9.1.0

9.1.0

Highlights

9.1.0 is a sample-editor and WOPI-operations release on top of the 9.0 Minimal-API core. The WopiHost.Web host page grew a postMessage-driven action bar — Save / Print / Close, a view↔edit switch, download, fullscreen, and a host-owned Share dialog — and editor-driven document rename: rename the open file from the WOPI client's own title UI, and the live editing session keeps working because the backend renames under the same file id. On the server, two new WOPI operations landed — GetShareUrl (files & containers) and AddActivities (comments / @mentions) — each lighting up its validator group.

The dev loop now runs two WOPI clients side by side: ONLYOFFICE Document Server joins Collabora as a second self-contained lane in the Aspire AppHost. Underneath sits a supply-chain and automation pass — NuGet package validation is now actually enforced, transitive security advisories are pinned and documented, and new prepare-release / security-audit skills plus a monthly audit workflow keep the codebase swept. A batch of stale-id hardening lets the FileSystem provider tolerate out-of-band renames/deletes across processes without 500s.

⚠️ Requires .NET 10 (unchanged from 9.0). This is a drop-in minor with no breaking changes — no framework, wiring, or signature changes. The only additive public surface is on the capability seams: IWopiHostCapabilities / WopiCheckFileInfo gained SupportsAddActivities and share-URL-type members (all default off). If you implement IWopiHostCapabilities directly instead of using the shipped WopiHostCapabilities, you'll add the new members on recompile.

✨ New

• Sample editor action bar (postMessage) (#540, #560) — the WopiHost.Web host page grew a thin top bar driving the WOPI postMessage API: Save / Print / Close, a view↔edit switch, download a copy, fullscreen, and a host-owned Share dialog. The transport was extracted into a reusable, origin-scoped wopi-postmessage.js module (#559).
• Editor-driven document rename (#581, closes #561) — rename the open document from the WOPI client's own editable title (SupportsRename + edit-scoped UserCanRename); the backend renames under the same file id so the session and its lock survive, and the host toolbar reflects the client's File_Rename. Verified live against Collabora and ONLYOFFICE.
• GetShareUrl WOPI operation (#540) — files and containers return a share link for supported X-WOPI-UrlType values (ReadOnly / ReadWrite) and 501 otherwise, via the new GET_SHARE_URL override.
• AddActivities WOPI operation (#544) — accepts editor-reported comments / @mentions on POST /wopi/files/{id}/activities (and the ADD_ACTIVITIES override), advertised through the new SupportsAddActivities capability. Pure managed, no proprietary dependency.
• ONLYOFFICE as a second WOPI-client lane (#546) — the Aspire dev loop brings up ONLYOFFICE Document Server alongside Collabora, each a self-contained lane (its own backend + frontend, independent proof-validation posture) with no project duplication, so the host can be exercised against two independent editors at once.

🐛 Fixes

• Self-referential FileUrl dropped from CheckFileInfo (#550) — the default FileUrl pointed back at the proof-gated GetFile endpoint, which clients fetch unsigned per spec; removing it fixes ONLYOFFICE's "Download failed" when proof validation is on. Hosts with a genuinely unsigned download channel can still set FileUrl via OnCheckFileInfoAsync.
• Stale-id hardening across the FileSystem provider and endpoints (#581) — a file renamed or deleted out of band (including by another process over the same tree) no longer 500s: CheckFileInfo / GetFile / PutFile and the sample download endpoint answer a clean 404, and the per-process id↔path maps converge so a renamed file stays visible in the listing and resolvable under a peer-derived id.
• Audit-driven correctness batches (#563 closes #562, #585 closes #579) — every finding from the 2026-06 and 2026-07 codebase/security audits across all severities: Azure-provider name-guard defense-in-depth on child creation, README snippets that didn't compile, and assorted correctness items.

🧹 Refactors & internals

• Path.Join where concatenation is meant (#588, closes #586) — no-op Path.Combine calls that only worked by discarding their base were dropped in favour of enumerating the stored (absolute) path directly; client-controlled names stay guarded to a single segment ahead of the join. Silences the CodeQL cs/path-combine sweep without suppressions.
• E2E projects consolidated into WopiHost.E2ETests (#548) — the two separate end-to-end projects merged into one.
• CodeQL config tidy (#531) — dropped a dead paths-ignore (a no-op for C#).

🔧 Maintenance, CI & dependencies

• NuGet package validation actually enforced (#551) — a props/targets evaluation-order bug meant validation wasn't running; fixed, with the baseline bumped to 9.0.0 (#532).
• Transitive security pins — Microsoft.OpenApi pinned to 2.7.5 for the NU1903 advisory (#582) and MessagePack pinned to 2.5.301 to unbreak CI restore (#554); the pins were grouped into a dedicated section with their unblock conditions documented (#583, #584).
• Automation & governance — a prepare-release skill (#533), a security-audit skill (#563), a monthly scheduled codebase-audit that files findings (#535, #536), three read-only agentic workflows — triage / CI-diagnosis / docs-drift — with a sticky-comment fix (#538, #542), Codecov Test Analytics via JUnit upload (#564), and a security policy + issue template (#534).
• Dependency bumps (consolidated): StackExchange.Redis 2.13.17 → 3.0.11 (major), Scalar.AspNetCore 2.14.14 → 2.16.6, Aspire.Hosting.* 13.4.2 → 13.4.4, Microsoft.AspNetCore.* / Microsoft.Extensions.* (runtime) 10.0.8 → 10.0.9, Microsoft.Extensions.Http.Resilience / ServiceDiscovery 10.6.0 → 10.7.0, OpenTelemetry.* 1.15.x → 1.16.0, Azure.Storage.Blobs 12.29.0 → 12.29.1, Microsoft.Playwright 1.60.0 → 1.61.0, Microsoft.NET.Test.Sdk 18.6.0 → 18.7.0; codecov/codecov-action 6 → 7 (#541), actions/checkout 6 → 7 (#569), actions/cache 5 → 6 (#573), fossa-contrib/fossa-action 3 → 4 (#556).

---

Full Changelog: 9.0.0...9.1.0