What's new in GrandNode 2.4: .NET 10, a store owner panel and a security overhaul

GrandNode 2.4 is the biggest release since GrandNode 2.0. It moves the platform to .NET 10, gives store owners their own panel, closes a long list of security gaps found in a systematic review, and renews both the storefront and the admin. The full changelog is in the release notes on GitHub.

The highlights

• .NET 10 and a leaner dependency tree.
• A store owner panel for multi-store and SaaS setups.
• Security: PBKDF2 passwords, CSRF protection everywhere, allowlist HTML sanitization and fixed cross-store access gaps.
• Performance: catalog cache per customer group, async database access and safe multi-instance scheduling.
• A new storefront frontend (Vue 3, Bootstrap 5, Vite) and a modernised admin panel.
• Better data for search engines and AI assistants: richer structured data and real availability.

.NET 10 and a leaner stack

GrandNode 2.4 runs on .NET 10, with .NET Aspire 13 for local orchestration. Two third-party libraries the whole codebase depended on were replaced with small in-house ones: Grand.Mediator instead of MediatR and Grand.Mapping instead of AutoMapper. JSON Patch moved from Newtonsoft.Json to System.Text.Json, and the solution file moved to the XML-based .slnx format.

A panel for store owners

The largest new feature is the store owner panel (Grand.Web.Store). In a multi-store installation, each store can now be managed by its own "Store manager" without access to the main admin panel: products and their attributes, reviews, CMS pages, blog, message templates, settings, currencies, languages, shipping, discounts, tax, payments, e-mail accounts and customers - all limited to that store. System-wide settings stay locked to the main admin.

This makes GrandNode a practical base for hosting many independent shops on one installation, the SaaS model. See the store owner panel in the documentation.

Security

2.4 is the result of a systematic security review of the codebase. Among the changes:

• Customer passwords are hashed with PBKDF2; older hashes are upgraded transparently when a customer signs in, and passwords are no longer stored in a reversible form.
• CSRF protection on every storefront controller, admin plugin POST actions and the admin file manager.
• An allowlist HTML sanitizer replaces the old script blacklist for content written in the editors.
• Fixed cross-store and vendor access gaps (IDOR) in the store owner and vendor panels, with ownership checks consolidated in one place.
• Fixed a memory denial-of-service and an extension bypass in file uploads, an open redirect, and API query parsing without a timeout. Weak JWT secrets now stop the application from starting.

Release Docker images are signed and published with an SBOM and build provenance (SLSA), so you can verify what you deploy.

Performance and reliability

• The storefront catalog is cached per customer group instead of per customer, so far more visitors share one cache entry.
• Paged and repository queries run asynchronously on the MongoDB driver instead of blocking threads; stock updates are batched.
• Order numbers are assigned under a unique index - no duplicates under load.
• Running several instances is safer: resilient Redis cache invalidation, scheduled tasks that run exactly once, and files written at runtime shared through one media path.
• A /health/ready endpoint for load balancers and orchestrators.

A new storefront frontend and a modern admin

The storefront moved to Vue 3, Bootstrap 5 and Vite, with dark mode, faster pages and checkout fixes. Two themes show what it can do: a redesigned Modern theme and the new Nordic Editorial theme. On phones the header icons move to a bottom bar.

The admin, store owner and vendor panels were rebuilt on Bootstrap 5 without the commercial Kendo UI library, with new data grids, a consistent component layer and redesigned sign-in screens with password recovery.

Search engines and AI assistants

• Product structured data (JSON-LD) now includes ratings, shipping details and the return policy, and reports real availability to search engines and AI crawlers.
• The XML sitemap task was fixed, and the product quick view no longer adds incomplete microdata to every page.

For plugin and theme developers

Most plugins need small changes for 2.4: target net10.0, replace MediatR and AutoMapper usings with Grand.Mediator and Grand.Mapping, and review storefront views against Vue 3 and Bootstrap 5. The repository also ships the AI Agent Kit - architecture notes, conventions and review checklists that coding agents such as Claude Code, Codex or Cursor read from AGENTS.md - which helps with exactly this kind of upgrade. See upgrades and migrations and upgrading GrandNode.

How to get it

• Run the grandnode/grandnode2 Docker image, or download the release package from GitHub - see Download.
• You need the .NET 10 runtime and MongoDB 4.0 or newer - see system requirements.
• Upgrading an existing store: back up the database and try the upgrade on a copy first. Database migrations run when the application starts.

Found a problem? Report it on GitHub.

2.4 and long-term support

GrandNode 2.4 is planned as the first long-term support (LTS) release, with 24 months of security fixes for companies that cannot upgrade every few months. LTS releases, backports and private vulnerability notices are part of GrandNode Official; buy now and your plan period starts when the first LTS release is published.