2.1.0

This release supports .NET 6.0, 7.0, and 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

What's Changed

• Set IsPackable to true for the k8s project on non rtw builds by @benjaminpetit in #2286
• Conditionally copy Strict-Transport-Security by @Tratcher in #2306
• fix: typo in prometheus sample metrics by @asafdl in #2309
• Add NuGet feed to get daily builds of Yarp.Kubernetes.Controller package. by @benjaminpetit in #2312
• [main] Update dependencies from dotnet/arcade by @dotnet-maestro in #2318
• Update config-files.md by @YehudaKremer in #2319
• Make RequestTransformContext.DestinationPrefix read-write by @benjaminpetit in #2311
• failing tests for rate limiter policy validation when 'default' or 'disable' used by @jakebanks in #2283
• Update dependencies to rtw by @benjaminpetit in #2326
• chore: fix prometheus sample metric typos in description by @asafdl in #2308
• Timeout integration by @Tratcher in #2307
• Clarify websocket activity failure by @Tratcher in #2325
• Minimal APIs for docs and samples by @Tratcher in #2327

New Contributors

• @asafdl made their first contribution in #2309
• @YehudaKremer made their first contribution in #2319
• @jakebanks made their first contribution in #2283

Full Changelog: v2.1.0-preview.1...v2.1.0

2.1.0-Preview.1

This release supports .NET 6.0, 7.0, and 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

What's Changed

• Update log level to warning for unsuccessful proxying by @kheardCB in #2044
• Fix an issue where destinations are compared against themselves by @felipeogarcia in #2065
• Workaround EventListener bug when consuming metrics by @MihaZupan in #2104
• Add .NET 8 TFM, clean up new warnings by @Tratcher in #2105
• Using new TimeProvider by @Tratcher in #2108
• Fix extended connect check condition by @benjaminpetit in #2119
• Adding distinct activity for distributed tracing to YARP by @samsp-msft in #2098
• Perf improvements by @MihaZupan in #2127
• Enable AOT Compatibility by @eerhardt in #2144
• Enable AOT compatibility for Yarp.Telemetry.Consumption by @eerhardt in #2146
• Added more direct routing APIs by @davidfowl in #2147
• Add [StringSyntax("Route")] to route patterns by @divyeshio in #2156
• Forwarder blame improvements by @Tratcher in #2167
• Change default policy to HealthyOrPanic by @Tratcher in #2171
• Add cluster destination address validation by @hahn-kev in #2184
• Overload constructors for ClusterState and DestinationState to enable unit testing by @antonybstack in #2198
• Changed streaming flag to empty string when logging no gRPC request by @marekott in #2200
• Add IDestinationResolver for resolving cluster destination addresses by @ReubenBond in #2210
• Request body exception status code granularity by @antonybstack in #2227
• Improve diagnostics for IDestinationResolver exceptions by @ReubenBond in #2241
• Improve route string syntax usage by @JamesNK in #2253
• 💡Feat: allow for simpler override of Response header encoding of Forwarded Requests by @ChintanRaval in #2254
• Update NotContains match mode for Header and QueryParameters to support missing/empty values by @evmurphy in #2258
• Add Request Header From Route by @daniel-steinmann in #2262
• Use SearchValues in RequestUtilities.EncodePath by @MihaZupan in #2267
• React to runtime EventSource changes by @MihaZupan in #2268
• Use frozen collections by @MihaZupan in #2272

New Contributors

• @kheardCB made their first contribution in #2044
• @obenarchid made their first contribution in #2053
• @catcherwong made their first contribution in #2043
• @felipeogarcia made their first contribution in #2065
• @jonathantower made their first contribution in #2112
• @kyler-swanson made their first contribution in #2114
• @kant2002 made their first contribution in #2122
• @eerhardt made their first contribution in #2144
• @foostackdev made their first contribution in #2152
• @antonybstack made their first contribution in #2157
• @divyeshio made their first contribution in #2156
• @MilenaHristova made their first contribution in #2189
• @hahn-kev made their first contribution in #2184
• @kzhen made their first contribution in #2180
• @marekott made their first contribution in #2200
• @ReubenBond made their first contribution in #2210
• @HappyCodeSloth made their first contribution in #2231
• @JamesNK made their first contribution in #2253
• @ChintanRaval made their first contribution in #2254
• @evmurphy made their first contribution in #2258
• @daniel-steinmann made their first contribution in #2262

Pull Requests: query
Full Changelog: v2.0.0...v2.1.0-preview.1

2.0.1 Security Patch

A security issue was identified in YARP 2.0.0. See Microsoft Security Advisory CVE-2023-33141.

The fix has been released and is available on NuGet.org.

1.1.2 Security Patch

A security issue was identified in YARP 1.1.1 and lower. See Microsoft Security Advisory CVE-2023-33141.

The fix has been released and is available on NuGet.org.

2.0.0

This release supports .NET 6.0 and .NET 7.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

• Existing HttpTransformer overloads that don't accept a CancellationToken have been marked as obsolete (#2016).
  • If you have created a custom class that derives from HttpTransformer, you should update the implementation to override the overloads which accept the CancellationToken instead.
  • Existing implementations that only override the obsolete overloads will continue working for the time being, but these overloads may be removed in a future major release.
• See 2.0.0-RC.1 release notes for the rest of the breaking changes between YARP 1.1 and 2.0.

Other changes

• Added a new enum value ForwarderError.RequestCreation that is reported if a request transform throws an exception (#2016).
• Fixed a bug introduced in RC1 where custom response transform callbacks were not called on errors (when ProxyResponse is null) (#2016).
• Fixed a bug where a request cancellation triggered by the manual CancellationToken (parameter to IHttpForwarder.SendAsync) was reported as RequestTimedOut instead of RequestCanceled (#2016).

For a full list of changes see here.

2.0.0-RC.1

This release supports .NET 6.0 and .NET 7.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

• We dropped support for .NET Core 3.1 and .NET 5.0 as they are no longer supported.
  • YARP 2.0 targets .NET 6 and .NET 7.
• The default session affinity policy has been changed from Cookie to HashCookie (#1989).
  • This policy provides fewer security guarantees about the protection level of the key data - the destination ids. On the other hand, it allows for multiple YARP instances to share session affinity cookies without the need to configure ASP.NET Core Data Protection.
  • For more details, see the Session Affinity documentation.
• YARP now sets the SocketsHttpHandler.ConnectTimeout by default (#1991). You may observe different exceptions being reported by the proxy in failure scenarios when destination servers aren't responding. See #1678 for more context on this change.
• The name of the enum value TlsHandshakeType.KeyEpdate has been corrected to KeyUpdate (#1614).

Major changes

• Added support for WebSockets over HTTP/2 (#1978).
  • Protocol upgrades and downgrades are automatic. You can mix different protocol versions on both incoming and outgoing sides.
  • This feature is available on .NET 7.0 and newer only. To accept HTTP/2 WebSockets, you must use Kestrel.
  • See the YARP WebSockets documentation for more details.
• Request transforms can now short-circuit requests and avoid proxying (#1923).
  • If you set the status code on the response to something other than 200 OK, or if you start writing to the response body, forwarding will be skipped.
  • See the Request Transforms documentation for more details.

Other changes

• You can specify the RateLimiterPolicy on a route from the configuration (#1967). See the Rate Limiting documentation for more details.
• You can specify the MaxRequestBodySize on a route from the configuration (#1947).
• We exposed the InMemoryConfigProvider as a built-in API (#1732). You no longer have to copy the implementation from the samples :)
• Added an IConfigChangeListener interface you can implement to receive notifications when and if configuration has been applied (#1734).
• Added an IHttpForwarder.SendAsync overload that accepts a cancellation token (#1985).
• Added async APIs to ISessionAffinityPolicy (#1990).
• Added an overload of ReassignProxyRequest that also accepts a route (#1760).
• Added a HeaderMatchMode.NotExists mode to header routing (#1806).
• Added an AddMetricsConsumer helper method to make it easier to register a consumer with multiple IMetricsConsumers (#1899).
• We report a warning early if you define multiple routes with the same ID (#1831).
• We throw if you use a custom IForwarderHttpClientFactory and also call ConfigureHttpClient as the two are mutually exclusive (#1805).
• We no longer restore the Upgrade response header unless there is a matching entry in the Connection header (#1731).
• We remove the Content-Length: 0 header on responses that don't allow bodies (#1813).
• We no longer proxy the Strict-Transport-Security header (#1984).

For a full list of changes see here.

1.1.1

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Changes:

• A fix for issue #1770 which was causing WebSockets to close abortively rather than gracefully.

1.1.0

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Also see changes included in 1.1.0-rc1.

Breaking changes

• Header routing now supports matching multi-value headers.

Other changes

• HTTP/3 support
• Docs covering WebSockets, body transforms, IProxyConfigFilter, Let's Encrypt, WebProxy
• Package readme's
• Other doc and bug fixes

For a full list of changes see here.

1.0.1 Security Patch

A security issue was identified in how YARP 1.0.0 processes input. See Microsoft Security Advisory CVE-2022-26924.

The fix has been released and is available on NuGet.org.

1.1.0-RC.1.22211.2 Security Patch

A security issue was identified in how YARP 1.1.0-rc.1.22152.1 processes input. See Microsoft Security Advisory CVE-2022-26924.

The fix has been released and is available on NuGet.org.