Will you be updating the versions of the AutoMapper and Scriban nuget packages any time soon? The versions currently being used have been reporting vulnerabilities for quite some time. Also, VS 2026 now forces EF migration generation and DB update processes to stop regardless of what the ErrorActionPreference is set to.
6 Answer(s)
-
0
AutoMapper / Scriban package updates (vulnerabilities):
- ABP regularly upgrades its NuGet dependencies to newer versions as part of its release cycle. There isn’t a separate public “ETA” per-package that I can confirm from the available verified sources.
- What I can verify from ABP support history is that the team’s approach is to upgrade NuGet packages to the latest and that such upgrades are handled via PRs/regular releases (example answer from ABP team): see the source below.
VS 2026 stopping EF migration generation / DB update regardless of
ErrorActionPreference:- I don’t have a verified ABP-specific source/known issue entry for this Visual Studio 2026 behavior from the available context.
- This sounds like a change in Visual Studio / PowerShell tooling behavior (outside ABP), rather than an ABP framework feature toggle, but I can’t provide a definitive ABP-verified fix without a verified source.
Actionable guidance you can safely apply in ABP solutions:
- Keep ABP packages on the latest patch/minor for your major line (e.g.,
8.3.x→ latest8.3.*) since ABP dependency updates typically ship via ABP releases. - If your security scanner flags transitive vulnerabilities, you can usually mitigate by:
- upgrading ABP to a newer version that carries updated transitive dependencies, and/or
- adding a direct PackageReference override (if compatible) in your solution (this is standard NuGet behavior; test thoroughly).
- Keep ABP packages on the latest patch/minor for your major line (e.g.,
Sources (validated)
- https://abp.io/support/questions/8276
- https://abp.io/docs/latest/release-info/migration-guides/abp-5-3
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
AI answer doesn't help as this is not two separate issues. Vulnerable nuget packages -> EF Migration / DB updates headache. The v10.5 roadmap says 3rd party updates just want to know if updating these packages is in that.
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Hi,
Both have already been addressed, so you don't need to wait for v10.5:
- Scriban was bumped to 7.0.0 in v10.4.0, which clears the security advisories. Just upgrading your ABP packages picks it up.
- AutoMapper is a different story: AutoMapper 14.x is the last free version and won't get a patch for
GHSA-rvv3-g6hj-g44x.Volo.Abp.AutoMapperitself still references 14.x and will keep showing the advisory. The supported fix is to switch toVolo.Abp.LuckyPenny.AutoMapper(available since v10.3.0), which targets the patched commercial AutoMapper (16.x). It's a drop-in replacement — only two changes in your own modules:
// *.csproj -<PackageReference Include="Volo.Abp.AutoMapper" /> +<PackageReference Include="Volo.Abp.LuckyPenny.AutoMapper" />// YourModule.cs -[DependsOn(typeof(AbpAutoMapperModule))] +[DependsOn(typeof(AbpLuckyPennyAutoMapperModule))]All types stay in the same namespaces (
AbpAutoMapperOptions,IMapperAccessor, etc.), so your existingProfiles andCreateMapcalls keep working as-is. LuckyPenny has a free Community License for organizations with annual gross revenue under $5,000,000 USD and that never received more than $10,000,000 USD in outside capital (sign-up page); otherwise paid plans. Full setup (including the license key configuration): https://abp.io/docs/latest/framework/infrastructure/luckypenny-automapperIf you'd rather not take on a commercial dependency, the free alternative is Mapperly (what ABP modules use internally in v10). Migration guide: https://abp.io/docs/latest/release-info/migration-guides/AutoMapper-To-Mapperly
About the VS 2026 PMC behavior: that's upstream NuGet Audit kicking in when a vulnerable package is restored — it's not something
$ErrorActionPreferencecan override. Once you upgrade to v10.4.x and switchVolo.Abp.AutoMapperto eitherVolo.Abp.LuckyPenny.AutoMapperorVolo.Abp.Mapperly, the audit stops flagging those packages andAdd-Migration/Update-Databasework normally again.Thanks
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Thanks @maliming will take a look at the AutoMapper options you provided. However, even the 7.0 version of Scriban has security vulnerabilities see https://github.com/advisories/GHSA-24c8-4792-22hx
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Hi,
You're right —
GHSA-24c8-4792-22hxwas published on 2026-05-12, after we shipped Scriban 7.0.0 in v10.4.0 (PR https://github.com/abpframework/abp/pull/25170 was merged on 2026-03-27, when 7.0.0 was still the latest stable with no known advisories). Scriban then released 7.2.0 with the fix on 2026-05-12, and 7.2.1 followed on 2026-05-24 with some extra hardening.I'll bump ABP's
Scribanreference to 7.2.1 in the next release.In the meantime, you can clear the audit on your side immediately by pinning the version in your own
Directory.Packages.props:<PackageVersion Include="Scriban" Version="7.2.1" />ABP modules that consume Scriban (
Volo.Abp.TextTemplating.Scriban,Volo.Docs) declare it as aPackageReferencewithout a fixed version, so NuGet resolves whatever you set here. No further changes needed.Thanks
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
