# What's new in GrandNode 2.4: .NET 10, a store owner panel and a security overhaul 2026-10-03 GrandNode 2.4 is the biggest release since GrandNode 2.0. It moves the platform to .NET 10, gives store owners their own panel, closes a long list of security gaps found in a systematic review, and renews both the storefront and the admin. The full changelog is in the [release notes on GitHub](https://github.com/grandnode/grandnode2/releases). ### The highlights - **.NET 10** and a leaner dependency tree. - **A store owner panel** for multi-store and SaaS setups. - **Security:** PBKDF2 passwords, CSRF protection everywhere, allowlist HTML sanitization and fixed cross-store access gaps. - **Performance:** catalog cache per customer group, async database access and safe multi-instance scheduling. - **A new storefront frontend** (Vue 3, Bootstrap 5, Vite) and a modernised admin panel. - **Better data for search engines and AI assistants:** richer structured data and real availability. ### .NET 10 and a leaner stack GrandNode 2.4 runs on .NET 10, with .NET Aspire 13 for local orchestration. Two third-party libraries the whole codebase depended on were replaced with small in-house ones: `Grand.Mediator` instead of MediatR and `Grand.Mapping` instead of AutoMapper. JSON Patch moved from Newtonsoft.Json to System.Text.Json, and the solution file moved to the XML-based `.slnx` format. ### A panel for store owners The largest new feature is the store owner panel (`Grand.Web.Store`). In a multi-store installation, each store can now be managed by its own "Store manager" without access to the main admin panel: products and their attributes, reviews, CMS pages, blog, message templates, settings, currencies, languages, shipping, discounts, tax, payments, e-mail accounts and customers - all limited to that store. System-wide settings stay locked to the main admin. This makes GrandNode a practical base for hosting many independent shops on one installation, the SaaS model. See [the store owner panel](https://grandnode.com/store-panel-overview) in the documentation. ### Security 2\.4 is the result of a systematic security review of the codebase. Among the changes: - Customer passwords are hashed with **PBKDF2**; older hashes are upgraded transparently when a customer signs in, and passwords are no longer stored in a reversible form. - **CSRF protection** on every storefront controller, admin plugin POST actions and the admin file manager. - An **allowlist HTML sanitizer** replaces the old script blacklist for content written in the editors. - Fixed **cross-store and vendor access gaps** (IDOR) in the store owner and vendor panels, with ownership checks consolidated in one place. - Fixed a memory denial-of-service and an extension bypass in file uploads, an open redirect, and API query parsing without a timeout. Weak JWT secrets now stop the application from starting. Release Docker images are signed and published with an SBOM and build provenance (SLSA), so you can verify what you deploy. ### Performance and reliability - The storefront catalog is cached per customer group instead of per customer, so far more visitors share one cache entry. - Paged and repository queries run asynchronously on the MongoDB driver instead of blocking threads; stock updates are batched. - Order numbers are assigned under a unique index - no duplicates under load. - Running several instances is safer: resilient Redis cache invalidation, scheduled tasks that run exactly once, and files written at runtime shared through one media path. - A `/health/ready` endpoint for load balancers and orchestrators. ### A new storefront frontend and a modern admin The storefront moved to **Vue 3, Bootstrap 5 and Vite**, with dark mode, faster pages and checkout fixes. Two themes show what it can do: a redesigned **Modern** theme and the new **Nordic Editorial** theme. On phones the header icons move to a bottom bar. The admin, store owner and vendor panels were rebuilt on Bootstrap 5 without the commercial Kendo UI library, with new data grids, a consistent component layer and redesigned sign-in screens with password recovery. ### Search engines and AI assistants - Product structured data (JSON-LD) now includes ratings, shipping details and the return policy, and reports real availability to search engines and AI crawlers. - The XML sitemap task was fixed, and the product quick view no longer adds incomplete microdata to every page. ### For plugin and theme developers Most plugins need small changes for 2.4: target `net10.0`, replace MediatR and AutoMapper usings with `Grand.Mediator` and `Grand.Mapping`, and review storefront views against Vue 3 and Bootstrap 5. The repository also ships the [AI Agent Kit](https://grandnode.com/ai-agent-kit) - architecture notes, conventions and review checklists that coding agents such as Claude Code, Codex or Cursor read from `AGENTS.md` - which helps with exactly this kind of upgrade. See [upgrades and migrations](https://grandnode.com/developers-upgrade-migrations) and [upgrading GrandNode](https://grandnode.com/getting-started-upgrading). ### How to get it - Run the `grandnode/grandnode2` Docker image, or download the release package from [GitHub](https://github.com/grandnode/grandnode2/releases) - see [Download](https://grandnode.com/download). - You need the .NET 10 runtime and MongoDB 4.0 or newer - see [system requirements](https://grandnode.com/getting-started-system-requirements). - Upgrading an existing store: back up the database and try the upgrade on a copy first. Database migrations run when the application starts. Found a problem? Report it on [GitHub](https://github.com/grandnode/grandnode2/issues). ### 2\.4 and long-term support GrandNode 2.4 is planned as the first long-term support (LTS) release, with 24 months of security fixes for companies that cannot upgrade every few months. LTS releases, backports and private vulnerability notices are part of [GrandNode Official](https://grandnode.com/official); buy now and your plan period starts when the first LTS release is published. - [Web page](https://grandnode.com/whats-new-in-grandnode-24)