volo.abp.cli although it’s not installed, or dotnet tool can’t reach the feed it is configured to use).dotnet tool list -g
dotnet tool uninstall -g Volo.Abp.Cli
dotnet tool update -g Volo.Abp.Studio.Cli
# or first-time install:
dotnet tool install -g Volo.Abp.Studio.Cli
NuGet.Config and remove/fix unreachable enterprise feeds (or ensure nuget.org is available).If ABP Studio still reports the error after these steps, it’s almost always because dotnet tool is using a NuGet source that is unreachable (ABP Studio depends on dotnet tool working correctly to install its CLI).
Links (verified):
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
Yes, this scenario is achievable in ABP without SaaS multi-tenancy. What you need is data authorization (row-level filtering), not “permission management” alone. In ABP, the most robust “easy” way is to implement custom global data filters (EF Core global query filters via ABP’s data filtering infrastructure) so all repository/app service queries automatically return only records the current user is allowed to see (works for APIs and UI dropdown sources).
A proven pattern in ABP is:
CompanyId, OfficeId, StoreId on the business entities that must be protected).UserCompany, UserOffice, UserStore).UserCompany/UserOffice/UserStore) for every query (works, but can be heavier).Implementation outline (recommended “selected context” approach):
IHasCompany / IHasOffice / IHasStore on entities that must be filtered:public interface IHasCompany { Guid CompanyId { get; } }
public interface IHasOffice { Guid OfficeId { get; } }
public interface IHasStore { Guid StoreId { get; } }
AbpDbContext, override ShouldFilterEntity + CreateFilterExpression and combine expressions to enforce:
entity.CompanyId == CurrentCompanyIdentity.OfficeId == CurrentOfficeIdentity.StoreId == CurrentStoreId
This makes the restriction automatically apply to all repository queries (including those feeding dropdowns and APIs).CurrentScopeAppService.ChangeCompany/ChangeOffice/ChangeStore that:
UserCompany etc.) before changing,UseAuthorization) that loads the saved “current scope” and calls CurrentScopeProvider.Change(...) for the request lifetime.Alternative “membership list” approach (no selection):
UserCompany/UserOffice/UserStore filtered by CurrentUser.Id. This can be done, but you must be careful about performance and EF translation (indexes become critical). The “current context” approach usually keeps queries simpler and faster.Also note: Permissions in ABP control “can the user call this feature/action”, but they do not automatically restrict data rows. So you typically use:
Sources (verified)
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
This is an Expo Go limitation, not an ABP/ABP Studio runtime problem: Expo Go can only open projects whose Expo SDK version is supported by the Expo Go app version installed on your device. If your generated mobile app is on Expo SDK 56 while the App Store Expo Go you have only supports up to SDK 54, you’ll get exactly: “Project is incompatible with this version of Expo Go… requires a newer version of Expo Go.”
What you can do (practical options):
npx expo start, use the option shown by Expo: “Press s to switch to development build” and proceed with a dev build flow for iOS. This avoids the Expo Go SDK compatibility lockstep.Should it work out of the box?
Links (verified):
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
There is no supported (built-in) way in LeptonX Angular SideMenu layout to move the main toolbar/user-profile menu into the topbar while keeping the main navigation in the left sidebar.
In the SideMenu layout, the toolbar is intentionally rendered in the right vertical strip (the lpx-toolbar-container area). The theme currently doesn’t expose an option/provider/panel directive to re-place that projection point into the topbar for the SideMenu layout.
What you can do instead (supported approach): create your own layout component and replace the default one.
This is the recommended way when you need a “hybrid” layout arrangement that LeptonX doesn’t support out of the box. In ABP Angular, layout/theme pieces are designed to be replaceable at the component level.
Practically, this means:
lpx-toolbar-panel content is projected into a container in the topbar (top-right), and keep the navbar/menu projection in the left sidebar.Roadmap / future support: According to ABP’s previous support response on the same request, this hybrid layout was not supported at that time, and multiple layout types were planned for the future, but there’s no confirmed/definitive configuration you can enable today for this exact hybrid placement. So: not currently supported; may be considered in future.
Sources (validated)
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
POST /signin-oidc is an OpenID Connect callback endpoint and must not be affected by your “tenant-from-route” Path/PathBase rewriting middleware/contributor logic.Request.Path (e.g., from /Tenant1/signin-oidc to /signin-oidc) and/orRequest.PathBase (e.g., to /Tenant1)
which is fine for normal pages, but it can break OIDC’s correlation/nonce/state validation flow. That frequently manifests as antiforgery/form validation exceptions when the callback is processed.In both Blazor Server UI and (if you added similar logic there) AuthServer, modify the middleware shown in the article so it skips authentication callback endpoints.
Example (based on the article’s app.Use(async (httpContext, next) => { ... }) middleware):
public override void OnApplicationInitialization(ApplicationInitializationContext context)
{
var app = context.GetApplicationBuilder();
app.Use(async (httpContext, next) =>
{
// Exclude OIDC endpoints from tenant route/pathbase rewriting:
var path = httpContext.Request.Path;
if (path.StartsWithSegments("/signin-oidc") ||
path.StartsWithSegments("/signout-callback-oidc") ||
path.StartsWithSegments("/Account") ||
path.StartsWithSegments("/connect")) // if needed
{
await next();
return;
}
// Your existing tenant-from-route PathBase logic (from the community article) here...
await next();
});
app.UseRouting();
// ...
}
This prevents the route-based tenant middleware from interfering with /signin-oidc (and related endpoints), which is the safest approach.
/signin-oidc)Do not try to make the callback tenant-prefixed (e.g. /Tenant1/signin-oidc). Let it stay at /signin-oidc, and resolve tenant after sign-in using your normal mechanisms (cookie/current user, etc.). With the exclusion above, the callback will be processed consistently.
Disabling antiforgery is not recommended for this scenario; the correct fix is to ensure the OIDC callback request is not mutated by the tenant-from-route pipeline.
Relevant references (validated):
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
Please contact us at https://abp.io/contact.
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
NU1903 is a NuGet security warning (known vulnerability). In your environment, NuGet/PMC is configured to treat security warnings as errors, so Update-Database stops even though it says “warning”.
ABP v10.4+ already moved several Microsoft/System packages to 10.0.7 for CVE remediation; your warning is specifically about System.Security.Cryptography.Xml 10.0.7. The practical fix is to upgrade to a non-vulnerable version of that package (or align packages to the ABP version that includes the bump), not to fight ErrorActionPreference / TreatWarningsAsErrors.
Add an explicit reference (or update the existing one) in the project that ends up restoring it (often *.Domain, but can be centralized via Directory.Packages.props if you use it):
<ItemGroup>
<PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.8" />
</ItemGroup>
Then:
bin/obj (you already did before, but do it again after changing versions)*.DbMigrator — see option C)Notes:
- The exact “fixed” version depends on the advisory. Use the first patched version for
System.Security.Cryptography.Xmlthat your organization allows (10.0.8+ is the usual next patch line after 10.0.7).- If you manage packages centrally, pin it once in
Directory.Packages.propsinstead.
If you’re allowed to proceed temporarily while you schedule a patch, suppress just that warning code in the startup/migrator project:
<PropertyGroup>
<NoWarn>$(NoWarn);NU1903</NoWarn>
</PropertyGroup>
This is not the preferred approach; upgrading to a patched version is.
ABP recommends running migrations via the .DbMigrator application (it’s also CI/CD friendly). Build and run YourProject.DbMigrator instead of Update-Database in PMC.
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
(1) Chart.js SAST finding (chart.umd.js in wwwroot/libs)
wwwroot/libs/* are typically vendor copies produced by tooling (e.g., ABP CLI abp install-libs) rather than code you should patch inline. ABP’s own guidance is to re-generate/update the library source instead of manually editing it.node_modules), thenwwwroot/libs/chart.js/* (e.g., re-run the equivalent of ABP’s library installation/copy step used in your pipeline) so the minified/UMD file in wwwroot/libs matches the updated upstream library.wwwroot/libs snapshot pinned forever.wwwroot, the clean remediation is upgrading/regenerating the vendor asset rather than trying to justify it away.(2) Uppy SCA finding (uppy@5.2.4, CWE-843 / CVE published Apr 2026)
uppy@5.2.4, because that depends on your solution’s package.json / lockfile and whether you implemented an Uppy-based upload UI.Links (validated):
wwwroot/libs artifacts are managed as copied vendor files (context for “don’t patch in place”): https://abp.io/support/questions/5067This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
/.suite/module-entity-extension.json.In Visual Studio (or your IDE), add project references so the Transaction side can compile against Master Data types:
Transaction.Domain → reference MasterData.DomainTransaction.EntityFrameworkCore → reference MasterData.EntityFrameworkCore (and/or MasterData.Domain as needed)[DependsOn(...)] module dependency on the Master Data module (Domain/EfCore module) so runtime registration is correct.Then build the whole solution successfully.
In the root of the solution you open with ABP Suite, create/edit this file:
/.suite/module-entity-extension.json
Put the Master Data domain assembly name there (the DLL name ABP Suite should scan):
{
"Modules": [
{
"DomainProjectDllFileName": "MyCompany.MyProject.MasterData.Domain.dll"
}
]
}
Notes:
Now go back to the Transaction entity → Navigation properties tab → Add navigation property. At this point, the Company entity from Master Data should appear in the Entity dropdown (because Suite can now scan that module’s domain DLL).
Click Save and generate, then:
module-entity-extension.json)This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
What to do (recommended, DDD-friendly approach):
CompanyId) and do not add an EF Core navigation to the Company aggregate from Master Data.
public class Transaction : AggregateRoot<Guid>
{
public Guid CompanyId { get; private set; } // Reference by Id only
// ...
}
Id + display fields) and consume it from the Transaction UI (Suite can generate lookups when the relationship is within the same module; for cross-module you typically wire the lookup manually).If you still want a real navigation property (same DbContext scenario):
Sources:
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
