XAF (Cross-Platform .NET App UI & Web API Service) — Year-End Roadmap (v26.2)

Thank you for your continued support and for sharing your XAF development requirements with us via product surveys, Support Center tickets, email, and social media engagements. This post outlines features and capabilities we expect to ship in our year-end release (v26.2 - Dec 2026).

Security and Dependency Updates

.NET 11 Support

DevExpress XAF Blazor/WinForms, Web API Service, and XPO ORM library will support .NET 11 (both v26.1 and v26.2) following Microsoft's official release.

Minimum Supported .NET and Visual Studio Versions

Separate NuGet Packages for Different .NET Versions (.NET 10, .NET 11, etc.)

Today, third-party dependencies are automatically patched after a detected vulnerability (for example, a vulnerability in System.Security.Cryptography.Xml) only for the minimally supported .NET version (today it's .NET 8). Today (with v26.1, v25.2, v25.1, v24.2), manual version pinning (Solutions #1 or #2 from this article) may still be required for .NET 9/10-based projects depending on their exact TFM and project SDK. We will provide .NET-specific dependency groups in DevExpress NuGet packages, which will simplify use of v26.2. 

Entity Framework Core 11 for Data Access

v26.2 will add official support for the most recent version of Entity Framework (EF Core 11) to our XAF Blazor/WinForms UI and Web API Service. We will also update our performance benchmarks - comparing EF Core 11 with XPO.

While EF Core 11 introduces performance and customization improvements, it also includes breaking changes that require updates on our side. Not all EF Core database providers offer compatible NuGet packages (for instance, we had to remove Pomelo.EntityFrameworkCore.MySql support in v26.1.5+).

SBOMs and CRA Readiness

If you deliver software in the EU, the Cyber Resilience Act (CRA) will require a Software Bill of Materials (SBOM – an inventory of every component inside your solution) as part of your conformity documentation. The CRA and its associated regulatory regime will go into effect on December 2027. Each software application/solution manufacturer must fulfil SBOM-related obligations. DevExpress-authored SBOMs will help customers document/inventory DevExpress libraries used within a DevExpress-powered app.  

Most dependency scanners and SBOM generation tools read what a NuGet package declares (its dependencies on other NuGet packages) and stop there, which leaves two gaps we fill:

• Components embedded inside a package. Some DevExpress NuGet packages bundle fonts and third-party JavaScript libraries. Package metadata has no way to declare them, so a scanner never reports them — even though their licenses and vulnerabilities are as real as those of any declared dependency.
• Developer dependencies. Libraries we use to build our products never reach users, so we mark them with scope: "excluded". We list these libraries regardless, because all vulnerabilities should be documented.

We released a preview version of DevExpress-authored SBOMs in May 2026 (for our .NET NuGet packages). SBOMs for CRA Compliance in DevExpress-powered Apps describes what the files contain and how to feed them into tools such as Dependency-Track, Trivy, and Grype. With v26.2, we expect to extend coverage to NPM packages and DevExpress VCL libraries, take our SBOMs out of preview and make them available to every customer.

Middle-Tier Security — Stricter Application Model Permissions

XAF applications that store Application Model differences in a database must currently grant pre-login read/write access to ModelDifferenceXXX types for the Middle-Tier application server. We plan to narrow these pre-login permissions in v26.2. This will help customers with strict security requirements or when XAFML exposes sensitive Application Model settings before a user authenticates.  

WCF Dependency Will Be Removed from XPO Core and Printing Libraries

These core libraries currently include references to WCF (Windows Communication Foundation), a standard library with a well-documented history of vulnerability disclosures in its dependencies ("thanks" to System.Security.Cryptography.Xml). We will remove these WCF references from DevExpress.Xpo core and DevExpress.Printing.Core libraries in v26.2.  .NET Framework users will use the new DevExpress.Xpo.Services and DevExpress.Printing.Remote libraries instead (if you need this advanced and rarely used WCF functionality). The Project Converter will update project references automatically, so you should not encounter upgrade-related issues.

XPO ORM - Connection Provider Updates

We plan to support the most recent versions of the following database engines (for both .NET and .NET Framework) in XPO v26.2.

• PostgreSQL
• Microsoft SQL Server
• SAP HANA 8
• Oracle 26ai
• etc.

Documentation

XAF Blazor 

Scalability & Performance Optimizations

As you know, XAF Blazor scalability remains a top priority at DevExpress (number of concurrent web users). For information on our initial implementation (load test conditions, hardware, latency comparisons between versions, etc.), please follow our Technical FAQ updates. 

By the end of 2026, we expect to publish the first production-ready version (Beta or RC) of our scalability-related enhancements:

• "Crowd/Peak Load” (ALL users execute commands simultaneously), “Activity" (average user work day), and “Requests Per Second" (RPS) tests.
• Additional enhancements based on ALL tests (XAF Core speed/memory usage and Blazor component rendering optimizations).
• Published test results, load tests, configs, important considerations, and limitations for public review.

List Editor Context Menu Enhancements

We will switch to the native Blazor context menu within the XAF Grid, TreeList, and Pivot Grid list editors. The default menu will include standard grid commands: Column Chooser, Filter Editor, sorting and grouping controls, Find Panel, Best Fit, and others. A concise API for customizing the default menu items will also be available (for example, previously missing DxTreeListModel.CustomizeContextMenu and DxTreeListModel.ContextMenus APIs). 

We will also ship basic runtime total/group summary customization in v26.2 (including the DXGridModelBase.TotalSummary and DevExpress.ExpressApp.Blazor.Editors.DxGridSummary APIs).

Blazor Pivot Grid Module — Official Release 

The XAF Blazor Pivot Grid module will officially ship in our v26.2 release cycle. The official release will include updated demos, documentation, and full test coverage.

DevExpress Icon Library Integration

XAF WinForms and XAF Blazor will leverage the new DevExpress Icon Library as the default icon source for v26.2 -- giving both platforms access to the entire DevExpress Fluent icon set. A global toggle between classic and Fluent icon styles will be available at the application level. XAF's built-in Image Picker (in the Model Editor) will also be updated to present and save icons from the new library. Existing image and icon references in your applications will continue to work without modification.

Template Kit Enhancements and New GitHub Examples

• XAF Template Kit: We will migrate to the ASP.NET Core Minimal API and simplify Blazor project files (for example, no Startup.cs file, less code, etc.).
• Electron.NET example: We expect to introduce an example for cross-platform desktop applications built atop XAF Blazor with Middle-Tier Security, and Electron.NET, supporting Windows and macOS deployment from a single codebase. We previously delayed this task and dropped Template Kit integration due to the new ElectronNET.Core.API library.
• .NET Aspire example: We will update our existing Aspire-based example with Microsoft Aspire 13.5. Aspire support simplifies database configuration and cloud deployment setup for XAF Blazor and Web API Service apps.

Artificial Intelligence (AI)

AI Integration Module — Official Release

Our AI Integration Module should be ready for production use in v26.2. The biggest new feature is certainly native AI Chat integration for both XAF Blazor/WinForms. Although it is already possible today with custom code (a community example), built-in form templates and other harnesses will save time for those using XAF.

Accurate XAFML Generation with AI Assistants

AI coding assistants currently struggle to generate correct XAF Application Model (XAFML) code. That is because XAF documentation includes very few XAFML code samples for individual model options. We plan to add XAFML snippets alongside online documentation and to publish a machine-readable XML schema for the Application Model. This will make contextual info available to the DevExpress MCP Documentation server and make AI-generated XAFML more accurate when using AI coding assistants.

Product-Tailored AI Skill Updates

We expect to extend and update the DevExpress AI Agent Skills repository based on user feedback (for multiple implementation tasks and AI coding assistants, such as GitHub Copilot, Claude Code, Cursor, and JetBrains AI Assistant).

The repository includes folders for different DevExpress products. Navigate to the dx-xaf directory to locate XAF-specific AI Agent Skills - coding assistants with built-in knowledge of XAF, its capabilities, related APIs, best practices, and code examples.

General MCP Server-related Updates

Our installer will now register the DevExpress MCP Documentation Server automatically (you can opt out via a checkbox), because it is a must-have feature when using AI coding assistants. NOTE: Our AI Skills already register the MCP Server by default (without conflicts).

Our MCP server will also support additional AI tools: to search public Support Center tickets and Breaking Change listings.

If you have not yet evaluated our AI Agent Skills or MCP Server, please take a moment to review this community post.

Localization / Globalization

Blazor UI — Right to Left (RTL) Support

DevExpress Blazor components and XAF Blazor will better support Right-to-Left (RTL) layouts in v26.2. Teams building applications for Arabic, Hebrew, and other RTL languages will be able to activate RTL across XAF Blazor UI elements, including our grids, editors, navigation, and form layouts (using a project-level option, without CSS or other workarounds).

New Localization Tool Integration

In our last release cycle (v26.1), the new DevExpress Localization Tool was updated to load strings from standard XAF modules (learn more). This change notwithstanding, XAF-specific strings customized in the Model Editor could not be transferred. We plan to close this gap in v26.2. XAF developers will be able to export Application Model strings and import them into the Localization Tool for translation, without manual file editing.

The deprecated Localization command in the Model Editor toolbar will also be removed in v26.2.

Improved Localization Support with AI-powered Translations

We expect to ship complete built-in localizations for a selected set of languages. Professional translators have already translated and reviewed approximately 80% of our German localization. To broaden language coverage while maintaining translation quality, we plan to leverage AI-powered translation workflows. The workflow will not rely on direct translation alone - it will also consider additional context:

• Usage context - how each string is used, collected from our source code.
• Established Microsoft terminology (obtained from the Microsoft Terminology Collection).

Web Localization Service — Supported Versions Limited to v23.2+ 

User translations for v23.1 and earlier releases will no longer be available through the Localization Service UI (view, edit, download, create). These translations will be retained by DevExpress should you require them. You can request your old translation archives via the DevExpress Support Center.

Your Feedback Counts

If you have questions or suggestions about XAF v26.2, please share your thoughts in the survey below or submit a ticket via the DevExpress Support Center.

Thanks,
Dennis Garavsky
Principal Product Manager
dennis@devexpress.com

Free DevExpress Products - Get Your Copy Today