Neos 3.3 highlights

Key insights

Welcome to the 3.3 release of Neos. There are many updates in this version that we hope you'll like, some of the key highlights include:

Test projects upgraded to xUnit 4

The Neos test dependencies move from xUnit 3 to xUnit 4. Custom test ordering now works at the method level ([TestMethodOrderer], with PriorityOrderer implementing ITestMethodOrderer), and the Parallelization attribute replaces the parallelization options of CollectionBehavior.

Run neos migrate-metadata after installing this version: it upgrades the xUnit 3 test projects of the cluster modules, and the shared test helper projects they reference, by updating their package references and lock files and rewriting the xUnit constructs that changed. Its output lists, file by file, what must be upgraded by hand. Test projects that still reference the Neos test packages of an older version stay on xUnit 3 and keep compiling. AI agent evaluation projects are upgraded with neos upgrade-ai-test.

See Upgrading cluster test projects to xUnit 4.

Data protection

Masking sensitive property values

A String entity property can now hide its value, such as a bank account, a card number, or a social security number, in what the application sends out, while the business code keeps working on the real value. The mask is chosen in Neos Studio, in the new Masking group of the entity property, among eight masking types: Full, Password, Partial, Regex, CreditCard, Iban, Email, and Phone. Full and Password hide the whole value, the other types leave a part of it visible, for example the country code and the last four characters of an IBAN. A sample value previews the result. The value is masked for every user.

  • Entity view properties inherit the mask of their entity property, and can override each of its options.
  • The API responses, the exports of displayed data, the MCP tools, and the AI skills only receive the masked value. A cluster that reads the entity views of another cluster receives it masked too.
  • The screens edit a masked property blindly: the first key typed replaces the whole value, and a masked column of a datagrid is read-only. A mask sent back keeps the stored value, and a value that has the form of a mask is refused.
Important

Masking hides a value from the users, it does not protect the stored data: combine it with IsEncrypted. neos generate warns about a masked property stored in a database without encryption (M0102), and reports the personal or encrypted properties left without a mask as information (M0101).

The People module of the Technical Demos cluster shows one example of each masking type.

See Property masking.

User interface

Enriched style and transition directives

Xml templates and native UI views gain several new style: directives: border-style, border-width, opacity, scale, font-scale, rotate, translate, and the shadow-offset-x/-y/-blur/-spread group, each with a hover-* variant where it makes sense. border-color now also accepts one or four space-separated values (top, right, bottom, left).

A theme token used on any color directive (background, color, border-color, shadow-color, ...) can carry its own transparency with the token/alpha notation, for example "primary-500/0.6". Directives that take a plain numeric factor (opacity, scale, font-scale) use a decimal value, for example "0.6" or "1.2".

A new transition: directive family (properties, duration, easing) animates a change to any of the style directives above, or to layout:height/layout:width.

See Style directives and Transition directives.

Overlaying elements with the canvas layout

The new canvas-layout component places its children in depth instead of one after the other, so elements can overlap: a badge in the corner of a picture, a caption over a card, a floating button, a banner that unfolds on hover.

Each child is positioned by its distances to the edges of the canvas, with the canvas:top, canvas:right, canvas:bottom, and canvas:left directives. A distance is a number of pixels (decimal or negative), a percentage of the canvas size, or a bound value. Two opposite distances stretch the child, and the align-horizontal and align-vertical attributes set the default alignment of the children. Children can extend beyond the canvas without a scrollbar, and style:overflow="hidden" clips them.

The canvas relies on the enriched style and transition directives above, completed by layout:align-self-* (including centering), style:rotate-x, style:rotate-y, and the event:mouseenter and event:mouseleave events. Transformations are always applied in the same order, inside a canvas or not: translation, then rotations, then scale.

Warning

Use a canvas-layout only when elements must overlap. A layout made of fixed positions does not adapt to the size of its content, of the window, or of translated texts: everything else stays with vertical-layout, horizontal-layout, and grid-layout.

See Canvas layout and Canvas directives.

Navigation gains several building blocks that make opening a view declarative, and let the browser treat it as a real link.

  • A new type="openView" button opens a UI view without a full action or method. Its ui-view-name can be bound to a value of the screen, and an optional synchronous customize-method-name adjusts the navigation options just before the view opens. The OpenView action type gets the same capability through a new OpenViewCustomizationCode property, edited in Neos Studio.
  • A cluster can opt in to real links with UIDefaultBehavior.EnableNavigationLinks (disabled by default). Eligible navigations, such as "open a view" menu entries, the MenuButton items, and the declarative buttons above, are then rendered as links: a simple click still runs inside the application, while Ctrl or Cmd click, or a middle click, opens the view in a new browser tab.
  • A UI view that is already open can update the browser URL with SetUrlContextValue, SetUrlContextValues, RemoveUrlContextValue, and RemoveUrlContextValues, choosing whether the history entry is replaced or added. Writing directly to the UrlContext is now a compilation error instead of being silently ignored.
  • A cluster custom home page can display its content in a single ViewContainer instead of tabs, through the new MainViewContainerId configuration key. The browser history, the back button, and a full page reload restore the exact view of the URL, and the protect-unsaved-changes attribute of view-container asks for confirmation before unsaved changes are discarded. The new UseMainUIViewTitleAsBrowserTitle cluster option makes the browser tab title follow the title of the home page UI view.

See Button, UI view actions, URL context, and Create a custom home page.

Percentage sizes and container-based responsive layouts

The layout:width, layout:height, and their min- and max- variants now accept a percentage of the parent size, such as 50% or 33.33%. A layout:width or layout:height in percent is handled like a fixed size: the parent neither shrinks nor stretches it, so a strip at 200% can hold two pages at 50%. The min- and max- variants set lower and upper bounds, as they do in pixels. Whole numbers remain pixels.

grid-layout can adapt to its own width instead of the browser window width, with breakpoint-scope="container" (window remains the default). Each grid-layout-definition can set the pixel threshold at which its tier activates, in both scopes, and a fifth tier, extraextralarge, is available.

view-container gains content-max-width and content-padding to center the displayed view at a maximum width and keep a margin around it, while the scrollbar stays at the edge of the container, unless the root element of the view declares layout:height="fill".

See Layout directives, Grid layout, and View container.

Interactive charts

A chart can now call a UI method when the user clicks a data element (pie slice, bar, point), through the new element-click attribute. The method receives the series and element indexes, the label, the series name, and the value. The pointer becomes a hand over a clickable element, and the legend keeps its usual behavior.

The new item-labels attribute adds extra lines to the tooltip of each data point.

See Chart.

Datagrid row actions

The row actions of a datagrid are redesigned. The overlay block now covers the whole height of the row up to its right edge, with the color of the row (hover, selection, or style rule). The new row-actions-location attribute (overlay or column) can instead display the actions in a column frozen at the right of the grid, which does not hide data and shows its buttons on hover, on focus, and on the current row of touch screens. This mode cannot be combined with data columns frozen on the left: the overlay mode then applies.

Row actions are displayed without border: a Default action as a ghost button, and three new GhostPrimarySubtle, GhostPositiveSubtle, and GhostDangerSubtle styles, also available as button variants in templates, take their color only on hover, click, or focus. In card mode, the actions are displayed in a last line at the bottom of each card.

The actions are also reachable with the keyboard: Tab moves from the cells of a row to its actions, Shift+Tab goes back, and Enter or Space runs the focused action.

See Datagrid.

Partial template slots

A UI view template can declare a named slot, and any module can plug partial templates into it, for example new tabs. Extending a screen of another module no longer requires overriding its UI view in YAML. An empty slot renders nothing, so the base module still generates on its own, and contributions are assembled in a predictable order whatever the module load order.

The base module declares where its screen can be extended:

<tabs>
    <tab-item caption="Overview">...</tab-item>
    <partial-template-slot name="Sections" />
</tabs>

Another module adds a tab from its own metadata, with a partial template of the new SlotContribution type:

- Name: SalesSection
  Type: SlotContribution
  Slot: Sections
  Order: 10
  Template: |-
    <tab-item caption="Sales">...</tab-item>

In Neos Studio, slot contributions have their own icon in the tree view, and an opened partial template shows its type, slot, and order under its title.

See Partial template slot.

Visual refinements of standard components
  • splitter: the new bar-style="handle" keeps the space between panels transparent and draws a rounded handle at its center, sized with handle-length and handle-thickness. bar-corner-radius now accepts full.
  • image and input-image: the new fit attribute (contain, cover, or fill) controls how the image fills its box.
  • horizontal-layout: vertical-align accepts baseline, to align elements of different font sizes on their text baseline.
  • button: the new "unstyled" variant, together with the generic style:cursor directive, turns any content, such as a card, into a clickable area without changing its look.
  • popover: the new side, align, side-offset, show-arrow, and arrow-size attributes choose its preferred side, alignment, distance, and arrow relative to its anchor. The arrow takes the background given to the popover.
  • chatbot: the new prompt-disabled, show-agent, and show-new-conversation attributes, a StartNewConversation method on the instance given by ref, and the PromptBackground, PromptBorder, PromptFocusBorder, and PromptBorderRadius theme attributes customize its prompt. The new show-avatars attribute and the chatbot-messages-start sub-component embed it in a custom conversation panel: messages without avatar, and a content at the start of the messages, in the same scroll. The header band is no longer shown when it has nothing to show: no agent, no button, and no chatbot-header content. The new content-max-width attribute centers its content at a maximum width. While the agent prepares its answer, an agent message now holds three animated dots until the first text arrives, in place of the former thinking indicator, and the new show-elapsed-time attribute hides the elapsed time shown above it. The new prompt-placeholder attribute replaces the hint of the empty prompt input, typically with a string resource of the application.
  • progress-bar: the new value-background, corner-radius, label-color, and label-outside-color attributes customize each instance, and can be bound to data, including per row of a repeated list. The percentage text now moves next to the fill when the fill is too narrow to contain it.

See Splitter, Popover, Chatbot, Image, Horizontal layout, Button, and Progress bar.

Deployment

Content-Security-Policy header at the Gateway

The Gateway now sends a Content-Security-Policy header on every response, including the responses it proxies from the clusters. By default the policy is style-src 'self' 'unsafe-inline': the browser only loads the stylesheets served by the application.

Warning

A stylesheet loaded from another origin (a CDN, an @import of an external URL in a tenant CSS) is now blocked. Set the full policy with the Helm value gateway.contentSecurityPolicy to allow its origin, for example style-src 'self' 'unsafe-inline' https://cdn.example.com, or set gateway.contentSecurityPolicyEnabled to false to remove the policy of the Gateway.

See Content-Security-Policy at the Gateway.

Files opened safely in the browser

A file stored by a user can no longer run a script in the application. The client only opens PDF, raster images, plain text and SVG files in the browser, and an SVG is cleaned of its scripts first. Any other type, such as HTML or XML, is downloaded instead of opened. The server adds X-Content-Type-Options: nosniff and, except for a PDF, Content-Security-Policy: sandbox to every file it returns.

See How are files opened in the browser?.

Neos Studio

Creating a menu item directly from a UI view

A UI view's tree view now has a Menu entries node, next to Actions, Methods, and Computeds, listing every existing menu item that opens this view. Clicking one navigates straight to its editor.

Its + button opens a quick-creation modal, so you no longer need to leave the UI view to create a menu item pointing to it: fill in a name, a caption, and optionally an icon and a menu. When a menu is selected, saving takes you directly to that menu's editor with the new entry already placed and selected, ready to be positioned exactly as if you had used the menu's own Add a menu item action.

See Creating a new menu item for the general menu item concepts.

Tenant Management

Per-tenant CSS override

A platform administrator can now override the look of a cluster for one tenant at runtime, without redeploying anything. The new Visual identity screen of Tenant Management, with its Visual identity, Theme and CSS tabs, stores reusable styles: a light slot and an optional dark slot. The images that a CSS references with url(assets/<name>) are added to the CSS. Each slot holds a theme, a free CSS, or both. A style is chosen as the default style of a tenant, or assigned to a tenant for a cluster version. The CSS can be typed in a code editor, which now supports CSS, or loaded from a .css file.

A theme editor lets the administrator build the look without writing CSS. Its Theme tab creates named, reusable themes. A theme starts from a standard Neos theme of its color scheme, Light or Dark, and only holds the colors and the component attributes that the administrator overrides, with a preview of the result. The light slot of a style needs a light theme or a free CSS, the dark slot is optional, and the published CSS of a slot is the CSS generated from its theme followed by its free CSS. When the dark slot is empty, the light slot is also used in the dark mode, so give a dark theme or a dark CSS to every style used by a tenant that supports it. Editing a theme republishes the styles of every tenant that uses a style with it, and a theme used by a style cannot be deleted.

A cluster uses the style that is assigned to the highest version lower than or equal to its own version, or else the default style of the tenant, and its users see it applied after the theme at their next page load. The screens are reserved to the tenants administrators, through the new Tenant visual identity function.

See Tenant visual identity and its Themes section.

Resource routes in the Tenant Management API

The entity views and server methods of the Tenants, Tenant Styling, Customer Licensing, Neos Deployment, Neos Diagnostics, and User Permissions modules now answer on routes named after the resources they handle, instead of the technical name of the entity view or of the server method. Each route carries a description, which labels its operation in the API documentation. The routes of the User Permissions module, such as users, roles, roles/assignments, and permissions, come with the module in every cluster that references it.

Operation Previous route New route
List the tenants GET api/v1/tenantlistview GET api/v1/tenants
Read a cluster GET api/v1/clusterview/{clusterId} GET api/v1/clusters/{clusterId}
Change the identifier of a tenant POST api/v1/methods/changetenantidentifier PUT api/v1/tenants/{tenantId}/identifier
Search the data POST api/v1/methods/globalsearch GET api/v1/search
Start a database migration POST api/v1/methods/migratedatabase POST api/v1/database-servers/{databaseServerId}/migrate
List the user accounts GET api/v1/useraccountview GET api/v1/users
Read a role GET api/v1/userroleview/{id} GET api/v1/roles/{id}
Assign a role to a user account POST api/v1/useraccountuserroleview POST api/v1/roles/assignments
Update a permission PUT api/v1/permissionview/{id} PUT api/v1/permissions/{id}
Read the report print settings of the user POST api/v1/methods/getuserreportprintsettings GET api/v1/users/settings/reports/by-name/{name}
List the tenant themes GET api/v1/tenantthemelistview GET api/v1/tenant-themes
Rebuild the published tenant styles POST api/v1/methods/rebuildtenantstyles POST api/v1/tenant-styles/rebuild
List the licenses GET api/v1/licensinglicenseview GET api/v1/licensing/licenses
Read the deployment configuration GET api/v1/methods/getdeploymentconfiguration GET api/v1/deployment-configuration

On its new route, a server method takes the HTTP verb that matches what it does: GET when it only reads data, PUT when it replaces a value. When it acts on a resource, the identifier of that resource moves into the route.

The new route of a server method is its primary route, which the screens call. Its previous route becomes a complementary route. The previous routes keep working: the deployment scripts and the calls from one cluster to another use them unchanged. They are hidden from the API documentation, with one exception: when a list view and a detail view of Tenant Management serve the same resource, the operations they share stay on their previous route, still documented, and their description names the route to prefer when there is one. GetAuthorizedTenants, SetMigrationResult, and SetTenantState, which only the framework calls, are hidden without a new route. So are UpsertUserAccounts, the subscription to the UserAccountSaved event, and the user account lookup view and the multi-cluster views of user accounts, roles, and role assignments, which serve the screens.

Note

A client generated from the API documentation, such as an NSwag client, switches to the new routes at its next generation. The operations it generates for them get new names, and the operations hidden without a new route disappear from it.

See API documentation, Root route, Complementary routes, and User Permissions.

What's new in documentation

This release includes significant documentation improvements.

New articles

  • New checks by version - Lists, for each framework version since 3.2, the generation, metadata-validation and analyzer checks a cluster can newly fail on when it moves to that version, with the message to look for and the fix to apply in the cluster.
  • Partial template slot - Explains how a UI view declares a named slot and how modules plug partial templates into it.
  • Property masking - Describes the masking types and their options, what the server masks, how the screens edit and save a masked value, and what masking does not protect.

Reorganized content

  • The key insights of a minor version are now published once, in a dedicated "Neos X.Y highlights" section at the very top of the changelog, ahead of every patch section, instead of below the patches of that version where they were easy to miss.

v3.3.0-alpha.6434

🛡️ Security patch 🛡️

Published on Nov 04, 2026.

Breaking changes

  • [Gateway] Tenant-status-specific 503 pages are now served by default instead of generic 503.html page. You can override them or disable them using NEOS_TENANT_PAGES_ENABLED=false in the gateway secret. Please see this article for details. (18830)
  • [Helm] Application metrics are no longer exported to Application Insights by default. See managing Application Insights ingestion volume for details. (19071)
  • [Helm] The OpenTelemetry Collector generated by the chart now exports only the logs at Warning level and above by default, instead of every level emitted by the pods. Lower observability.collector.config.minLogLevel to export more, see Default log level filter. (19325)
  • [C# Dependencies] Upgraded xUnit test dependencies to 4.0.0. The neos migrate-metadata command now upgrades the xUnit 3 test projects of the cluster modules (package references, lock files, test method orderer and parallelization attributes) and the shared test projects they reference, and lists the constructs left to migrate manually. Test projects that still use the test packages of an older Neos version stay on xUnit 3 with a warning. AI agent evaluation projects must be upgraded with neos upgrade-ai-test. (18615)
  • [Helm] Made the internal OpenTelemetry Collector image configurable with observability.collector.image and observability.collector.imagePullSecret. Custom collector configurations supplied through config.inline or config.existingConfigMap must be adapted to the 0.161.0 collector, see this article. (19058)
  • [Native UI views] Removed the exported runtime directives exports. Use directiveStyles formatters, dragdropHandlers listeners and contentStyle/contentClass props. See documentation. (19644)
  • [Neos AI] Model usage and token pricing now use the Neos Studio model name instead of the provider-specific model identifier. Review your token configurations to reference the model name defined in Neos Studio. (18982)
  • [Neos Studio] Replaced AI model capability collection by a Type property (Chat or Embeddings) on the AI model. A metadata migration automatically performs the replacement. (18968)
  • [User Permissions] Removed the obsolete UserAccount.Synchronized column and related user account view fields. (18635)
  • Changed the default path of the MCP endpoint from /api/mcp to /api/v1/mcp, so it is routed and protected by the Gateway without configuration. MCP clients using /api/mcp must switch to the new path or set AI:McpUrlPattern. (20243)
  • Each Pub/Sub subscription can now define its own dead letter event. Failed messages are no longer published as DefaultDeadLetter events, and those of a subscription without dead letter event are lost after all retries. (19678)
  • ICustomizingTenantDataIsolation.NewQueryFilter was replaced by TenantQueryFilter, which receives the tenant of the query as its first parameter: a custom tenant filter no longer keeps the authorized tenants of the first tenant that built the Entity Framework model. See Customizing data isolation. (20110)
  • In a calculable number input, Enter evaluates a formula and commits its result at once. (19990)
  • Opening a user file in the browser now only opens PDF, raster images, plain text and sanitized SVG files: any other type, such as HTML or XML, is downloaded. See How are files opened in the browser?. (20070)
  • Removed Azure AI Inference AI model API type. (18542)
  • Removed the AzureOpenAI API for AI models, as there is no longer any Azure-specific code following the migration to the Microsoft Agent Framework. Use the OpenAI API instead. A metadata migration automatically updates existing AI models. (18898)
  • Replaced Swagger UI with Scalar as the default API documentation UI. Swagger UI can still be enabled through cluster configuration. (19018)
  • Restricted the template directive values: a style directive value containing a semicolon is now rejected when the template is generated, and the value space-between of layout:align-self-horizontal, which had no effect, is now ignored with a warning. (19644)
  • The InputNumberCalculable and NumberCalculableFormField components are removed: use an InputNumber or a NumberFormField with the calculable prop. (19990)
  • The QueryExpressionEvaluator function of the AI entities querier skill takes an entity name and OData query options instead of C# code. MaxConcurrency, WaitTimeoutSeconds and ForceMemoryCleanup settings of AI:EntityQuerierSkill are no longer used. (19895)
  • The design system only loads the styles of the Wijmo grid. An application that uses other Wijmo controls directly (inputs, menus, charts, gauges, grid filter...) must import @mescius/wijmo.styles/wijmo-core.css itself. (20181)
  • The Gateway now enforces the Content-Security-Policy style-src 'self' 'unsafe-inline' by default, so a stylesheet loaded from another origin is blocked until its origin is added to gateway.contentSecurityPolicy. See Content-Security-Policy at the Gateway. (20070)
  • The view displayed in a frame is wrapped in a frame-content element: the class is no longer on the root element of the view, and the visible prop of the UI views is removed, the frame hiding the wrapper itself. If you use other tools than Neos features to write E2E tests, update the CSS selectors and the tests that target .frame-content as the root of the view. (20217)
  • With Kestrel, a cluster is now only served from the root of its port (https://localhost:5001/): its name is no longer part of the URL. A page opened with the cluster name (https://localhost:5001/{ClusterName}/...) is redirected to the root, and an API call with the cluster name is still served, but scripts and tools should now call https://localhost:{port}/webapi/.... With an identity provider that checks the redirect URIs (Azure AD, Azure AD B2C, Microsoft Entra External ID...), register https://localhost:{port}/signin-oidc for the clusters run with Kestrel.
    More details : 20311

Security

  • [Gateway] Fixed the cluster name of the notifications routes being taken from the neos-clustername header sent by the client: the header is now ignored and the cluster is always resolved from the host and the path, so the tenant validation always applies. (20713), closes 38953
  • [Helm] Upgraded the internal OpenTelemetry Collector image from 0.96.0 to 0.161.0, which removes its 67 high and 4 critical known vulnerabilities. (19058)
  • [Security] Updated dependencies to fix CVE-2026-93749 (HIGH CVSS 7.5) (19324), closes 36926, 37123
  • [Security] Updated dependencies to fix GHSA-2fmv-rv2c-59x7 (MEDIUM CVSS 5.9) (19841), closes 37841
  • [Security] Updated dependencies to fix GHSA-846f-f764-76mx (HIGH CVSS 7.5) (19841), closes 37841
  • [Security] Updated dependencies to fix GHSA-p98j-92pf-mc4p (LOW CVSS 2.3) (19324), closes 36926, 37123
  • A file stored by a user can no longer run a script in the application: SVG files are sanitized before being opened, other active types are downloaded, and the server sends every file with X-Content-Type-Options: nosniff and, except for a PDF, Content-Security-Policy: sandbox. (20070)
  • Fixed a claim value being able to add or replace a user property, such as the identifier, in the Neos-User header sent to the clusters. (20248)
  • Fixed the gateway and the server proxy forwarding the requests of service accounts (client credentials tokens) without checking their tenant membership. (20492), closes 38716
  • Fixed the gateway forwarding a request to a tenant other than the one it had validated when the tenant in the URL differed from the Neos-Tenant header. Such requests are now rejected with a 400 error, letter case included. Requests carrying several Neos-Tenant headers are now rejected by the gateway with a 400 error.
    More details : 20232, closes 37830
  • Fixed the gateway forwarding to the backend a Neos-User header sent by an unauthenticated caller. The header received from outside is now always removed. (19788)
  • The database migration and the development proxy no longer write the database password to the logs: the secret values of the connection string are masked. (20488)
  • Updated the .NET runtime and SDK to 10.0.14 and 10.0.403 to fix two CVEs.
    • CVE-2026-111497: Brotli decoder out-of-bounds write. You should rebuild and redeploy your cluster images on the updated base image. See this article.
    • CVE-2026-114148: Linux .NET tarball file ownership (local elevation of privilege).
      More details : 20563

Features

  • "Open a view" items of a MenuButton are now rendered as real links when EnableNavigationLinks is enabled, so they can be opened in a new tab. (19456)

  • [Documentation] Added a tips and tricks article on managing Application Insights ingestion volume on capped Log Analytics workspaces. (19071)

  • [Helm] Added an optional memory limiter to the generated collector pipelines with observability.collector.config.memoryLimiter, see Collector memory limiter. (19325)

  • [Helm] Added optional cpuLimit configuration alongside cpuRequest for Neos containers (see CPU resources configuration). (19879)

  • [Helm] Added the optional gateway.contentSecurityPolicy and gateway.contentSecurityPolicyReportOnly Helm values, which make the Gateway send a Content-Security-Policy header on every response, either enforced or in report-only mode. See this article. (19263)

  • [Helm] Added the possibility to set priority class for business clusters pods. See this article. (18682)

  • [License Management] Added Spanish translations. (19777)

  • [Neos AI] Added Spanish translations. (19777)

  • [Neos AI] Added the execution durations to the conversation log: the total time taken to answer each question and the duration of each function call. (19100)

  • [Neos Audit] Added an AI assistant that answers questions about the audits, the clusters and the tracked errors from the screen being viewed. (19966)

  • [Neos Manager] Added two buttons to switch a SQL query between its parameterized form and a version with real parameter values substituted, ready to run directly against the database. (18763)

  • [Neos Studio] Added Groupable option for UI view properties. (18566)

  • [Neos Studio] Added a Visible boolean option to menu items, which can be set to a C# expression, evaluated on the client side. (18567)

  • [Neos Studio] Added a button next to the "Name in the template" field of a UI component to copy its tag to the clipboard. (19847)

  • [Neos Studio] Added an Enabled property to themes: a disabled theme is neither generated nor checked, which also silences M0107 and M0109 for a theme the application does not use. See Themes. (20548)

  • [Neos Studio] Added cluster-level default report styles for report editing, viewing, and PDF generation. (18603)

  • [Neos Studio] Added more examples / states in the theme component preview. (19037)

  • [Neos Studio] Added the NEOS0007 analyzer, which warns when a string is implicitly converted to a LocalizableString, since such a text is only available in the default language. (19067)

  • [Neos Studio] Added the PubSubComponentSpec cluster configuration property, which replaces the pub/sub component used by neos run with any broker supported by Dapr, for example RabbitMQ. See the documentation for details. (19683)

  • [Neos Studio] Added the ability to create and browse menu entries directly from the UI view editor. (18719)

  • [Neos Studio] Added the real diagnostic code of client C# warnings and errors to the code editor tooltip and to the generation output. (18570)

  • [Neos Studio] Added typed inputs for the default value and the bounds of entity properties, entity view properties and data columns: numeric input, list of the allowed expressions, enumeration members, None / true / false buttons, color picker. (20008)

  • [Neos Studio] Indexes and alternate keys containing a column stored as JSON (LocalizableString, Json or StringArray) were rejected in Neos Studio, and reported by the warning M0097 at generation and by check-metadata. (19043)

  • [Neos Studio] Simplified the Entity View AI tools tab. (18771)

  • [Neos Webhooks] Added the NeosWebhooks module, which receives the webhooks sent by external services with Bearer or HMAC (Standard Webhooks, or a scheme added by a business module) authentication, duplicate detection, a receipt log, replay and administration screens. See Receiving webhooks. (20510)

  • [NeosAICore] Added NeosGpt61Sol and NeosGpt6Luna AI models. (19026)

  • [NeosAICore] Added NeosGpt6Sol AI model. (20313)

  • [Notification Center] Added a button-size parameter to the neos-notification-center component to set the size of its button. (19278)

  • [Support Center] Added Spanish translations. (19777)

  • [Task Scheduler Client] Added an UpdateTask method to the TaskSchedulerClient module to update an existing scheduled task without recreating it. (18593)

  • [Task Scheduler Client] Added Enable/Disable and Modify schedule row actions to the RemoteScheduledTaskListUI administration screen. (18593)

  • [Task Scheduler] Added a scheduled task that deletes every night the task executions older than 30 days by default, keeping the last run of each task (see How it works?). (19805)

  • [Task Scheduler] Added Spanish translations. (19777)

  • [Tenant Management] Added resource routes, each described in the API documentation, to the entity views and server methods of the Tenants module, and hid the previous routes, which still work, from that documentation. (20489)

  • [Tenant Management] Added Spanish translations. (19777)

  • [Tenant Management] Added the user login criterion to the advanced filter of the tenant list. (19376)

  • [Tenant Management] Added the Visual identity screen, where an administrator builds reusable visual identities from colors, component attributes and CSS with images, and gives one to a tenant as its default or for a cluster version, with a live preview of the theme. The users of that tenant then see it applied on top of the cluster theme, without any redeployment. (19263)

  • [Tenant Management] Added three filter criteria to the tenants list based on the users attached to each tenant: user login, first name and last name. Entering a login now narrows the list to the tenants that user belongs to. (18730)

  • [Tenant Management] Added user groups and deployment solutions, to give several tenants the same publisher administrators and the same versioned clusters in a few actions. See user groups and deployment solutions.

    • User groups
      • Added the User groups screen (Users menu, publisher accounts only) and a "User group" filter on the user list.
      • Added the "Publisher administrators" tab: picking a group adds its publishers to the tenant, in bold until saved.
      • Changed the users tab into "Client administrators", and moved Roles and permissions into the Users menu.
    • Deployment solutions
      • Added the Solutions screen (Clusters menu): versioned clusters, each with an optional shared database.
      • Added the "Deployment solution" box filling or adding the Clusters list.
      • Added the "Deployment solution" column and filter on the tenant list.
        More details : 20315

  • [Tenant Styling] The CSS of the tenant themes is generated again with the new version of Neos when Tenant Management starts after an upgrade, and by the RebuildTenantStyles method. See When a new version of Neos is deployed. (20266)

  • [User Permissions] A role can no longer be saved with a name already used by another role in the same language, and a clear message now explains why. (19086)

  • [User Permissions] Added Okta user synchronization through an optional module. See User Synchronization and Okta authentication. (19722)

  • [UserPermissions] User accounts are created automatically at the first login on multi-tenant clusters, with the role each tenant checks as assigned to automatically created accounts. (20133)

  • A calculable input-number supports the update-mode attribute, and its type attribute can be bound. (19990)

  • A cluster's custom home page can now use a ViewContainer instead of a FramesContainer as its main container, via the new MainViewContainerId configuration key, with matching URL/browser history behavior and an opt-in confirmation before discarding unsaved changes. (18797)

  • A masked value is edited in a field that replaces it as a whole, and the server keeps the stored value when it receives the mask back. (20497)

  • A new UseMainUIViewTitleAsBrowserTitle cluster option makes the browser tab title follow the title of the custom home page UI view, which can be built from the view displayed in its container. (19692)

  • A tenant claim mapped to the TenantIdentifier user property of the authentication configuration admits a user into this tenant of a multi-tenant cluster, even when the user is not yet a member of it. The TenantClaimAdmission option can restrict this admission to users who are not yet a member of any tenant of the cluster. See Authentication configuration. (20133)

  • Added Anthropic API type for AI models. (18847)

  • Added InputCapabilities.SupportsTouch() static method indicating whether touch input is supported. (UI code only) (18660)

  • Added layout:rendered-size and event:resize directives reporting the size actually rendered for an element. (18668)

  • Added neos dependencies rename command to rename a metadata element and update its references, with a --dry-run option. See CLI commands. (20434)

  • Added PromptAsync<T> method to IChatCompletion interface to be able to get a typed response: the JSON schema of the expected type is sent to the model, which is constrained to respond with a matching payload, and the response is deserialized automatically. (18838)

  • Added row-draggable attribute to the datagrid to drag one or several rows out of it, and the external-row-dragover and external-row-drop attributes to drop data coming from elsewhere in a datagrid at a given position. See row drag and drop. (19826)

  • Added SelectFilesAsync and SelectDeferredFilesAsync to view models to let the user select several files at once in the file selection dialog. See Select several files. (20803)

  • Added VisualIdentity and WithVisualIdentity to OnTenantResolvedResult, so that a tenant resolved interceptor can replace the visual identity chosen by Tenant Management with any other visual identity, chosen by its name, or with the standard look. See Choose the style from the cluster code. (20669)

  • Added Window.Current.IsPageVisible to client code, to skip the ticks of a periodic processing while the browser tab is hidden. (19888)

  • Added a "handle" bar style to the splitter, which keeps the space between panels transparent and displays a rounded handle at its center. (19493)

  • Added a fit attribute (contain, cover or fill) to the image and input-image components to control how the image fills its box. (19214)

  • Added a neos update-modules CLI command that updates referenced modules to their latest published version, or to the latest patch of their currently used major and minor version with the --patch-only option, reusing the same NuGet resolution as neos restore. (18662)

  • Added a configuration per database engine for programmable objects in Neos Studio, to choose whether the parameters of a function are bound by name or by position and to set the order of the parameters. (19307)

  • Added a container-based responsive mode to GridLayout, allowing the component to adapt its columns and spacing to its own width instead of the browser window's width. (18955)

  • Added a detailed breakdown of AI token usage (message, conversation history, system prompt) and tracking of cached input/output tokens in the NeosAI pricing. (18692)

  • Added a generation warning that detects when a business assembly's metadata name does not match its project's real assembly name, to catch silent test-coverage gaps early. (18910)

  • Added a generation warning when a UI view's datagrid has no visible column, closing a gap where only lookup-target views were checked. (18828)

  • Added a guard against accidental interactions with elements that are closing: a combobox list, a date or color picker, a popover, a modal, a dropdown or context menu, a toast and the content of a collapsing group box now ignore clicks during their closing animation, instead of selecting another option or running an action a second time. (20515)

  • Added a new declarative openView button type to open a UI view from a template, without writing a full action or method. (19031)

  • Added a read-only MCP server to Neos Audit and a Claude plugin to fix the errors and warnings reported for a cluster. (20047)

  • Added a template validation that reports a two-way or write-only attribute bound to a computed without setter or to a UI view property that cannot be set, as a warning (M0098), or as an error for write-only attributes such as layout:rendered-size. (19051)

  • Added a threshold attribute on grid-layout-definition to customize the pixel value at which each breakpoint tier activates, for both window and container responsive scopes. (18955)

  • Added a tokenizer setting on the AI model configuration to force the token estimation encoding, with automatic detection from the model name. (18692)

  • Added a warning in neos restore on Windows when a module referenced by local path has no Directory.Build.props redirecting its bin and obj folders, which every cluster sharing the module would otherwise overwrite. (19934)

  • Added an OpenViewCustomizationCode property to OpenView actions to customize the navigation options before the view is opened. (19275)

  • Added an opt-in --include-module option to neos generate and neos check-metadata that tags each diagnostic with its owning Neos module. The module is exposed as a structured property visible in JSON console output only - it never appears in the default, human-readable output. (18934)

  • Added an opt-in setting to generate database CHECK constraints for line breaks in single-line text and maximum lengths in multiline text. (18583)

  • Added an optional item-labels attribute to the chart component, showing extra tooltip lines for each data point. (19029)

  • Added an optional loading screen, configurable per cluster with the LoadingScreen setting, that replaces the blank page displayed while the application loads. Its colors and its texts, in any language, can be customized, or it can be replaced by a custom HTML file. (19466)

  • Added breakpoints in theme. (18660)

  • Added ExecuteAsync to IViewModelAction, allowing client code to trigger a view model action programmatically, without going through a statically declared button. (18720)

  • Added HasModifiedNavigationProperty() to the entity view API surface available to business assemblies. (18591)

  • Added keyboard-accessible resize bars for splitter component. (19964)

  • Added programmatic chatbot message sending. (19011)

  • Added Prometheus metrics for SignalR negotiation failures, transport fallback, and the connectionToken/Tenant cache, along with an example Grafana dashboard. (19028)

  • Added properties and methods in Viewport to granularly know the current breakpoint. They are accessible in UI code and template. (18660)

  • Added property masking: a String entity property can hide its value in the responses of the application, with a masking type chosen in Neos Studio (Property masking). (20497)

  • Added relative dates, an advanced mode and user favorites to the date filter of editable filters. (19396)

  • Added RetrieveCountAsync and RetrievePagedItemsAsync methods to IRetrievingRuleArguments to retrieve a count or a paginated page with its total without loading every matching item. (18824)

  • Added Settable property on IViewModelProperty for generic code that iterates over a UIView's properties, to know upfront which ones can be set (independently of any expression or read-only rule) without hard-coding a list. (18597)

  • Added SetUrlContextValue/SetUrlContextValues/RemoveUrlContextValue/RemoveUrlContextValues on the UI view model to update the browser URL dynamically from an already open UI view, replacing or adding a browser history entry. (18953)

  • Added Spanish translations of the framework's server messages and client application labels, including the rich text editor and the client components. (19762)

  • Added style classes: named styles defined in Neos Studio and applied to the elements of the UI templates with the style:classes directive. They allow, as a last resort, the creation of layouts that are not possible natively with Neos, for example by using CSS directly. The Components cluster shows examples in the "Style classes" screen of its Directives menu. (19987)

  • Added style directives for border style, border width, opacity, scale, font scale, rotation, translation and shadow offset/blur/spread, each with a hover variant where relevant. Border color now accepts one or four values, and any color-consuming directive can carry its own alpha with the "token/alpha" notation. Added a transition directive family to animate style and layout changes. (19169)

  • Added support for 2 or 3 values to the multi-value template directives. (19644)

  • Added support for PeriodicTimer, CancellationTokenSource and cancellable Task.Delay in client C# code, with a LifetimeToken that automatically stops periodic processing when a screen or a UI component is closed. (19375)

  • Added support for referencing Constants from UI templates: code generation, live diagnostics, editor autocompletion, and dependency/unused-usage detection. (18723)

  • Added support for the using statement in client C# code: the resource is disposed at the end of its scope. (19375)

  • Added syntax highlighting of the code blocks of the markdown viewer on a light background, and the standard light themes now display light code blocks. (20379)

  • Added the event:keydown template directive, which calls a UI method with the key pressed, such as Enter in a text box. (20301)

  • Added the baseline value to the vertical-align attribute of horizontal-layout, to align elements with different font sizes on their common text baseline. (19491)

  • Added the content-max-width and content-padding attributes to the view-container component to limit and center the width of the displayed view, and to keep a margin around it, while keeping the scrollbar at the edge of the container. (19213)

  • Added the GhostPrimarySubtle, GhostPositiveSubtle and GhostDangerSubtle action styles and button variants, which only take their color when hovered. (19645)

  • Added the NavigationTarget property to global search result items, and a UI view that opens in the same or a nested frame now opens in a new frame by default when selected from the global search. (19764)

  • Added the neos dependencies move command to move a metadata element to another module, with a --dry-run option. See CLI commands. (20558)

  • Added the NEOS0008 and NEOS0009 analyzers, which report as errors an event rule whose constructor does not match how it is registered (missing or unexpected base rule), instead of letting it fail at runtime. (19685)

  • Added the NewMock<T>() method to the unit test base classes, to create a mock that is configured and verified like the AutoMocker mocks, instead of new Mock<T>(). (19757)

  • Added the partial-template-slot node, which lets several modules contribute partial templates to a named slot of a UI view template. See Partial template slot. (20046)

  • Added the row-actions-location datagrid attribute, with a theme fallback, to display the row actions in a column frozen at the right end of the datagrid. (19645)

  • Added the row-click-selection-mode attribute to the datagrid: with the toggle value, a click on a row toggles its selection without unselecting the other rows. (19724)

  • Added the show-markers, track-thickness, track-border-width, track-border-color, selected-track-border-color, thumb-size, thumb-border-width and thumb-background attributes to input-slider-discrete to hide the markers and customize the track, its border and the thumb. Every color of the slider is defined by the theme and can be overridden on a slider. A slider without markers accepts more than 20 values. (20703)

  • Added the showPositiveSign option to the InputNumber component, see InputNumber. (19396)

  • Added the side, align, side-offset, show-arrow and arrow-size attributes to the popover template component to choose its preferred side, alignment, distance and arrow relative to its anchor, see Popover. (20048)

  • Added the StrictTestsByDefault assembly attribute: a test library that declares it runs its TestBase test classes in strict mode by default, whatever their base class. Changed the strict parameter of the TestBase, BackgroundServiceTestBase<T> and RemoteServiceInvokerTestBase constructors to bool?. Changed the Strict* test base classes to obsolete: use the StrictTestsByDefault attribute instead. (19575)

  • Added the style:letter-spacing and style:text-transform template directives to set the spacing between letters and the displayed case of a text. See Style directives. (20169)

  • Added the WithMaximumToolIterations prompt option to change the maximum number of tool-calling rounds an AI agent can chain for a single prompt. (19075)

  • Added the canvas-layout component, which places each child at an exact position with canvas:top, canvas:right, canvas:bottom and canvas:left, together with the style and transition directives it relies on. (19312)

  • Added the deprecation of standard theme colors, so that they can evolve without breaking existing themes: a deprecated color stays an alias of the color that replaces it until a major version removes it — see Standard colors. The generation and the template editor of Neos Studio warn about a color that a theme does not have (M0109) and about a deprecated standard color (M0108).
    More details : 20314

  • Added the display of the validation message of a datagrid cell selected with the keyboard, and its announcement by screen readers. (20162)

  • Added the M0099 generation warning, raised when UIView client code resets the key of a non-editable reference to an empty value, which makes the save fail. (19373)

  • Added the optional strict and superStrict constructor parameters to the domain and application test base classes and to the generated ApplicationTest and rule test classes, so a cluster unit test can enable the strict mock verification of TestBase. (19574)

  • Added the prompt-disabled, show-agent and show-new-conversation attributes to the chatbot component, and a StartNewConversation method on the chatbot instance given by ref. (19966)

  • Added the PromptBackground, PromptBorder, PromptFocusBorder and PromptBorderRadius theme attributes to customize the chatbot prompt, which no longer uses the input theme attributes. (19966)

  • Added the SelectLocalFileAsync method to UI views, which opens the file picker and reads the text content of the selected file in the browser without uploading it to the server. (19449)

  • Adding the agent's response time to the chatbot. (18894)

  • Additional data: each tenant can add its own fields to the entities enabling additional data. The fields are defined in the screen of the NeosAdditionalData module, read and written through the customFields property of the Web API, queried with OData (customFields/Name), displayed as grid columns, and entered in forms with the neos-additional-data-slot UI component. Enable them with the Allow additional data option of the entity in Neos Studio, and choose the storage mode with the AdditionalData:StorageMode key of the cluster configuration (Json or Eav). (19873)

  • AI agent evaluation tests could be configured by environment variables, repeat a case with a success threshold, check the tools called by the agent with the new ToolCallAccuracy, TaskAdherence and IntentResolution evaluators, and be filtered by agent. (19053)

  • Charts can now call a UI method when the user clicks a data element (pie slice, bar, point), through the new element-click attribute. (19511)

  • Datagrid row actions are now displayed without border, and a danger row action only turns red when hovered. (19645)

  • Datagrid rows now extend to the right edge of the datagrid when the columns do not fill its width. (19645)

  • Deprecated Device class (UI code only). Use Window.Current.Viewport in UI code or @Viewport in UI template instead. (18660)

  • Deprecated some Window properties and methods (UI code only). Use the following classes instead: Display, Viewport, InputCapabilities, SystemPreferences. (UI code only) (18660)

  • Entity view parameters are now exposed, with their description, as arguments of the MCP tools generated for an entity view. (18785)

  • Entity view properties inherit the masking options of their entity property and can override them. (20497)

  • Improved PromptOptions.ResponseFormat to be able to specify the expected schema of the expected response. (18838)

  • Improved chatbot UI : message times and agent durations, transparent standard-theme agent bubbles.transparent (20118)

  • Improved input accessibility by exposing labels, validation messages, required states to screen readers. (20080)

  • Improved the alignment of the summary tiles of the clusters in error on narrow screens. (20670)

  • Improved the datagrid rendering performance when checking rows, changing the current row or editing values. (20049)

  • Improved the server build time of neos generate: NuGet packages are now restored only when needed, and the AspNetCore and TaskRunner projects are built together. (19643)

  • Improved the tracked errors filter on narrow screens: it is summarized in a single link that opens the filters in a popup. (20670)

  • Improved the UI rendering and update speed: template directives are now resolved when the application is generated. (19644)

  • Improved toast stacking and dismissal. (19909)

  • Improved unit test base classes: the mocks of an additional AutoMocker passed to GetMockerServiceProvider are now verified at the end of the test, like the mocks of the main mocker. (19500)

  • In development, the access rights error page now shows the actual cause when the backend server failed to start or crashed, such as a dependency injection or database migration error. (19545)

  • LocalizableString.GetTranslationOrDefault() and LocalizableString.GetTranslationOrDefault(string language) can now be used in UI code. (19067)

  • Masking types: full, password, partial (visible prefix and suffix), regular expression (visible parts), credit card, IBAN, e-mail and phone, with a live preview in Neos Studio. (20497)

  • MCP tools now expose the application context keys declared by IUserContextPermissions as neos-{key} input parameters, and check the provided values like the REST API does. (19283)

  • Menu items can now begin a group, which draws a separator above them in the side menu and its sub-menus. The separator moves down to the next visible item when the item that opens the group is hidden, and is never duplicated nor displayed at the top of a menu. (18834)

  • Migrated AI related code from Microsoft.SemanticKernel to Microsoft.Agents.AI (Microsoft Agents Framework). (18542)

  • Migrated the button component out of PrimeVue. (19686)

  • Migrated the carousel component out of PrimeVue. (19305)

  • Migrated the chip, badge and divider components out of PrimeVue. (19292)

  • Migrated the color input component out of Wijmo. (19566)

  • Migrated the dropdown menu and context menu components out of PrimeVue. (19243)

  • Migrated the group-box component out of PrimeVue. (19567)

  • Migrated the modal component out of PrimeVue. (19677)

  • Migrated the password input component out of PrimeVue. (19286)

  • Migrated the popover component out of PrimeVue. (19240)

  • Migrated the select button component out of PrimeVue. (19303)

  • Migrated the time input component out of Wijmo. (19304)

  • Migrated the timeline component out of PrimeVue. (19294)

  • Migrated the toast component out of PrimeVue. (19623)

  • Moving an entity, an entity view or a server method with neos dependencies move now moves its rule files or its implementation file, with their unit tests, to the business assembly of the same layer in the target module, and gives them its namespace. (20743)

  • neos generate now builds the server projects when the code of a business assembly changed since the last build, without --rebuild. (19993)

  • neos generate reports the new warning M0110 for a ProjectReference of a business assembly that reaches a dependency module through the dependencies folder instead of $(<Module>ModuleDirectory) — see Module dependencies. (20665)

  • neos generate reports UI template references to a module that is not a declared dependency as warning M0105, and references to an Internal element without access as warning M0106 instead of an error (see Generation message level configuration). Neos Audit counts them in the Boundaries category. (20426)

  • neos run stops with a clear message when a port of its URLs is already in use, and lists the configuration folders read when the PersistenceType or ConnectionString variable is missing. (20328)

  • Rebuilt the progress bar component without its previous third-party UI library dependency, with no visual or functional change. Added value-background, corner-radius, label-color, and label-outside-color attributes on progress-bar component to set the fill color, corner radius, and percentage label color (inside and outside the fill). (18710)

  • Removed the IsCustom property of theme colors: in a theme based on a standard theme, a color is standard when it has the name of a standard color or of a color of the base theme, so Neos Studio no longer lets it be renamed or deleted. neos migrate-metadata removes the property from the theme color files — see Standard colors. (20736)

  • Renamed device attribute of the grid-layout-definition element to viewport. Existing templates are migrated automatically. (19175)

  • Renaming a server method or a validation rule with neos dependencies rename now renames its files and those of its unit tests, with its class, its test class and its generated interface. (20743)

  • Renaming an entity or an entity view with neos dependencies rename now moves the files of its event and validation rules, and their unit tests, to the folders of its new name, and updates their namespaces. (20743)

  • Replaced colors that were hardcoded in some UI components by colors configurable in themes using new attributes:

    • Application: Background, Foreground
    • Calendar: Border, DayFocusBorder, FocusBorder, Foreground
    • Carousel: PaginationIndicatorFocusBorder
    • Chatbot: PromptDragActiveBackground
    • Checkbox, FrameNestedTab, FrameTab, SelectButton, TabItem, UserButton: FocusBorder
    • Datagrid: FormulaIcon, LinkCellForeground, NotLoadedBannerAccent, NotLoadedBannerBackground, TooltipBorder
    • Divider: ContentForeground
    • Dropdown: ItemIcon, ItemHoverIcon, ItemSelectedIcon, SubmenuLabelForeground
    • FilterBuilder: NamedFilterGroupBorder
    • GlobalSearch: ModalItemSeparator, ModalOverlay
    • Input: CalculableIcon, CalculableModeBorder, CalculableModeForeground, CalculablePreviewForeground, DropdownBackground, DropdownBorder, DropdownBorderRadius, DropdownForeground, DropdownPadding, DropdownItemBorderRadius, DropdownItemGap, DropdownItemPadding, LookupFreeValueForeground, PasswordIcon, UploadProgressBackground, UploadProgressBar
    • LoadingOverlay: Background, PanelBackground, PanelBorder
    • MarkdownViewer: CodeBlockBackground, CopyCodeButtonFocusBorder, CopyCodeButtonForeground
    • MessageModal: LogDebugForeground, LogErrorForeground, LogWarningForeground
    • Modal: Foreground, Overlay
    • PaginationBar: PageNumberBorder
    • PanelMenu: ItemFocusBorder, Overlay
    • SliderDiscrete: ThumbBackground
    • Timeline: ConnectorColor, MarkerContentBackground
    • Toast: ProgressBar
    • Tooltip: Background, Foreground
    • TreeView: NodeFocusBorder
      More details : 19037

  • Saving a non-editable reference whose key was reset now fails with an explicit, logged technical error naming the reference and the possible fixes, instead of a generic "entity view not found" message. (19348)

  • The Chatbot got the show-avatars, show-elapsed-time, prompt-placeholder and content-max-width attributes and the chatbot-messages-start child, to embed it in a custom panel without avatars, with its own prompt hint and a content at the start of the conversation. Its header band is no longer shown when it has nothing to show. While an answer is in progress, the agent message now shows three animated dots until the first text. (20707)

  • The InputNumber component has a calculable prop to type a formula, which replaces the InputNumberCalculable component. (19990)

  • The layout:width, layout:height, layout:min-width, layout:min-height, layout:max-width and layout:max-height directives now accept percentages of the parent size, such as 50% or 33.33%. (19582)

  • The AI agent evaluation projects now build the OpenAPI document of the application, so that the agents creating or proposing data can be evaluated. (19099)

  • The AI entities querier skill now queries the entities with OData queries translated into SQL, instead of C# scripts compiled by Roslyn. The read permission is checked on every entity used by a query, the returned rows are limited and the timeout cancels the query. (19895)

  • The AI personalization agent can now save the changes it applies (columns, filters, sorting, styles) into a custom view, updating the one already applied or creating a new one. (18788)

  • The anonymous routes of the gateway and of the development proxy accept * segments, each standing for one path segment such as the tenant (/*/api/v1/webhooks/public/*). (20510)

  • The color picker gives its value when the pointer is released instead of on each move while dragging. (20049)

  • The CSS of external libraries and of the Neos framework is now placed in the neos-vendor and neos-framework cascade layers, so the CSS of an application always takes precedence over them whatever the specificity of their selectors. (19399)

  • The font size, font weight and border width of the datagrid header and summary cells, the text color of the totals row, the font, padding and border of the summary cell tag, and the color of the time below the chatbot messages, can be set in the theme. (20667)

  • The Helm value gateway.contentSecurityPolicyEnabled set to false disables the Content-Security-Policy of the Gateway. (20070)

  • The row actions of a datagrid in card mode are now displayed at the bottom of each card. (20043)

  • The row actions of the datagrid can be reached and run with the keyboard: Tab moves from the cells of a row to its actions, and Enter or Space runs the focused action. (20044)

  • The up and down arrows of the Chatbot prompt recall the messages already sent. (20663)

  • Transpilation of types in the UI code:

    • added Record<TKey, TValue> support, transpiled to a TypeScript Record and used to serialize a dictionary to JSON (see documentation)
    • improved IReadOnlyDictionary<TKey, TValue> with Count and fixed conditional access x?.Method() on a generic type (for use with the TryGetValue method of a dictionary for instance).
      More details : 19988

  • UI automation tests can read the state of a web-view component through IWebViewComponent, which tells whether its page is loading and which URL it shows. (20112)

  • Updated Stimulsoft library from version 2026.1.3 to version 2026.4.1. (19489)

  • When a UI automation test fails with Chrome or Edge, the verbose log of the web driver is saved next to the screenshot in NEOS_AUTOMATION_SCREENSHOTS_FOLDER, without the values that the test types or reads. See this article. (20141)

Fixes

  • [Docker] Upgraded frontend base image to nginx:1.30.5-alpine-slim. (18957), closes 36680
  • [Neos Studio] Fixed default status pages missing in development mode. (18830)
  • [Automation tests] Fixed data-grid empty-row waits to poll until row removal is reflected. (18822), closes 36470
  • [Docker] Upgraded .NET runtime base image to mcr.microsoft.com/dotnet/aspnet:10.0.12-alpine3.24. (19319)
  • [Docker] Upgraded .NET runtime base image to mcr.microsoft.com/dotnet/aspnet:10.0.13-alpine3.24. (19842)
  • [Docker] Upgraded frontend base image to nginx:1.31.6-alpine-slim. (19319)
  • [License Management] Fixed the API allowing the customer or the commercial solution of an existing license to be changed. Such a change is now rejected. (19968), closes 38108
  • [Neos AI] Fixed keyboard navigation with the Tab key skipping a neos-ai-rich-text-editor without a tab-stop attribute. (20096), closes 37425
  • [Neos AI] Fixed the automatic detection and the display of a markdown value returned by a function in the function call details. (19209), closes 36979
  • [Neos AI] Fixed the casing of the native UI views directory. (18665), closes 36200
  • [Neos AI] Fixed the display of a JSON or XML question and answer in the conversation tracking. (19793), closes 37826
  • [Neos AI] Fixed the documentation of token prices, which did not state that prices are per million tokens. (19803), closes 37842
  • [Neos AI] The email analysis no longer created an entry from an email which did not contain the expected information, such as a newsletter. (19053)
  • [Neos AI] The navigation assistant could refuse to open a view on an identifier given in the request, or open the messages of a conversation thread without restricting them to that thread. (19103), closes 36974
  • [Neos AI] The text corrector could fix the spelling of a word while leaving the sentence grammatically incorrect. (19103), closes 36974
  • [Neos Copilot] Fixed skills that referenced a removed command, broken file links, outdated module dependency checks and resources unavailable from a user's cluster. (19647)
  • [Neos Data Exchange] Fixed a French spelling mistake in the title of the import settings screen. (19310), closes 37199
  • [Neos Data Exchange] Fixed accented characters in data import: the sample file now opens correctly in Excel, and a CSV file saved by Excel in Windows-1252 is no longer rejected. (20732)
  • [Neos Data Exchange] Fixed the raw English error messages shown when an import file is rejected: a duplicate column in the header and required columns missing from the file are now explained in the user's language, and unexpected errors start with a translated message. (20802)
  • [Neos Data Exchange] Restored sample-file downloads after switching import templates. (18624), closes 36125
  • [Neos Manager] Fixed the errors card of the dashboard, too small to read its errors when the request detail had many lines: a resize bar now separates the two areas. (20828), closes 39129
  • [Neos Notification Center] Toasts and action buttons of the notification center now display texts in the cluster's default language when no translation exists in the user's language, instead of an empty text. (19067), closes 36764
  • [Neos Shared UI] Fixed the tab navigator's Previous/Next buttons being shown disabled instead of hidden when navigation through them is not intended. (18716), closes 29158
  • [Neos Studio VSCode extension] Fixed an error when opening the entity view UI. (18607), closes 35637, 36060, 36099, 36103
  • [Neos Studio VSCode extension] Fixed serialization error (Seroval error) raised when saving the view state while a validation message was displayed. (19092), closes 36838
  • [Neos Studio VSCode extension] Fixed Seroval error when opening a lookup modal. (18854), closes 36416
  • [Neos Studio VSCode extension] Fixed the list opened by the "View all N items" entry of the quick search, which was displayed empty. See Search. (19847)
  • [Neos Studio] Added a generation warning to report the placeholder ignored attribute, as for the other attributes supported only on unbound inputs. (18927), closes 36602
  • [Neos Studio] Changing the module of a menu item, an interface or a style class no longer moves the menu entries, interface implementations or theme style class targets that belong to another element. (20558)
  • [Neos Studio] Fixed an error wrongly reported on an entity view property whose value was actually valid, which remained visible until another property row was selected. (18916), closes 36554
  • [Neos Studio] Fixed API path classification so client files sharing an API-prefix name were no longer treated as API requests. (18765), closes 36370
  • [Neos Studio] Fixed rejection of long expression-based UI property formats when saving. (19976), closes 37832
  • [Neos Studio] Fixed the "Data type" field being required when saving a UI view property bound to a reference property of its entity view. (19756), closes 37518
  • [Neos Studio] Fixed the "Display differences (external tool)" and "Merge help (external tool)" actions of the overridden metadata screen, which failed with a technical error on an empty value or on a git tool command not starting with the quoted tool path. An incomplete git configuration now displays a message explaining the expected setting, see Metadata overriding. (20084), closes 38196
  • [Neos Studio] Fixed the C# full name being left as ... when opening an entity. (18647), closes 36156
  • [Neos Studio] Fixed the entity view tree view highlighting the header for an error on a property, parameter or rule. (20115), closes 38301
  • [Neos Studio] Images created by the AI assistant from a description in another language could be named in that language instead of English. (19103), closes 36974
  • [Neos Studio] Preserved overridden inherited UIView action function permissions across saves. (18526), closes 34285
  • [Neos Studio] Prevented metadata generation from creating a table for an abstract entity without a table or persistence inheritance pattern while continuing to generate its children. (19097), closes 36740
  • [Neos Studio] The image creator no longer generated SVG images containing scripts or event handlers. (19053)
  • [Reporting] Fixed report generation failing with "The generation failed while applying styles." when a 3.2 reporting service served a business cluster older than 3.2. (18858), closes 36476
  • [Reporting] Fixed system fonts not being embedded in a PDF report generated right after the report server restarted, on Linux. (19557), closes 37336
  • [Task Scheduler] Fixed StyleCop warnings raised when the TaskSchedulerClient or TaskSchedulerShared module was referenced from another cluster. (18572)
  • [Task Scheduler] Fixed the "Recent" tab of the dashboard, which loaded slowly and could overload the database by reloading in a loop on every task execution notification. (19805), closes 37846
  • [Technical Demos] Fixed the Oracle migration and enabled retries after partial programmable-object creation failures. (19059), closes 36569
  • [Tenant Management] Fixed the "This email address is not valid" error when creating a tenant with a user whose login is not an email address: the users of a new tenant have an optional email address. (20287), closes 38512
  • [Tenant Management] Fixed the additional properties of a tenant being kept when the tenant was deleted from its edition screen. (20458), closes 38341
  • [Tenant Management] Selecting a connection settings tab right after changing a database server's type no longer switches back to the Main tab or builds the connection string from the previous type's settings. (19074), closes 36906
  • [UI Customization] Enabled custom-view editing for nested subviews. (19003)
  • [UI Customization] Fixed custom view editing when inherited subviews were disabled and preserved their saved settings. (19050)
  • [UI Customization] Fixed erroneous frozen-column warnings when saving an unchanged custom view. (18896), closes 36515
  • [User Permissions] Fixed StyleCop warnings raised on the Permission partial class file when referenced from another cluster. (18572)
  • [User Permissions] Fixed the automatic creation of a user account (CreateUserAccountIfNotExists), which never happened when the user's permissions were already cached. (20367), closes 38604
  • [User Permissions] Fixed the generation of a module that references UserRoleView, which produced code that failed to compile. (19768), closes 37754
  • [User permissions] Removed the alternate key and the unique index on the localizable user role name, which was stored as JSON and could not be indexed directly. Role names are no longer required to be unique. (19043)
  • A child of a canvas layout is now always drawn over the content of the children written before it, even when that content has its own stacking order. (20718), closes 38964
  • A datagrid lookup cell could briefly display the value of another row after scrolling. (20049)
  • A variable passed as an out or ref argument inside a nested block (if, else or loop body) of client-side C# code is now correctly transpiled as a reference. (19846), closes 37873
  • A view opened in a view-container no longer replaces the view displayed in the container with the same identifier of another tab: each open view has its own containers. (20042), closes 38226
  • Added an option to neos run so it can stop itself automatically when its owning process exits, preventing orphaned proxy server processes. (18946), closes 36618
  • After logging out of an application served under a path prefix and logging in again, the user now returns to the page they left instead of the root of the domain. (20771), closes 39068
  • Applied row style backgrounds to datagrid system columns. (18951)
  • Changed read-only and disabled comboboxes and multi-selects to show the default cursor on hover. (20519), closes 38713
  • Clearer error message when running neos run without a completed neos setup for the current Neos version (Dapr mode or not). (18598)
  • Clicking an action button placed inside a clickable element no longer triggers the click of that element. (19580), closes 37484
  • Compilation errors reported during neos generate are now parsed and coded individually instead of being duplicated as raw uncoded text for each failing build. (18754)
  • Datagrid color, file and localizable string cells displayed their value as HTML instead of plain text. (20049)
  • Disabled SQL parameter values logging outside of development, where they could expose sensitive or personal data. (19691), closes 37636
  • Double-clicking an editable datagrid cell no longer opens the editing view of the row. (19791)
  • Enabled drag-and-drop file attachments in the chatbot prompt. (18926)
  • Excluded the primary key from update request models for entities bound to a relational database table, and reapplied its real value from the URL before any nested collection is processed, so a mismatched or missing id in the payload can no longer corrupt the entity's identity or its children's reconciliation. (18677)
  • Fixed event:click directive on combobox component. (18607)
  • Fixed neos build client failing when the UI packages of the cluster's modules had no installed npm dependencies. The command installs them before the build, as neos run does. (20386)
  • Fixed neos check-metadata --fix command to preserve language files in referenced modules when the cluster did not use their language. (19985), closes 38140
  • Fixed neos dependencies set-accessibility command to no longer rewrites the C# code when the metadata changes cannot be saved. (20434)
  • Fixed neos dependencies set-accessibility command to no longer rewrites unchanged metadata files, such as the module files of referenced read-only modules. (20434)
  • Fixed neos setup failing when a preview or release candidate .NET SDK is installed: such SDKs are now ignored and a supported stable SDK installed alongside is detected. (20165), closes 38346
  • Fixed ThemeManager.GetCurrentTheme() returning a copy of the applied theme instead of the applied theme itself. (UI code only) (20616), closes 38620
  • Fixed a browser tab that froze when a popup showing a Neos application in an iframe, such as the preview of a tenant theme, was closed while this application was starting. (20167), closes 38348
  • Fixed a bug where a string value equal to "Null", "NULL" or "~" was saved without quoting in YAML metadata files and silently turned into an empty value when read back, which could later break code generation. (18694), closes 35543
  • Fixed a button's label being unexpectedly centered instead of left-aligned once it wrapped onto several lines. (18655), closes 30855
  • Fixed a crash that could occur when resizing a chart while it was being redrawn after a data change. (18944), closes 36648
  • Fixed a font embedded as a report resource and applied through a report style being replaced by another font in the first PDF generated after the report server started. (19728), closes 37396
  • Fixed a heading or a paragraph stuck to the code block above it in the Markdown viewer. (20788), closes 39082
  • Fixed a remaining crash in the shared Chart component's annotation plugin, triggered by a resize during the chart's very first layout pass. (19012), closes 36748
  • Fixed a report or report style file modified outside Neos Studio not being taken into account by the running application until the next action in Neos Studio. (19368)
  • Fixed a scrollbar flashing on an element whose animated size changes while its classes change. (19644)
  • Fixed a technical error raised when filtering a string property with a value that looked like a GUID or a date. (19234), closes 36982
  • Fixed a text size in pixels bound to a text field being ignored by the text and progress bar components. (19314), closes 37209
  • Fixed a typed catch clause without variable in client C# code, which caught every error instead of only the specified exception type. (19375)
  • Fixed a view field of a non-nullable date type causing the view to crash on opening because of a missing import in the generated view model. (19279), closes 37156
  • Fixed a view opened with WithContainerId toward a container that is not displayed, which was not shown. It now opens in a tab of the main container. (20820), closes 38683
  • Fixed actions of the main UI view being hidden for users without an explicit permission on that view. Actions restricted by their own function remain hidden. (19444), closes 37309
  • Fixed an InvalidCastException thrown by the E2E UI automation framework when searching components of a type whose tag is also used by another type, such as headings and texts. (20203)
  • Fixed an action clicked from the notification center panel opening its screen in a popup instead of a new tab. (19776), closes 37534
  • Fixed an API error when POSTing an entity view where a required boolean property with no value was omitted. Before 3.2, this specific case was handled. To avoid introducing this breaking change, we are restoring the specific handling for this case. For all other types, a default value must be set on the required property if you want to be able to omit it. (18661)
  • Fixed an error when saving large JSON content on SQL Server or Oracle databases: JSON columns now use an unlimited-length column on SQL Server and the native JSON type on Oracle. (18902), closes 35612
  • Fixed an intermittent server error when two clients requested the list of AI agents at the same moment right after a server start. (18990), closes 36712
  • Fixed an internal error returned when sorting a list whose entity view declared a collection that is not loaded on read (LoadedOnGet set to false). (18761), closes 36308
  • Fixed an invalid datagrid width such as *2 being silently accepted by the generator and crashing the grid at runtime. The generation now reports an error. (20229), closes 38251
  • Fixed an issue where the first column of a grouped data grid could be truncated. (18607)
  • Fixed an issue with modifying the filter when entering a value in the quick search input: a new filter instance is assign instead of mutating the current filter instance. (18607)
  • Fixed an issue with opening the dropdown of a lookup in combobox mode within an editable data grid. (18607)
  • Fixed background server methods staying pending with neos run when Neos Studio is not started: the development proxy now starts the task runner on the first background server method call. (20327)
  • Fixed chatbot stream failures to show an inline error and end the waiting state while preserving partial responses. (20556), closes 38808
  • Fixed chatbot streaming requests timing out or being buffered during long-running responses. (18753)
  • Fixed combobox focus border to be consistent with other inputs. (19037)
  • Fixed DateTime formatting so that standard .NET format specifiers (such as "d" or "t") now render the same result as in .NET, instead of silently showing incorrect data or causing a technical error. (18782), closes 36253
  • Fixed drag and drop: moving a drag between two adjacent drop targets now calls the handlers of both, and a drag from outside the page no longer exposes the object of a previous drag. (19644)
  • Fixed dropping files dragged in Safari. (20577), closes 38846
  • Fixed E2E automation of the advanced filter failing to click its Apply and back to simple filter buttons when it shows many conditions. (19376)
  • Fixed empty area when the datagrid in card mode has no data. (18717)
  • Fixed group headers showing the enumeration code instead of its label when the grouping was added by UI code with a property name in another casing. (20177), closes 38352
  • Fixed JSON inference of ISO date-only values so they deserialize as DateOnly. (18676), closes 36190
  • Fixed loading and waiting overlays appearing behind frozen Datagrid headers. (20433), closes 38136
  • Fixed lookup display labels and string-array parameters in server-side CSV exports. (19481), closes 37359
  • Fixed markdown viewer code blocks which now display non-highlighted code in a readable color. (19711)
  • Fixed markdown-viewer rendering of text starting with horizontal rules when the intervening content was not valid YAML. (20414), closes 38654
  • Fixed migration command insertion before the first or after the last command of a specified type, including migrations with preliminary commands. (19463), closes 37320
  • Fixed missing generation error for a directive bound to an unknown value. (19644)
  • Fixed next-position navigation to load remaining pages in partially loaded server-side datagrid groups. (18648)
  • Fixed Oracle migrations that dropped and recreated unchanged tables and altered unchanged columns at each run: computed columns and decimal columns without decimals are now compared correctly. (19180), closes 37024
  • Fixed redundant SQL joins for fully materialized Entity View collections. (18284)
  • Fixed report URLs being truncated when the filter, culture or styles bundle name contained a reserved URI character such as '#'. (18823), closes 36404
  • Fixed routing via Neos gateway version 3.2 for SignalR clients on version 3.1/3.0. (18630), closes 36126
  • Fixed save errors on an item of an embedded collection being reported on the saved item instead of the item and field they concern. (20115)
  • Fixed server-side CSV exports to use localized booleans, grid captions and lookup labels, limit selectable columns, and localize failure notifications. (19483), closes 37359
  • Fixed server-side lookup display values for columns sourced through entity references. (19495), closes 37359
  • Fixed several StyleCop/Roslyn warnings raised by code generated by neos generate (empty string literals, obsolete member suppression, generated EF Core query expressions, and undocumented generated fields). (18933)
  • Fixed size directives (layout:width, layout:height and their min/max variants) on action and menu buttons, which were applied to each inner part of the button instead of the whole button. (19635), closes 37495
  • Fixed tab dividers disappearing when the browser was zoomed out. (19046), closes 36797
  • Fixed tabs sometimes keeping the wrong content associated with the wrong tab header after tabs were dynamically added or removed from a list. (19142)
  • Fixed the input-number component with update-mode="immediate" not refreshing its displayed value when a UIViewAction reassigned it to a value already known internally. (18973), closes 36679
  • Fixed the neos dependencies unused command failing with a NullReferenceException on clusters containing elements whose name includes a dot. (19276), closes 37168
  • Fixed the authentication failure of MCP clients that strictly validate the authorization server metadata (such as the MCP Inspector) when using Azure AD B2C. (19176)
  • Fixed the automatic NotEmpty check constraint rejecting some non-empty strings on SQL Server and PostgreSQL depending on the database collation, and aligned SQL Server with the other databases by accepting whitespace-only strings. (19485), closes 37295
  • Fixed the badge of a button being cut off while the button is loading. (19278), closes 37173
  • Fixed the call of an Oracle scalar function programmable object that modifies data, which failed with the error ORA-14551. (20442), closes 38666
  • Fixed the card mode of a datagrid ignoring disabled infinite scrolling, which loaded the next pages on scroll and showed no card when the grid had no fixed height. (19581), closes 37428
  • Fixed the chatbot component showing an agent selector with no agent when its agent-ids were bound to a value still empty when the agents loaded. (20149), closes 38338
  • Fixed the check constraints on the minimum and maximum values of properties being dropped and created again at every database migration on PostgreSQL and SQL Server. (19532), closes 37399
  • Fixed the code editor suggestions appearing far from the cursor when the code editor was displayed in a modal. (19369), closes 19616
  • Fixed the combobox displaying [object Object] when its value is an object that is not one of its options. (20616)
  • Fixed the creation form opened empty by the data creation AI agents when the model wrapped the data in an object named after the creation schema. (20538), closes 38795
  • Fixed the CS0108 warning raised on generated code when an entity view implements an interface that declares a reference or a collection with the same name as one of its navigation properties. (19804), closes 37799, 37800
  • Fixed the CS1570 warning raised on generated code when the description of an enumeration or the caption of one of its members contains a < or & character. (19804), closes 37799, 37800
  • Fixed the datagrid selection and row context menu commands acting on an outdated selection when an item selection rule takes time. (19791)
  • Fixed the display of a filter that was supposed to be invisible on the chip of a property displayed in the filter bar. (18661), closes 36185, 36193, 36194
  • Fixed the empty UI of a tab opened at startup when closing the active tab that was immediately after it. (18661)
  • Fixed the Enter key moving to the next row instead of the next cell from a lookup cell of an editable datagrid when the "Enter key acts as Tab" option was enabled. (19206), closes 36790, 37042
  • Fixed the excessive memory usage of the AI entities querier skill, which could make the application restart, and limited the number of rows returned by its queries. (19655), closes 37570
  • Fixed the first opening of a nested cluster UI view, whose view models were created before the languages, resources, context and permissions of the nested cluster were loaded (for example, a localizable string field opened in the default language). (19917)
  • Fixed the generation deleting the files it had just generated when a metadata element was renamed with only a change of casing on Windows. (20002), closes 38151
  • Fixed the generation of an entity global filter that queries the database, which failed to compile when the entity had a read-only view. (20103)
  • Fixed the hot reload of business assemblies during neos run: modules whose bin directory is moved to the businessAssembly directory are reloaded, and the DLLs of referenced modules are no longer copied as if they had just been built. (19930), closes 38026
  • Fixed the input schemas of the generated MCP tools so that nullable properties and row versions are described in a form accepted by more MCP clients. (19361)
  • Fixed the label of a radio option wrapping under its radio button on narrow screens for comboboxes and checkboxes displayed as radio buttons. (19365), closes 36798
  • Fixed the loss of authentication when navigating between several applications hosted on the same machine with HTTP.sys. (19233), closes 36988
  • Fixed the main authentication cookie being scoped to the cluster's URL prefix instead of the site root on prefixed (host/prefix) deployments, which caused every API request to fail with a 401 error after a successful login. (18779), closes 36392
  • Fixed the MCP endpoint so a client authenticated through the NeosDevAuth development server is identified, and so an unauthenticated call is answered with a 401 that starts the client's OAuth flow. (19308), closes 37115
  • Fixed the MCP endpoint so external OAuth clients can discover the real Azure AD B2C authorization server and complete the authorization code exchange as a public client, instead of failing with an invalid client_secret error or being redirected to the application's sign-in flow. (18711)
  • Fixed the modal retrieval of the UI automation framework, which could return a modal during its opening animation and lose the focus of the element clicked right after. (19204), closes 37065
  • Fixed the notification center keeping the former icon and caption of a notification category after they were changed in its registration. (19896), closes 37750
  • Fixed the progress bar's percentage label becoming unreadable or invisible at very low values: it now automatically renders next to the fill, on the track, instead of being clipped. (18710)
  • Fixed the Querya agent calling the query tool directly on a non-existent 'Entity' entity instead of exploring the available entities first. (19203)
  • Fixed the quick search not filtering the cards of a datagrid displayed in card mode. (20183), closes 38356
  • Fixed the report designer not opening when running with Dapr and no cluster-level default report style is configured. (19104), closes 36850
  • Fixed the rich text editor staying light when the current theme is dark. It now also looks like the other fields. (20170)
  • Fixed the scrollbar that appeared under the discrete slider when its markers overflowed the component. (20703)
  • Fixed the SignalR connection being closed on deployed applications when the browser returned a value containing an enumeration to the server. (19045), closes 36799
  • Fixed the splitter panels not filling the full height of the splitter on Firefox. (19197), closes 36741
  • Fixed toasts overflowing the screen on mobile. (20077), closes 38235
  • Fixed transpiled integer division so it truncates toward zero like C# instead of producing a floating-point value, and added support for transpiling Math.Truncate. (18714), closes 36254
  • Fixed values longer than the maximum length of a String, StringArray or LocalizableString property not being reported on the client: a value set by code, such as the text pre-filled in the creation view of a lookup, is now shown as an error on the field and blocks the save. (20282), closes 38300
  • Fixed values of the application context containing a literal %xx sequence being decoded twice when propagated to another cluster (remote service calls, event publications and background tasks). (19302), closes 37177
  • Fixed XML code blocks being unreadable in the chatbot, their text having the same color as the background. (19206), closes 36790, 37042
  • Generation now reports a warning when a declared ServerMethod has no matching implementation file, instead of silently omitting the method from the generated interface. (18829), closes 36252
  • Global filters that check a function with FunctionAuthorizer now see the permissions of the user in background methods and in the scopes created by business code. (20152)
  • Improved the readability of Markdown content: tables now have borders, a header, alternating rows and horizontal scrolling, very long words wrap instead of overflowing, and code blocks are readable in dark themes. (19952), closes 38070
  • In card mode with infinite scrolling, the next page is now loaded only when the list is scrolled to the bottom, not whenever scrolling stops. (20619)
  • In card mode, an input in progress in a card is no longer lost or moved to another item when an item is inserted before it. (20619), closes 38841
  • In the filter bar, clicking a value of an enumeration property with the "in" or "not in" operator no longer unselects the other values. (19723)
  • Increased the default AI provider network timeout to five minutes and added configurable timeouts per model and provider. (19479), closes 37366
  • MCP tools now apply the function permissions (AuthorizeResource) like the REST API: a tool the user is not allowed to call is hidden from the tool list and its call is rejected. Regenerate the clusters after upgrading: MCP-only resources and public server methods depend on the generated code. (19283)
  • Message box and error box buttons are now stacked at full width on narrow screens instead of wrapping over several misaligned lines. (19810), closes 37850
  • On mobile, adding a card to a datagrid in card mode with infinite scrolling now scrolls to the new card instead of stopping on the previous one. (20619)
  • Prevented images from shrinking beside long text. (20118)
  • Reduced the size of the badge of small and extra small buttons, with a minimum size to keep it legible. (19278), closes 37173
  • Restored the ability to call LocalizableString.GetTranslationOrDefault with only localization settings in server-side code, by adding a GetTranslationOrDefault(ILocalizationSettings) overload. (20247)
  • Row actions displayed over a datagrid row now have an opaque background covering the whole row, so the content of the covered cells no longer shows through them. (19645)
  • Smart search could return no filter for a question about a computed value of a field, such as the number of characters of a text. (19103), closes 36974
  • The full value of corner-radius now rounds both ends of a non-square element into a pill shape instead of drawing an ellipse. (19326), closes 37212
  • The browser context menu no longer opens in the datagrid, except in a text field. (19791)
  • The chart component's canvas could get stuck at an outdated size after a fast, continuous window resize, causing a neighboring card to remain wrapped onto its own line even when enough space became available again. (18783), closes 36255
  • The dependencies of a constants static class no longer list code that does not use the class. (20743)
  • The generated controller of a server method that has a CancellationToken and optional parameters now compiles, without having to give the token an explicit default value. (19854), closes 37872
  • The message asking to refresh the page is displayed again when opening a view fails after the application has been redeployed, instead of the tab silently disappearing. (19405), closes 37277
  • The notification center can now be closed on mobile with a close button, and its headers no longer break over several lines on narrow screens. (19911)
  • The rich text editor no longer logs a TinyMCE deprecation warning about the content_css_cors option in the browser console. (20613), closes 38840
  • The validation tooltips of a datagrid could disappear when another datagrid was closed. (20049)
  • Two clusters run with Kestrel at the same time on different ports no longer sign each other out. (20311), closes 38818
  • UI templates with several root elements no longer lose the root elements that follow a self-closing second root element, and an else or else-if following a self-closing if at the root level no longer fails the generation. (19770), closes 37681
  • Upgraded the recommended .NET SDK to 10.0.401. (19319)
  • Upgraded the recommended .NET SDK to 10.0.402. (19842)