The monthly Oqtane Community Standup was held on September 2, 2026.

Release Updates

The last official release was 10.2.4 which was released on August 17, 2026 and was a maintenance release.

• 26 Pull Requests (3621 Total)
• 52 Commits (8023 Total)
• 5 Contributors (58 Total)

Contributors: @sbwalker, @leigh-pointer, @mdmontesinos, @AmazonBBQ, @arpitjain099

10.2.4 Highlights

• Improved performance and scalability of loading Folders
• Fixed API issue with spaces in folder/file names
• Changed all repositories to use AsNoTracking() by default
• Modified Site Settings to allow Culture to be any valid Language defined for a site - not just neutral cultures
• Added FusionCache distributed stampede protection
• Resolved 2 security vulnerabilities
• Updated to .NET SDK 10.0.11

Security

There was a reminder that the Oqtane Security Center is the official location for getting information about any Oqtane security vulnerabilities and for reporting potential vulnerabilities. It was also noted that Oqtane's philosophy on limiting third party dependencies has resulted in very few security vulnerabilities being reported for the framework over its 6 year history.

Security ID#7: Broken Object-Level Authorization In Notification API (Critical)

The Notification PUT API method makes authorization decisions based on the body of the request. This means that an authenticated user can construct a payload which claims that a notification belongs to them. The server will accept the claim, load the notification, update some properties, and return the fully populated notification object. If an authenticated user is able to guess the specific identifier for a notification associated to user security (ie. password reset, email verification, two factor authentication) it is possible that they could take over the related user's account. Our thanks to @AmazonBBQ for reporting this vulnerability.

Security ID#8: Unprotected Visitor Cookie Authorization (Moderate)

When an anonymous caller requests a visitor record, the system compares the visitor identifier in the request to an integer parsed out of a client-side cookie. The cookie is not protected so it is possible for the caller to supply both sides of the comparison, allowing it to access information for other visitors. Our thanks to @arpitjain099 for reporting this vulnerability.

ImageSharp

There was a discussion about the recent ImageSharp licensing change, and confusion in the .NET ecosystem which is leading people to mistakenly believe that they need to replace ImageSharp with a different image library. Shaun Walker has been in contact with the maintainer of ImageSharp and was able to obtain clear guidance on its licensing.

• License is only enforced when compiling a project in Release mode that has a direct dependency on ImageSharp
• License still allows free usage in open source projects - this has not changed
• Transitive dependencies are not enforced ie. if you consume a package (such as Oqtane) which has a direct dependency on ImageSharp you do not need to obtain your own license for ImageSharp
• The only new requirement is that Oqtane need to obtain a license key to be used when building/packaging official releases

Marketplace

The Oqtane Marketplace continues to be enhanced based on feedback from users:

• Users can now provide their Time Zone, and date/times are displayed in local time
• Release Notes which are included in the New Releases newsletter now support line breaks properly
• Security vulnerabilities now include a separate Resolution field

BlazorKit

Shaun Walker announced a new distribution of Oqtane which will be branded "BlazorKit" and is focused on .NET developers.

• A new "distribution" in the form of an application template demonstrating many of the capabilities offered in Oqtane
• Licensed under an open source MIT license
• Leverages the "Blazor" brand/reputation and brings more awareness to Oqtane
• Creates more visibility for third party Oqtane modules, themes, services
• Provides a functional example of an "Oqtane Application"
• Will be promoted at https://blazorkit.net and through social media at @blazorkit

Demonstration

Shaun Walker did a demonstration of the BlazorKit application template.

Oqtane Plus

Shaun Walker announced that a commercial support offering for Oqtane which will available soon, and it will be branded "Oqtane Plus".

• Commercial support offering for Oqtane framework
• Offered as a standard commercial module that can be purchased/installed from the Marketplace
• Oqtane continues to be fully open source, licensed under an MIT license
• All major functionality will continue to be included in the Oqtane framework ie. this is NOT an "open core" business model
• Anyone offering a module or theme on the Marketplace will receive a complimentary license for Oqtane Plus

Roadmap

The next release will be 10.2.5 in early September and will be a maintenance release. Following 10.2.5 will be a 10.3 release in September/October which will be a major release focused on Folder Providers and potentially a native MCP Server for the Oqtane API.

Epilogue

The full recording of the meeting has been published to Oqtane's YouTube Channel:

Watch Full Recording

The next Oqtane Community Standup will be on Wednesday, October 7, 2026:

Join Meeting

Meetings occur on the first Wednesday of each month (add to your calendar so you don't forget)