior to this version, access tokens issued by the auth-server were stored in localStorage, making them vulnerable to XSS attacks. We've made the following enhancements to improve safety and reduce security risks:

• Store sensitive tokens in memory
• Use web-workers for state sharing between tabs

These enhancements are automatically available in new Angular projects and can be applied to existing projects by updating ABP packages.

See #23930 for more details.

Angular Version Upgrade to v21

ABP v10.1 upgrades Angular to version 21, bringing the latest improvements and features from the Angular ecosystem to your ABP applications. We've upgraded the relevant core Angular packages and 3rd party packages such as angular-oauth2-oidc and ng-bootstrap. We will also update the ABP Studio templates along with the stable v10.1 release.

See #24384 for the complete change list.

File Management Module: Public File Sharing Support

This is a PRO feature available for ABP Commercial customers.

The File Management Module now supports public file sharing via shareable links, similar to popular cloud storage services like Google Drive or Dropbox. This feature enables you to generate public URLs for files that can be accessed without authentication.

Example Share URL:

https://abp.io/api/file-management/file-descriptor/share?shareToken=CfDJ8AK%2BOEpCD...

Configuration:

You can configure the public share domain through options:

Configure<FileManagementWebOptions>(options =>
{
    options.FileDownloadRootUrl = "https://files.yourdomain.com";
});

This feature is available for all supported UI types (MVC, Angular, Blazor) and integrates seamlessly with the existing File Management Module.

Payment Module: Public Page Implementation for Blazor & Angular UIs

The Payment Module now includes public page implementations for Angular and Blazor UIs, completing UI coverage across all ABP-supported frameworks. Previously, public payment pages (payment gateway selection, pre-payment, and post-payment pages) were only available for MVC/Razor Pages UI. With this version, both admin and public pages are now available for MVC, Angular, and Blazor UIs.

The public payment pages seamlessly integrate with ABP's Payment Module and support all configured payment gateways. The documentation will be updated soon with detailed integration guides and examples at abp.io/docs/latest/modules/payment.

AI Management Module: Blazor & Angular UIs

With this version, Angular and Blazor UIs for the AI Management module have been implemented, completing the cross-platform support for this powerful AI integration module.

The AI Management Module builds on top of ABP's AI Infrastructure and provides:

• Multi-Provider Support: Integrate with OpenAI, Google Gemini, Anthropic Claude, and more from a unified API
• Workspace-Based Organization: Organize AI capabilities into separate workspaces for different use cases
• Built-In Chat Interface: Ready-to-use chat UI for conversational AI
• Chat Widget: Drop-in chat widget component for customer support or AI assistance
• Resource-Based Permissions: Control access to specific AI workspaces for users, roles, or clients

Learn more about the AI Management Module in the announcement post and official documentation.

Identity PRO Module: Password History Support

The Identity PRO Module now includes Password History support, preventing users from reusing previous passwords. This security feature helps enforce stronger password policies and meet compliance requirements for your organization.

Administrators can enable password reuse prevention by toggling the related setting on the Administration -> Settings -> Identity Management page:

When changing a password, the system checks the specified number of previous passwords and displays an error message if the new password matches any of them:

Account PRO Module: Introducing WebAuthn Passkeys

ABP v10.1 introduces Passkey authentication, enabling passwordless sign-in using modern biometric authentication methods. Built on the WebAuthn standard (FIDO2), this feature allows users to authenticate using Face ID, Touch ID, Windows Hello, Android biometrics, security keys, or other platform authenticators.

What are Passkeys?

Passkeys are a modern, phishing-resistant authentication method that replaces traditional passwords:

• Passwordless: No passwords to remember, type, or manage
• Secure: Uses public/private key cryptography stored on the user's device
• Convenient: Sign in with a fingerprint, face scan, or device PIN
• Cross-Platform: Can sync across devices depending on platform support (Apple, Google, Microsoft)

How It Works:

1. Enable or disable the WebAuthn passkeys feature in the Settings -> Account -> Passkeys page:

2. Add your passkeys in the Account/Manage page:

3. Use the Passkey login option for passwordless authentication the next time you log in:

For more information, refer to the Web Authentication API (WebAuthn) passkeys documentation.

Community News

Special Offer: Level Up Your ABP Skills with 33% Off Live Trainings!

We're excited to announce a special limited-time offer for developers looking to master the ABP Platform! Get 33% OFF on all ABP live training sessions and accelerate your learning journey with hands-on guidance from ABP experts.

Why Join ABP Live Trainings?

Our live training sessions provide an immersive learning experience where you can:

• Learn from the Experts: Get direct instruction from ABP team members and experienced trainers who know the platform inside and out.
• Hands-On Practice: Work through real-world scenarios and build actual applications during the sessions.
• Interactive Q&A: Ask questions in real-time and get immediate answers to your specific challenges.
• Comprehensive Coverage: From fundamentals to advanced topics, our trainings cover everything you need to build production-ready applications with ABP.
• Certificate of Completion: Receive a certificate upon completing the training to showcase your ABP expertise.

Don't miss this opportunity to invest in your skills and career. Whether you're new to ABP or looking to advance your expertise, our live trainings provide the structured learning path you need to succeed.

👉 Learn more and claim your discount here

Introducing the ABP Referral Program

We're thrilled to announce the launch of the ABP.IO Referral Program, a new way for our community members to earn rewards while helping others discover the ABP Platform!

How It Works:

ABP's Referral Program is simple and rewarding:

1. Get Your Unique Referral Link: Sign up for the program and receive your personalized referral link.
2. Share with Your Network: Share your link with colleagues, friends, and fellow developers who could benefit from ABP.
3. Earn Rewards: When someone purchases an ABP Commercial license through your referral link, you earn 5% commission!

By joining the referral program, you're not just earning rewards and also you're helping other developers discover a platform that can significantly improve their productivity and project success.

👉 Join the ABP.IO Referral Program

Announcing AI Management Module

We are excited to announce the AI Management Module, a powerful new module to the ABP Platform that makes managing AI capabilities in your applications easier than ever!

What is the AI Management Module?

Built on top of the ABP Framework's AI infrastructure, the AI Management Module allows you to manage AI workspaces dynamically without touching your code. Whether you're building a customer support chatbot, adding AI-powered search, or creating intelligent automation workflows, this module provides everything you need to manage AI integrations through a user-friendly interface.

Key Features:

• Multi-Provider Support: Allows integrating with multiple AI providers including OpenAI, Google Gemini, Anthropic Claude, and more from a single unified API.
• Buit-In Chat Interface
• Ready to Use Chat Widget
• and more... (RAG & MCP supports are on the way!)

👉 Read the announcement post for more...

We Were At .NET Conf China 2025!

The ABP team participated in .NET Conf China 2025 in Shanghai, celebrating the release of .NET 10 (LTS) and the achievements of the .NET community in China.

Event Highlights:

The conference brought together hundereds of developers and featured Scott Hanselman's opening keynote announcing .NET 10's availability, focused on four pillars: AI, cloud-native, cross-platform, and performance. The event covered three main themes: performance improvements, AI integration, and cross-platform development, with in-depth sessions on topics ranging from Avalonia and Blazor to AI agents and enterprise adoption.

ABP's Participation:

At the ABP booth, we showcased our developer platform with live demonstrations of modular architecture, multi-tenancy support, and built-in authentication systems. We hosted interactive raffles with prizes including ABP stickers, the Mastering ABP Framework book, and Bluetooth headphones. The booth was a hub for sharing experiences, impromptu code walkthroughs, and meaningful conversations with Chinese developers about ABP's future.

👉 Read the full event recap

Community Talks 2025.10: AI-Powered .NET Apps with ABP & Microsoft Agent Framework

In our latest ABP Community Talks session, we dove deep into the world of Artificial Intelligence and its integration with the ABP Framework. This session explored Microsoft's cutting-edge AI libraries: Extensions AI, Semantic Kernel, and the Microsoft Agent Framework.

What We Covered:

We introduced the new AI Management Module, discussing its current status and roadmap. The session included practical demonstrations on building intelligent applications with the Microsoft Agent Framework within ABP projects, showing how these technologies empower developers to create AI-powered .NET applications.

👉 Missed the live session? Click here to watch the full session

New ABP Community Articles

There are exciting articles contributed by the ABP community as always. I will highlight some of them here:

• Salih Özkara has published 3 new articles:
  • Building Dynamic XML Sitemaps with ABP Framework
  • Implement Automatic Method-Level Caching in ABP Framework
  • Building Production-Ready LLM Applications with .NET: A Practical Guide
• Adnan Ali has published 2 new articles:
  • Integrating AI into ABP.IO Applications: The Complete Guide to Volo.Abp.AI and AI Management Module
  • How ABP.IO Framework Cuts Your MVP Development Time by 60%
• My First Look and Experience with Google AntiGravity by Alper Ebiçoğlu
• TOON vs JSON for LLM Prompts in ABP: Token-Efficient Structured Context by Suhaib Mousa

Thanks to the ABP Community for all the content they have published. You can also post your ABP-related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v10.1 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

When building modern web applications, managing BLOBs (Binary Large Objects) such as images, videos, documents, or any other file types is a common requirement. Whether you're developing a CMS, an e-commerce platform, or almost any other kind of application, you'll eventually ask yourself: "Where should I store these files?"

In this article, we'll explore different approaches to storing BLOBs in .NET applications and demonstrate how the ABP Framework simplifies this process with its flexible BLOB Storing infrastructure.

ABP Provides multiple storage providers such as Azure, AWS, Google, Minio, Bunny etc. But for the simplicity of this article, we will only focus on the Database Provider, showing you how to store BLOBs in database tables step-by-step.

Understanding BLOB Storage Options

Before diving into implementation details, let's understand the common approaches for storing BLOBs in .NET applications. Mainly, there are three main approaches:

1. Database Storage
2. File System Storage
3. Cloud Storage

1. Database Storage

The first approach is to store BLOBs directly in the database alongside your relational data (you can also store them separately). This approach uses columns with types like VARBINARY(MAX) in SQL Server or BYTEA in PostgreSQL.

Pros:

• ✅ Transactional consistency between files and related data
• ✅ Simplified backup and restore operations (everything in one place)
• ✅ No additional file system permissions or management needed

Cons:

• ❌ Database size can grow significantly with large files
• ❌ Potential performance impact on database operations
• ❌ May require additional database tuning and optimization
• ❌ Increased backup size and duration

2. File System Storage

The second obvious approach is to store BLOBs as physical files in the server's file system. This approach is simple and easy to implement. Also, it's possible to use these two approaches together and keep the metadata and file references in the database.

Pros:

• ✅ Better performance for large files
• ✅ Reduced database size and improved database performance
• ✅ Easier to leverage CDNs and file servers
• ✅ Simple to implement file system-level operations (compression, deduplication)

Cons:

• ❌ Requires separate backup strategy for files
• ❌ Need to manage file system permissions
• ❌ Potential synchronization issues in distributed environments
• ❌ More complex cleanup operations for orphaned files

3. Cloud Storage (Azure, AWS S3, etc.)

The third approach can be using cloud storage services for scalability and global distribution. This approach is powerful and scalable. But it's also more complex to implement and manage.

Best for:

• Large-scale applications
• Multi-region deployments
• Content delivery requirements

ABP Framework's BLOB Storage Infrastructure

The ABP Framework provides an abstraction layer over different storage providers, allowing you to switch between them with minimal code changes. This is achieved through the IBlobContainer (and IBlobContainer<TContainerType>) service and various provider implementations.

ABP provides several built-in providers, which you can see the full list here.

Let's see how to use the Database provider in your application step by step.

Demo: Storing BLOBs in Database in an ABP-Based Application

In this demo, we'll walk through a practical example of storing BLOBs in a database using ABP's BLOB Storing infrastructure. We'll focus on the backend implementation using the IBlobContainer service and examine the database structure that ABP creates automatically. The UI framework choice doesn't matter for this demonstration, as we're concentrating on the core BLOB storage functionality.

If you don't have an ABP application yet, create one using the ABP CLI:

abp new BlobStoringDemo

This command generates a new ABP layered application named BlobStoringDemo with MVC as the default UI and SQL Server as the default database provider.

Understanding the Database Provider Setup

When you create a layered ABP application, it automatically includes the BLOB Storing infrastructure with the Database Provider pre-configured. You can verify this by examining the module dependencies in your *Domain, *DomainShared, and *EntityFrameworkCore modules:

[DependsOn(
    //...
    typeof(BlobStoringDatabaseDomainModule) // <-- This is the Database Provider
    )]
public class BlobStoringDemoDomainModule : AbpModule
{
    //...
}

Since the Database Provider is already included through module dependencies, no additional configuration is required to start using it. The provider is ready to use out of the box.

However, if you're working with multiple BLOB storage providers or want to explicitly configure the Database Provider, you can add the following configuration to your *EntityFrameworkCore module's ConfigureServices method:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.ConfigureDefault(container => 
    {
        container.UseDatabase();
    });
});

Note: This explicit configuration is optional when using only one BLOB provider (Database Provider in this case), but becomes necessary when managing multiple providers or custom container configurations.

Running Database Migrations

Now, let's apply the database migrations to create the necessary BLOB storage tables. Run the DbMigrator project:

cd src/BlobStoringDemo.DbMigrator
dotnet run

Once the migration completes successfully, open your database management tool and you'll see two new tables:

Understanding the BLOB Storage Tables:

• AbpBlobContainers: Stores metadata about BLOB containers, including container names, tenant information, and any custom properties.

• AbpBlobs: Stores the actual BLOB content (the binary data) along with references to their parent containers. Each BLOB is associated with a container through a foreign key relationship.

When you save a BLOB, ABP automatically handles the database operations: the binary content goes into AbpBlobs, while the container configuration and metadata are managed in AbpBlobContainers.

Creating a File Management Service

Let's implement a practical application service that demonstrates common BLOB operations. Create a new application service class:

using System.Threading.Tasks;
using Volo.Abp.Application.Services;
using Volo.Abp.BlobStoring;

namespace BlobStoringDemo
{
    public class FileAppService : ApplicationService, IFileAppService
    {
        private readonly IBlobContainer _blobContainer;

        public FileAppService(IBlobContainer blobContainer)
        {
            _blobContainer = blobContainer;
        }

        public async Task SaveFileAsync(string fileName, byte[] fileContent)
        {
            // Save the file
            await _blobContainer.SaveAsync(fileName, fileContent);
        }

        public async Task<byte[]> GetFileAsync(string fileName)
        {
            // Get the file
            return await _blobContainer.GetAllBytesAsync(fileName);
        }

        public async Task<bool> FileExistsAsync(string fileName)
        {
            // Check if file exists
            return await _blobContainer.ExistsAsync(fileName);
        }

        public async Task DeleteFileAsync(string fileName)
        {
            // Delete the file
            await _blobContainer.DeleteAsync(fileName);
        }
    }
}

Here, we are doing the followings:

• Injecting the IBlobContainer service.
• Saving the BLOB data to the database with the SaveAsync method. (it allows you to use byte arrays or streams)
• Retrieving the BLOB data from the database with the GetAllBytesAsync method.
• Checking if the BLOB exists with the ExistsAsync method.
• Deleting the BLOB data from the database with the DeleteAsync method.

With this service in place, you can now manage BLOBs throughout your application without worrying about the underlying storage implementation. Simply inject IFileAppService wherever you need file operations, and ABP handles all the provider-specific details behind the scenes.

Also, it's good to highlight that, the beauty of this approach is provider independence: you can start with database storage and later switch to Azure Blob Storage, AWS S3, or any other provider without modifying a single line of your application code. We'll explore this powerful feature in the next section.

Switching Between Providers

One of the biggest advantages of using ABP's BLOB Storage system is the ability to switch providers without changing your application code.

For example, you might start with the File System provider during development and switch to Azure Blob Storage for production:

Development:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.ConfigureDefault(container =>
    {
        container.UseFileSystem(fileSystem =>
        {
            fileSystem.BasePath = Path.Combine(
                hostingEnvironment.ContentRootPath, 
                "Documents"
            );
        });
    });
});

Production:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.ConfigureDefault(container =>
    {
        container.UseAzure(azure =>
        {
            azure.ConnectionString = "your azure connection string";
            azure.ContainerName = "your azure container name";
            azure.CreateContainerIfNotExists = true;
        });
    });
});

Your application code remains unchanged! You just need to install the appropriate package and update the configuration. You can even use pragmas (for example: #if !DEBUG) to switch the provider at runtime (or use similar techniques).

Using Named BLOB Containers

ABP allows you to define multiple BLOB containers with different configurations. This is useful when you need to store different types of files using different providers. Here are the steps to implement it:

Step 1: Define a BLOB Container

[BlobContainerName("profile-pictures")]
public class ProfilePictureContainer
{
}

[BlobContainerName("documents")]
public class DocumentContainer
{
}

Step 2: Configure Different Providers for Each Container

Configure<AbpBlobStoringOptions>(options =>
{
    // Profile pictures stored in database
    options.Containers.Configure<ProfilePictureContainer>(container =>
    {
        container.UseDatabase();
    });

    // Documents stored in file system
    options.Containers.Configure<DocumentContainer>(container =>
    {
        container.UseFileSystem(fileSystem =>
        {
            fileSystem.BasePath = Path.Combine(
                hostingEnvironment.ContentRootPath, 
                "Documents"
            );
        });
    });
});

Step 3: Use the Named Containers

Once you have defined the BLOB Containers, you can use the IBlobContainer<TContainerType> service to access the BLOB containers:

public class ProfileService : ApplicationService
{
    private readonly IBlobContainer<ProfilePictureContainer> _profilePictureContainer;

    public ProfileService(IBlobContainer<ProfilePictureContainer> profilePictureContainer)
    {
        _profilePictureContainer = profilePictureContainer;
    }

    public async Task UpdateProfilePictureAsync(Guid userId, byte[] picture)
    {
        var blobName = $"{userId}.jpg";
        await _profilePictureContainer.SaveAsync(blobName, picture);
    }
}

With this approach, your documents and profile pictures are stored in different containers and different providers. This is useful when you need to store different types of files using different providers and need scalability and performance.

Conclusion

Managing BLOBs effectively is crucial for modern applications, and choosing the right storage approach depends on your specific needs.

ABP's BLOB Storing infrastructure provides a powerful abstraction that lets you start with one provider and switch to another as your requirements evolve, all without changing your application code.

Whether you're storing files in a database, file system, or cloud storage, ABP's BLOB Storing system provides a flexible and powerful way to manage your files.

In this article, we'll explore different authorization approaches in ASP.NET Core and examine how ABP's permission-based authorization system works.

First, we'll look at some of the core authorization types that come with ASP.NET Core, such as role-based, claims-based, policy-based, and resource-based authorization. We'll briefly review the pros and cons of each approach.

Then, we'll dive into ABP's Permission-Based Authorization System. This is a more advanced approach that gives you fine-grained control over what users can do in your application. We'll also explore ABP's Permission Management Module, which makes managing permissions through the UI easily.

Understanding ASP.NET Core Authorization Types

Before diving into permission-based authorization, let's examine some of the core authorization types available in ASP.NET Core:

• Role-Based Authorization checks if the current user belongs to specific roles (like "Admin" or "User") and grants access based on these roles. (For example, only users in the "Manager" role can access the employee salary management page.)

• Claims-Based Authorization uses key-value pairs (claims) that describe user attributes, such as age, department, or security clearance. (For example, only users with a "Department=Finance" claim can view financial reports.) This provides more granular control but requires careful claim management (such as grouping claims under policies).

• Policy-Based Authorization combines multiple requirements (roles, claims, custom logic) into reusable policies. It offers flexibility and centralized management, and this is exactly why ABP's permission system is built on top of it! (We'll discuss this in more detail later.)

• Resource-Based Authorization determines access by examining both the user and the specific item they want to access. (For example, a user can edit only their own blog posts, not others' posts.) Unlike policy-based authorization which applies the same rules everywhere, resource-based authorization makes decisions based on the actual data being accessed, requiring more complex implementation.

Here's a quick comparison of these approaches:

| Authorization Type | Pros | Cons | |-------------------|------|------| | Role-Based | Simple implementation, easy to understand | Becomes inflexible with complex role hierarchies | | Claims-Based | Granular control, flexible user attributes | Complex claim management, potential for claim explosion | | Policy-Based | Centralized logic, combines multiple requirements | Can become complex with numerous policies | | Resource-Based | Fine-grained per-resource control | Implementation complexity, resource-specific code |

What is Permission-Based Authorization?

Permission-based authorization takes a different approach from other authorization types by defining specific permissions (like "CreateUser", "DeleteOrder", "ViewReports") that represent granular actions within your application. These permissions can be assigned to users directly or through roles, providing both flexibility and clear action-based access control.

ABP Framework's permission system is built on top of this approach and extends ASP.NET Core's policy-based authorization system, working seamlessly with it.

ABP Framework's Permission System

ABP extends ASP.NET Core Authorization by adding permissions as automatic policies and allows the authorization system to be used in application services as well.

This system provides a clean abstraction while maintaining full compatibility with ASP.NET Core's authorization infrastructure.

ABP also provides a Permission Management Module that offers a complete UI and API for managing permissions. This allows you to easily manage permissions in the UI, assign permissions to roles or users, and much more. (We'll see how to use it in the following sections.)

Defining Permissions in ABP

In ABP, permissions are defined in classes (typically under the *.Application.Contracts project) that inherit from the PermissionDefinitionProvider class. Here's how you can define permissions for a book management system:

public class BookStorePermissionDefinitionProvider : PermissionDefinitionProvider
{
    public override void Define(IPermissionDefinitionContext context)
    {
        var bookStoreGroup = context.AddGroup("BookStore");

        var booksPermission = bookStoreGroup.AddPermission("BookStore.Books", L("Permission:Books"));
        booksPermission.AddChild("BookStore.Books.Create", L("Permission:Books.Create"));
        booksPermission.AddChild("BookStore.Books.Edit", L("Permission:Books.Edit"));
        booksPermission.AddChild("BookStore.Books.Delete", L("Permission:Books.Delete"));
    }

    private static LocalizableString L(string name)
    {
        return LocalizableString.Create<BookStoreResource>(name);
    }
}

ABP automatically discovers this class and registers the permissions/policies in the system. You can then assign these permissions/policies to users/roles. There are two ways to do this:

• Using the Permission Management Module
• Using the IPermissionManager service (via code)

Setting Permissions to Roles and Users via Permission Management Module

When you define a permission, it also becomes usable in the ASP.NET Core authorization system as a policy name. If you are using the Permission Management Module, you can manage the permissions through the UI:

In the permission management UI, you can grant permissions to roles and users through the Role Management and User Management pages within the "permissions" modals. You can then easily check these permissions in your code. In the screenshot above, you can see the permission modal for the user's page, clearly showing the permissions granted to the user by their role. ((R) in the UI indicates that the permission is granted by one of the current user's roles.)

Setting Permissions to Roles and Users via Code

You can also set permissions for roles and users programmatically. You just need to inject the IPermissionManager service and use its SetForRoleAsync and SetForUserAsync methods (or similar methods):

public class MyService : ITransientDependency
{
    private readonly IPermissionManager _permissionManager;

    public MyService(IPermissionManager permissionManager)
    {
        _permissionManager = permissionManager;
    }

    public async Task GrantPermissionForUserAsync(Guid userId, string permissionName)
    {
        await _permissionManager.SetForUserAsync(userId, permissionName, true);
    }

    public async Task ProhibitPermissionForUserAsync(Guid userId, string permissionName)
    {
        await _permissionManager.SetForUserAsync(userId, permissionName, false);
    }
}

Checking Permissions in AppServices and Controllers

ABP provides multiple ways to check permissions. The most common approach is using the [Authorize] attribute and passing the permission/policy name.

Here is an example of how to check permissions in an application service:

[Authorize("BookStore.Books")]
public class BookAppService : ApplicationService, IBookAppService
{
    [Authorize("BookStore.Books.Create")]
    public async Task<BookDto> CreateAsync(CreateBookDto input)
    {
        //logic here
    }
}

Notice that you can use the [Authorize] attribute at both class and method levels. In the example above, the CreateAsync method is marked with the [Authorize] attribute, so it will check the user's permission before executing the method. Since the application service class also has a permission requirement, both permissions must be granted to the user to execute the method!

And here is an example of how to check permissions in a controller:

[Authorize("BookStore.Books")]
public class CreateBookController : AbpController
{
    //omitted for brevity...
}

Programmatic Permission Checking

To conditionally control authorization in your code, you can use the IAuthorizationService service:

public class BookAppService : ApplicationService, IBookAppService
{
    public async Task<BookDto> CreateAsync(CreateBookDto input)
    {
        // Checks the permission and throws an exception if the user does not have the permission
        await AuthorizationService.CheckAsync(BookStorePermissions.Books.Create);
        
        // Your logic here
    }

    public async Task<bool> CanUserCreateBooksAsync()
    {
        // Checks if the permission is granted for the current user
        return await AuthorizationService.IsGrantedAsync(BookStorePermissions.Books.Create);
    }
}

You can use the IAuthorizationService's helpful methods for authorization checking, as shown in the example above:

• IsGrantedAsync checks if the current user has the given permission.
• CheckAsync throws an exception if the current user does not have the given permission.
• AuthorizeAsync checks if the current user has the given permission and returns an AuthorizationResult, which has a Succeeded property that you can use to verify if the user has the permission.

Also notice that we did not inject the IAuthorizationService in the constructor, because we are using the ApplicationService base class, which already provides property injection for it. This means we can directly use it in our application services, just like other helpful base services (such as ICurrentUser and ICurrentTenant).

Conclusion

Permission-based authorization in ABP Framework provides a powerful and flexible approach to securing your applications. By building on ASP.NET Core's policy-based authorization, ABP offers a clean abstraction that simplifies permission management while maintaining the full power of the underlying system.

The ability to check permissions in both application services and controllers makes ABP Framework's authorization system very flexible and powerful, yet easy to use.

Additionally, the Permission Management Module makes it very easy to manage permissions and roles through the UI. You can learn more about how it works in the documentation.

We are glad to announce that ABP 9.3 stable version has been released today.

What's New With Version 9.3?

All the new features were explained in detail in the 9.3 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 9.3

Creating New Solutions

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI to create new solutions.

Note: ABP Studio v1.2.1 has been released with support for ABP 9.3. If you already have ABP Studio installed, update it to v1.2.1 (or later, if available) to create new applications targeting 9.3. ABP Studio checks for updates automatically and will prompt you in-app modal to update to the latest version, or you can download the latest installer from the Studio page. See the upgrading guide for details. After updating, the New Solution wizard will create applications with ABP 9.3 by default. You can check the ABP Studio and ABP Startup Template Version Mappings documentation to see the corresponding ABP versions for other versions of Studio.

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v9.2: ABP Version 9.3 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Fahri Gedik has published 2 new articles:
  • A Modern Approach to Angular Dependency Injection using inject function
  • Angular Application Builder: Transitioning from Webpack to Esbuild
• Benjamin Fadina has published several videos on various topics such as Blazor Web Assembly Using ABP.IO, CQRS Implementation with MediatR in ABP and more. You can see all his videos here.
• Mansur Besleney has published How to Build Persistent Background Jobs with ABP Framework and Quartz
• Halil Ibrahim Kalkan has published Multitenancy with Separate Databases in .NET and ABP
• Alex Maiereanu has published ABP-Hangfire-AzurePostgreSQL
• Jack Fistelmann has published ABP and maildev
• Harsh Gupta has published How to Add a Module in the ABP.io Application?
• Tarık Özdemir has published AI-First Architecture for .NET Projects: A Modern Blueprint Inspired by McKinsey
• Liming Ma has published Using Hangfire Dashboard in ABP API Website

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 10.0. You can follow the release planning here. Please submit an issue if you have any problems with this version.

We are happy to release ABP version 9.3 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v9.3! Thanks to you in advance.

Get Started with the 9.3 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v9.2 or earlier: ABP Version 9.3 Migration Guide

What's New with ABP v9.3?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• Cron Expression Support for Background Workers
• Docs Module: PDF Export
• Angular UI: Standalone Package Structure
• Upgraded to Blazorise v1.7.7
• Audit Logging Module: Excel Export

Cron Expression Support for Background Workers

We've enhanced the Background Workers System by adding support for Cron expressions when using Hangfire or Quartz as the background worker manager. This new feature provides more flexibility in scheduling background tasks compared to the simple period-based timing system.

Now you can define complex scheduling patterns using standard Cron expressions. For example, you can schedule a task to run: "Every day at midnight", "Every Monday at 9 AM", or "First day of every month".

Here's how you can use it in your background worker:

public class MyPeriodicBackgroundWorker : AsyncPeriodicBackgroundWorkerBase
{
    public MyPeriodicBackgroundWorker(
        AbpAsyncTimer timer,
        IServiceScopeFactory serviceScopeFactory)
        : base(timer, serviceScopeFactory)
    {
        // You can either use Period for simple intervals
        Timer.Period = 600000; //10 minutes

        // 👇 or use CronExpression for more complex scheduling 👇
        CronExpression = "0 0/10 * * * ?"; //Run every 10 minutes
    }

    protected async override Task DoWorkAsync(
        PeriodicBackgroundWorkerContext context)
    {
        // Your background work...
    }
}

The CronExpression property takes precedence over the Period property when both are set. This feature is available when you use either the Hangfire or Quartz background worker managers.

See the Background Workers documentation for more information about configuring and using background workers with Cron expressions.

Docs Module: PDF Export

We're excited to introduce a new feature in the Docs Module that allows users to export documentation as PDF files. This feature makes it easier for users to access documentation offline or share it with team members who might not have immediate access to the online documentation system.

Administrators can generate PDF files from the back-office side:

and then a "Download PDF" button appears in the document system (as shown in the image below - the bottom right of the navigation menu -), allowing users to download the compiled documentation as a PDF file:

The feature supports multiple versions of documentation, different language variants, and ensures proper formatting of all content including code blocks and technical documentation.

Angular UI: Standalone Package Structure

ABP v9.3 introduces support for Angular's standalone components architecture while maintaining full compatibility with existing module-based applications. This update aligns with Angular's strategic direction toward standalone components as the recommended approach for building Angular applications.

The key improvements include:

• Dual-support routing configurations that work seamlessly with both module-based and standalone approaches
• ABP Suite integration for generating code that supports standalone components
• Updated schematics that provide templates for both development patterns

This enhancement gives developers the flexibility to choose their preferred Angular architecture. Existing module-based applications continue to work without modifications, while new projects can leverage the standalone approach for simplified dependency management, reduced boilerplate code, and better lazy-loading capabilities.

For developers interested in migrating to standalone components or starting new projects, we'll be publishing a comprehensive blog post with detailed guidance and best practices. In the meantime, you can check #22829 for implementation details of the standalone package structure and make the necessary changes to your project.

Upgraded to Blazorise v1.7.7

Upgraded the Blazorise library to v1.7.7 for Blazor UI. If you are upgrading your project to v9.3.0, please ensure that all the Blazorise-related packages are using v1.7.7 in your application. Otherwise, you might get errors due to incompatible versions.

See #23013 for the updated NuGet packages.

Audit Logging Module: Excel Export

In this version, we've added Excel export capabilities to the Audit Logging Module, allowing administrators to export audit logs and entity changes to Excel files for further analysis or reporting purposes.

This feature enables users to:

• Export audit logs with filtering options
• Export entity changes with detailed information
• Receive email notifications when exports are completed or fail
• Download exported files via secure links

The export process runs in the background, and once completed, users receive an email with a download link. This approach ensures that even large audit log exports don't block the UI or time out during processing.

You can configure various aspects of this feature using the AuditLogExcelFileOptions in your module's configuration:

Configure<AuditLogExcelFileOptions>(options =>
{
    // How long to keep exported files before cleanup
    options.FileRetentionHours = 48;
    
    // Base URL for download links in notification emails
    options.DownloadBaseUrl = "https://yourdomain.com";
    
    // Configure the cleanup worker schedule
    options.ExcelFileCleanupOptions.Period = (int)TimeSpan.FromHours(24).TotalMilliseconds;
    
    // Use cron expression for more advanced scheduling (requires Hangfire or Quartz)
    options.ExcelFileCleanupOptions.CronExpression = "0 2 * * *"; // Run at 2 AM daily
});

The module includes pre-configured email templates for notifications about completed or failed exports, ensuring users are always informed about the status of their export requests.

Note: This feature requires a configured BLOB storage provider to store the generated Excel files. See the BLOB Storing documentation for more information.

For more details about the Audit Logging Module and its Excel export capabilities, please refer to the official documentation.

Community News

Announcing ABP Studio 1.0 General Availability 🚀

We are thrilled to announce that ABP Studio has reached version 1.0 and is now generally available! This marks a significant milestone for our integrated development environment designed specifically for ABP developers. The stable release brings several powerful features including:

• Enhanced Solution Runner with health monitoring capabilities
• Theme style selection during project creation (Basic, LeptonX Lite, and LeptonX Themes)
• New "Container" application type for better Docker container management
• Improved handling of multiple DbContexts for migration operations

For a detailed overview of these features and to learn more about what's coming next, check out our announcement post.

ABP Community Talks 2025.05: Empower Elsa Workflows with AI in .NET + ABP Framework

In this episode of ABP Community Talks, 2025.05, we are thrilled to host Sipke Schoorstra, the creator of the Elsa Workflows library! This month's session is all about "Empower Elsa Workflows with AI in .NET + ABP Framework".

Sipke will join us to demonstrate how you can leverage AI within Elsa Workflows using .NET and the ABP Framework. The session will explore practical techniques and showcase how to integrate AI capabilities to enhance and automate your business processes within the Elsa workflow engine.

👉 Don't miss this opportunity to learn directly from the creator of Elsa and see real-world examples of building intelligent, automated workflows! You can register from here.

ABP Bootcamp: Mastering Infrastructure & Features

We are excited to announce the very first ABP Bootcamp: Mastering Infrastructure & Features! This is a live training program designed to give you hands-on, practical experience with ABP's core infrastructure and features.

Join the ABP Bootcamp to learn directly from the core team in a focused, hands-on program designed for busy developers. Over four days, you'll gain a deep understanding of ABP's infrastructure, best practices, and practical skills you can immediately apply to your projects.

Seats are limited! Don't miss this opportunity to level up your ABP skills with direct guidance from the experts.

👉 See full details and reserve your seat!

New ABP Community Articles

There are exciting articles contributed by the ABP community as always. I will highlight some of them here:

• Prabhjot Singh has published 3 new articles:
  • Accessing Multiple Remote ABP based Backends Using HttpApi.Client
  • Adopting the new .slnx format to organize applications and services
  • Replacing Dynamic client proxies with Static client proxies
• Liming Ma has published 2 new articles:
  • Resolving Tenant from Route in ABP Framework
  • Integrating .NET AI Chat Template with ABP Framework
• Engincan Veske has published 2 new articles:
  • Understanding HttpApi.Client Project & Remote Services in an ABP Based Application
  • Using Elsa 3 with the ABP Framework: A Comprehensive Guide
• Enis Necipoğlu has published 2 new articles:
  • White Labeling in ABP Framework by Enis Necipoğlu
  • You do it wrong! Customizing ABP Login Page Correctly
• New in ABP Studio: Docker Container Management by Yunus Emre Kalkan
• Solving MongoDB GUID Issues After an ABP Framework Upgrade by Burak Demir

Thanks to the ABP Community for all the content they have published. You can also post your ABP-related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v9.3 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

It's the moment you've been waiting for! We are thrilled to announce the stable release of ABP Studio v1.0. This milestone marks a significant step forward in our mission to provide a first-class, integrated development environment for ABP developers. Paired with the recently released ABP v9.2, ABP Studio v1.0 brings new features and improvements that will make your development work faster and more efficient.

For the past several months, our core ABP team has been hard at work, focusing on the features that matter most to you, our community of developers. This release is the peak of that effort, bringing a host of improvements and new capabilities to the forefront. Let's dive in and explore what's new in ABP Studio v1.0.

What's New with ABP Studio v1.0?

ABP Studio v1.0 is all about enhancing your development experience, from project creation to deployment. Here, we'll walk you through some of the latest features we've implemented, along with other key enhancements that make this release truly special.

❤️ Solution Runner with Ready/Health Checks

ABP Studio's Solution Runner now provides visual health monitoring that makes tracking your applications' status easily. When you start an application, a spinner indicates it's "starting", then in the Overall tab, you can see the application's health (✅ for healthy, ⚠️ for unhealthy) that displays real-time health status:

With pre-configured health checks in ABP solution templates including database connectivity tests, you get instant feedback on your applications' health.

When health check UI is configured, you can access comprehensive health dashboards with a dedicated "Browse Health UI" command or see the last health response from the "Show Latest Health Check Response" command:

When you restart applications that are open in your browser, ABP Studio automatically refreshes the pages for you.

🎨 Theme Style Selection on Project Creation

When creating a new solution, you can now choose your theme, theme style, and layout right from the project creation wizard instead of having to configure these settings later. ABP Studio lets you pick from ABP's officially provided themes including Basic, LeptonX Lite, and LeptonX.

If you select Basic or LeptonX Lite themes, only the theme will be changed. However, if you select the LeptonX theme, you'll get additional options to fine-tune your setup:

• Theme Style Configuration - Pick from System, Light, Dim, or Dark styles to match how you like your development environment
• Layout Options - Sidebar menu / Top menu

📦 "Container" Application Type for Solution Runner

ABP Studio v1.0 introduces a dedicated "Container" application type that gives you better control over your Docker containers directly from the Solution Runner. Instead of managing all your containers through PowerShell scripts or running them all together, you can now see and control each container individually in the Solution Runner panel.

This new feature replaces the previous Infrastructure folder approach with a cleaner, more intuitive container section. You can now:

• Start and stop containers individually - No more starting all containers at once when you only need specific services
• Monitor container status - See which containers are running, stopped, or have issues directly in the UI
• Manage container dependencies - Control the order and timing of container startup based on your application needs

Whether you're working with databases, message brokers, or other containerized services, the new Container application type makes it much easier to manage your development environment. This is especially useful for microservice architectures where you might want to run only specific services during development or testing.

⚙️ Handle Multiple DbContexts When Adding/Removing/Applying Migrations

When working with ABP solutions that have multiple DbContexts (such as when using the separate tenant database option), ABP Studio now intelligently prompts you to select the appropriate DbContext for migration operations. This enhancement ensures you're always working with the correct database context and helps prevent common mistakes when managing multiple databases.

The context selection dialog appears automatically when you perform any of these Entity Framework operations:

• Adding a new migration - Choose which DbContext the new migration should target
• Removing an existing migration - Select the DbContext from which to remove the migration
• Updating the database - Specify which database context should be updated

Get Started with ABP Studio v1.0 Today!

ABP Studio v1.0 is built on the solid foundation of the latest version of ABP Framework, which is v9.2. This means that when you create a new project with ABP Studio, you're getting all the latest features, performance improvements, and bug fixes that come with v9.2. This includes updates to dependencies, enhancements to the core framework, and improvements to application modules.

We are incredibly excited for you to get your hands on ABP Studio v1.0. We believe these new features will make a real difference in your day-to-day development workflow.

⬇️ Download ABP Studio 1.0

Ready to get started? You can download the stable v1.0 release right now from the official ABP Studio website: https://abp.io/studio

If you are an existing ABP Studio user, it's even easier. You don't need to download the installer again. Simply launch ABP Studio, and it will prompt you to update to the latest version directly from the UI.

Alternatively, you can click to the Help -> Check for Updates context menu item to check for updates and install the latest version:

🔮 What's Next?

ABP Studio v1.0 represents just the beginning of our journey. We're committed to continuously evolving the platform, adding features that directly address real-world development challenges and enhance your workflow. Our goal is to make ABP Studio the go-to development environment for .NET and ABP Framework developers.

We will keep releasing new versions with exciting features based on our roadmap and your valuable feedback. To give you a sneak peek into what's planned for future releases, you can expect to see:

• Environment Variable Management: A dedicated UI to easily manage environment variables for your solutions.
• OpenTelemetry Integration: We'll be integrating OpenTelemetry support directly into the startup templates, making distributed tracing and observability a seamless part of your application from day one.
• LeptonX Theme Builder: Allowing users to determine styling, colour palette and easily override their project's theme styles.
• Monitor dashboards of the tools used in the solution (e.g. Kubernetes, Redis, Grafana, etc...)
• Pre-configured Aspire for the Microservice Startup Template
• and more...

We are incredibly excited about the future of ABP Studio and can't wait to share the next set of features with you. Your comments and suggestions are invaluable to us. If you have any feedback, please drop a comment below.

Thank you for being part of our community and happy coding!

The Volosoft Team

We are glad to announce that ABP 9.2 stable version has been released today.

What's New With Version 9.2?

All the new features were explained in detail in the 9.2 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 9.2

Creating New Solutions

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI to create new solutions.

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v9.x: ABP Version 9.2 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• Liming Ma has published 3 new articles:
  • Integrating .NET AI Chat Template with ABP Framework
  • Resolving Tenant from Route in ABP Framework
  • Common Errors in JWT Bearer Authentication
• Engincan Veske has published 3 new articles:
  • Understanding HttpApi.Client Project & Remote Services in an ABP Based Application
  • Using Elsa 3 with the ABP Framework: A Comprehensive Guide
  • Implementing Custom Tenant Logo Feature in ABP Framework: A Step-by-Step Guide
• Berkan Şaşmaz has published 2 new articles:
  • Understanding the Domain and Application Layers in ABP Framework
  • How Do We Maintain Code Quality and Technical Debt in Our .NET Codebase?
• Enis Necipoğlu has published 2 new articles:
  • White Labeling in ABP Framework by Enis Necipoğlu
  • You do it wrong! Customizing ABP Login Page Correctly
• Ariful Islam has published 2 new articles:
  • Multi-Workspace Management for ABP Applications
  • Using Semantic Kernel in the ABP Framework
• Guide to Add Custom Modules in ABP.IO App by Harsh Gupta
• Debugging NuGet Packages in ABP.IO: A Complete Guide by Suhaib Mousa
• Using Microsoft AI Extensions Library and OpenAI to Summarize User Comments by Halil Ibrahim Kalkan

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

About the Next Version

The next feature version will be 9.3. You can follow the release planning here. Please submit an issue if you have any problems with this version.

In this two-part series, we'll explore how to build modern web applications that can listen to users and intelligently process their input.

Series Overview:

• Part 1 (this article): Implementing speech-to-text functionality using the Web Speech API
• Part 2 (coming next): Using .NET Smart Components to intelligently fill forms with AI

In this first part, we'll explore how to use speech recognition with the Web Speech API to convert spoken words into text within a Blazor WebAssembly application.

Web Speech API is a powerful browser-based interface that enables web applications to handle voice data, providing both speech recognition (converting spoken words to text) and speech synthesis (converting text to speech) capabilities. While the API is well-supported in modern browsers like Chrome, Edge, and Firefox, it's worth noting that Safari has limited support through the webkit prefix.

Let's dive into implementing this functionality in our Blazor application.

Building Our Speech Recognition Demo

Let's walk through the step-by-step process of creating our voice-enabled Blazor application.

Step 1: Create a New Blazor WASM (WebAssembly) Project

Start by creating a new Blazor WASM application using the .NET CLI:

dotnet new blazorwasm -n VoiceRecognitionDemo

This command creates a new Blazor WASM project with all the necessary scaffolding and dependencies.

Step 2: Implementing the Web Speech API Integration

The Web Speech API provides powerful speech recognition capabilities directly in the browser. We'll create a JavaScript file to handle the speech recognition functionality and provide a clean interface for our Blazor components.

2a. Speech Recognition Using Web Speech API

First, create a new folder structure for our JavaScript files. In your project's wwwroot folder, create a js directory and add a new file called speech-recognition.js:

window.speechRecognizer = {
    recognition: null,
    startRecognition: function (dotNetObject) {
        const SpeechRecognition = window.SpeechRecognition || window.webkitSpeechRecognition;

        if (!SpeechRecognition) {
            alert("Speech recognition not supported in this browser."); //for Safari
            return;
        }

        const recognition = new SpeechRecognition();
        recognition.lang = 'en-US';
        recognition.interimResults = false;
        recognition.maxAlternatives = 1;

        recognition.onresult = function (event) {
            const text = event.results[0][0].transcript;
            dotNetObject.invokeMethodAsync('OnSpeechRecognized', text);
        };

        recognition.onerror = function (event) {
            console.error("Speech recognition error:", event.error);
        };

        recognition.start();
        window.speechRecognizer.recognition = recognition;
    },
    stopRecognition: function () {
        if (window.speechRecognizer.recognition) {
            window.speechRecognizer.recognition.stop();
        }
    },
    resetRecognition: function () {
        window.speechRecognizer.recognition = null;
    }
};

This JavaScript code provides several key features:

• Browser compatibility detection: Handles both standard and webkit-prefixed versions of the Speech Recognition API
• Language configuration: Set to English (US) by default, but easily configurable
• Error handling: Gracefully handles browsers that don't support speech recognition (like Safari)
• Callback integration: Uses .NET's JavaScript interop to communicate results back to our Blazor component (dotNetObject.invokeMethodAsync('OnSpeechRecognized', text);)

2b. Adding the Script to the Project

Next, we need to include our JavaScript file in the application. Add the following script reference to your wwwroot/index.html file, just before the closing </body> tag:

<script src="js/speech-recognition.js"></script>

Step 3: Building the Blazor Component

Open the Home.razor file and replace its content with the following comprehensive implementation:

@page "/"
@inject IJSRuntime JS
@implements IDisposable

<h3>Speech to Text</h3>

<div class="row">
    <div class="col">
        @if (!isListening)
        {
            <button @onclick="StartSpeechRecognition" class="btn btn-primary">🎤 Start Speaking</button>
        }
        else
        {
            <button @onclick="StopSpeechRecognition" class="btn btn-danger">🚫 Stop Speaking</button>
        }

        <div class="row mt-3">
            <div class="col">
                <p><strong>Recognized Text:</strong></p>
                <textarea class="form-control" rows="3" readonly>@recognizedText</textarea>
            </div>
        </div>
    </div>
</div>

@code {
    private string recognizedText = "";
    private bool isListening = false;

    private DotNetObjectReference<Home>? objRef;

    protected override void OnInitialized()
    {
        objRef = DotNetObjectReference.Create(this);
    }

    private async Task StartSpeechRecognition()
    {
        await JS.InvokeVoidAsync("speechRecognizer.startRecognition", objRef);
        isListening = true;
    }

    [JSInvokable]
    public Task OnSpeechRecognized(string text)
    {
        recognizedText = text;
        StateHasChanged();
        return Task.CompletedTask;
    }

    public async Task StopSpeechRecognition()
    {
        isListening = false;
        await JS.InvokeVoidAsync("speechRecognizer.stopRecognition");
    }

    public void Dispose()
    {
        objRef?.Dispose();
    }
}

Let's break down the key components of our Blazor implementation:

• State management: We track the application state using two fields:

  private string recognizedText = ""; // Stores the converted speech text
  private bool isListening = false;   // Tracks if we're actively listening
  

• JavaScript interop: We use IJSRuntime to call our JavaScript functions:

  private async Task StartSpeechRecognition()
  {
      await JS.InvokeVoidAsync("speechRecognizer.startRecognition", objRef);
      isListening = true;
  }
  

• Callback handling: The [JSInvokable] attribute enables JavaScript to call back into our code:

  [JSInvokable]
  public Task OnSpeechRecognized(string text)
  {
      recognizedText = text;
      StateHasChanged();
      return Task.CompletedTask;
  }
  

• Resource cleanup: We implement IDisposable to properly clean up the JavaScript reference:

  private DotNetObjectReference<Home>? objRef;
  
  public void Dispose()
  {
      objRef?.Dispose();
  }
  

• Reactive UI: The component automatically updates when speech is recognized:

  // In OnSpeechRecognized:
  recognizedText = text;      // Update the text
  StateHasChanged();          // Trigger UI refresh
  

Step 4: Testing Your Application

Once you've implemented all the components, run your application:

dotnet run

When you navigate to the application and click the "🎤 Start Speaking" button, you'll see the interface change to show a "🚫 Stop Speaking" button, indicating that the application is actively listening for your voice input. As you speak, the recognized text will appear in the textarea below the buttons.

The application provides a smooth user experience with clear visual feedback about the current state of speech recognition.

What's Next?

In Part 2 of this series, we'll enhance our speech recognition implementation with AI capabilities using .NET Smart Components. We'll explore how to intelligently parse the recognized speech and automatically fill form fields, creating truly intelligent user interfaces that understand context and intent.

Stay tuned for the next part where we'll transform simple speech-to-text into intelligent form completion!

We are happy to release ABP version 9.2 RC (Release Candidate). This blog post introduces the new features and important changes in this new version.

Try this version and provide feedback for a more stable version of ABP v9.2! Thanks to you in advance.

Get Started with the 9.2 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v9.x or earlier: ABP Version 9.2 Migration Guide

What's New with ABP v9.2?

In this section, I will introduce some major features released in this version. Here is a brief list of titles explained in the next sections:

• Added ApplicationName Property to Isolate Background Jobs & Background Workers
• Docs Module: Added "Alternative Words" to Filter Items
• Introducing the Bunny BLOB Storage Provider
• Upgraded MongoDB.Driver to v3.1.0
• Using Timezone Settings to Display Datetime
• Identity Pro Module: Require Email Verification to Register
• Switching users during OAuth login

Added ApplicationName Property to Isolate Background Jobs & Background Workers

ABP's Background Jobs Module has been enhanced with a new ApplicationName property that helps isolate jobs and workers across multiple applications sharing the same database.

Previously, when different applications used the BackgroundJobs module and shared a database, an application might encounter jobs that didn't belong to it. This would lead to failed processing attempts and marking jobs as IsAbandoned = true with a "Undefined background job for the job name" error, preventing these jobs from ever being executed.

With the new ApplicationName property, applications now properly filter jobs at the repository level, ensuring each application only processes job types it recognizes. This prevents the incorrect abandonment of jobs and ensures consistent behavior in multi-application scenarios.

You can set ApplicationName of AbpBackgroundJobWorkerOptions to your application name to isolate jobs and workers across multiple applications sharing the same database:

public override void PreConfigureServices(ServiceConfigurationContext context)
{
    PreConfigure<AbpBackgroundJobWorkerOptions>(options =>
    {
        options.ApplicationName = context.Services.GetApplicationName()!;
    });
}

For more information, please refer to the Background Jobs Module documentation and the PR that added this feature.

Docs Module: Added "Alternative Words" to Filter Items

ABP's Docs Module now supports "alternative words" to enhance the search functionality when filtering documentation items. This feature addresses a common user experience issue where users might search using terminology different from what appears in the documentation.

For example, when a user searches for "Error" in the documentation, they may actually be looking for content related to "Exception Handling." With this new feature, documentation items can now be configured with alternative keywords that are considered during filtering.

The implementation allows defining optional "keywords" for items in the navigation tree. For example:

{
  "text": "Exception Handling",
  "path": "framework/fundamentals/exception-handling.md",
  "keywords": ["Error", "Another Value"]
}

When users search or filter content, the system now considers both the original text and these alternative keywords, improving discoverability of relevant documentation sections. This enhancement makes the documentation more accessible and user-friendly, especially for newcomers who might not be familiar with the exact terminology used in the ABP documentation.

Introducing the Bunny BLOB Storage Provider

ABP v9.2 RC introduces a new BLOB storage provider for Bunny Storage, a global edge storage solution. This addition expands ABP's BLOB Storage options beyond the existing providers like Azure, AWS, and others.

The Bunny BLOB Storage Provider allows ABP applications to seamlessly integrate with Bunny's CDN-backed storage service, which offers high-performance content delivery through its global network.

To use this new provider, you'll need to:

• Run abp add-package Volo.Abp.BlobStoring.Bunny command.
• And then configure the provider in your module's ConfigureServices method:

Configure<AbpBlobStoringOptions>(options =>
{
    options.Containers.ConfigureDefault(container =>
    {
        container.UseBunny(bunny =>
        {
            bunny.StorageZoneName = "your-storage-zone";
            bunny.ApiKey = "your-api-key";
            bunny.Region = "your-region"; // de, ny, la, sg, or sy
        });
    });
});

This integration provides ABP applications with an efficient and globally distributed storage solution, particularly beneficial for applications requiring fast content delivery across different geographical regions. To use this new provider and make the related configurations, you can refer to the Bunny Storage Provider documentation always.

This new BLOB Storage provider is contributed by @suhaib-mousa. Thanks to him for his contribution! We are always happy to see the community contributing to the ABP Framework and encouraging them to contribute more.

Upgraded MongoDB.Driver to v3.1.0

ABP v9.2 RC includes an upgrade to MongoDB.Driver version 3.1.0. This significant version bump from previous releases brings several improvements and new features that benefit ABP applications using MongoDB as their database.

The upgrade provides:

• Async/Await Support: Write non-blocking, asynchronous code easily.
• Fluent API: Build queries and updates intuitively with Builders.
• LINQ Support: Use LINQ for querying MongoDB collections.
• and more ...

For more information, please refer to the MongoDB.Driver release notes.

We have prepared a migration guide for this upgrade. Please refer to it to learn more about the changes and how to migrate your application.

Using Timezone Settings to Display Datetime

A significant enhancement in ABP v9.2 is the ability to use timezone settings to display DateTime values according to the user's or application's configured timezone. Introduced in v9.2.0-rc.2, this feature addresses the common challenge of ensuring users see accurate time information, regardless of their geographical location.

Previously, DateTime values were often shown in the server's timezone or in UTC, which could cause confusion for users in different timezones. With this new feature, ABP applications can now respect the configured timezone and automatically convert and display datetime values accordingly.

Before setting the timezone:

Consider a scenario where you have a list of books, and the CreationTime property is displayed without any timezone consideration. It may appear in the server's default timezone:

(Screenshot of a Books page showing the CreationTime in a default timezone.)

Setting the timezone:

To set the timezone, start by configuring the AbpClockOptions in your module's ConfigureServices method:

Configure<AbpClockOptions>(options =>
{
    options.Kind = DateTimeKind.Utc;
});

By setting the Kind property of AbpClockOptions to DateTimeKind.Utc, ABP will normalize all datetime values. Times stored in the database and returned to the frontend will be in UTC. Additionally, the SupportsMultipleTimezone property of the IClock service will be true, and you’ll be able to configure the timezone from the UI under the Settings page.

After setting the Kind property, you can run your application and configure the timezone from the UI under the Settings page. For example, set the timezone to "Asia/Tokyo (+09:00)":

(Screenshot showing the configuration setting for Abp.Timing.TimeZone, set to "Asia/Tokyo (+09:00)".)

ABP provides the Abp.Timing.TimeZone setting, which allows you to configure the desired timezone at the application, tenant, or user level and this setting can be configured in the UI under the Settings page, inside of the Time Zone tab.

After setting the timezone:

Once the timezone is configured, ABP automatically handles the conversion and display of DateTime values. The CreationTime on the Books page will now be shown in the "Asia/Tokyo" timezone.

(Screenshot of the Books page after setting the timezone, showing the CreationTime adjusted to the "Asia/Tokyo" timezone.)

This feature utilizes the IClock service, which provides methods like ConvertToUserTime and ConvertToUtc to facilitate timezone conversions. By configuring the Abp.Timing.TimeZone setting, developers can ensure a consistent and user-friendly experience across applications with a global user base.

For a more detailed guide on implementing and using this feature, refer to the article: Developing a Multi-Timezone Application Using the ABP Framework. It offers step-by-step instructions and examples for handling multi-timezone scenarios in ABP applications.

Identity Pro Module: Require Email Verification to Register

ABP Identity Pro module has been enhanced with a new feature that allows administrators to require email verification during the registration process. This security improvement ensures that users must verify their email addresses before their registration is considered complete. Enabling this feature is especially important for applications that want to prevent spam registrations.

Administrators can enable or disable this feature through the Identity management -> Identity Verification (tab) settings page (by checking the Enforce email verification to register checkbox):

Switching users during OAuth login

If you have an OAuth/Auth Server application using the ABP Account Pro module , you can pass the prompt=select_account parameter to force the user to select an account.

For more information, please refer to the Switching users during OAuth login documentation.

New ABP Community Articles

There are exciting articles contributed by the ABP community as always. I will highlight some of them here:

• Implementing CQRS with MediatR in ABP by Engincan Veske
• Using Vue Components in a Razor Pages ABP Application by Enis Necipoglu
• Using ABP's AWS Blob Storing Provider with DigitalOcean Spaces by Suhaib Mousa
• Video Post: Using Vue Components in a Razor Pages ABP Application by Enis Necipoglu
• Understanding the Embedded Files in ABP Framework by Liming Ma
• How to Change the CurrentUser in ABP? by Engincan Veske

Thanks to the ABP Community for all the content they have published. You can also post your ABP-related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v9.2 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

ABP Framework provides a powerful service for accessing information about the currently authenticated user in your application. Understanding how to use and modify this service (ICurrentUser) is essential for both basic and certain advanced scenarios.

In this article, we'll explore the CurrentUser service, its use cases, and how to change it when necessary.

🛠 Liked this post? I now share all my content on Substack — real-world .NET, AI, and scalable software design. 👉 Subscribe here → engincanveske.substack.com 🎥 Also, check out my YouTube channel for hands-on demos and deep dives: https://www.youtube.com/@engincanv

Understanding the ICurrentUser Service

The ICurrentUser interface is the primary service in ABP Framework for obtaining information about the logged-in user. It provides some key properties, such as Id, UserName, TenantId, Roles (roleNames), and more...

ICurrentUser is implemented on the ICurrentPrincipalAccessor service and works with claims as well. So, all of these properties are actually retrieved from the claims. ICurrentUser has some methods to directly work with the claims, such as:

• FindClaim (finds a single claim by name)
• FindClaims (gets all claims with the given name)
• IsInRole (checks if the user has a specific role)
• GetAllClaims (gets all claims of the user)

Where the CurrentUser Service is Used?

The CurrentUser service is used extensively throughout ABP applications whenever there's a need to access information about the logged-in user. Common scenarios include: authorization checks, logging, setting common properties like CreatorId, LastModifierId, DeleterId, and more...

When to Change the CurrentUser Service?

While the CurrentUser service works automatically in the context of HTTP requests (it gets the User property of the current HttpContext), there are advanced scenarios where you might need to manually set or change the current user:

1. Background workers: When executing code outside the context of a user request
2. Event handlers: When processing events that may run in a different context
3. Unit & integration tests: When simulating a user for testing purposes

How to Change the CurrentUser Service?

If you need to change the CurrentUser service, you can inject the ICurrentPrincipalAccessor service, use its Change method to change the current user, and then use the CurrentUser service as usual.

Here's how to change the current user for a specific scope:

using System.Security.Claims;
using System.Threading.Tasks;
using Volo.Abp.DependencyInjection;
using Volo.Abp.EventBus.Distributed;
using Volo.Abp.Identity;
using Volo.Abp.Security.Claims;

namespace MyProject.Products;

public class ProductEventHandler : IDistributedEventHandler<OrderPlacedEto>, ITransientDependency
{
    private readonly IProductRepository _productRepository;
    private readonly ICurrentPrincipalAccessor _currentPrincipalAccessor;
    private readonly IdentityUserManager _userManager;

    public ProductEventHandler(
        IProductRepository productRepository,
        ICurrentPrincipalAccessor currentPrincipalAccessor,
        IdentityUserManager userManager
    )
    {
        _productRepository = productRepository;
        _currentPrincipalAccessor = currentPrincipalAccessor;
        _userManager = userManager;
    }

    public async Task HandleEventAsync(OrderPlacedEto eventData)
    {
        var product = await _productRepository.FindAsync(eventData.ProductId);
        if (product == null)
        {
            return;
        }
        
        //Get the admin user
        var adminUser = await _userManager.FindByNameAsync("admin");
        if (adminUser == null)
        {
            return;
        }

        var newPrincipal = new ClaimsPrincipal(new ClaimsIdentity(
            new Claim[] { 
                new Claim(AbpClaimTypes.UserId, adminUser.Id.ToString()),
                new Claim(AbpClaimTypes.UserName, "admin"),
            }));
        
        //IMPORTANT: It will set the CreatorId, LastModifierId, etc. with the admin user
        using (_currentPrincipalAccessor.Change(newPrincipal))
        {
            product.StockCount -= eventData.Quantity;

            // Update the product
            await _productRepository.UpdateAsync(product);
        }
    }
}

In this example, we have a distributed event handler that processes an OrderPlacedEto event. When an order is placed, we need to update the product's stock count. However, we want this operation to be performed under an admin user's context for auditing purposes.

Here's what the code does step by step:

1. First, it retrieves the product using the product ID from the event data.
2. Then, it finds the admin user by username using the _userManager.FindByNameAsync("admin").
3. A new ClaimsPrincipal is created with the admin user's claims (UserId and UserName).
4. Using the _currentPrincipalAccessor.Change() method within a using statement, it temporarily changes the current user context to the admin user.
5. Inside this scope, it updates the product's stock count by subtracting the ordered quantity.
6. Finally, it saves the changes to the database using the repository.

The important part here is that any audit properties (like CreatorId, LastModifierId, etc.) will be set to the admin user's ID because we changed the current principal. Once the using block ends, the original user context is automatically restored.

This pattern is particularly useful in background jobs, event handlers, or any scenario where you need to perform operations under a specific user's context, regardless of the actual authenticated user.

🛠 Liked this post? I now share all my content on Substack — real-world .NET, AI, and scalable software design. 👉 Subscribe here → engincanveske.substack.com 🎥 Also, check out my YouTube channel for hands-on demos and deep dives: https://www.youtube.com/@engincanv

Conclusion

The CurrentUser service in ABP Framework provides a simple way to access information about the authenticated user. While it works automatically in most scenarios, there are cases where you need to explicitly change the current user identity, particularly in background processing scenarios.

By using the ICurrentPrincipalAccessor.Change() method within a using statement, you can temporarily change the current user for a specific scope of execution, enabling your background processes, event handlers, or tests to execute with the identity of a specific user.

We are glad to announce that ABP 9.1 stable version has been released today.

What's New With Version 9.1?

All the new features were explained in detail in the 9.1 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 9.1

Creating New Solutions

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI to create new solutions.

By default, ABP Studio uses stable versions to create solutions. Therefore, it will be creating the solution with the latest stable version, which is v9.1 for now, so you don't need to specify the version.

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version to align it with ABP v9.1. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Upgrade ABP Packages action button to instantly upgrade your solution:

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v9.0: ABP Version 9.1 Migration Guide

Community News

New ABP Community Articles

As always, exciting articles have been contributed by the ABP community. I will highlight some of them here:

• URL-Based Localization by Alper Ebiçoğlu
• Building a CRUD API with ABP Framework, ASP.NET Core, and PostgreSQL by Berkan Şaşmaz
• Encryption and Decryption in ABP Framework by Liming Ma
• Migrate Your DB from the Web Application - Adding a DB Migration Controller by Alper Ebiçoğlu
• Containerization: Blazor WASM + JWT Web API => Docker by Bart Van Hoey
• Configuring Post-Logout Redirect URI in ABP Based Blazor Applications with OpenIddict by Engincan Veske

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

ABP Community Talks 2025.2: Real World Problems and Solutions with AI

In this episode of ABP Community Talks (2025.2), Decision Tree joined us to explore how AI is being leveraged to solve real-world problems, showcasing a practical use case of AI applications.

You can re-watch the talk from here.

About the Next Version

The next feature version will be 9.2. You can follow the release planning here. Please submit an issue if you have any problems with this version.

ABP's OpenIddict Module provides an integration with the OpenIddict library, which provides advanced authentication features like single sign-on, single log-out, and API access control.

OpenIddict provides an event-driven model (event models) that allows developers to customize authentication and authorization processes. This event model enables handling actions such as user sign-in, sign-out, token validation, and request handling dynamically.

In this article, we will explore OpenIddict event models, their key use cases, and how to implement them effectively.

🛠 Liked this post? I now share all my content on Substack — real-world .NET, AI, and scalable software design. 👉 Subscribe here → engincanveske.substack.com 🎥 Also, check out my YouTube channel for hands-on demos and deep dives: https://www.youtube.com/@engincanv

Understanding OpenIddict Event Model

OpenIddict events are primarily used within the OpenIddict server component. These events provide hooks into the OpenID Connect flow, allowing developers to modify behavior at different stages of authentication & authorization processes.

They are triggered during critical moments such as:

• User authentication (sign-in)
• Session termination (sign-out)
• Token validation and generation
• Request processing
• Error handling

OpenIddict provides multiple server events, under the OpenIddictServerEvents static class to make them easier to find (also provides additonal validation events under the OpenIddictValidationEvents static class).

Here are some of the pre-defined OpenIddictServerEvents:

Each event represents a specific checkpoint in the request processing pipeline, such as validating an OpenID Connect request, extracting request parameters, processing the request, or generating a response. As an application developer, you simply need to create event handlers that subscribe to these predefined events to implement your custom logic at the desired pipeline stage.

Example: How to add custom logic when a user signs out?

Let's walkthrough a practical example of implementing custom sign-out logic using OpenIddict events.

Step 1: Create a Custom Event Handler

First, create a handler that implements IOpenIddictServerHandler<OpenIddictServerEvents.ProcessSignOutContext>:

using System.Threading.Tasks;
using OpenIddict.Server;

namespace MySolution;

public class SignOutEventHandler : IOpenIddictServerHandler<OpenIddictServerEvents.ProcessSignOutContext>
{
    public static OpenIddictServerHandlerDescriptor Descriptor { get; }
        = OpenIddictServerHandlerDescriptor.CreateBuilder<OpenIddictServerEvents.ProcessSignOutContext>()
            .UseSingletonHandler<SignOutEventHandler>()
            .SetOrder(100_000)
            .SetType(OpenIddictServerHandlerType.Custom)
            .Build();
    
    public ValueTask HandleAsync(OpenIddictServerEvents.ProcessSignOutContext context)
    {
        // Implement your custom sign-out logic here

        // Examples:
        // - Clear custom session data
        // - Perform audit logging
        // - Notify other services
        // - Clean up user-specific resources
        
        return ValueTask.CompletedTask;
    }
}

The handler configuration includes several important components:

• Descriptor - Defines how the handler should be registered and executed
• SetOrder - Determines the execution order when multiple handlers exist
• SetType - Specifies this as a custom handler implementation
• UseSingletonHandler - Sets lifetime of the class as Singleton

Step 2: Register the Event Handler

Register your custom handler in your application's module configuration:

//...

public class MySolutionAuthServerModule : AbpModule
{
    public override void PreConfigureServices(ServiceConfigurationContext context)
    {
        PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
        {
            serverBuilder.AddEventHandler(SignOutEventHandler.Descriptor);
        });
    }

    //...
}

That's it! After these steps, your SignOutEventHandler.HandleAsync() method should be triggered after each signout request. You can also use other pre-defined server events for other stages of the authentication & authorization processes such as;

• OpenIddictServerEvents.ProcessSignInContext -> after each sign-in,
• OpenIddictServerEvents.ProcessErrorContext -> when an error occurs in the authentication,
• OpenIddictServerEvents.ProcessChallengeContext -> called when processing a challenge operation,
• and other 40+ server events...

Each event provides access to the relevant context, allowing you to access and modify the authentication flow's behavior.

🛠 Liked this post? I now share all my content on Substack — real-world .NET, AI, and scalable software design. 👉 Subscribe here → engincanveske.substack.com 🎥 Also, check out my YouTube channel for hands-on demos and deep dives: https://www.youtube.com/@engincanv

Conclusion

ABP Framework integrates OpenIddict as its authentication and authorization module. OpenIddict provides an event-driven model that allows developers to customize authentication and authorization processes within their ABP applications. It's pre-installed & pre-configured in the ABP's startup templates.

OpenIddict provides a powerful and flexible way to customize authentication flows. By leveraging these events, developers can implement complex authentication scenarios while maintaining clean, maintainable code.

References

• OpenIddict Documentation
• ABP OpenIddict Module Documentation
• Advanced OpenIddict Scenarios

This addition expands our platform compatibility, ensuring that developers using Intel-powered Macs can also benefit from the powerful features of ABP Studio.

What is ABP Studio?

For those who aren't familiar with it, ABP Studio is a powerful desktop application that makes ABP development faster and easier. It offers:

• Easy creation of new solutions (from simple applications to microservices)

• Visual architecture management for modular-monolith and microservice solutions

• Solution exploration tools for entities, services, and HTTP APIs

• Simplified running, debugging, and monitoring of multi-application or microservice solutions

• Kubernetes cluster integration capabilities

• and more...

Extended Platform Support

ABP Studio has been proudly supporting multiple platforms, and we're excited to add MacOS Intel to our list of supported architectures. You can now use ABP Studio on:

• Windows x64

• Windows ARM

• MacOS Apple Silicon (M1/M2/M3)

• MacOS Intel (New!)

Why This Matters

This update is particularly important for developers who are using Intel-based Mac computers. Previously, ABP Studio was only available for Apple Silicon Macs (for MacOS), but we understand that many developers are still using Intel-based Macs. With this release, we're ensuring that all Mac users can access our development tools, regardless of their processor architecture.

Getting Started

Installing ABP Studio on your Intel-based Mac is straightforward:

1. Go to abp.io/studio

2. Click on the download button and select "MacOS Intel" from the dropdown menu

3. Once downloaded, open the installer package

4. Follow the installation wizard to complete the setup

Conclusion

As the ABP team, we're always looking for ways to improve the developer experience. By supporting Intel-based Macs, we're ensuring that all Mac users can access our development tools, regardless of their processor architecture.

Stay tuned for more updates and enhancements as we continue to optimize ABP Studio and please provide us with your invaluable feedback. Thanks in advance!

Try this version and provide feedback for a more stable version of ABP v9.1! Thanks to you in advance.

Get Started with the 9.1 RC

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI.

By default, ABP Studio uses stable versions to create solutions. Therefore, if you want to create a solution with a preview version, first you need to create a solution and then switch your solution to the preview version from the ABP Studio UI:

Migration Guide

• ABP Version 9.1 Migration Guide

What's New with ABP v9.1?

In this section, I will introduce some major features released in this version.

Here is a brief list of titles explained in the next sections:

• Upgraded to Angular 19

• Upgraded to OpenIddict 6.0

• New Blazor WASM Bundling System

• Idle Session Warning

• Lazy Expandable Feature for Documentation

Upgraded to Angular 19

We've upgraded the Angular templates and packages to Angular 19. This upgrade brings the latest features and improvements from the Angular ecosystem to ABP-based applications, including better performance and development experience.

Upgraded to OpenIddict 6.0

OpenIddict 6.0 has been released and we've upgraded the OpenIddict packages to version 6.0 in ABP 9.1. This brings enhanced security features and improved authentication capabilities. The migration is straightforward and mainly involves updating some constant names:

• OpenIddictConstants.Permissions.Endpoints.Logout is now OpenIddictConstants.Permissions.Endpoints.EndSession

• OpenIddictConstants.Permissions.Endpoints.Device is now OpenIddictConstants.Permissions.Endpoints.DeviceAuthorization

If you're using IdentityModel packages directly, you'll need to upgrade them to the latest stable version (8.3.0). This update ensures your applications stay current with the latest security standards and best practices.

Please refer to the OpenIddict 6.0 migration guide for more information.

New Blazor WASM Bundling System

We've implemented a new bundling system for Blazor WebAssembly applications that eliminates the need to manually run the abp bundle command. This system automatically handles JavaScript and CSS file bundling at runtime, significantly improving both development experience and application loading performance.

Key improvements include:

• Automatic bundling of JavaScript and CSS files without manual intervention

• Dynamic file generation through the host application

• Better integration with the ABP module system

• Improved asset management through the virtual file system

The new system is particularly beneficial for modular applications, as it allows modules to contribute their assets automatically to the global bundles. This results in a more maintainable and efficient asset management system for Blazor WebAssembly applications.

Please refer to this documentation for more information.

Idle Session Warning

We've introduced a new idle session warning feature for the Account (Pro) Module that helps manage user sessions more effectively. This security enhancement automatically monitors user activity and manages session timeouts in a user-friendly way.

The feature can be easily configured through the administration interface, where administrators can:

• Enable/disable the idle session timeout

• Set custom timeout duration in minutes

• Configure when users should be signed out

When a user becomes inactive for the configured duration, they'll receive a warning dialog:

Key features and behaviors:

• Tracks real user activity (mouse movements, keyboard presses) across all tabs

• Works on a per-browser session basis - affects all tabs of the same session

• Maintains session if user is active in any tab of the application

• Provides a countdown timer before automatic sign-out

• Offers options to "Stay signed in" or "Sign out now"

This feature significantly improves application security while maintaining a smooth user experience by preventing unexpected session expirations and data loss.

Lazy Expandable Feature for Documentation

We've introduced a new lazy expandable feature to the documentation system that significantly improves navigation through large documentation sections. This enhancement addresses common challenges when dealing with extensive documentation hierarchies by introducing smart menu management.

Key benefits and features:

• Cleaner Navigation: The menu stays concise by hiding sub-items until they're needed, reducing visual clutter

• Better Performance: Reduces the initial load of the navigation tree by loading sub-items on demand

• Improved Search Experience: Makes filtering documentation items more efficient by showing only relevant top-level items

• Context-Aware Expansion: Automatically expands relevant sections when viewing specific documentation pages

The feature works by marking certain documentation sections as "lazy expandable" in the navigation configuration. When users navigate to a document within a lazy expandable section, the system automatically expands the relevant menu items while keeping other sections collapsed.

This improvement is particularly valuable for complex documentation areas like tutorials, solution templates, and extensive module documentation, where having all navigation items visible at once could be overwhelming.

An example of lazy expandable feature from the ABP's BookStore Tutorial:

        {

          "text": "Book Store Application",

          "isLazyExpandable": true,

          "path": "tutorials/book-store",

          "items": [

            {

              "text": "Overview",

              "path": "tutorials/book-store",

              "isIndex": true

            },

            //other items...

          ]

        }

Others

Some other highlights from this release:

• Updated Iyzico NuGet packages to the latest version, which is used in the ABP's Payment Module.

• Removed optional secondaryIds from path. See: #21307

• CMS Kit Pro: Added automatic deletion of comments when a blog post is deleted - comments are now automatically removed when their associated blog post is deleted.

• Avoiding global blocking in distributed event handlers (See #21716).

Community News

New ABP Community Articles

There are exciting articles contributed by the ABP community as always. I will highlight some of them here:

• Integrating ABP Modules in Your ASP.NET Core Web API Project. A Step-by-Step Guide by Sajankumar Vijayan

• ABP Framework: Background Jobs vs Background Workers — When to Use Which? by Alper Ebiçoğlu

• The new Unit Test structure in ABP application by Liming Ma

• How to Use OpenAI API with ABP Framework by Berkan Şaşmaz

Thanks to the ABP Community for all the content they have published. You can also post your ABP-related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v9.1 RC and provide feedback to help us release a more stable version.

Thanks for being a part of this community!

Let's dive into what R2R publishing is, how it works, and the benefits it brings to ABP Studio.

What is Ready-to-Run (R2R) Publishing?

Ready-to-Run (R2R) is a form of AOT compilation available in the .NET ecosystem. Unlike traditional just-in-time (JIT) compilation, R2R precompiles parts of your application to native code before deployment. This precompiled code helps reduce the startup time by minimizing the work needed during runtime.

However, R2R isn't a complete AOT compilation. Instead, it's a hybrid approach because it stores both:

• Native code for precompiled methods (to improve startup time and performance)

• Intermediate Language (IL) code for methods that may need further JIT compilation

This hybrid nature is why R2R binaries are typically larger. For ABP Studio, the storage size increased by ~150 MB with R2R enabled, but the trade-off is well worth it for the performance and startup-time gains.

How R2R (Ready-to-Run) Improves ABP Studio

Faster Startup Time 🚀

One of the biggest advantages of R2R publishing is its impact on startup times. In our local tests, enabling R2R resulted in startup times being reduced by 2.5x ⬇️.

This means you can get to work faster, without waiting for the application to being startup from the beginning. Whether you're launching ABP Studio to manage projects, generate code, or deploy applications, the improved responsiveness is noticeable.

Performance Enhancements 📈

In addition to faster startups, R2R publishing contributes to overall performance improvements. By precompiling frequently used methods, R2R reduces the workload on the JIT compiler during execution, leading to smoother and more efficient operations.

Trade-offs: Increased Storage Size 🆙

With great performance comes a slight trade-off: storage size. R2R binaries include both native and IL code, which increases the file size. In the case of ABP Studio, the storage footprint increased by ~150 MB. However, the substantial improvements in speed and responsiveness make this a worthwhile investment.

How to Enable R2R Publishing in Your Applications?

If you're developing applications and want to benefit from R2R, here's a quick guide on how to enable it in your .NET projects:

1. You can add the following configuration to your final project's .csproj file:

<PropertyGroup>

    <PublishReadyToRun>true</PublishReadyToRun>

</PropertyGroup>

2. Then, publish your application with the dotnet publish command:

dotnet publish -c Release

Alternatively, you can specify the PublishReadyToRun flag directly to the dotnet publish command as follows:

dotnet publish -c Release -r win-x64 -p:PublishReadyToRun=true

That's it! Your application will now include precompiled native code for faster startup and great performance benefits.

Please refer to the official documentation before publishing your application with R2R.

Conclusion

As ABP team, we're always looking for ways to improve the developer experience. By adopting Ready-to-Run (R2R) publishing for ABP Studio, we're aiming to deliver a faster and more efficient tool for your development needs.

Stay tuned for more updates and enhancements as we continue to optimize ABP Studio and please provide us with your invaluable feedback.

What's New With Version 9.0?

All the new features were explained in detail in the 9.0 RC Announcement Post, so there is no need to review them again. You can check it out for more details.

Getting Started with 9.0

Creating New Solutions

You can check the Get Started page to see how to get started with ABP. You can either download ABP Studio (recommended, if you prefer a user-friendly GUI application - desktop application) or use the ABP CLI to create new solutions.

By default, ABP Studio uses stable versions to create solutions. Therefore, it will be creating the solution with the latest stable version, which is v9.0 for now, so you don't need to specify the version. You can create solutions with ABP 9.0 starting from v0.9.11.

How to Upgrade an Existing Solution

You can upgrade your existing solutions with either ABP Studio or ABP CLI. In the following sections, both approaches are explained:

Upgrading via ABP Studio

If you are already using the ABP Studio, you can upgrade it to the latest version to align it with ABP v9.0. ABP Studio periodically checks for updates in the background, and when a new version of ABP Studio is available, you will be notified through a modal. Then, you can update it by confirming the opened modal. See the documentation for more info.

After upgrading the ABP Studio, then you can open your solution in the application, and simply click the Switch to stable action button to instantly upgrade your solution:

Please note that ABP CLI & ABP Studio only upgrade the related ABP packages, so you need to upgrade the other packages for .NET 9.0 manually.

Upgrading via ABP CLI

Alternatively, you can upgrade your existing solution via ABP CLI. First, you need to install the ABP CLI or upgrade it to the latest version.

If you haven't installed it yet, you can run the following command:

dotnet tool install -g Volo.Abp.Studio.Cli

Or to update the existing CLI, you can run the following command:

dotnet tool update -g Volo.Abp.Studio.Cli

After installing/updating the ABP CLI, you can use the update command to update all the ABP related NuGet and NPM packages in your solution as follows:

abp update

You can run this command in the root folder of your solution to update all ABP related packages.

Please note that ABP CLI & ABP Studio only upgrade the related ABP packages, so you need to upgrade the other packages for .NET 9.0 manually.

Migration Guides

There are a few breaking changes in this version that may affect your application. Please read the migration guide carefully, if you are upgrading from v8.x: ABP Version 9.0 Migration Guide

Community News

ABP Community Talks 2024.7: What’s New with .NET 9 & ABP 9?

In this episode of ABP Community Talks, 2024.7; we will dive into the features that came with .NET 9.0 with Alper Ebicoglu, Engincan Veske, Berkan Sasmaz and Ahmet Faruk Ulu.

Highlights from .NET 9.0

Our team has closely followed the ASP.NET Core and Entity Framework Core 9.0 releases, read Microsoft's guides and documentation, and adapted the changes to our ABP.IO Platform. We are proud to say that we've shipped the ABP 9.0 based on .NET 9.0 just after Microsoft's .NET 9.0 release.

In addition to the ABP's .NET 9.0 upgrade, our team has created many great articles to highlight the important features coming with ASP.NET Core 9.0 and Entity Framework Core 9.0.

You can read this post to see the list of all articles.

New ABP Community Articles

In addition to the articles to highlight .NET 9.0 features written by our team, here are some of the recent posts added to the ABP Community:

• Video: Building Modular Monolith Applications with ASP.NET Core & ABP Studio by Halil İbrahim Kalkan

• How to create your Own AI Bot on WhatsApp Using an ABP.io Template by Michael Kokula

• ABP Now Supports .NET 9 by Alper Ebiçoğlu

Thanks to the ABP Community for all the content they have published. You can also post your ABP related (text or video) content to the ABP Community.

Conclusion

This version comes with some new features and a lot of enhancements to the existing features. You can see the Road Map documentation to learn about the release schedule and planned features for the next releases. Please try ABP v9.0 and provide feedback to help us release more stable versions.

Thanks for being a part of this community!

In November 2024, exciting things happening in the .NET world and in this blog post, we are covering some of them.

.NET Conf 2024

Microsoft organized the .NET Conf 2024 between November 12 and 14 as an online event. There were many speakers who talked at the conference from all around the world.

The co-founder of Volosoft and Lead Developer of the ABP, Halil Ibrahim Kalkan gave a speech about "Building Modular Applications with ASP.NET Core & ABP".

In his session, he discussed building modular applications and mentioned how ABP Studio makes it easier to create fully modular systems with ASP.NET Core.

What's new with ASP.NET & Entity Framework Core 9.0

Microsoft released the .NET 9.0 in the .NET Conf 2024, with ASP.NET Core 9.0 and Entity Framework Core 9.0.

Our team has closely followed the ASP.NET Core and Entity Framework Core 9.0 releases, read Microsoft's guides, documentation, and adapted the changes to our ABP.IO Platform. We are proud to say that we shipped the ABP 9.0 RC.1 based on .NET 9.0 just after Microsoft's .NET 9.0 pre-release and we are going to share the v9.0 with .NET 9.0 stable release soon.

In addition to the ABP's .NET 9.0 upgrade, the team has created many great articles to highlight the important features coming with ASP.NET Core 9.0 and Entity Framework Core 9.0. Here, is a list of all the articles:

ASP.NET Core 9.0

• Optimizing Static Asset Delivery feature in ASP.NET Core 9.0 by Liming Ma
• C# 13 Features by Enis Necipoğlu
• Hybrid Cache in .NET 9 by Engincan Veske
• .NET Aspire 9.0 Features by İsmail Çağdaş
• .NET 9.0 SignalR supports trimming and Native AOT by Ahmet Faruk Ulu
• Built-in OpenAPI Document Generation with .NET 9 — No more SwaggerUI! 👋 by Alper Ebiçoğlu
• Middleware Now Supports Keyed Dependency Injection in .NET 9 by Salih Özkara

Entity Framework 9.0

• EF Core 9 LINQ & SQL translation by liangshiwei
• EF Core 9 Read-only Primitive Collections by Berkan Şaşmaz

We enjoyed writing these, we hope you also enjoy and like them while reading. Happy coding!

-- The Volosoft Team