v10.7.0

The first stable release of Dignite ABP Modules — reusable ABP Framework modules, released together on one version.

Module	What it is
blob-storing/	Pipeline contributors for ABP BlobStoring: size cap, content-type allow-list checked against the real bytes, GZip, image resize and compress, content-based MIME detection
notifications/	Event-driven notification framework with SignalR and email channels, plus the optional Notification Center (inbox, subscriptions, REST API, MVC and Angular UI)
flex-fields/	Runtime-defined fields: field types, validation, value bag and query index, EF Core and MongoDB providers, Angular UI
aspnetcore-mcp/	Shared host for the one MCP server an ABP application can have

Requirements: .NET 10 · ABP Framework 10.7.x · Angular 22 (@abp/ng.* ~10.7.0) for the Angular libraries.

Reading the version: MAJOR.MINOR is the ABP Framework version a release is built on, and PATCH is ours. 10.7.x targets ABP 10.7. Moving to ABP 10.8 will release 10.8.0, and a new ABP patch needs no release here. Breaking changes only ship when MAJOR.MINOR moves. Details: CONTRIBUTING → Versioning and releases.

Upgrading from a 10.0.0-rc.* pre-release: 10.7.0 is 10.0.0-rc.29 plus the fixes below; the new number reflects the versioning scheme, not a jump in content. If you are on an older rc, follow the Migrate notes of each version you skip in the CHANGELOG. The larger ones:

• rc.23 / rc.24: the notifications packages were split and renamed to ABP's naming (.Abstractions, .Client, definition store).
• rc.25: Dignite.FileExplorer.* and the File Explorer flex-field packages left this repository.
• rc.28: Dignite.Abp.FileStoring / .Imaging became Dignite.Abp.BlobStoring.Pipeline / .Imaging, built on ABP 10.7's BLOB pipeline. This version requires ABP 10.7.
• rc.29: the blob-storing and flex-fields module classes were renamed to ABP's Abp<Module><Layer>Module pattern.

---

Changed

shared build and dependencies

• The version now says which ABP it is built on: MAJOR.MINOR is the ABP Framework MAJOR.MINOR, PATCH is
  this repository's own. 10.7.x targets ABP 10.7 (and therefore Angular 22); moving to ABP 10.8 will release
  10.8.0. Until now only MAJOR followed ABP, so the step from 10.0.0-rc.29 to 10.7.0 is a numbering change,
  not a jump in content, and 10.0.0 was never published. New features can arrive in a PATCH; breaking
  changes only ship when MAJOR.MINOR moves. CI's version check now fails when <Version> does not start with the
  Volo.Abp.Core MAJOR.MINOR, or when an Angular package's @abp/ng.* dependency is not a ~MAJOR.MINOR.x
  range. See CONTRIBUTING.md → Versioning and releases.

Fixed

notifications

• The packages that reference ABP Identity now resolve System.Security.Cryptography.Xml and .Pkcs 10.0.13,
  fixing five advisories published 2026-10-13. Volo.Abp.Identity.Domain 10.7.0 pulls
  Microsoft.AspNetCore.DataProtection 10.0.11, which resolved both packages at 10.0.11 (affected up to 10.0.12:
  GHSA-r955-8q5j-3h83, GHSA-7hqp-7c5m-4vq6, GHSA-c399-9853-6jmj and GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7
  moderate). Both are pinned in Directory.Packages.props, so they now show up as direct >= 10.0.13 dependencies in
  the published nuspec of those packages (the audit flagged Dignite.Abp.Notifications.Emailing.Identity and
  Dignite.NotificationCenter.Push.Identity) and a consumer gets the patched versions without pinning them itself.
  The pins can go once ABP's own graph resolves 10.0.13 or later. CI's "Block vulnerable NuGet dependencies" step
  was failing on these from 2026-10-13.
• The Angular Subscriptions settings tab no longer stays empty until an unrelated click.
  NotificationSubscriptionsComponent loaded its rows on open, but the screen only showed them after something
  else refreshed the view. Angular 22 made OnPush the default, so the host layout's wrappers
  (abp-router-outlet, the LeptonX layouts) are OnPush, and a plain-field write in an HTTP callback never marks
  them for check. The rows now live in a signal (groups is a Signal<NotificationSubscriptionGroup[]>, read as
  groups() - it was a plain array property). The bell and the inbox were not affected: they mark the view for
  check after every response. The demo host's "Publish to subscribers" hint had the same flaw and got the same fix.
• The Angular bell's dropdown, the inbox and the Subscriptions tab now follow a dark host theme. Their component
  styles hardcoded light colours (#fff panel, #ddd/#eee borders, #888 muted text, a fixed blue unread
  tint), so under a dark theme the bell's dropdown stayed a white panel while its text turned light, which read as
  washed out. They now use Bootstrap's tokens: the dropdown paints with --bs-dropdown-* through .dropdown-menu
  like the theme's other menus, muted text uses --bs-secondary-color, borders --bs-border-color, the unread
  tint --bs-primary-rgb. Bell items also get a hover background. A host that restyled .abp-notification-dropdown
  by overriding background or border keeps working - those declarations are simply no longer there to fight.
  The MVC bell already followed the theme through Bootstrap classes; its unread tint (bell and inbox) now uses
  --bs-primary-rgb too, and its items get the same hover background, so both UIs look alike.

Removed

notifications

• The NotificationCenter permission group and its three NotificationCenter.Deliveries* permissions are gone,
  together with NotificationCenterErrorCodes. They were left behind when the per-recipient delivery state
  machine (retries, force-delivery) was cut before rc.3, and nothing checked them: they only put three checkboxes
  in the permission management UI that granted nothing. NotificationCenterPermissions,
  NotificationCenterPermissionDefinitionProvider, NotificationCenterErrorCodes and their Permission:* /
  NotificationCenter:Delivery* localization texts are removed. Grants stored under the old names are now orphan
  rows in AbpPermissionGrants; ABP ignores them, and they can be deleted at will. The README's sample
  DbContext also listed a NotificationDeliveryRecord set from the same era; it now lists PushDevices.