API Host throwing health check error #10811

5 Answer(s)

• 

  0

  AI-Bot created 2 months ago

  Support Team ABP Agent

  • This error is thrown by AspNetCore.Diagnostics.HealthChecks UI’s background collector (HealthChecks.UI.Core.HostedService.HealthCheckCollectorHostedService). In some dependency graphs (commonly after upgrading ABP to v10), the IdentityModel assembly that HealthChecks.UI expects is not copied to the output, so the hosted service crashes repeatedly with:

    Could not load file or assembly 'IdentityModel, Version=5.2.0.0'

  • Fix (recommended): add an explicit package reference to IdentityModel in the project(s) where you call AddHealthChecksUI() / MapHealthChecksUiEndpoints() (typically *.HttpApi.Host, and in some solutions also *.Web):

    Option A (match the requested assembly version exactly):

  <ItemGroup>
      <PackageReference Include="IdentityModel" Version="5.2.0" />
    </ItemGroup>
  

  Option B (use the newer version ABP team suggested in a similar case):

  <ItemGroup>
      <PackageReference Include="IdentityModel" Version="7.0.0" />
    </ItemGroup>
  

  • Then:

    1. dotnet clean
    2. delete bin/obj for the affected host project(s)
    3. dotnet restore
    4. rebuild + run

  • If you have multiple hosts/services each registering HealthChecks UI, add the reference to each of those host projects (only where the UI collector runs).

  Links (validated):

  • https://abp.io/docs/latest/solution-templates/microservice/health-check-configuration
  • https://github.com/Xabaril/AspNetCore.Diagnostics.HealthChecks
  • https://www.nuget.org/packages/IdentityModel/

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 2 months ago

  Support Team Fullstack Developer

  Hi,

  This one comes from the IdentityModel package change in ABP 10. Volo.Abp.IdentityModel used to bring the old IdentityModel package in transitively, and in v10 it switched to Duende.IdentityModel. The HealthChecks UI background collector still needs the old IdentityModel assembly (5.2.0.0) at runtime, so once nothing pulls it into the output anymore it can't find it and keeps throwing that FileNotFoundException. That's also why you no longer see any direct or transitive reference to it.

  Add an explicit reference to the old package in the host project(s) where you call AddHealthChecksUI() / MapHealthChecksUiEndpoints() (usually *.HttpApi.Host, and *.Web too if it registers the UI there):

  <PackageReference Include="IdentityModel" Version="7.0.0" />
  

  Then clean the bin/obj folders and rebuild. Version 7.0.0 is the last release under the old IdentityModel name and its assembly satisfies the 5.2.0.0 the collector asks for. The newly generated 10.x templates already include this line, so it's only existing solutions upgraded from 9.x that need it added by hand.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  smwasimraja@gmail.com created one month ago

  Hi Maliming, The issues that I have above said was arrested by applying fix that you have suggested. But now when I try to apply migration through the package manager console. I'm getting the following error.

  PM> Update-Database Multiple startup projects set. Using project 'Bluestar\Bluestar_src\Bluestar.EntityFrameworkCore' as the startup project. Build started... Build succeeded. The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: E:\VS Repo\Products\Bluestar-API\src\Bluestar.Domain\Bluestar.Domain.csproj : warning NU1903: Package 'System.Security.Cryptography.Xml' 10.0.7 has a known high severity vulnerability, https://github.com/advisories/GHSA-23rf-6693-g89p [E:\VS Repo\Products\Bluestar-API\src\Bluestar.EntityFrameworkCore\Bluestar.EntityFrameworkCore.csproj]

  I have tried setting the $ErrorActionPreference = "Continue" and <TreatWarningsAsErrors>false</TreatWarningsAsErrors>.

  Please help to resolve this.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  AI-Bot created one month ago

  Support Team ABP Agent

  • NU1903 is a NuGet security warning (known vulnerability). In your environment, NuGet/PMC is configured to treat security warnings as errors, so Update-Database stops even though it says “warning”.

  • ABP v10.4+ already moved several Microsoft/System packages to 10.0.7 for CVE remediation; your warning is specifically about System.Security.Cryptography.Xml 10.0.7. The practical fix is to upgrade to a non-vulnerable version of that package (or align packages to the ABP version that includes the bump), not to fight ErrorActionPreference / TreatWarningsAsErrors.

  1) Solution

  A) Upgrade the vulnerable package to a fixed version (recommended)

  Add an explicit reference (or update the existing one) in the project that ends up restoring it (often *.Domain, but can be centralized via Directory.Packages.props if you use it):

  <ItemGroup>
    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.8" />
  </ItemGroup>
  

  Then:

  1. Delete bin/obj (you already did before, but do it again after changing versions)
  2. Restore/build
  3. Run migrations again (preferably via *.DbMigrator — see option C)

  Notes:

  • The exact “fixed” version depends on the advisory. Use the first patched version for System.Security.Cryptography.Xml that your organization allows (10.0.8+ is the usual next patch line after 10.0.7).
  • If you manage packages centrally, pin it once in Directory.Packages.props instead.

  B) If your org policy blocks migrations due to NU1903, suppress only this warning (workaround)

  If you’re allowed to proceed temporarily while you schedule a patch, suppress just that warning code in the startup/migrator project:

  <PropertyGroup>
    <NoWarn>$(NoWarn);NU1903</NoWarn>
  </PropertyGroup>
  

  This is not the preferred approach; upgrading to a patched version is.

  C) Use ABP’s recommended migration path (avoids PMC quirks)

  ABP recommends running migrations via the .DbMigrator application (it’s also CI/CD friendly). Build and run YourProject.DbMigrator instead of Update-Database in PMC.

  2) Sources

  • https://abp.io/docs/10.4/release-info/migration-guides/abp-10-4
  • https://abp.io/docs/latest/release-info/upgrading

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Hi,

  Glad the health check one is sorted.

  This second one isn't really a build error, it's a NuGet security audit warning (NU1903). In 10.5, System.Security.Cryptography.Xml gets pulled in transitively at 10.0.7 (through Hangfire), and a recent advisory flags that version as high severity. The Package Manager Console turns that restore-time audit warning into a terminating error, so Update-Database stops right after Build succeeded. That's also why TreatWarningsAsErrors=false and $ErrorActionPreference didn't help, it's a restore/audit warning, not a compiler one.

  Pin the package to the patched 10.0.10 (10.0.7, 10.0.8 and 10.0.9 are all still flagged). Add this to your *.Domain project, since that's where it's being flagged, and it flows up to the projects that reference it:

  <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
  

  Then restore and run Update-Database again. If you use central package management, bump the <PackageVersion> for it in Directory.Packages.props instead.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel