cloudscribe v10.0 released

We are pleased to announce the release of cloudscribe v10.0, which targets .NET 10.0 and includes npm security improvements. This is a framework alignment release — all cloudscribe packages have been updated to version 10.0.* to align with the .NET 10 release cycle.

Please note: MySQL support is temporarily unavailable in this release. See the known limitation below.

Known Limitation: MySQL Not Yet Supported

Pomelo.EntityFrameworkCore.MySql does not yet have a release compatible with EF Core 10. The current stable release is v9.x, which is incompatible with .NET 10's version of EF Core. Attempting to run a cloudscribe project generated with the MySQL storage option will result in the following runtime error:

System.MissingMethodException: Method not found: 'System.String Microsoft.EntityFrameworkCore.Diagnostics.AbstractionsStrings.ArgumentIsEmpty(System.Object)'
  • Affected storage option: MySQL only. SQL Server, PostgreSQL, SQLite, and NoDb are all unaffected.
  • Tracking issue: Pomelo.EntityFrameworkCore.MySql #2007 — EF Core 10 support
  • Status: The Pomelo team have this on their 10.0.0 milestone. No release date is currently published.
  • Workaround: If you require MySQL, continue using cloudscribe v8.7 targeting .NET 8.0 until a compatible Pomelo release is available. The cloudscribe template will be updated to include MySQL support once Pomelo.EntityFrameworkCore.MySql v10 is released.

Target Framework

  • Updated: Target framework updated from .NET 8.0 to .NET 10.0
  • Package References: All cloudscribe package references updated to version 10.0.*
  • ASP.NET Core: Microsoft.AspNetCore.Mvc.NewtonsoftJson updated from 8.0.0 to 10.0.0

Security Improvements

npm Package Updates

  • Updated: A number of npm package references have been incremented to address known security vulnerabilities in the generated project's frontend build toolchain
  • Overrides: An overrides block has been added to package.json to force clean versions of vulnerable transitive npm dependencies that cannot be resolved by incrementing direct references alone

Known Transitive NuGet Vulnerabilities

The following vulnerabilities appear in Visual Studio's NuGet vulnerability report for projects generated from this template. They are legacy NuGet packages pulled in transitively by referenced packages lower in the dependency chain.
On .NET 10, the runtime's built-in implementations completely override these old NuGet packages and therefore they are not exploitable. They will be removed from the individual libraries lower in the dependency chain whenever possible:

  • System.Net.Http 4.3.0 (High, CVE-2018-8292) — not exploitable on .NET 10
  • System.Text.Encodings.Web 4.5.0 (Critical, CVE-2021-26701) — not exploitable on .NET 10
  • System.Text.RegularExpressions 4.3.0 (High, CVE-2019-0820) — not exploitable on .NET 10

Upgrading to v10.0

To upgrade your existing cloudscribe installation to version 10.0:

  1. Update your project's target framework to net10.0 in your .csproj file
  2. Update all cloudscribe package references to version 10.0.*
  3. Update all relevant Microsoft package references (e.g. EFCore, AspNetCore, NewtonsoftJson...) to 10.0.0 if referenced directly
  4. If using the npm frontend build toolchain, update your package.json dependencies and add the overrides block as delivered by the updated template
  5. Run dotnet build and verify all features are working as expected

Backward Compatibility: This release is a framework alignment update. No breaking changes to cloudscribe APIs or features are included beyond those introduced by .NET 10 itself. Please refer to the Microsoft .NET 10 release notes for any platform-level breaking changes.

MySQL users: Do not upgrade to v10.0 until Pomelo.EntityFrameworkCore.MySql v10 is released. Remain on cloudscribe v8.7 / .NET 8.0 in the meantime.

Community and Support

We appreciate the continued support and feedback from the cloudscribe community. For questions or issues related to this release, please visit our GitHub repository or join the discussion in our community forums.

Thank you for using cloudscribe!

Comments