CoreUpload v5 . ASP.NET Core 8+
Direct-to-S3 / Azure tus 1.0 resume IndexedDB Golden Retriever 30 locales Webcam & screen capture
Contact

Release notes

A reverse-chronological record of what shipped in each CoreUpload release. The current line is 5.3.

5.3

Current

5.3.9 — maintenance

  • Direct-to-GCS endpoint names. The client posts /gcs/initiate and /gcs/finalize, but the endpoints were mapped only as /gcs/create and /gcs/complete, so a GCS upload answered 404. Both spellings are now mapped to the same handlers.
  • Server error messages reach the user. A rejected upload showed only the status code; the JSON errorMessage the endpoint had already written was discarded on the single-file path. It is now surfaced, matching the chunked path.
  • allowedExtensions accepts an array as well as a comma-separated string. The array form — which the documentation shows — previously threw during initialization.
  • New progress event. on('progress') now fires with the same payload as the onProgress option.
  • onFileAdded argument order is consistent across selection, resume and URL-import: all pass (task, uploader), matching multipleupload.d.ts.

Native Blazor component

CoreUpload now ships <CoreUploader /> in the package. No hand-written JS interop: 16 parameters configure the uploader and six EventCallback parameters (OnTaskComplete, OnQueueComplete, OnProgress, OnFileAdded, OnError, OnInstantUpload) deliver strongly-typed results to your C# code. Works in Blazor Server and WebAssembly. A runnable BlazorDemo app ships in the download package. See the Blazor guide.

Folder uploads keep their structure

Folder drops and directory-picker selections carry each file's relative path through single, multiple and chunked uploads, and expose it server-side as RelativePath (traversal-sanitized: .. segments, drive letters, control characters and Windows reserved device names are all neutralized), so your handler can recreate the tree.

Instant upload (content dedupe)

Opt-in via EnableInstantUpload. The client hashes the file with SHA-256 and, when the server already stores that exact content, the upload completes instantly with zero bytes transferred. The server hashes content itself — client-claimed hashes are never trusted — and the dedupe probe runs through the same authorization gate as any other read, so it cannot be used to discover another user's files.

Fixes

  • Chunked uploads posted to the wrong endpoint when uploadUrl pointed at /upload/upload or /upload/multiple; the chunk base is now derived correctly, with a one-shot fallback for custom routes.
  • Multi-file posts to /upload/multiple discarded the relative path, so folder drops saved flat.
  • Folder scans could dispatch a partial batch when the browser resolved entries synchronously.

5.2

5.2.3 — security update Recommended for all users

This release fixes security issues in the upload pipeline. Upgrading is recommended for every deployment.

  • Chunked-upload validation bypass. Validation ran only on the first chunk and not at completion, so a client that skipped chunk 0 — or renamed the file in the completion call — could store a file whose extension, MIME type and size were never checked. Validation now runs on every chunk, at completion, and against the real assembled size.
  • Cross-site scripting via file names. Toast notifications and several queue/preview elements inserted file names and server error text as markup, so a hostile file name could execute script. All such values are now escaped or inserted as text.
  • Unbounded disk writes. Chunk uploads were not size-capped, and tus PATCH was not clamped to the declared Upload-Length, allowing a single client to fill the disk. Both are now bounded, and abandoned tus sessions are cleaned up.
  • Image-transform memory exhaustion (Web Forms): transform dimensions are now clamped before allocation.
  • Error detail no longer echoed to clients — exceptions are logged with a correlation id (opt out with VerboseErrors in development).
  • New: optional IUploadAuthorizationHandler for per-file authorization on info/download/delete. The default remains capability-based (holding the file GUID grants access) and is now documented as such.

5.2.2 refinements

  • Multi-rendition upload: the renditions option generates and uploads scaled versions (thumbnail, WebP medium…) alongside the original, linked via renditionOf. Demo.
  • Per-file metadata: inline queue inputs plus a modal editor for thumbnail-grid files (openMetaEditor). Demo.
  • Deep keyboard queue navigation (roving tabindex, row actions) — on by default. Demo.
  • prioritizeFirstAndLastChunk: head/tail chunks first for early server validation.
  • Transform-URL contract widened to 13 keys (crop, blur, gravity incl. smart/face, rotate, flip, grayscale, watermark) with a validated ImageTransformRequest parser.
  • All of the above configurable from the Tag Helper (asp-renditions, asp-meta-fields, asp-keyboard-navigation, asp-prioritize-first-last-chunk) and the Web Forms control.
  • tus checksum extension, chunk-status resume verification, and framework adapters shipped in the package (/_content/CoreUpload/adapters/).

Cloud sources

  • Box promoted to a first-class source.
  • Unsplash search-and-import source added.
  • Companion broker: self-hosted Node OAuth plus file proxy (Dropbox, Box, Drive, OneDrive) with proxy and server-to-destination transfer modes.

Headless framework hooks

  • useUploader() for React and Vue.
  • use:uploader Svelte action.
  • UploaderService for Angular.

Image editor

  • Content-aware smart-crop (edge-energy focal point - not AI).
  • Text and sticker overlays with styling controls.
  • Filter adjustments (brightness, contrast, saturation, sepia, grayscale) plus presets.
  • EXIF metadata viewer and crop-ratio chips.
  • AVIF and WebP output with a quality slider.

Image pipeline

  • EXIF auto-rotate on upload.
  • PDF poster thumbnails.
  • URL-based transforms: transformUrl client helper, honored server-side via the pluggable IImageTransformer on Core.

Validation and UX

  • Standalone aspectRatio validator and per-file rename UI.
  • Restore prompt to resume incomplete uploads after reload.
  • Whole-page drop target, form auto-attach, locale auto-detect.
  • Accessibility: ARIA live-region announcements, reduced-motion support, focus traps.
  • 28 built-in locales.

Server / .NET

  • GCS server endpoints and IGcsSigner.
  • IImageTransformer extension point on CoreUpload.

Earlier releases

5.1

7 transport strategies including GCS, 4 cloud pickers, AES-GCM encryption, an offline service-worker queue, cross-tab coordination, locales expanded from 20 to 30, webcam / screen / audio capture, and a virus-scan hook.

5.0

The v5 rewrite: pluggable transport strategies, direct-to-S3 / Azure / tus, IndexedDB resume, an inline image editor, and the canonical single-source branded build.