This patch version improves the overall reliability of the various Steeltoe components and fixes minor bugs.

What's Changed

• Update memory dump dependencies by @bart-vmware in #1744
• Fix flaky tests by @bart-vmware in #1745
• Fix race condition in SBA, fix more flaky tests by @bart-vmware in #1748
• Fix violations of S3776: Cognitive Complexity of methods is too high by @bart-vmware in #1750
• Make OS-based network resolution calls in InetUtils testable by @bart-vmware in #1752
• Fix MongoDB health checks similar to #1733 by @bart-vmware in #1755
• Various reliability fixes (mostly in tests) by @bart-vmware in #1756
• Fix resource leaks in tests related to missing host Start/Stop by @bart-vmware in #1759
• Consul discovery: fix heartbeat and shutdown leaks, send health checks consistently, simplify registration by @bart-vmware in #1758
• Update to latest dependencies for memory dumps by @bart-vmware in #1761
• Improve reliability of the codebase and its test suite by @bart-vmware in #1762

Full Changelog: 4.3.0...4.3.1

Steeltoe 4.3 adds new features, fixes various bugs, and improves overall security. Highlights include:

• A new build-time-only package, Steeltoe.Management.GitProperties.Build, which generates a git.properties file compatible with the Spring Boot Actuator format, and wires it into the existing Info actuator endpoint so the values are automatically exposed at runtime. Note: you will need to explicitly add the package reference. This removes the need to use a package like GitInfo, a third-party package that has licensing constraints.
• A new configuration post-processor that loads values from CredHub service bindings in IConfiguration.
• Connectors now support the Microting.EntityFrameworkCore.MySql driver.
• Fixed a race condition in database health checks that resulted in health checks actuator failure.
• Adopted Trusted Publishing on nuget.org.
• Various security/hardening fixes.

What's Changed

• Update Steeltoe prerequisites in README.md by @bart-vmware in #1711
• Log instead of throwing when localhost is used for registry server by @TimHess in #1719
• Add NuGet package to write git.properties file by @bart-vmware in #1717
• Minor tweaks for git.properties support by @bart-vmware in #1723
• git.properties: support transitive references from shared projects by @bart-vmware in #1724
• Add a CredHub PostProcessor by @TimHess in #1722
• git.properties: stop fallback-file refresh from overriding ProjectReference opt-out by @bart-vmware in #1725
• git.properties: Don't write fallback if turned off by @bart-vmware in #1727
• Add support for Microting.EntityFrameworkCore.MySql EF Core driver by @bart-vmware in #1730
• Prevent concurrent database health checks from sharing a single connection by @TimHess in #1733
• Package updates by @bart-vmware in #1734
• Mask sensitive query string parameters in logs and httpexchanges responses @bart-vmware in 9bf0ecb
• Be resilient against invalid "secure" metadata in Consul response by @bart-vmware in 028569c
• Be resilient against invalid instances in Eureka response by @bart-vmware in bc1c376
• True mTLS for Certificate Auth and fix SYSLIB0057 by @TimHess and @bart-vmware in b626ef3
• feat(actions): add nuget trusted publishing by @micheloliveira-com in #1603

New Contributors

• @micheloliveira-com made their first contribution in #1603

Full Changelog: 4.2.0...4.3.0

Steeltoe 4.2 improves overall security and fixes various bugs. Highlights include:

• Improved reliability of the Config Server client.
• Updated to non-vulnerable OpenTelemetry packages.
• Added new APIs to support service discovery in Aspire.
• Added support to define your own credential mapping logic for Connectors.

What's Changed

• Fix awkward sentences in comments by @bart-vmware in #1650
• Use source generators for logging and regular expressions by @bart-vmware in #1652
• Port: Fix broken documentation in Steeltoe 4.x by @bart-vmware in #1655
• Use json source generator by @bart-vmware in #1656
• Fix binding options against null values by @bart-vmware in #1663
• Fix Eureka Dynamic Port Assignment overriding user-configured ports by @TimHess in #1666
• Config Server stability improvements by @bart-vmware in #1667
• Add missing logger categories in appsettings auto-completion by @bart-vmware in #1669
• Add IDiscoveryClient.InstancesFetched event by @bart-vmware in #1672
• Follow-up changes for new IDiscoveryClient.InstancesFetched event by @bart-vmware in #1677
• Gracefully handle access token fetch failure in Eureka and Config Server by @bart-vmware in #1679
• Connectors: add option to turn off the built-in post-processors by @bart-vmware in #1680
• Bump OpenTelemetry dependencies to fix vulnerabilities by @bart-vmware in #1685
• Fix invalid links by @bart-vmware in #1690
• Package updates by @bart-vmware in #1694
• Fix CA1873: Potentially expensive logging by @bart-vmware in #1695
• Ignore case when comparing Connector configuration keys by @bart-vmware in #1700
• Fix crash on shutdown: Eureka trying to unregister app that never registered by @bart-vmware in #1705
• Fix management port isolation bypass by @TimHess in b7ca93c
• Fix Eureka DataCenterInfo poisoning by @TimHess in c34a739
• Enhance /env sanitizer by @TimHess in e50cd31
• Require FULL Permissions on /env, /threaddump, /heapdump by default by @TimHess in b39defa
• Fix Vault token leak on HTTP redirect by @TimHess in 64ed5ff
• Harden temporary files written by MySQL/PostgreSQL Connectors by @bart-vmware in 8dd97cc
• Fix unexpected OAEP algorithm downgrade by @TimHess in 6cfee5c
• Placeholder resolution should only be logged at trace-level by @TimHess in 463dcbc
• Add expiration to JWT/OpenID keys caching by @TimHess and @bart-vmware in 04db2ac

Full Changelog: 4.1.0...4.2.0

Steeltoe 3.4 improves overall security and updates all vulnerable dependencies. As a result:

• .NET 6 is no longer targeted, because no compatible non-vulnerable version of OpenTelemetry exists.
• .NET 8 support was added for Integration/Messaging/Stream.
• Updated KubernetesClient library may result in behavior changes.
• The versions of System/Microsoft libraries for the NetStandard target were updated.

For the full details of runtime and package changes, see #1688.

What's Changed

• Bump 3x vulnerable dependencies; drop net60 by @bart-vmware in #1688
• Fix management port isolation bypass by @TimHess in 4cbc352
• Fix Eureka DataCenterInfo poisoning by @TimHess in b8ed855
• Enhance /env sanitizer by @TimHess in bef9f14
• Require FULL Permissions on /env, /threaddump, /heapdump by default by @TimHess in da6c604
• Fix Vault token leak on HTTP redirect by @TimHess in 610ebde
• Add expiration to JWT/OpenID keys caching by @TimHess and @bart-vmware in 17b27b8

Full Changelog: 3.3.0...4.3.0

Steeltoe 4.1 adds full support for .NET 10 and fixes minor bugs. By explicitly targeting net10.0, consumers benefit from the latest compiler and runtime optimizations. We enhanced internal logic and added a few public APIs to facilitate the upcoming integration with Aspire. This release also adds a new contributor to the /actuator/info endpoint, which shows details about the .NET runtime and operating system.

What's Changed

• Remove placeholder packages that were added to help migrate from 3.x by @bart-vmware in #1590
• Update 3.x compatibility in README.md by @TimHess in #1592
• Consul: fix invalid port number in app registration by @bart-vmware in #1596
• Service Discovery: Expose Instance ID in IServiceInstance by @bart-vmware in #1597
• Exclude Aspire resolver from Eureka internal HttpClient by @bart-vmware in #1598
• Set templated=false for all management endpoints by @TimHess in #1600
• Expose secure/non-secure URIs on service instance, optimize Eureka by @bart-vmware in #1604
• Lower the level of recurring logging to reduce noise in apps by @bart-vmware in #1608
• Guard usages of BindConfiguration by @bart-vmware in #1609
• Update dump dependencies, fix gcdump by @bart-vmware in #1611
• Add public method to convert InstanceInfo to EurekaServiceInstance by @bart-vmware in #1613
• Update Steeltoe for .NET 10 by @bart-vmware in #1615
• Fix gcdump publish and transitive references by @bart-vmware in #1619
• Fix actuators when used with UsePathBase by @bart-vmware in #1618
• Accept null tags/meta in Consul responses by @bart-vmware in #1631
• Configuration Schema Generator: Port changes from Aspire by @bart-vmware in #1634
• Fix scoped ASP.NET health checks, correct AddHealthContributor docs by @bart-vmware in #1636
• Add .NET runtime information to /info actuator endpoint by @TimHess in #1640
• Enable skipping ASP.NET health checks at actuator endpoint by @bart-vmware in #1644
• Update non-exposed dependencies by @bart-vmware in #1646

Full Changelog: 4.0.0...4.1.0

Steeltoe 4 is a major release that brings many improvements and changes to the library. The goal of this release is to make Steeltoe better integrated in the .NET ecosystem in a more developer-friendly way, compatible with the latest versions of .NET and third-party libraries/products, and to improve the overall quality of the library.

This is the first generally available release for Steeltoe 4.0. Review What's New in Steeltoe 4 for more information about all the improvements. If you are currently using Steeltoe v3, review Migrating from Steeltoe 3 for step-by-step guidance.

For packages that no longer exist, this release ships placeholders that will fail the build with pointers on how to move forward.

What's Changed

• Add a roadmap for 4.1.0 by @TimHess in #1551
• Add workflow to scan for vulnerable dependencies by @bart-vmware in #1563
• Public API diffs by @bart-vmware in #1564
• Fixed crash in RabbitMQ connector by @bart-vmware in #1569
• Crashfix in Config Server client when Environment is a comma-separated list by @bart-vmware in #1567
• Remove custom JsonStreamConfigurationProvider/Source by @bart-vmware in #1576
• Enhance JWT issuer validation by @TimHess in #1580
• Mark Public APIs as shipped for Steeltoe 4.0.0 by @bart-vmware in #1585

Full Changelog: 4.0.0-rc1...4.0.0

Introduction

This release supports .NET 8 (except for Integration, Messaging and Stream packages) and drops support for .NET Core 3.1. CVEs in transitive dependencies have been addressed. These updates required upgrading OpenTelemetry, which is a breaking change. As a result of the OpenTelemetry upgrade, we had to remove Jaeger support from Steeltoe; please see the OpenTelemetry or Jaeger documentation for how to use OTLP. Additionally, Steeltoe Security components now fully support running against a local UAA server and samples have been updated accordingly.

This release will be supported for one year, providing time for migration to Steeltoe 4.0.

What's Changed

• Fix loss of indication to use ampqs by @TimHess in #1495
• Updates for Steeltoe v3.3 by @bart-vmware in #1556
• Add obsoletions for OpenTelemetry and the metrics actuator by @bart-vmware in #1559
• Remove explicit package versions from project files by @bart-vmware in #1561
• Fix transitive vulnerable dependencies 3x by @bart-vmware in #1562
• Constrain the maximum RabbitMQ version for Hystrix and Messaging/Stream by @bart-vmware in #1577
• Small enhancements to Security components, primarily for local, non-https UAA by @TimHess in #1574
• Fix RabbitMQ connection issue by @TimHess in #1584

Full Changelog: 3.2.8...3.3.0

For testing the latest build from the main branch, we changed the Azure DevOps feed URL. See https://github.com/SteeltoeOSS/Steeltoe?tab=readme-ov-file#pre-release-packages.

What's Changed

• Ensure HTTP header values are redacted by @bart-vmware in #1490
• Allow network share paths with disk health contributor, better exceptions for WindowsNetworkFileShare by @TimHess in #1503
• Enhancements for Spring Boot Admin registration by @bart-vmware in #1508
• Async refactorings by @bart-vmware in #1513
• Fix generation of local certificate files when running from publish directory by @bart-vmware in #1514
• Memory dump fixes/enhancements by @bart-vmware in #1517
• Align Cloud Controller response handling with Spring, improve tests by @TimHess in #1521
• Improve management test coverage by @bart-vmware in #1520
• Update connector brokers by @bart-vmware in #1528
• Account for ASP.NET Core changes around proxy header handling by @TimHess in #1525
• Improve Common.Certificates internals and tests by @TimHess in #1523

Full Changelog: 4.0.0-beta1...4.0.0-rc1

Steeltoe 4 is a major release that brings many improvements and changes to the library. The goal of this release is to make Steeltoe better integrated in the .NET ecosystem in a more developer-friendly way, compatible with the latest versions of .NET and third-party libraries/products, and to improve the overall quality of the library.

• Read the documentation for what's new in 4.0
• Get started with Steeltoe Initializr
• See it in action with Steeltoe 4.0 Samples

Contributors to this release

@bart-vmware, @cieciurm, @davgia, @dtillman, @bart-vmware, @fennekit, @hananiel, @macsux, @ccheetham, @TimHess, @thompson-tomo

Full Changelog: 3.2.0...4.0.0-beta1

What's Changed

• Adjust Eureka uri logging in 3x by @TimHess in #1324

Full Changelog: 3.2.7...3.2.8