Duende.BFF 4.3.3
This release lets BFF accept V2 license keys, and moves BFF's dependencies onto the ASP.NET Core 10.0.14 packages.
V8 style license keys
Identity Server V8 introduced a license key format (internally referred to as V2). BFF now reads and validates its license key the same way IdentityServer does. Before this release, BFF rejected Identity Server V8 license keys (V2): it logged "Error validating the license key" and ran as if it had no license. V2 keys are now accepted. Existing Identity Server V7 license keys(V1) keys keep working.
BFF still reads the key from BffOptions.LicenseKey, or from Duende_License.key or Duende_IdentityServer_License.key in the current directory. When IdentityServer and BFF run in the same host, they share the license.
ASP.NET Core 10.0.14 (CVE-2026-102870)
GitHub advisory GHSA-g27p-qf6j-c96c (CVE-2026-102870) now covers Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13. Duende.BFF.Blazor.Client 4.3.3 requires the 10.0.14 versions of Microsoft.AspNetCore.Components.Authorization, Microsoft.AspNetCore.Components.WebAssembly and Microsoft.Extensions.Http, and the BFF templates use 10.0.14.
If your Blazor host references Microsoft.AspNetCore.Components.WebAssembly.Server directly, update it to 10.0.14. Also update the .NET runtime on your hosts and container images to 10.0.14.
Breaking changes
None to the public API.
Full Changelog: bff-4.3.2...bff-4.3.3