<!-- This issue template is for use in opening issues that document breaking changes. This template should be used to create an issue by Microsoft product team members who are documenting a breaking change.

Bracketed text is a placeholder; replace the text with the requested information and remove the brackets before submitting the issue. Also, remove this comment before submitting the issue.

-->

Changed MessagePack library in @microsoft/signalr-protocol-msgpack npm package

@microsoft/signalr-protocol-msgpack used to reference msgpack5 now it references @msgpack/msgpack.

The MessagePackOptions that could optionally be passed into the MessagePackHubProtocol also has a breaking change. The options disableTimestampEncoding and forceFloat64 no longer exist, and some additional options now exist.

Version introduced

ASP.NET Core 6.0

Old behavior

Previously to use the MessagePack hub protocol in the browser you needed to include 3 script references

<script src="~/lib/signalr/signalr.js"></script>
<script src="~/lib/msgpack5/msgpack5.js"></script>
<script src="~/lib/signalr/signalr-protocol-msgpack.js"></script>

In addition the msgpack5 package was downloaded to your node_modules so you could use it in your app if you wanted.

MessagePackOptions had disableTimestampEncoding and forceFloat64 properties, but doesn't anymore.

New behavior

To use the MessagePack hub protocol in the browser you now only need 2 script references

<script src="~/lib/signalr/signalr.js"></script>
<script src="~/lib/signalr/signalr-protocol-msgpack.js"></script>

And you will have the @msgpack/msgpack package downloaded to your node_modules if you want to use the directly in your app.

MessagePackOptions has new properties and removed the disableTimestampEncoding and forceFloat64 properties.

Reason for change

Reduced asset size, reduced complexity to consume the package, and more customizability.

Recommended action

If you were previously using msgpack5 in your app, you will need to add a direct reference to the library in your package.json.

Category

ASP.NET

Affected APIs

Removed MessagePackOptions.disableTimestampEncoding Removed MessagePackOptions.forceFloat64

<!-- Do not modify anything below this line -->

Issue metadata

• Issue type: breaking-change

- static Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseNullableQuery(string! queryString) -> System.Collections.Generic.Dictionary<string!, Microsoft.Extensions.Primitives.StringValues>?
+ static Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseNullableQuery(string? queryString) -> System.Collections.Generic.Dictionary<string!, Microsoft.Extensions.Primitives.StringValues>?
- static Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(string! queryString) -> System.Collections.Generic.Dictionary<string!, Microsoft.Extensions.Primitives.StringValues>!
+ static Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(string? queryString) -> System.Collections.Generic.Dictionary<string!, Microsoft.Extensions.Primitives.StringValues>!

WebEventDescriptor.EventArgsType replaced by WebEventDescriptor.EventName

The Microsoft.AspNetCore.Components.RenderTree.WebEventDescriptor class is part of Blazor's internal protocol for communicating events from JavaScript into .NET. This class is not typically used by application code. It is typically used only by platform authors.

Starting from version 6.0, the EventArgsType property on WebEventDescriptor is being replaced by a new property called EventName. This will not affect any typical application code as it is only a detail of the low-level platform implementation.

Version introduced

6.0

Old behavior

The property EventArgsType described a nonstandard, Blazor-specific category name for groups of DOM event types. For example, the click and mousedown events were both mapped to an EventArgsType value of mouse. Similarly, cut, copy, and paste events were all mapped to an EventArgsType value of clipboard. These category names were used to determine the .NET type to use for deserializing the incoming event args data.

New behavior

The new property EventName simply specifies the original name of the event, for example click, mousedown, cut, copy, or paste. There is no longer a need to supply a Blazor-specific category name, so the old property EventArgsType is removed.

Reason for change

In PR #29993 we have introduced support for custom event arguments classes. As part of this, we no longer rely on all events fitting into a predefined set of categories. The framework now only need to know the original, raw event name.

Recommended action

Application code should not be affected in any way and does not need to change.

Anyone building a custom Blazor rendering platform may need to update their mechanism for dispatching events into the Renderer, replacing any hardcoded rules they had before about event categories with simpler logic that supplies the original, raw event name.

Category

ASP.NET

Affected APIs

WebEventDescriptor.EventArgsType property

Issue metadata

• Issue type: breaking-change

6.0-preview2 fixed nullable annotations for Microsoft.AspNetCore.SignalR namespace:

- Microsoft.AspNetCore.Http.Connections.Features.IHttpContextFeature.HttpContext.get -> Microsoft.AspNetCore.Http.HttpContext!
+ Microsoft.AspNetCore.Http.Connections.Features.IHttpContextFeature.HttpContext.get -> Microsoft.AspNetCore.Http.HttpContext?

- static Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage.WithError(string! invocationId, string! error) -> Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage!
+ static Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage.WithError(string! invocationId, string? error) -> Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage!

- static Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage.WithResult(string! invocationId, object! payload) -> Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage!
+ static Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage.WithResult(string! invocationId, object? payload) -> Microsoft.AspNetCore.SignalR.Protocol.CompletionMessage!

- Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.Arguments.get -> object?[]?
+ Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.Arguments.get -> object?[]!

- Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.HubMethodInvocationMessage(string? invocationId, string! target, object?[]? arguments) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.HubMethodInvocationMessage(string? invocationId, string! target, object?[]! arguments) -> void

- Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.HubMethodInvocationMessage(string? invocationId, string! target, object?[]? arguments, string![]? streamIds) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.HubMethodInvocationMessage.HubMethodInvocationMessage(string? invocationId, string! target, object?[]! arguments, string![]? streamIds) -> void

- Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string! target, object?[]? arguments) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string! target, object?[]! arguments) -> void

- Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string? invocationId, string! target, object?[]? arguments) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string? invocationId, string! target, object?[]! arguments) -> void

- Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string? invocationId, string! target, object?[]? arguments, string![]? streamIds) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.InvocationMessage.InvocationMessage(string? invocationId, string! target, object?[]! arguments, string![]? streamIds) -> void

- Microsoft.AspNetCore.SignalR.Protocol.StreamInvocationMessage.StreamInvocationMessage(string! invocationId, string! target, object![]! arguments) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.StreamInvocationMessage.StreamInvocationMessage(string! invocationId, string! target, object?[]! arguments) -> void

- Microsoft.AspNetCore.SignalR.Protocol.StreamInvocationMessage.StreamInvocationMessage(string! invocationId, string! target, object![]! arguments, string![]! streamIds) -> void
+ Microsoft.AspNetCore.SignalR.Protocol.StreamInvocationMessage.StreamInvocationMessage(string! invocationId, string! target, object?[]! arguments, string![]? streamIds) -> void

- Microsoft.AspNetCore.SignalR.Protocol.IHubProtocol.TryParseMessage(ref System.Buffers.ReadOnlySequence<byte> input, Microsoft.AspNetCore.SignalR.IInvocationBinder! binder, out Microsoft.AspNetCore.SignalR.Protocol.HubMessage! message) -> bool
+ Microsoft.AspNetCore.SignalR.Protocol.IHubProtocol.TryParseMessage(ref System.Buffers.ReadOnlySequence<byte> input, Microsoft.AspNetCore.SignalR.IInvocationBinder! binder, out Microsoft.AspNetCore.SignalR.Protocol.HubMessage? message) -> bool

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendAllAsync(string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendAllAsync(string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendAllExceptAsync(string! methodName, object?[]? args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendAllExceptAsync(string! methodName, object?[]! args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendConnectionAsync(string! connectionId, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendConnectionAsync(string! connectionId, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendConnectionsAsync(System.Collections.Generic.IReadOnlyList<string!>! connectionIds, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendConnectionsAsync(System.Collections.Generic.IReadOnlyList<string!>! connectionIds, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupAsync(string! groupName, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupAsync(string! groupName, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupExceptAsync(string! groupName, string! methodName, object?[]? args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupExceptAsync(string! groupName, string! methodName, object?[]! args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupsAsync(System.Collections.Generic.IReadOnlyList<string!>! groupNames, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendGroupsAsync(System.Collections.Generic.IReadOnlyList<string!>! groupNames, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendUserAsync(string! userId, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendUserAsync(string! userId, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendUsersAsync(System.Collections.Generic.IReadOnlyList<string!>! userIds, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ override Microsoft.AspNetCore.SignalR.DefaultHubLifetimeManager<THub>.SendUsersAsync(System.Collections.Generic.IReadOnlyList<string!>! userIds, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendAllAsync(string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendAllAsync(string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendAllExceptAsync(string! methodName, object?[]? args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendAllExceptAsync(string! methodName, object?[]! args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendConnectionAsync(string! connectionId, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendConnectionAsync(string! connectionId, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendConnectionsAsync(System.Collections.Generic.IReadOnlyList<string!>! connectionIds, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendConnectionsAsync(System.Collections.Generic.IReadOnlyList<string!>! connectionIds, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupAsync(string! groupName, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupAsync(string! groupName, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupExceptAsync(string! groupName, string! methodName, object?[]? args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupExceptAsync(string! groupName, string! methodName, object?[]! args, System.Collections.Generic.IReadOnlyList<string!>! excludedConnectionIds, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupsAsync(System.Collections.Generic.IReadOnlyList<string!>! groupNames, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendGroupsAsync(System.Collections.Generic.IReadOnlyList<string!>! groupNames, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendUserAsync(string! userId, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendUserAsync(string! userId, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendUsersAsync(System.Collections.Generic.IReadOnlyList<string!>! userIds, string! methodName, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ abstract Microsoft.AspNetCore.SignalR.HubLifetimeManager<THub>.SendUsersAsync(System.Collections.Generic.IReadOnlyList<string!>! userIds, string! methodName, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- Microsoft.AspNetCore.SignalR.IClientProxy.SendCoreAsync(string! method, object?[]? args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!
+ Microsoft.AspNetCore.SignalR.IClientProxy.SendCoreAsync(string! method, object?[]! args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task!

- virtual Microsoft.AspNetCore.SignalR.HubConnectionContext.User.get -> System.Security.Claims.ClaimsPrincipal?
+ virtual Microsoft.AspNetCore.SignalR.HubConnectionContext.User.get -> System.Security.Claims.ClaimsPrincipal!

readonly Microsoft.AspNetCore.Components.RenderTree.RenderTreeEdit.RemovedAttributeName -> string!
readonly Microsoft.AspNetCore.Components.RenderTree.RenderTreeEdit.RemovedAttributeName -> string?

Rationale

Since we enabled GitHub Discussions, we've found them quite hard to manage for a repository the size of aspnetcore. Without labelling and assigning capabilities, there are no effective ways to triage or track what discussions have been looked at, or who has the next step.

To that end, we're going to disable them, and encourage people to just use issues instead - that way we can continue to ensure they get reviewed by the team, and acted upon if they are in fact bugs, etc.

When will this happen

I'll make the switch in a week, on 2021-02-11.

What happens to existing discussions

They will no longer be visible, but as far as we can tell, GitHub still keeps them, and if we ever enable discussions again, they will come back.

Where do I discuss this

Please comment on the discussion issue for this announcement on dotnet/aspnetcore.

<!-- This issue template is for use in opening issues that document breaking changes. This template should be used to create an issue by Microsoft product team members who are documenting a breaking change.

Bracketed text is a placeholder; replace the text with the requested information and remove the brackets before submitting the issue. Also, remove this comment before submitting the issue.

-->

Change to parameter name in RequestImageFileAsync

The parameter maxWith in the RequestImageFileAsync method was renamed from maxWith to maxWidth to address a typo.

Version introduced

6.0.0-preview1

Old behavior

The parameter name was spelled maxWith.

New behavior

The parameter name is spelled maxWidth.

Reason for change

API hygiene.

Recommended action

If you are using named parameters in the in RequestImageFile API, you may need to ensure that the parameter name is updated accordingly. Otherwise, no change is necessary.

Category

ASP.NET

Affected APIs

BrowserFileExtensions.RequestImageFileAsync

Issue metadata

• Issue type: breaking-change

<!-- This issue template is for use in opening issues that document breaking changes. This template should be used to create an issue by Microsoft product team members who are documenting a breaking change.

Bracketed text is a placeholder; replace the text with the requested information and remove the brackets before submitting the issue. Also, remove this comment before submitting the issue.

-->

Notice on obsoleted and removed APIs in AspNetCore

[Brief description of the change]

Version introduced

6.0.0-preview1

Old behavior

APIs were not removed or obsolete.

New behavior

APIs are removed or obsoleted.

Reason for change

APIs are either no longer used or don't function anymore.

Recommended action

Use the recommended replacement APIs.

Category

ASP.NET

Affected APIs

• Removed Microsoft.AspNetCore.Http.Connections.ParseResponse
• Removed Microsoft.AspNetCore.SignalR.HubInvocationContext
• Removed Microsoft.AspNetCore.Http.FeaturesIHttpBufferingFeature use Microsoft.AspNetCore.Http.Features.IHttpResponseBodyFeature instead
• Removed Microsoft.AspNetCore.Http.Features.IHttpSendFileFeature use Microsoft.AspNetCore.Http.Features.IHttpResponseBodyFeature instead
• Removed argument-less constructor of Microsoft.AspNetCore.StaticFiles.StaticFileResponseContext use the constructor with parameters instead
• Removed a constructor of Microsoft.AspNetCore.Mvc.Infrastructure.ObjectResultExecutor
• Removed Microsoft.AspNetCore.Mvc.ModelBinding.ValidationAllowShortCircuitingValidationWhenNoValidatorsArePresent
• Removed Microsoft.AspNetCore.Mvc.ViewFeatures.ViewComponentResultExecutor
• Obsoleted CompatibilityVersion

<!-- Do not modify anything below this line -->

Issue metadata

• Issue type: breaking-change

- Microsoft.AspNetCore.Authentication.Cookies.ITicketStore.RetrieveAsync(string! key) -> System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket!>!
+ Microsoft.AspNetCore.Authentication.Cookies.ITicketStore.RetrieveAsync(string! key) -> System.Threading.Tasks.Task<Microsoft.AspNetCore.Authentication.AuthenticationTicket?>!

- Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateDictionary.SetModelValue(string! key, object? rawValue, string! attemptedValue) -> void
+ Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateDictionary.SetModelValue(string! key, object? rawValue, string? attemptedValue) -> void

- Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateDictionary.this[string! key].get -> Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateEntry!
+ Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateDictionary.this[string! key].get -> Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateEntry?

- Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ClientValidatorItem.ClientValidatorItem(object! validatorMetadata) -> void
+ Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ClientValidatorItem.ClientValidatorItem(object? validatorMetadata) -> void

- Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ClientValidatorItem.Validator.get -> Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IClientModelValidator!
+ Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ClientValidatorItem.Validator.get -> Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IClientModelValidator?

Microsoft Security Advisory CVE-2021-1723 | .NET Core Denial of Service Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core and ASP.NET 5. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/aspnetcore/issues/29236

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

• Any .NET Core 3.1 or .NET 5.0 application running on .NET Core 3.1.10 or .NET 5.0.1 or lower respectively.

Please note that .NET Core 3.0 is out of support and all applications should be updated to 3.1.

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed in affected software you are exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

To fix the issue please install the latest version of .NET Core 3.1. If you have installed one or more .NET Core SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio which will also update your .NET Core SDKs.

You can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):
 Version:   3.1.100
 Commit:    cd82f021f4

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.18363
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\3.1.100\

Host (useful for support):
  Version: 3.1.0
  Commit:  65f04fb6db

.NET Core SDKs installed:
  3.1.100 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.App 3.1.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 3.1.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

• If you are using .NET Core 3.1, you should download and install Runtime 3.1.11 or SDK 3.1.111 (for Visual Studio 2019 v16.4) or 3.1.405 (for Visual Studio 2019 v16.5 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1

• If you are using .NET 5.0, you should download and install Runtime 5.0.2 or SDK 5.0.102 (for Visual Studio 2019 v16.8) from https://dotnet.microsoft.com/download/dotnet-core/5.0

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET Core, please email details to secure@microsoft.com. Reports may qualify for the .NET Core Bug Bounty. Details of the .NET Core Bug Bounty including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET Core GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2021-1723

Revisions

V1.0 (January 12, 2021): Advisory published.

Version 1.0

Last Updated 2021-01-12

HttpsRedirectionMiddleware will throw if there are multiple ambiguous https ports

The HttpsRedirectionMiddleware (UseHttpsRedirection) will now throw an InvalidOperationException if it finds multiple https ports in the server config.

"Cannot determine the https port from IServerAddressesFeature, multiple values were found. Set the desired port explicitly on HttpsRedirectionOptions.HttpsPort."

See https://github.com/dotnet/aspnetcore/issues/29222 for discussion.

Version introduced

6.0

Old behavior

When the HttpsRedirectionMiddleware isn't explicitly configured with a port it will search IServerAddressesFeature during the first request to figure out what https port it should redirect to. If there are no https ports or multiple distinct ports then it's ambiguous which should be used so the middleware logs a warning and turns itself off. Http requests will be processed normally.

New behavior

When the HttpsRedirectionMiddleware isn't explicitly configured with a port it will search IServerAddressesFeature during the first request to figure out what https port it should redirect to.

If there are no https ports the middleware still logs a warning and turns itself off. Http requests will be processed normally. This supports development scenarios without https, as well as hosted scenarios where TLS is terminated before reaching the server.

If there are multiple distinct ports then it's ambiguous which should be used so the middleware throws an exception and fails the http request.

Reason for change

This is done to prevent potentially sensitive data from being served over un-encrypted http connections when https is known to be available.

Recommended action

To enable https redirection when the server has multiple distinct https ports you must specify one port in the configuration. See https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-5.0&tabs=visual-studio#port-configuration.

If you do not need the HttpsRedirectionMiddleware in your app then remove UseHttpsRedirection from Startup.cs.

If you need to select the correct https port dynamically then please provide feedback on https://github.com/dotnet/aspnetcore/issues/21291.

Category

ASP.NET

Affected APIs

UseHttpsRedirection

<!-- Do not modify anything below this line -->

Issue metadata

• Issue type: breaking-change

<!-- This issue template is for use in opening issues that document breaking changes. This template should be used to create an issue by Microsoft product team members who are documenting a breaking change.

Bracketed text is a placeholder; replace the text with the requested information and remove the brackets before submitting the issue. Also, remove this comment before submitting the issue.

-->

Kestrel logging ID changes

Kestrel log messages have associated IDs and names. These are used to uniquely identify different kinds of log messages. Some of those IDs and names were incorrectly duplicated. This is being fixed in .NET 6.

Version introduced

.NET 6.0

New behavior

HTTP/2 connection closed log messages:

Name: Http2ConnectionClosed (unchanged) ID: 36 (before) -> 48 (after)

HTTP/2 frame sending log messages:

Name: Http2FrameReceived (before) -> Http2FrameSending (after) ID: 37 (before) -> 49 (after)

Reason for change

Log IDs and names should be unique so different message types can be identified.

Recommended action

If you have code or configuration that references the old IDs and names, update those reference use the new IDs and names.

Category

ASP.NET

Affected APIs

Not detectable via API analysis

<!-- Do not modify anything below this line -->

Issue metadata

• Issue type: breaking-change

- Microsoft.AspNetCore.Http.Features.IFeatureCollection.Get<TFeature>() -> TFeature
+ Microsoft.AspNetCore.Http.Features.IFeatureCollection.Get<TFeature>() -> TFeature?

- Microsoft.AspNetCore.Http.Features.IFeatureCollection.Set<TFeature>(TFeature instance) -> void
+ Microsoft.AspNetCore.Http.Features.IFeatureCollection.Set<TFeature>(TFeature? instance) -> void

- Microsoft.AspNetCore.Http.Features.FeatureCollection.Set<TFeature>(TFeature instance) -> void
+ Microsoft.AspNetCore.Http.Features.FeatureCollection.Set<TFeature>(TFeature? instance) -> void

- Microsoft.AspNetCore.Http.Endpoint.Endpoint(Microsoft.AspNetCore.Http.RequestDelegate! requestDelegate, Microsoft.AspNetCore.Http.EndpointMetadataCollection? metadata, string? displayName) -> void
+ Microsoft.AspNetCore.Http.Endpoint.Endpoint(Microsoft.AspNetCore.Http.RequestDelegate? requestDelegate, Microsoft.AspNetCore.Http.EndpointMetadataCollection? metadata, string? displayName) -> void

- Microsoft.AspNetCore.Http.Endpoint.Endpoint(Microsoft.AspNetCore.Http.RequestDelegate! requestDelegate, Microsoft.AspNetCore.Http.EndpointMetadataCollection? metadata, string? displayName) -> void
+ Microsoft.AspNetCore.Http.Endpoint.Endpoint(Microsoft.AspNetCore.Http.RequestDelegate? requestDelegate, Microsoft.AspNetCore.Http.EndpointMetadataCollection? metadata, string? displayName) -> void

- Microsoft.AspNetCore.Routing.RouteValueDictionary.TryAdd(string! key, object! value) -> bool
+ Microsoft.AspNetCore.Routing.RouteValueDictionary.TryAdd(string! key, object? value) -> bool

- abstract Microsoft.AspNetCore.Routing.LinkGenerator.GetUriByAddress<TAddress>(TAddress address, Microsoft.AspNetCore.Routing.RouteValueDictionary! values, string! scheme, Microsoft.AspNetCore.Http.HostString host, Microsoft.AspNetCore.Http.PathString pathBase = default(Microsoft.AspNetCore.Http.PathString), Microsoft.AspNetCore.Http.FragmentString fragment = default(Microsoft.AspNetCore.Http.FragmentString), Microsoft.AspNetCore.Routing.LinkOptions? options = null) -> string?
+ abstract Microsoft.AspNetCore.Routing.LinkGenerator.GetUriByAddress<TAddress>(TAddress address, Microsoft.AspNetCore.Routing.RouteValueDictionary! values, string? scheme, Microsoft.AspNetCore.Http.HostString host, Microsoft.AspNetCore.Http.PathString pathBase = default(Microsoft.AspNetCore.Http.PathString), Microsoft.AspNetCore.Http.FragmentString fragment = default(Microsoft.AspNetCore.Http.FragmentString), Microsoft.AspNetCore.Routing.LinkOptions? options = null) -> string?

6.0-preview1: Fixed nullability annotation for Microsoft.AspNetCore.DataProtection namespace:

- string Microsoft.AspNetCore.DataProtection.Infrastructure.IApplicationDiscriminator.Discriminator { get; set; }
+ string? Microsoft.AspNetCore.DataProtection.Infrastructure.IApplicationDiscriminator.Discriminator { get; set; }

- string Microsoft.AspNetCore.DataProtection.DataProtectionOptions.ApplicationDiscriminator { get; set; }
+ string? Microsoft.AspNetCore.DataProtection.DataProtectionOptions.ApplicationDiscriminator { get; set; }

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.AuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.AuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngCbcAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngCbcAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.IAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.IAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ManagedAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ManagedAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.KeyManagement.IKey.CreateEncryptor()
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.KeyManagement.IKey.CreateEncryptor()

- IKey Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.DefaultKeyResolution.DefaultKey { get; set; }
+ IKey? Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.DefaultKeyResolution.DefaultKey { get; set; }

- IKey Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.DefaultKeyResolution.FallbackKey { get; set; }
+ IKey? Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.DefaultKeyResolution.FallbackKey { get; set; }

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.DefaultAuthenticatedEncryptor { get; set; }
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.DefaultAuthenticatedEncryptor { get; set; }

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.GetAuthenticatedEncryptorByKeyId(System.Guid keyId, out bool isRevoked)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.GetAuthenticatedEncryptorByKeyId(System.Guid keyId, out bool isRevoked)

- IAuthenticatedEncryptor Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.GetAuthenticatedEncryptorByKeyId(System.Guid keyId, out bool isRevoked)
+ IAuthenticatedEncryptor? Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IKeyRing.GetAuthenticatedEncryptorByKeyId(System.Guid keyId, out bool isRevoked)

- AlgorithmConfiguration Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.AuthenticatedEncryptorConfiguration { get; set; }
+ AlgorithmConfiguration? Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.AuthenticatedEncryptorConfiguration { get; set; }

- IXmlEncryptor Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.XmlEncryptor { get; set; }
+ IXmlEncryptor? Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.XmlEncryptor { get; set; }

- IXmlRepository Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.XmlRepository { get; set; }
+ IXmlRepository? Microsoft.AspNetCore.DataProtection.KeyManagement.KeyManagementOptions.XmlRepository { get; set; }

- X509Certificate2 Microsoft.AspNetCore.DataProtection.XmlEncryption.ICertificateResolver.ResolveCertificate(string thumbprint)
+ X509Certificate2? Microsoft.AspNetCore.DataProtection.XmlEncryption.ICertificateResolver.ResolveCertificate(string thumbprint)

- static string Microsoft.AspNetCore.DataProtection.DataProtectionUtilityExtensions.GetApplicationUniqueIdentifier(this System.IServiceProvider services)
+ static string? Microsoft.AspNetCore.DataProtection.DataProtectionUtilityExtensions.GetApplicationUniqueIdentifier(this System.IServiceProvider services)

- static DirectoryInfo Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository.DefaultKeyStorageDirectory { get; set; }
+ static DirectoryInfo? Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository.DefaultKeyStorageDirectory { get; set; }

- static RegistryKey Microsoft.AspNetCore.DataProtection.Repositories.RegistryXmlRepository.DefaultRegistryKey { get; set; }
+ static RegistryKey? Microsoft.AspNetCore.DataProtection.Repositories.RegistryXmlRepository.DefaultRegistryKey { get; set; }

- X509Certificate2 Microsoft.AspNetCore.DataProtection.XmlEncryption.CertificateResolver.ResolveCertificate(string thumbprint)
+ X509Certificate2? Microsoft.AspNetCore.DataProtection.XmlEncryption.CertificateResolver.ResolveCertificate(string thumbprint)

<!-- This issue template is for use in opening issues that document breaking changes. This template should be used to create an issue by Microsoft product team members who are documenting a breaking change.

Bracketed text is a placeholder; replace the text with the requested information and remove the brackets before submitting the issue. Also, remove this comment before submitting the issue.

-->

Notice on obsoleted RazorEngine APIs in Razor

Types related to the RazorEngine type in Blazor have been obsoleted.

Version introduced

6.0.0-preview1

Old behavior

APIs were not obsolete.

New behavior

APIs are obsoleted.

Reason for change

The RazorEngine type has been deprecated in favor of the RazorProjectEngine type.

Recommended action

Migrate source code from the RazorEngine type to the RazorProjectEngine type.

Category

ASP.NET

Affected APIs

• Microsoft.AspNetCore.Mvc.Razor.Extensions.InjectDirective.Register
• Microsoft.AspNetCore.Mvc.Razor.Extensions.ModelDirective.Register
• Microsoft.AspNetCore.Mvc.Razor.Extensions.PageDirective.Register
• Microsoft.AspNetCore.Razor.Language.Extensions.FunctionsDirective.Register
• Microsoft.AspNetCore.Razor.Language.Extensions.InheritsDirective.Register
• Microsoft.AspNetCore.Razor.Language.Extensions.SectionDirective.Register
• Microsoft.AspNetCore.Razor.Language.IRazorEngineBuilder

<!-- Do not modify anything below this line -->

Issue metadata

• Issue type: breaking-change