Neos 3.2 highlights

Key insights

Welcome to the 3.2 release of Neos. There are many updates in this version that we hope you'll like, some of the key highlights include:

Neos Copilot

Neos Copilot, the AI coding assistant that helps you build Neos clusters from Claude Code or GitHub Copilot, has changed a fair amount since its 3.0/3.1 alpha. It's now organized into 8 focused skills — cluster bootstrap, metadata authoring, generation, theming, and more — instead of one monolithic prompt, its framework knowledge has been extended, and safety hooks now catch an invalid YAML file the moment it's saved and block writes into generated code outright. It's also available for Claude Code as well as GitHub Copilot.

See Neos Copilot for what it is and how to get it running on an existing cluster.

Upgraded to C# 14

Now, the generated projects and business assemblies uses C# 14. This lets you use new language features, such as the field keyword.

The UI code transpiler also now targets C# 14 (previously C# 12). No new C# 13 or 14 language features are supported by the transpiler itself. The new native method signatures introduced by these versions may also cause transpilation issues.

See Upgrade troubleshooting for known migration issues.

Removed Newtonsoft.Json usage to only use System.Text.Json

Newtonsoft.Json and System.Text.Json are two JSON serialization/deserialization libraries. The framework used to rely on both: mainly Newtonsoft.Json, but also System.Text.Json in a few places.

System.Text.Json has since matured into a more performant library and become the most widely used one, so we removed Newtonsoft.Json to rely exclusively on System.Text.Json.

This also removes a source of compatibility issues: several dependencies (including Dapr) use System.Text.Json internally, and having Newtonsoft.Json alongside it in the same process could lead to conflicts.

You can still use Newtonsoft.Json in your business assemblies for manual JSON serialization/deserialization. However, we recommend migrating to System.Text.Json so that only a single library is used, for performance, consistency, and maintainability reasons.

Even though we made sure JSON serialization and deserialization behave as before, we may have missed some edge cases. Please report any such issue as soon as possible.

  • Framework projects no longer depend on Newtonsoft.Json. If the code of your business assemblies references Newtonsoft.Json, a metadata migration automatically adds the Newtonsoft.Json package reference to the corresponding business assembly .csproj file. However, in some specific cases, the migration may not be able to do so. If this happens, add the Newtonsoft.Json package reference manually to the business assembly C# project.
  • The Newtonsoft.Json converter for LocalizableString has been removed. Newtonsoft.Json serialization or deserialization of objects containing LocalizableString properties in your business assemblies no longer works automatically. You can copy the former converter into your business assembly and pass it explicitly when serializing or deserializing. See Maintain compatibility with existing Newtonsoft.Json code.
  • A server method expecting an object parameter is now of type System.Text.Json.JsonElement instead of Newtonsoft.Json.Linq.JObject.
System.Text.Json breaking changes

While migrating, we noticed a few behavioral differences between Newtonsoft.Json and System.Text.Json that are worth being aware of:

  • The required keyword is honored. System.Text.Json enforces C# required properties and throws if they are missing from the JSON payload, while Newtonsoft.Json has no built-in support for this keyword.
  • A set or init accessor is required for deserialization. System.Text.Json needs a settable property to deserialize into it, whereas Newtonsoft.Json can populate a read-only property.
  • Deserializing into object does not infer the runtime type. Newtonsoft.Json infers concrete .NET types (string, long, bool, …) when deserializing into an object, while System.Text.Json always deserializes into a JsonElement. As a consequence, deserializing into a Dictionary<string, object> yields a Dictionary<string, JsonElement> instead of a dictionary with native .NET types as values.
  • Deserialization is stricter regarding type conversions. System.Text.Json does not allow deserializing a number into a string property (and vice versa), while Newtonsoft.Json performs this conversion implicitly.

Regarding this last point, we ran into it when a cluster published a pub/sub message with a payload object containing an int property, while another cluster subscribing to that pub/sub declared the same property as a string in its matching payload object. Deserialization of the payload failed because the value was a number while the corresponding property was of type string.

If you run into such issues, which only surface at runtime, we added a LooseJsonDeserialization option (to set as an environment variable or in the appsettings file) that enables a more lenient deserialization to quickly unblock this kind of issue. This option allows:

  • deserializing a string value into a number (int, decimal, ...) or bool property
  • deserializing a number or bool value into a string property

Even if the option can help, we recommend fixing the underlying issue instead so that the option can stay disabled and deserialization performance is not degraded.

Web API

Evolving API routes without breaking consumers

Neos 3.2 lets you evolve the REST surface of entity views and server methods without breaking already-integrated clients. Instead of editing a route (a breaking change), you add a new route alongside the old one and deprecate the old one, so consumers migrate at their own pace. Each additional route can also be refined independently — restricted to local callers (Internal use only), hidden from the API explorer (Display in API explorer), or marked obsolete (the generator emits [System.Obsolete(...)], reported as deprecated in OpenAPI / Swagger).

Entity view routes

An entity view operation type (GetAll, Get, Put, …) can now expose several API routes at once, added in bulk from the Web API panel. The route at the controller path stays the technical route used by the application's own screens; the additional routes are the ones you version and deprecate (for example addons/v2 next to addons). Per-route options apply only to additional routes, and marking the entity view itself obsolete propagates to every route.

See Web API and routes, Per-route API-surface options and Deprecating a route.

Server method routes

A server method is no longer limited to a single route: you can add complementary routes that invoke the same business code, each with its own path, verb, options and deprecation. They are purely additive — the primary route keeps working — and a Set as primary route action swaps a complementary route with the primary one for a progressive migration. Conflicting routes are detected at generation time, and marking the server method itself obsolete deprecates all of its routes.

See Complementary routes.

Property omission in POST and PUT requests

Neos now gives callers more flexibility when constructing API payloads by relaxing the rules around which properties must be explicitly included.

Required properties with a default value can be omitted from POST

Required properties that carry a default value no longer need to be included in the request body.

If the property is omitted, the server applies its declared default value automatically.

To force a property to remain explicitly required in POST requests, check the Required in POST option in the Web API tab on the entity view property in Neos Studio.

Omitted properties in PUT retain their current value

Any property that is absent from the PUT body is now left unchanged.

Previously:

  • A required property had to be present.
  • Omitting non-required property would reset it to its default value.

This change makes partial updates safer and more predictable.

Server method authorization check in client code

Client code can now check ServerMethods.{ServerMethodName}.IsAllowed() before calling a server method. It checks whether the current user is authorized to execute the corresponding server method, and avoids triggering an API call that would otherwise fail with a 403 Forbidden response.

For more details, see Calling the server method from the client.

Persistence

Reading an entity's original value from a rule on an abstract entity

Saving rules and validation rules declared on an abstract base entity can now read an entity's original (pre-modification) value. This was previously impossible: a rule typed on the base entity could not obtain a repository — only concrete IRepository<ConcreteEntity> are registered — and the repository was the only way to call GetOriginal.

Saving-rule arguments now expose args.GetOriginal(item) (typed) and args.GetRepository(item), and validation rules expose the protected GetOriginal() and Repository helpers. The correct concrete repository is resolved per item at runtime, so a single rule on the base entity works across every derived entity — a natural fit for cross-cutting concerns such as a shared IsLocked guard. (Original-value access is not available in Saved rules, where the original values have already been persisted.)

For more details, see Event rules and Validation rules.

Filtered indexes

Neos 3.2 lets an index target only a subset of rows with a WHERE filter — a partial index on PostgreSQL and a filtered index on SQL Server — to keep indexes smaller and query plans sharper on targeted business cases. The filter is declared per engine (value and operator syntax differs across databases) and references columns with {Column} placeholders, which Neos substitutes with the correctly-quoted physical identifier for each engine. A filter may reference any column of the table, not only the index's key columns.

A filtered index is created only on the engines for which a filter is specified. Oracle has no native partial index, so a filtered unique index is emulated with a function-based unique index that preserves the partial-uniqueness constraint (a filter on a non-unique Oracle index is rejected). Filters are compared in a normalized form, so an index is not needlessly dropped and recreated on every migration.

See Filtered indexes.

User interface

UI template completions and diagnostics for current item access

The UI template editor now provides completions and diagnostics when you reference properties through @DatasourceCurrent.MyProperty and @Item.MyProperty.

This improves authoring by helping you discover available properties faster and by surfacing invalid references directly in the template.

After upgrading and regenerating, you may now see generation errors related to these new checks in templates that previously passed unnoticed.

These errors should be reviewed and corrected so the template references match existing properties.

Improved filters
Hidden filters

We have added the ability to define a hidden filter. This applies to filters added by code. Here is an example of code that shows how to define a hidden filter:

Filter filter = new Filter("Type", FilterOperator.Equal, "Client");
filter.Visible = false;
SetFilter(filter);

The filter will not be displayed to the user and they will not be able to modify it.

Hidden filters, like read-only filters, are not persisted in custom views.

Inactive filters

We also added the ability to disable a filter without removing it. Users can disable and re-enable a visible and editable filter from its chip.

Filters added by code can also be set as inactive:

Filter filter = new Filter("Type", FilterOperator.Equal, "Client");
filter.Active = false;
SetFilter(filter);

Unlike hidden and read-only filters, inactive filters are persisted in custom views.

Business validation rules on filters

Filters on view properties and entity view parameters could already be marked required, restricted to a set of operators, or given a default operator — but there was no way to validate the value itself against business rules (for example, checking that a start date is not after an end date).

FilterValidationRules on IViewModelFilterableAttribute closes that gap. A rule is a function that receives the current filter condition and returns null when the value is valid, or a validation message otherwise — reusing the existing validation-message types, so no new result or severity type is introduced. Rules are registered once in the Initialized event and re-evaluate reactively on every filter change; the first rule that reports a problem wins.

A failing rule colors the filter chip (red for an error, orange for a warning) and shows its message in a tooltip and in the filter's edit popup. An error blocks the search action until the value is corrected; a warning is purely informative.

For more details, see Filter validation rules.

Partial loading of UI view properties

A read-only list screen with many optional columns used to fetch every one of them on every request, even the ones the user never shows. A new AlwaysLoaded attribute on UIViewProperty (default true) lets such a screen opt a column out of that: set it to false and the GetAll request skips the property whenever it is not needed.

AlwaysLoaded: false only makes a property excludable — a Retrieving rule still decides, per request, whether to actually load it:

foreach (var property in GetProperties())
{
    if (!property.AlwaysLoaded)
    {
        property.ShouldLoad = property.DatagridVisible || property.UsedByApplicableUserStyleRule;
    }
}

DatagridVisible is the most common condition — load the column only while it's shown. UsedByApplicableUserStyleRule covers a less obvious case: a user-configured conditional formatting rule that reads a hidden column's value.

Reading such a property's value is restricted to a UIViewProperty Getter and a Computed's Getter — the only contexts where a possibly-missing value is expected. Reading it anywhere else (an event rule, a Setter, a style rule condition, ...) is a generation-time error rather than a silent runtime surprise.

When a not-always-loaded column is shown without its data — the first time a hidden column is displayed, or when a saved custom view surfaces it before the initial fetch catches up — the datagrid shows a dash placeholder for the affected cells and an informational banner offering to refresh.

AlwaysLoaded can never be set to false on an EntityView's key property, nor on a UIView that allows creating or updating data — either is a generation error, since the property must always be available to identify or save the record.

For more details, see UI view properties.

Improved frames-container tabs

Tabs in frames-container can now be reordered with drag and drop, making it easier to organize an active workspace.

In applications that use User Permissions module, users can also pin tabs so they are restored automatically when they start the application again.

Input slider discrete

This version introduces a new discrete slider input for both XML templates and native UI views. It lets users select a single numeric value or a numeric range from an explicit list of allowed values, while keeping the selection snapped to the nearest allowed item.

In XML templates, use input-slider-discrete. In native UI views, use InputSliderDiscrete.

This component is a good fit when a field should only accept known numeric steps, for example a score scale, a percentage grid, or a bounded range selector.

Reference retrieving when setting lookup values programmatically

The TrySet...Async methods now execute the ReferenceRetrieving event rule with the TrySet trigger when resolving a lookup value. This lets lookup rules apply the same constraints to values set programmatically as to values selected in the UI.

See ReferenceRetrieving.

Deployment

Migration from Kernel Memory to Vector Data

The Kernel Memory project is now deprecated. RAG (Retrieval-Augmented Generation) is now implemented with Vector Data.

If you previously used Neos RAG features with PostgreSQL Database, you must update your vector tables to include the following new columns:

  • document_id (text, nullable): The unique identifier of the document.
  • chunk_index (integer, not null, default 0): The index of the chunk within the document.
  • chunk_count (integer, not null, default 0): The total number of chunks in the document.

For example, if your vector table is named km-documents, run the following SQL command to add the new columns:

ALTER TABLE "km-documents"
    ADD COLUMN document_id text NULL,
    ADD COLUMN chunk_index integer NOT NULL DEFAULT 0,
    ADD COLUMN chunk_count integer NOT NULL DEFAULT 0;

See SearchDocumentSkill for more details on using the new Vector Data APIs.

Removed SignalR POD

The SignalR POD is no longer deployed in production. Production namespaces now run without a dedicated SignalR POD.

Warning

A namespace deployed with Neos 3.2 is only supported by Neos 3.2, 3.1, or 3.0 clusters. For Neos 3.0 and 3.1 clusters, patch versions 3.0.20 and 3.1.8 or later are required.

See SignalR with a Redis backplane for more details on how SignalR is now implemented in production.

Database connection pool metrics

Neos backend servers and task runners now expose normalized Prometheus metrics for their database connection pools. neos_db_pool_connections reports the current active and idle connection counts, and neos_db_pool_max_connections reports the configured maximum when the provider can supply it.

Note

Keep in mind that "database connection limits (whether resource-bound or configured)" and "database CPU/RAM resource saturation" are two different topics:

  1. Database connection capacity is a resource in its own right. It is constrained by PostgreSQL's connection slots and underlying OS/network resources, independently of CPU and RAM saturation.
  2. Your active connection count may plateau when it reaches your configured connection limit.
  3. Your active connection count may also plateau because of database CPU/RAM saturation, without reaching your configured connection limit.

An example of connection saturation / load testing was added in TechnicalDemos (DatabaseWorkloadDiagnosticsUI) and uses procedures and sleep instructions, for instance:

BEGIN
    PERFORM pg_sleep(10);
END;

The metrics are aggregated per provider and process, never per pool. This keeps tenant database identifiers out of metric labels and avoids creating one Prometheus series per tenant. PostgreSQL through Npgsql reports individual pools internally, which Neos aggregates before export, including the combined maximum. SQL Server through SqlClient provides only process-wide active and idle counters, so it does not expose a maximum series.

An absent maximum series is not a zero. For providers that expose it, operators can calculate saturation from the active count divided by the maximum; for SQL Server, the unavailable maximum must not be interpreted as zero or unlimited. Background server methods run in the task runner, so their connections are reported by the task runner's own metrics endpoint.

See Database connection pools and Database pool versus process scope.

PostgreSQL localhost connection timeouts after the Npgsql upgrade

Npgsql, the data provider for PostgreSQL, has been updated.

Depending on local network settings, PostgreSQL connection strings that use localhost as the host may now time out when opening a connection. The specific network settings that trigger this behavior have not yet been identified.

If this occurs, use one of the following workarounds:

  • Replace localhost with the IPv4 loopback address: 127.0.0.1.
  • Replace localhost with the IPv6 loopback address: ::1.
  • Add GSS Encryption Mode=Disable to the PostgreSQL connection string.

Metadata

Dependency analysis from the command line

Neos Studio's dependency analysis now runs from the command line with the neos dependencies command group, making it easy to keep a cluster healthy as it grows. Unused metadata tends to accumulate silently over time; now you can catch it automatically, before it ships.

Used in a pipeline, neos dependencies unused --fail-on-found fails the build whenever an unused element exists — so dead metadata is caught automatically instead of accumulating unnoticed.

neos dependencies unused --fail-on-found

Every command emits stable, deterministic YAML, so the same analysis is just as usable by your AI coding agents: they can see exactly what uses an element before renaming or deleting it, avoiding broken references.

See the full command group in the CLI reference.

Module accessibility

A metadata element can now declare Accessibility: Public (default) or Internal, and a module can grant targeted access to its Internal elements with InternalAccessGrantedTo. Marking an element Internal guarantees it's unused outside its module, so it can be reworked freely without risking a breaking change for consumers.

This is checked automatically almost everywhere a module boundary can be crossed:

  • Metadata (YAML) — check-metadata and Neos Studio's save pipeline (error N108).
  • C# code — new Roslyn analyzers NEOS0001-NEOS0003. Transpiled UI code is checked live in the Neos Studio editor and during neos generate; handwritten server code gets the same three diagnostics through Visual Studio's live analysis or Sonar in CI.
  • UI templates and free-text .NET type properties — neos generate messages: a warning for .NET type references (M0090/M0091) and for a UI template referencing a module it doesn't depend on, but a hard, unsuppressible error for a UI template referencing an Internal element without a grant.

See Module accessibility for details.

Neos Roslyn analyzers

A new GroupeIsa.Neos.CodeAnalysis.Analyzers package ships five diagnostics that catch classes of bugs the compiler alone can't see:

  • NEOS0001, NEOS0002, NEOS0003 — a module boundary is crossed without the right dependency, layer, or Internal access grant (see Module accessibility above).
  • NEOS0004 — the result of a [MustUseReturnValue]-marked method (such as IUnitOfWork.SaveAsync) is discarded.
  • NEOS0005 — a resource is reached through the cluster's default namespace shortcut instead of its owning module's own namespace.

See Analyzers for all five diagnostics and how to resolve them, and Cluster and pipeline hardening for the cluster and pipeline settings that make the most of them.

Tenant Management

Filtering tenants by their users

The tenants list in Tenant Management could already answer "who has access to this tenant" through the authorized users tab. Starting from Neos v3.2.3, it can now answer the reverse question, "which tenants does this person reach", without leaving the list.

Three criteria are available in the filter bar: User login, pinned as a chip, plus User first name and User last name under More filters.

Each criterion keeps the standard operator palette, and every operator is evaluated per user: a tenant matches as soon as one of its users satisfies the criterion. "Starts with" on a login can therefore bring in tenants through several different accounts, and "in list" covers several logins in a single chip.

Belonging is the only test. A tenant appears when the user is attached to it, whether or not that account is active or expired, so the result reads as an audit of who has been granted access rather than of who can sign in today.

The criteria are filter-only and add nothing to reading the list: the collection they traverse is declared with ExposedInGet: false and LoadedOnGet: false, so it is never fetched with the tenants themselves, and an active criterion contributes one correlated sub-query.

See Filtering or quick search on nested properties to apply the same pattern to your own lists.

Connection string editor

Tenant Management now offers a structured editor for database server connection strings. The editor separates the most commonly configured settings into Main, Pooling, and Security tabs, while retaining the complete provider connection string on the Advanced tab.

PostgreSQL connection strings can be edited structurally when the provider can parse them. SQL Server supports SQL authentication connection strings, and Oracle supports EZConnect data sources. Provider-specific formats that cannot be represented by the editor, such as SQL Server integrated security, Oracle TNS descriptors, or a non-structural server value, remain editable through the raw connection string.

When an existing connection string is valid but incompatible with the structured editor, Tenant Management explains why and keeps Advanced selected. Invalid connection strings are handled the same way with an error callout until they are corrected. The raw field is always available, including when a best-effort structured preview cannot be converted into a valid connection string.

See Database server connection strings.

Reporting

Cluster-level default report styles

Starting from Neos v3.2.2, a cluster can now provide a default ReportStyle for reports that do not name one themselves:

Reporting:
  DefaultReportStyleName: MyClusterReportStyle

Neos resolves the default when a report is opened in the designer and when Viewer or PDF output is generated. A report's own ReportStyleName takes precedence, and WithStylesCollection in business code can override both for one execution.

The report designer imports the selected bundle without applying it to the design canvas. Preview shows the applied result. Neos also keeps the shared styles out of the saved .mrt, so the .sts bundle remains the source of truth.

See Report styles for configuration, precedence, and designer behavior.

Upgrade troubleshooting

After upgrading and regenerating a cluster, review the following generation and compilation errors:

  • Entity view route placeholders: a placeholder in an exposed route must match an entity view key property, {rootRoute}, {fileName}, or {$keys}. Replace an invalid placeholder, or remove the custom route to use the generated default route. See Entity view routes.
  • Undefined properties and images in UI templates: correct references to undeclared UI view properties, or define the required property. Declare every image used by a template in the cluster image list. See UI template completions and diagnostics for current item access.
  • string.Concat in entity view property expressions: replace string.Concat(a, b) with a + b. With C# 14, the preferred string.Concat overload uses ReadOnlySpan and cannot be used in an expression tree. The + operator is also translated to SQL by EF Core, whereas string.Concat is evaluated in memory.
  • Report IDs in UI view code: replace the fully qualified GroupeIsa.Neos.Designer.UIAbstractions.Ids.ReportId type with ReportId, because the type has moved and is now available without its former namespace.

What's new for DevOps

If you operate a deployed Neos environment, several changes in this release affect infrastructure and hosting, runtime configuration, operations and monitoring, or migration and upgrade steps.

See What's new for DevOps in 3.2 for a digest curated for ops/infra teams.

What's new in documentation

This release includes significant documentation improvements.

Reorganized content

The documentation navigation has been reworked around a smaller number of clear entry sections so it better matches the main user workflows.

The top navigation now points to four task-oriented sections:

  • Getting started for installation, prerequisites, and first implementation steps,
  • Build for data modeling, backend, frontend, templates, and tests,
  • Operate and deploy for deployment, observability, reporting, and operational topics,
  • Platform and tooling for reusable framework assets, supporting clusters, AI features, and development tools.

The result is a documentation structure that is easier to scan, more predictable to browse, and better suited to the table-of-contents filter when users need to narrow the visible navigation quickly.

Updated documentation

  • Documentation home — The documentation landing page has been redesigned and aligned with the new section-based navigation.
  • Migration customization — Added a decision guide with a comparison table and Mermaid flowchart.
  • Tenant resolved interceptor — Clarified how to preserve the previous resolved result and when to use WithContextValue or WithClientOnlyContextValue.

v3.2.2

Published on Sep 10, 2026.

Features

  • [Neos Studio] Added cluster-level default report styles for report editing, viewing, and PDF generation. (18646)

Fixes

  • [Neos AI] Fixed the casing of the native UI views directory. (18675), closes 36200
  • [Neos Data Exchange] Restored sample-file downloads after switching import templates. (18631), closes 36125
  • [Neos Studio] Fixed the C# full name being left as ... when opening an entity. (18657), closes 36156
  • Fixed an API error when POSTing an entity view where a required boolean property with no value was omitted. Before 3.2, this specific case was handled. To avoid introducing this breaking change, we are restoring the specific handling for this case. For all other types, a default value must be set on the required property if you want to be able to omit it. (18674)
  • Fixed JSON inference of ISO date-only values so they deserialize as DateOnly. (18681), closes 36190
  • Fixed the display of a filter that was supposed to be invisible on the chip of a property displayed in the filter bar. (18674), closes 36185, 36193, 36194
  • Fixed the empty UI of a tab opened at startup when closing the active tab that was immediately after it. (18674)

v3.2.1

Published on Sep 02, 2026.

Fixes

  • [Neos Studio VSCode extension] Fixed an error when opening the entity view UI. (18619), closes 35637, 36060, 36099, 36103
  • [Neos Studio] Preserved overridden inherited UIView action function permissions across saves. (18600), closes 34285
  • Fixed event:click directive on combobox component. (18619)
  • Fixed an issue where the first column of a grouped data grid could be truncated. (18619)
  • Fixed an issue with modifying the filter when entering a value in the quick search input: a new filter instance is assign instead of mutating the current filter instance. (18619)
  • Fixed an issue with opening the dropdown of a lookup in combobox mode within an editable data grid. (18619)
  • Fixed routing via Neos gateway version 3.2 for SignalR clients on version 3.1/3.0. (18618)

v3.2.0

Published on Aug 31, 2026.

Breaking changes

  • [Security] The GetClusterVersions, GetTenantInfo, and GetTenantClusters methods of the tenant management API are isolated behind the gateway and, consequently, restricted to the internal network. (17434)
  • [User Permissions] Deprecated the UserAccount.Synchronized property and removed it from user account views. This property could drift from the actual state depending on the cluster, making it unreliable. This property will be permanently removed in version 3.3.0. (17550)
  • Changed background server methods to use BackgroundService execution by default, with Dapr Workflow enabled only through explicit configuration. (18533)
  • Fixed the item attribute of components (form-field, text, etc.) to differentiate between a null value and the absence of the attribute. If the attribute is null, no item will be bound. If the item attribute is not defined, the element at the current position (DatasourceCurrent) will be bound. If you had cases where passing null was intended to bind to the element at the current position, you will need to explicitly use DatasourceCurrent instead. (18250)
  • Removed invalid TrySet... lookup helper methods for UI view reference properties. This prevented runtime failures. Use directly the setter on the reference property (Item.Reference = ...). (17511)
  • Vectorization of Office documents (Excel, Word, and PowerPoint) is no longer supported. (17953)
  • Vectorization or search operations using Azure AI Search must be migrated to the new vectorization interfaces and the ILookupDocument method. SearchAsync should be used instead of ILookupDocument.LookupAsync. (17953)

Features

  • [C# Dependencies] Updated the recommended .NET SDK to 10.0.301 and .NET runtime Docker base images to mcr.microsoft.com/dotnet/aspnet:10.0.9-alpine3.23. (17122)
  • [C# Dependencies] Updated the recommended .NET SDK to 10.0.302 and .NET runtime Docker base images to mcr.microsoft.com/dotnet/aspnet:10.0.10-alpine3.23 . (18066)
  • [Deployment] Added support for deploying clusters on shared hosts via URL prefixes. See this article. (16745)
  • [Documentation] Added documentation for Redis including persistence, troubleshooting and Backup and restore sections. (17281)
  • [Helm] Added configurable env and envFrom entries to business-cluster frontend pods. (18154)
  • [Neos AI Core] Added AzureGpt56Sol, AzureGpt56Terra and AzureGpt56Luna AI models. (18518)
  • [Neos AI] Reworked the Neos AI monitoring screens with native views for the home page, conversation list, and conversation timeline. Added function details, parameters, and richer token/status information for each conversation. (17099)
  • [Neos Data Exchange] Added enum-type support to data imports and propagated enum metadata through mapping and validation. Updated the technical demo to include journal type import fields. (17773)
  • [Neos Data Exchange] Added an option to automatically continue from validation to live integration when a validation pass completed without warnings or errors. Updated import completion notifications to reduce duplicate completion messages during chained execution. (17864)
  • [Neos Data Exchange] Added persistent fatal-error reporting and status visibility for failed intermediate imports. (18200)
  • [Neos Data Exchange] Added sample CSV upload and download support for import templates. (18187)
  • [Neos Data Exchange] Allowed import enum values to be resolved from multilingual captions in addition to canonical member names. Reported ambiguous caption matches more clearly. (17860)
  • [Neos Data Exchange] Redesigned data-import mapping and import settings workflows. (18116)
  • [Neos Data Exchange] Reported fatal background import failures to users with error notifications. (18139)
  • [Neos Studio] Indexes can declare a per-engine WHERE filter — a partial index on PostgreSQL, a filtered index on SQL Server, and a function-based unique index on Oracle. Columns are referenced with {Column} placeholders. See the filtered indexes documentation. (17691)
  • [Neos Studio] neos generate messages M0090/M0091 now flag a free-text .NET type metadata property (e.g. DotNetDataType) referencing an inaccessible Internal type or a type in a module not declared as a dependency. See documentation. (18492)
  • [Neos Studio] neos generate now validates UI template references to UI views, images, menus, lookups, string resources, and UI components for existence, module dependency, and Internal accessibility. See documentation. (18492)
  • [Neos Studio] A metadata element of a supported type (entity, entity view, DataObject, image, UI view, and others) can now declare Accessibility: Public (default) or Internal, and a module can grant targeted access to its Internal elements with InternalAccessGrantedTo. check-metadata and Neos Studio's save pipeline validate every cross-module reference to an Internal element (error N108, ignorable via YamlIgnoredErrors, the same way as module dependencies). See documentation. (18492)
  • [Neos Studio] Added Required in POST option for entity view properties to distinguish POST requiredness from general requiredness. (17541)
  • [Neos Studio] Added xhigh and max AI agent reasoning efforts. (18518)
  • [Neos Studio] Added a generation warning when a UIView Title is written as a literal string that looks like a malformed resource reference instead of a code expression. (18092)
  • [Neos Studio] Added a generation-time warning (M0090) when a metadata property referencing a .NET type by name points to an Internal element from a module without granted access. (18156)
  • [Neos Studio] Added a Roslyn analyzer warning (NEOS0005) when hand-written C# code accesses a generated Resources/AppResources property through the cluster's own default RootNamespace, while the resource's module has (18412)
  • [Neos Studio] Added AcceptPropertyChange/RejectPropertyChange/HasPropertyChange to accept, reject or check the change of a single property, both on the client ViewModel and in UIView rules. (18080)
  • [Neos Studio] Added clearer 401 Unauthorized and 403 Forbidden messages in report preview when the user account of the designed application is not authenticated for the localhost domain or does not have the appropriate permissions. (17608)
  • [Neos Studio] Added completions and diagnostics in UI template for @DatasourceCurrent.{Property} and @Item.{Property}. (17526)
  • [Neos Studio] Added datagrid row detail theme attributes. (17505)
  • [Neos Studio] Added generation diagnostics for theme component attributes matching a palette token while marked as custom (M0080), duplicate Reference/scalar column mapping on an EntityView (M0081), and RelatedEntityViewName ignored on non-navigation properties (M0083). (17902)
  • [Neos Studio] Added GetRowVersion/SetRowVersion to read and update an item's row version (as a hexadecimal string) from a UIView rule, e.g. around a ServerMethod call. (18080)
  • [Neos Studio] Added support for complementary API routes on server methods, including per-route HTTP verb, authentication, internal-use, API explorer, and deprecation settings. Exposed complementary routes in OpenAPI/Swagger and added generation-time validation for duplicate routes.
    More details : 17555
  • [Neos Studio] Added support for the input-slider-discrete user interface template component, enabling the configuration of discrete sliders with explicit allowed numeric values. (17249)
  • [Neos Studio] Added themable corner-radius attributes: per-size on Button (Extrasmall to Extralarge), and a single BorderRadius on Input (whole input family), Card and Datagrid (outer container), so a theme can globally soften corners without per-screen markup. (17916)
  • [Neos Studio] Enabled EntityViews to expose multiple API routes for the same operation type, with bulk route creation in Neos Studio and duplicate-path validation during save and generation. Existing routes remained usable so APIs could evolve without breaking deployed clients. (17497)
  • [Neos Studio] Made the standard Report and ReportStyle identifiers available in backend code by moving them from {AppNS}.CSharpAbstractions.Ids.Reports to {AppNS}.Application.Abstractions.Ids.Reports. Updated metadata migration to version 38 to switch UI metadata report ID types and generated report constants to the new namespaces. (17790)
  • [Neos Studio] New Roslyn analyzer MustUseReturnValueAnalyzer ships to report NEOS0004 when the result of a [MustUseReturnValue]-marked method (such as IUnitOfWork.SaveAsync) is discarded. See documentation. (18492)
  • [Neos Studio] New Roslyn analyzer OriginAccessAnalyzer reports NEOS0001/NEOS0002/NEOS0003 when C# code references a symbol outside its project's declared module dependencies, layer, or granted accessibility — live in the Neos Studio code editor and while neos generate transpiles UI code, and via Visual Studio/Sonar for handwritten server code. See documentation. (18492)
  • [Neos Studio] Per-route obsolescence and API-surface controls on EntityView additional routes. An additional route (a distinct path of the same type) can be marked obsolete (emitting [Obsolete], hence deprecated in OpenAPI), hidden from the API explorer, or restricted to local callers, independently. Marking the EntityView itself obsolete now deprecates every generated route (technical and custom), like ServerMethods. The main technical route stays generated as-is. Routes are edited from the grid's "More" menu and obsolete ones are highlighted. (17591)
  • [Neos Studio] The "Exposed API elements" screen now lists ServerMethod complementary routes and adds per-route markers and filters for obsolete, hidden-from-explorer, and internal-only routes, reflecting what the generated API actually exposes. (17622)
  • [Neos Studio] UIViewProperty can now be marked as not systematically loaded (editable directly in Neos Studio), so a screen's Retrieving rule can request partial ($select/$expand-based) loading of its GetAll query — including through nested references and based on which columns are used by an applicable user style rule — instead of always fetching every exposed property. (18125)
  • [Reporting / Helm] Added S3 backed persistence for generated reports, see this article. (18140)
  • [Reporting] Added bounded detailed exception diagnostics to the Report service. (18370)
  • [Reporting] Added configuration capability for the Stimulsoft HTML5 Viewer backend cache mode: can be globally or selectively (on a report-by-report basis) switched from the default 'ObjectCache' to 'None'. Disabling the Viewer's backend cache is required when the reporting service runs with multiple replicas and reports allow viewer events (Save As, Print, etc.). (18202)
  • [Reporting] Retrieving reporting assets (templates and style bundles) through UTF-8 endpoints instead of the Base64 ones (compatible with clusters based on Neos FMK 3.0+ only). (18498)
  • [Tenant Management] Added a daily cluster migration cleanup scheduled task with a default retention of 180 days. Allowed the task to be adjusted from Task Scheduler for schedule and retention changes. (17899)
  • [Tenant Management] Added a dedicated cluster migration tracking screen with live progress updates and access to migration or simulation logs. (17646)
  • [Tenant Management] Added structured editing for database server connection strings with provider-specific fields, raw-string fallback, and validation for unsupported formats. (17914)
  • [Tenant Management] Removed plaintext database connection string storage from Tenant Management and kept only encrypted connection strings. Added a migration-time validation that blocked schema cleanup until existing connection strings had been encrypted. (17530)
  • [UI Customization] Modified filter persistence to only persist user filters. Hidden or read only filters are not persisted. (18110)
  • [User Permissions] Added support for pinning tabs to restore them automatically at startup. (18058)
  • a different, explicit RootNamespace of its own. The message names the stable, fully-qualified form to use instead, since the shortcut form only keeps compiling as long as the same cluster keeps generating it. (18412)
  • Added .gitignore file generation to neos init. (17270)
  • Added $expand OData query parameter to GET ALL entity view requests. (17856)
  • Added agent-ids to chatbot component to filter available agents. (18258)
  • Added Does not contain filter operator. (17296)
  • Added layout:lazy-visible directive to defer mounting hidden UI sections until their first display. (16997)
  • Added multi-select component. (17989)
  • Added prompt-max-rows attribute on chatbot component. (18151)
  • Added ServerMethods.{ServerMethodName}.CanExecute() method so client code can verify whether the current user has permission to execute a server method before calling it. (17243)
  • Added UIViewDataSkill AI skill to manipulate the data of a UI view. (18481)
  • Added Visible property on Filter : A hidden filter is not visible in the UI, cannot be modified or removed by the user. (18110)
  • Added a ReferenceRetrieving rule trigger when lookup values were set through TrySet...Async methods. (18142)
  • Added a load-more action to lookup dropdown. (16998)
  • Added business validation rules on filters via FilterValidationRules: live feedback while typing, colored chip with message in every filter popover, relative-date support, conditionally-required filters, inactive filters excluded, Error-severity blocking with a dialog only on explicit actions, and advanced-filter (FilterBuilder) support with author-declared rule scope (SimpleFilterOnly/AllFilterModes), a severity-colored button, and a live per-condition recap. (17901)
  • Added configurable CORS support to the gateway, including settings for allowed origins, methods, headers, credentials, and preflight caching. Please see this article. (17868)
  • Added drag and drop support for tabs of frames-container. (18058)
  • Added loading spinner when web-view is loading. (18000)
  • Added local Prometheus installation and Manager controls for starting, stopping, and opening Prometheus during development. (17100)
  • Added min / max check constraint on numeric columns. (18112)
  • Added normalized Prometheus metrics for PostgreSQL and SQL Server database connection pools. (18312)
  • Added per-filter chip toggles to temporarily disable individual filters without clearing their values or operators. (17534)
  • Added runtime entity metadata for GDPR-tagged properties, including personal-data flags and mapped database table/column names. Demonstrated the feature with a migration interceptor that labels sensitive columns during migrations. (17537)
  • Added single column support for check constraints in the Neos migration system. (17571)
  • Added support for absolute paths in local module references. (18248)
  • Added support for filtering a listing on a property located in a collection nested beyond the first level (up to 5 traversed collections), e.g. filtering work orders on a property of their lines through Intervention → Transaction → Line. (17482)
  • Added support for installing the Neos agent hooks from any directory, so a single installation at the root of a multi-cluster repository protects every cluster in its sub-folders. (17527)
  • Added the neos dependencies CLI command group, exposing Neos Studio's dependency analysis on the command line: usages and usages-by-type to find references, unused (with --fail-on-found to fail a pipeline on dead code), accessibility-suggestions, and set-accessibility. Output is YAML for deterministic consumption by pipelines and AI coding agents. (17597)
  • Added the ability to customise tenant selection screen according to each tenant status (disabled via tenant manager or currently unavailable, eg: migrating). See this article. (17602)
  • Added the ability to vectorize documents using multiple embedding models. (17953)
  • Added the PanelMenu.ItemHoverIconColor attribute to customize the icon color when hovering over the menu item. (18123)
  • Added transpilation support for LookupDefinition and the generated Lookups class, allowing UI code to reference lookup definitions through Lookups.*. (17063)
  • Aligned DELETE server method status codes with REST standards: 204 No Content when the action is enacted, 202 Accepted when executed in background. (18443)
  • ApiClient.GetAsync<T>, GetAllAsync<T>, PostAsync<T> and PutAsync<T> now return the data as a real model instance when T is a UIView model. The result exposes the full model behavior (change tracking, acceptChanges(), relations) directly, without having to re-wrap it manually. (17740)
  • Automatically preselected the default view flag when creating a user's first custom view for a screen. (17876)
  • Between date filter now supports a single date value, applying a "greater than or equal to" or "less than or equal to" filter accordingly, with the chip label reflecting the effective operator. (17492)
  • Configured the Helm chart to use a default Kubernetes RollingUpdate strategy with maxSurge: 1 and maxUnavailable: 50%, and added configurable per-service deployment strategy overrides. See this article. (17617)
  • Exposed the Neos framework version and cluster version as separate readable properties on the schema model, instead of only an opaque combined version string. (18069)
  • Fixed filter bar so server filter chips are displayed in advanced mode. (17319)
  • Forwarded the X-Forwarded-Prefix header to destination clusters for prefixed and nested gateway routes. (18208)
  • Implemented stable API ordering by appending missing key fields to explicit OData sorts, ensuring consistent pagination across pages. (17292)
  • Improved Helm deployments with checksum annotations so dependent configuration changes trigger rolling pod restarts. (18448)
  • Improved AI chatbot conversation continuity by persisting tool calls and tool results in thread history so follow-up prompts can reuse previous tool outputs. (17563)
  • Improved AI-driven screen customization reliability by enforcing end-to-end frame context consistency, switching to strongly typed configuration inputs, strengthening validation/application safeguards. (18181)
  • Improved AI-driven view customization with active-view validation, compact summaries, targeted configuration patches, and load-error reporting. (18288)
  • Improved chatbot streaming through SSE and enabled multiple chatbot instances per application. (18214)
  • Increased default prompt input max rows of the chatbot from 4 to 10. (18151)
  • Made neos setup install or update the Neos Copilot agent as part of environment setup, matching neos agent install. Added a --skip-copilot-install flag to opt out. (18079)
  • Migrated internal code to use System.Text.Json instead of Newtonsoft.Json. (17660)
  • Preserved existing values for omitted properties in PUT requests. (17598)
  • Prevented AI UI interactions from opening or creating UI views when the user lacked permission, and returned a clear unauthorized error instead of an opening failure. (17862)
  • Removed NGINX-specific notification rewrites and prefix redirect ingresses, delegating path handling to the gateway. (18490)
  • Removed the dedicated NeosSignalR service and routed SignalR/WebSocket traffic through backend services and the gateway. Updated Helm, gateway routing, and development proxy behavior to use the backend Redis backplane for notifications. (17688)
  • Replaced Kernel Memory with Microsoft.Extensions.VectorData. (17953)
  • Saving rules and validation rules declared on an abstract base entity can now read an entity's original value. See Accessing the original value. (17684)
  • Updated documentation : Removal of the unencrypted connection string. (18242)
  • Updated the .NET SDK to 10.0.400 and .NET runtime images to 10.0.11.
    • CVE-2026-62898 | .NET Information Disclosure Vulnerability
    • CVE-2026-62899 | .NET Security Feature Bypass Vulnerability
    • CVE-2026-62900 | .NET Information Disclosure Vulnerability
    • CVE-2026-62901 | .NET Denial of Service Vulnerability
    • CVE-2026-62886 | .NET Elevation of Privilege Vulnerability
    • CVE-2026-62871 | .NET Elevation of Privilege Vulnerability
    • CVE-2026-70354 | .NET Core Remote Code Execution Vulnerability
    • CVE-2026-62902 | .NET Information Disclosure Vulnerability
    • CVE-2026-62897 | .NET Remote Code Execution Vulnerability
    • CVE-2026-62909 | .NET Elevation of Privilege Vulnerability
      More details : 18436

Fixes

  • [Documentation] Added notes clarifying the ambiguity regarding which Docker image versions to use for the frontend, backend, and taskrunner. See this article. (18168)
  • [Gateway] Fixed api-documentation route not working for nested clusters. (18056)
  • [Helm] Fixed cert-manager annotation to enable cert request and generation, this is usefull for test environements without Cloudflare proxy (17871), closes 34791
  • [Helm] Required authenticationSecret in Helm chart values and rejected empty values. (17599), closes 34342
  • [Helm] Switched RabbitMQ from a Deployment to a StatefulSet to provide stable pod identity and safer volume handling during upgrades. (17519)
  • [Neos Data Exchange] Fixed access to data mapping until a mapping model is selected. (18231), closes 35464
  • [Neos Data Exchange] Fixed adding import column mappings from a file when an empty column is selected. (18228), closes 35461
  • [Neos Data Exchange] Fixed exports after sorting localized text columns by targeting the current language value in OData ordering. (18414), closes 35849
  • [Neos Data Exchange] Fixed import batch selection failures on Oracle when batch sizes exceeded 1,000 rows. (18277), closes 35480
  • [Neos Data Exchange] Fixed import simulation/integration so unassociated save errors were appended to existing row validation messages instead of overwriting prior messages. (17786)
  • [Neos Data Exchange] Preserved template column order in data import staging grids. (18240), closes 35458
  • [Neos Studio] Delayed the development proxy's started state until the backend reported readiness. (18445)
  • [Neos Studio] neos generate now reports the same frontend warnings and errors on every incremental run until they are fixed, instead of only on the first run. Previously, a warning or error in a UI template or in transpiled UI code was shown by the first generation but silently dropped by subsequent incremental generations (with no changes), forcing the use of the -f option to see it again. (17529)
  • [Neos Studio] A list column bound to a property that cannot be sorted server-side (a non-filterable source, or a collection) can no longer be marked sortable: the Sortable toggle is read-only, the value is normalized to non-sortable, and generation reports it as M0077. The entity-view "Filterable" option is renamed "Filterable & sortable" because it also controls sorting. (17696), closes 34496
  • [Neos Studio] Added a generation warning when a data table is not referenced by any entity. (18070)
  • [Neos Studio] Fixed a crash when opening a UI view embedded inline via a remote <ui-view> (micro-frontend), where the component could be used before its Module Federation import had resolved. (18390), closes 35609
  • [Neos Studio] Fixed a false-positive module-dependency warning (M0058) reported against a base UIView when an inheriting UIView overrides a child element (partial template, computed, field...) using a UI Component from its own module. (18372), closes 35748
  • [Neos Studio] Fixed a misleading error message when a template binding attribute (values, condition...) chains a method/LINQ call onto a bound path, and fixed a generation crash where one UIView's failure could delete other UIViews' already-generated client files. (18034), closes 35128
  • [Neos Studio] Fixed a rare lost filter update when several filter-bar columns were changed in quick succession, where the last-resolving change could overwrite another column's change. (17990), closes 34982
  • [Neos Studio] Fixed AI suggestions for asynchronous UI method return types so they no longer proposed System.Threading.Tasks.Task, preventing invalid double-wrapped Task<Task> signatures and transpilation errors. (17524), closes 32591
  • [Neos Studio] Fixed an error when adding properties from the entity on an entity view that contains many expression properties. (17473), closes 33318
  • [Neos Studio] Fixed an incorrect warning on the datagrid column width validation when a decimal proportional value was used (e.g. 0.8*). (17987), closes 35038
  • [Neos Studio] Fixed an issue where an action button remained permanently disabled after calling an async UIView method with an await Task.CompletedTask; body. (17852), closes 34648
  • [Neos Studio] Fixed an unnecessary server request to reload the EntityView definition when saving a UIView. (17603), closes 30885
  • [Neos Studio] Fixed custom API routes on an entity view using a non-"Id" key property generating a mismatched route parameter instead of the real key, including entity views using an alternate key resolved through navigation to related entities. (17965), closes 34945, 34987
  • [Neos Studio] Fixed data table column filtering. (17984), closes 35020
  • [Neos Studio] Fixed dependency analysis reporting UI view event rules with All accessibility instead of Frontend, which suppressed accessibility-narrowing suggestions for elements referenced only from those event rules. (17619)
  • [Neos Studio] Fixed directives silently having no effect when placed on a UI component whose template root is a logical node; a configurable generation warning now reports the issue and how to fix it. (17494), closes 32868
  • [Neos Studio] Fixed entity and entity-view diagram links in the VS Code extension. (18410), closes 35413
  • [Neos Studio] Fixed EntityView route collisions being missed during generation, preventing ambiguous API routes from disrupting runtime routing and Swagger. (18059), closes 35141
  • [Neos Studio] Fixed enumeration persistence type change not being applied when regenerating metadata. (17493), closes 32368
  • [Neos Studio] Fixed function assignment navigation for overridden UIView actions to use their current module. (18384), closes 35628
  • [Neos Studio] Fixed generation buttons that could remain disabled after a generation timeout. (17370), closes 33665
  • [Neos Studio] Fixed incorrect typing of the Arguments parameter shown in the UI view event rule code editor (IntelliSense and diagnostics) when overriding a rule already declared on an inherited view's base. (18048), closes 35094
  • [Neos Studio] Fixed inheritance retrieval for disabled and overridden UI items so overridden values were preserved when parent definitions were synchronized. (17586), closes 34079
  • [Neos Studio] Fixed interface tree node expansion. (17421)
  • [Neos Studio] Fixed localization of the nodes in the object list tree view. (18517)
  • [Neos Studio] Fixed misleading error message displayed when the database connection fails at startup in single-tenant mode: the error now correctly indicates a migration failure instead of an interceptor failure. (17594), closes 34266
  • [Neos Studio] Fixed module overriding position of lookup suggestion properties. (17419), closes 32833
  • [Neos Studio] Fixed native UI views reopening on the Template section instead of the Header section. (17410), closes 34041
  • [Neos Studio] Fixed report designer preview/export configuration sheets to persist tenant and generation-config selections more reliably, prompt before losing unsaved changes, and refresh stale cached selections more safely. (17459), closes 33687
  • [Neos Studio] Fixed server code generation failing to compile when an entity view embedded as a collection references its parent through an alternate key: a call to RegisterBeforeSavingRules was generated on a repository for which the method was (correctly) not generated. (17713), closes 34542
  • [Neos Studio] Fixed StringResource references with a mismatched scope going undetected during incremental generation; generation now reports an information message for each invalid reference and repeats it on each run until corrected. (17562), closes 33780
  • [Neos Studio] Fixed the multilingual (LocalizableString) modal closing on its own in a datagrid when an AI translation suggestion icon appeared in the cell behind it. (17993), closes 35003
  • [Neos Studio] Fixed the opening mode of a lookup's creation/editing view not being reset correctly after clearing the associated view through a metadata override, which could resurrect a value that was never chosen and block saving. (18120), closes 35204
  • [Neos Studio] Fixed the parent rule call not being added automatically when adding an event rule to a UI view that is overridden in another module. (17525), closes 32935
  • [Neos Studio] Fixed the unused-elements search incorrectly reporting string resources and constants as unused when they were referenced only in UI view event rules. (17569), closes 34320
  • [Neos Studio] Fixed the Web API tab and the exposed-API elements list showing the entity's primary key instead of the view's alternate key when one was configured. (17965), closes 34945, 34987
  • [Neos Studio] Generation now reports a clear, named validation error when an EntityViewProperty of Type=Expression is missing DataType, instead of crashing with an unhandled exception. (18045), closes 35146
  • [Neos Studio] Hid empty Actions nodes when UI view tree searches returned no matching actions. (17421), closes 32586, 32589
  • [Neos Studio] Incremental generation now regenerates the entities, entity views and UI views that implement a modified interface (previously only a full generation updated them). (17903), closes 29032
  • [Neos Studio] Partial generation now regenerates the child UIViews that inherit from a modified parent UIView, so editing an inherited action no longer requires a full generation. (17533)
  • [Neos Studio] Removed context, form-field, and ui-view from UI component template completions, and reported diagnostics when these tags were used in a UI component template. (17994), closes 34954
  • [Neos Studio] The generator no longer emits the M0003 "unassociated resource" warning twice for the same UIView or ServerMethod. (18086), closes 35213
  • [Neos Studio] The UI template editor's automation-IDs view button is now enabled automatically when a view is opened, instead of requiring a manual refresh first. (17536), closes 34107
  • [NeosReportCustomization] Improved report selection UI. (17413), closes 33899
  • [NeosSharedUI] Removed style:background="white" in NeosTemplateList UI component. (17988), closes 35052
  • [Security] Fixed forwarded-header handling so InternalUseOnly server methods are properly isolated behind the gateway. (17434), closes 33655
  • [Security] Replaced Kernel Memory with Microsoft.Extensions.VectorData to fix GHSA-f32c-w444-8ppv (HIGH CVSS 7.5) (17953)
  • [Security] Replaced Kernel Memory with Microsoft.Extensions.VectorData to fix GHSA-qj66-m88j-hmgj (HIGH CVSS 7.5) (17953), closes 35596
  • [Security] Updated dependencies to fix GHSA-2v37-7h3g-55p8 (HIGH CVSS 5.9) (18291), closes 35595
  • [Security] Updated dependencies to fix GHSA-2v37-7h3g-55p8 (HIGH CVSS 5.9) (18454), closes 35595
  • [Task Scheduler Client] Fixed scheduling tasks without arguments by sending a null arguments payload. (18236), closes 35431
  • [Tenant Management] Fixed database schema migration not tracking check constraints, so they were dropped instead of preserved. (18263), closes 35537, 35538
  • [Tenant Management] Fixed migration simulation summary handling when a migration failed. (18317), closes 35460
  • [Tenant Management] Fixed user synchronization during tenant creation and tenant migration state changes to prevent unintended cross-cluster sync events. (17408)
  • [UI Customization] Added quick-search and filter bars to the custom view property and filter grids, merged grid and form property editing into a single properties tab, and enabled row reordering for custom view properties. (17957)
  • [User Permissions] Fixed the AllowDeny permissions migration turning legacy empty access values into no access (denied) instead of granted. (18263), closes 35537, 35538
  • [User Permissions] Fixed unintended language switch to English when assigning a role to a user. (17436), closes 30822
  • [User Permissions] Prevented assigning publisher-only roles to client users before saving user accounts. (18352), closes 35227
  • [User Permissions] Propagated Publisher-to-Client user type changes across clusters. (18124), closes 35308
  • [User Permissions] Refreshed permission trees after saves and role navigation. (18335), closes 35479, 35481
  • [User Permissions] Removed data objects marked as obsolete with error since version 3.0. (18239)
  • [User Permissions] Removed the automatic synchronized status update because this property could drift from the actual state depending on the cluster, making it unreliable. (17408), closes 34043
  • Added a cross in the top right corner to close the mobile search window (17356), closes 33779
  • Added English and French translations for the “Advanced” label. (18067)
  • Database migrations for the cluster have been moved to background processing. (17302), closes 33741
  • Delayed unavailable-tenants warmup and refresh calls in the development server proxy until the Tenant Management backend had started, preventing premature getunavailabletenants failures during startup. (17514), closes 34121
  • Fixed "equal" and "not equal" filters on Date properties returning no results because of the timezone. (17714), closes 34501
  • Fixed "equal" and "not equal" filters on invariant datetime properties returning no results because of the timezone. (17753), closes 34573
  • Fixed LocalizableStringExtensions.GetCurrentValue return type (string? to string). (17478), closes 34158
  • Fixed neos setup self-signed development certificate creation for .NET SDK 10.0.302 (and .NET SDK 10.0.110). (18233), closes 35473
  • Fixed rich-text-editor fill-height layout with labels and validation messages. (18447), closes 32462
  • Fixed Search.IsMatch rewriting for captured subqueries so QuickSearch worked when retrieving rules reused a captured IQueryable subquery. (17414), closes 33460
  • Fixed a bug where adding a standard filter after a named (predefined) filter would silently remove the named filter. (18108), closes 35230
  • Fixed a compilation error in the AI Chatbot's EntitiesQuerier tool when a generated script accesses an entity property of type LocalizableString. (18532), closes 35997
  • Fixed a crash when opening an inherited UI view whose base event rule calls a UI view method: the method was not found at runtime because the base rule resolved its members one inheritance level too high. (17558), closes 29928
  • Fixed a datagrid error that could occur when adding multiple rows at once while the pointer remained over the grid. (17466), closes 32966
  • Fixed a filter parameter chip not reappearing in the simple filter bar after its value was entered in the advanced filter and the user returned to the simple filter. (18006), closes 34966
  • Fixed a keyboard shortcut from a parent view still triggering while a popup was open, when focus had not yet moved into the popup. (18494), closes 35344
  • Fixed a lookup incorrectly showing "The value is invalid" for a genuinely valid value on slow connections, when leaving the cell right after typing it. (18424), closes 35532
  • Fixed a memory leak in Semantic Kernel dependency injection configuration. (17578)
  • Fixed a nested Lookup column ending on the referenced entity's own primary key never showing its display value in grouping, filtering, and sorting. (18146), closes 35332
  • Fixed a SQL execution error raised when opening a screen bound to an entity defining a self-referencing one-to-one relation: the generated Entity Framework Core configuration no longer declares the relationship twice. (17472), closes 31887
  • Fixed action buttons (<button type="action">) silently ignoring custom inner content and the icon, label, badge, badge-severity, variant and size attributes; these are now applied. (17495), closes 32866
  • Fixed an error occurring when grouping a datagrid column configured with a LookupName together with a group summary on another column. (18127), closes 35176
  • Fixed an issue where a failed AI chatbot tool call (e.g. EntitiesQuerier) could make the entire conversation thread unusable, causing every subsequent question to fail. (18534), closes 35996
  • Fixed API validation for decimal properties when minimum or maximum values used a dot decimal separator. Prevented culture-dependent failures in decimal range constraints. (17346), closes 34014
  • Fixed Application Insights client tracing so each HTTP request now gets its own W3C traceparent instead of reusing the page trace context. (17100), closes 33673
  • Fixed automatic scrolling to newly added items in card-mode datagrid. (17337), closes 32867
  • Fixed backend monitoring rule notifications so concurrent executions were tracked safely and failures were still reported when a rule threw an exception. (17379), closes 33656
  • Fixed background color (forced to white) of the suggestions table of the lookup filter compoonent. (18012)
  • Fixed background task dispatch so it no longer inherited a disposed HTTP context from the initiating request. (18531)
  • Fixed border and icon color of the info message modal in NeosV3 theme. (17669), closes 34456
  • Fixed calculable input-number input so replacing a fully selected value with a negative number no longer concatenated with the previous value. (17369), closes 34016
  • Fixed chat history conversion for parallel chatbot tool calls. (18389), closes 35747
  • Fixed client generation failing for UI views with a three-or-more-level inheritance chain whose base defines event rules: the generated rule overrides used the wrong UI view as the generic argument, and the Initialized rule signature no longer matched base calls. (17672), closes 34464
  • Fixed client typecheck failing for UI views with a three-or-more-level inheritance chain: the generated ViewModel cast its properties and actions to the immediate base view instead of the highest ancestor that declares them. Type-only issue (no runtime change), present since 3.0 and surfaced once the related event-rule generation defect was fixed. (17690), closes 34509
  • Fixed CSV and XLSX exports to evaluate column display templates with the correct row context. (18378), closes 35633
  • Fixed datagrid auto-sizing so the last auto-sized column no longer expanded incorrectly when another visible column used * sizing. (17422), closes 32441
  • Fixed datagrid boolean cell styling so read-only checkboxes matched editable sizing, and switch controls no longer animated when rows were remounted during scrolling. (17481), closes 32806, 32988
  • Fixed datagrid row actions becoming misaligned or wrapping onto multiple lines after scrolling the grid horizontally. (18540), closes 35986
  • Fixed datagrid row selection so right-clicking the current selected row no longer cleared other selected rows. (17978), closes 35007
  • Fixed Date filters with a month or year selection (and "between" ranges) not covering the full period. (17775), closes 34501
  • Fixed direct remote service invocation now returns 401 Unauthorized instead of 403 Forbidden when the request bypasses the gateway. (17608), closes 34420
  • Fixed disabled non-inherited UI view event rules being generated and executed. (18102), closes 34111, 35234
  • Fixed disabled tenants displaying in tenant selection screen. (17602), closes 34071
  • Fixed error logs emitted on neos run with NPM 12. (18121)
  • Fixed filter bar reset button visibility to be hidden when there are only read only filters. (18110), closes 35200, 35201, 35233
  • Fixed full-size popups overflowing the viewport on some mobile browsers. (18419), closes 35824
  • Fixed global search result tooltips so items without a description no longer displayed [undefined]. (17432), closes 32448
  • Fixed grid position navigation to follow visible sorted, filtered, and expanded-group rows. (18407)
  • Fixed inherited UI view actions to resolve permissions from their defining UI view while keeping inherited function assignments read-only. (18282), closes 34280, 34281
  • Fixed inherited UI view initialization so fields updated by base event rules remain reactive. (18499), closes 35303
  • Fixed IntelliSense so the Item property was no longer suggested for UI event rules that do not have a current item context, including Retrieved, DataSaved, and Removing. (17943), closes 34887
  • Fixed keyboard shortcut in remote UI view in development mode (micro-frontends). (17515)
  • Fixed LocalizableString validation not rejecting empty translations, only null ones. (18119), closes 34750
  • Fixed lookup create/edit write-back so saved reference values were applied to the original bound record even if the current record changed while the separate frame remained open. (17552), closes 34179
  • Fixed main UI view initial navigation when the open mode is not New frame. (17339), closes 32865
  • Fixed missing invalid-value error message on a standalone input-date or input-date-time field (not bound to an entity property and not wrapped in a form-field). (18057), closes 34923
  • Fixed nested cross-cluster lookup filters so suggestions and results were displayed when total-count retrieval was disabled. (17467), closes 34099
  • Fixed Oracle required-string check constraints by using LENGTH(...) > 0 for NCLOB columns and removing redundant bounded-string checks. (18087), closes 34829
  • Fixed Oracle stored procedure execution to bind parameters by name instead of declaration order. Added a Technical Demos example for executing a cross-database subtraction stored procedure. (17232)
  • Fixed Remote Invoke not exposing the business message when the called cluster throws a business error. (17781), closes 34606
  • Fixed remote service invocations without a service identifier to fail fast with an explicit error instead of surfacing an opaque Dapr routing failure. (17547), closes 34213
  • Fixed report URLs so the timeZone query parameter was correctly URL-encoded when using WithTimeZone, preventing failures for IANA time zone IDs containing + such as Etc/GMT+4. (17661), closes 34459
  • Fixed spacing being lost between the items of a virtualized list (repeat virtual) placed inside a layout: items now inherit the parent layout's spacing, matching the non-virtual rendering, instead of being rendered glued together. (17656), closes 34418
  • Fixed style of the suggestions table of the lookup filter compoonent. (18040)
  • Fixed the HorizontalLayout fill-width workaround so it applied only when wrap="false". (17510), closes 34237
  • Fixed the clear button being shown on required dropdown and reference fields in grids. (18111), closes 35221
  • Fixed the client base URL not being injected when an application was reached through a URL whose casing differed from the cluster name, which could leave the application unable to load. (17975), closes 34981
  • Fixed the color picker state when switching between form records. (18302), closes 35620
  • Fixed the data grid disappearing in card view when column grouping was active. A notice with a Remove grouping action was shown instead of an empty area. (17663), closes 33208
  • Fixed the data grid sometimes displaying rows that did not match the active filter after rapid filter, sort, pagination or refresh changes. (18007), closes 35049
  • Fixed the error in the cache building process. (17302)
  • Fixed the index of a nested cluster (e.g. /tenants/) being served without any Cache-Control header in production. Browsers could heuristically cache it and replay a re-navigation without contacting the server, so an identity switch carried by the URL was silently lost and subsequent calls ran as the previously connected automation user. (18061), closes 35087
  • Fixed the migration schema comparer's name comparison so that table/column/index/primary-key/foreign-key/check-constraint/view names are compared case-sensitively on PostgreSQL and Oracle when QuotedIdentifiers is enabled, instead of always being case-insensitive. A case-only rename was previously silently ignored, leaving a stale physical table/object behind. (18090), closes 35215
  • Fixed the unit test auto-mocking environment so ILocalizationSettings now has a default mock implementation, preventing GetCurrentValue() conversion from throwing when no explicit localization setup is provided. (17962), closes 34974
  • Fixed UI template IntelliSense so snippet completions were no longer suggested while typing inside closing tag markup. (17809), closes 34647
  • Fixed wrong tenant settings used for sequences and database exception converter in background server methods. (17872), closes 34734
  • Fixed XML mapping for partial UI templates with multiple root elements so known namespace prefixes were preserved for automation and E2E attributes. (17959), closes 34928
  • Increased NPM minimal version of from 9 to 10. (18121), closes 35307
  • Increased the datagrid multi-sort limit from 5 to 10 columns and prevented adding more than 10 sort criteria from the grid UI. (17344), closes 27730
  • Made the forced synchronous tenant caches rebuild (triggered by the SetDatabaseClusterVersion server method) wait for the store locks (bounded by buildStoreTimeoutInSeconds) instead of failing immediately, so updating several clusters right after a deployment no longer returns "could not acquire lock" while a concurrent rebuild is still in progress. (17657)
  • Preserved backend build requests when C# files were saved during incremental generation. (18472), closes 35761
  • Reduced verbose automation-identity logs during database migrations. (18320), closes 35489
  • Serialized Date values in API context headers to ISO 8601 strings before sending requests to avoid invalid forwarded headers that may be rejected by CloudFlare and break downstream service invocations. (17342), closes 33032
  • Setting the unsupported disabled or loading attributes on an action button now emits a generation warning instead of being silently ignored. (17495), closes 32866
  • Simplified the date filter by hiding relative-date controls in the default display mode and adding an Advanced mode to access them when needed. (17898)
  • Updated module federation plugin to fix culture of date and number inputs. (17301), closes 33948
  • Updated module federation plugin to fix lazy loading of remote entry scripts for microfrontends. (17301)
  • Upgraded C# version from 12 to 14 for the UI code transpilation. None of the new features introduced in C# 13 and C# 14 are supported. (17886), closes 34763

Previous releases

You can find the changelog of previous releases by clicking on the following links :