7.0.0

7.0.0

Highlights

This release adds a first-class observability surface to the WOPI pipeline (activities, metrics, structured logs), closes a race condition in the Azure-blob lock provider's AddLockAsync, and ships a thorough cleanup pass against issue #331. The sample apps got a coordinated polish — HTTPS-only frontends, monochrome action glyphs, Bootstrap dropped from the validator, and the two layouts unified.

✨ New

• WOPI pipeline telemetry (#338) — an ActivitySource produces an Activity per WOPI operation with consistent tags (wopi.operation, wopi.file_id, wopi.outcome, …), a Meter exposes counters for requests, lock conflicts, and proof-validation failures, structured logs carry stable correlation / session IDs, and WopiHost.ServiceDefaults wires the OpenTelemetry exporters out of the box.

🐛 Fixes

• Azure lock provider — AddLockAsync race (#353) — concurrent first-time-lock attempts could clobber each other because metadata was set in a separate round-trip after blob create. The flow is now atomic upload-with-metadata gated by IfNoneMatch = ETag.All, so the blob's existence is the synchronisation point. Includes a regression test that fires six concurrent AddLockAsync calls and asserts exactly one succeeds.

🧹 Cleanup pass — issue #331

A coordinated set of internal-quality fixes:

• TODOs, suppressed warnings, drive-by audit (#352).
• IDE0005 + IDE0161 enforcement (#354) — GenerateDocumentationFile is now solution-wide so unused-using detection fires at build time; 30+ unused usings cleaned up.
• Spec-mandated constants extracted (#355) — WopiLockInfo.ExpirationMinutes, WopiProofValidator.MaxTimestampAgeMinutes / MaxFutureSkewMinutes, DiscoveryOptions.DefaultRefreshIntervalHours, and a WopiUrlSettings.Placeholders static class collecting every WOPI URL placeholder name.

🧪 Test infrastructure

• WopiTelemetryTests isolated from cross-class meter pollution (#339).
• IDE0028 / IDE0039 / IDE0042 / IDE0059 / IDE0350 cleanups in telemetry tests (#341).
• IntegrationTests/launchSettings.json committed for parity with the other test projects (#346).

🎨 Sample apps

• HTTPS-only frontends, text-style action icons, layout unification (#356)
  • Frontends bind HTTPS only and the duplicate https://localhost:6001 entry in the Aspire dashboard is gone.
  • View / edit icons render as monochrome text-style glyphs (🔍 + 🖉) on supporting browsers.
  • WopiHost.Validator dropped Bootstrap entirely (and with it the bundled jquery / jquery-validation-unobtrusive files); six zombie Dependabot alerts auto-resolved.
  • WopiHost.Web and WopiHost.Validator now share a byte-identical _Layout.cshtml and site.css (modulo project name).

🛠️ CI / build infrastructure

• Public-API break reporting on PRs + auto-bump release baseline (#333) — pack-time package validation runs on every PR and posts a sticky comment if the public surface changes vs. the previously-released baseline. After each non-prerelease release, an automated PR bumps PackageValidationBaselineVersion to the just-published version.
• Dependabot authenticates against the Cobalt GitHub Packages feed (#340) — dependency PRs touching WopiHost.Cobalt no longer fail at restore time.

📦 Dependency updates

NuGet:

• Azure.Identity 1.13.2 → 1.21.0 (#342)
• Microsoft.AspNetCore.Authentication.OpenIdConnect 10.0.3 → 10.0.7 (#343)
• Microsoft.AspNetCore.Mvc.Testing 10.0.3 → 10.0.7 (#344)
• Microsoft.Extensions.DependencyInjection 10.0.3 → 10.0.7 (#345)
• Scalar.AspNetCore 2.14.9 → 2.14.11 (#347)
• Xunit.SkippableFact 1.5.23 → 1.5.61 (#350)
• Testcontainers + Testcontainers.Azurite 4.7.0 → 4.11.0 (#351, supersedes #348 / #349)

GitHub Actions:

• peter-evans/create-pull-request v7 → v8 (#335)
• actions/upload-artifact v4 → v7 (#336)
• marocchino/sticky-pull-request-comment v2 → v3 (#337)

📝 Docs

• Drop RELEASE_NOTES_6.0.0.md (#334) — release notes live on the GitHub release page going forward.

---

Full Changelog: 6.0.0...7.0.0