Version 25.0.2 includes upgraded solutions of all Ocelot packages based on .NET SDK 10.0.402, released on October 13, 2026. For more details about SDK 10.0.402 (also known as Runtime 10.0.13), see the .NET 10.0.13 Release Notes as part of the .NET 10 Release Notes.

🔥 Hotfix for bugs #2352 #2428 (version 25.0.2), a.k.a. Dynamic Routing patch 📦

Affected Milestones: .NET 10, Summer '25
Hotfixed versions: 24.1.0 ("Globality"), 25.0.0, 25.0.1 (".NET 10")
Read the Docs: Ocelot 25.0 with PDF

🔥 Hotfixed bugs are #2352 and #2428. A sincere and heartfelt "Thank You" goes to @xiexihui, @elenacalugaru, and @alin-popa for reporting these critical bugs.
❤️ A special "Thank You" goes to Beka Mosulishvili (@bekammo) for the professional and timely contributions in pull requests #2427 and #2429.

❗Breaking Changes❗

Interface Breaking Changes:

Interface FQN: Ocelot.DownstreamRouteFinder.Finder.IDownstreamRouteProvider
Deleted type FQN: Ocelot.DownstreamRouteFinder.DownstreamRouteHolder

The IDownstreamRouteProvider.Get method now returns Response<Route> (previously Response<DownstreamRouteHolder>). The DownstreamRouteHolder class has been removed. Placeholders are now stored directly on Route.TemplatePlaceholderNameAndValues. Custom implementations of IDownstreamRouteProvider and any code that references DownstreamRouteHolder require updates and recompilation.

Other changes affecting deployments:

Dynamic Routing no longer attempts to build upstream header templates from incoming request headers (fixes RegexParseException on certain browser headers such as sec-ch-ua). An empty collection is returned instead. Static routing is unchanged.
Reference updated to .NET SDK 10.0.402 / Runtime 10.0.13.

Contributors

alin-popa, xiexihui, and 2 other contributors

Assets 7

25.0.1 Ocelot Extension Packages

raman-m released this 16 Sep 18:12

25.0.1-QualityOfService.Polly

fb0c764

Release `Ocelot.*` extension packages

Ocelot release: 25.0.1 on Sep 14, 2026 → Release Radar 📡

`Ocelot.QualityOfService.Polly` version 25.0.1

Ocelot.QualityOfService.Polly release: 25.0.1 on Sep 16, 2026

`Ocelot.Discovery.Consul` version 25.0.1.2

Ocelot.Discovery.Consul release: 25.0.1.2 on Sep 18, 2026

`Ocelot.Discovery.Eureka` version 25.0.1

Ocelot.Discovery.Eureka release: 25.0.1 on Sep 17, 2026

`Ocelot.Discovery.KubeClient` version 25.0.1

Ocelot.Discovery.KubeClient release: 25.0.1 on Sep 17, 2026

Assets 10

25.0.1 ⚠️

raman-m released this 14 Sep 20:35

25.0.1

ba90c50

Warning

Critical Hotfix for Dynamic Routing users. Please upgrade to 25.0.2 ASAP❗

If your Ocelot deployment uses the Dynamic Routing feature, you are affected by two critical bugs — #2352 and #2428 — and must upgrade to 25.0.2 immediately. Users not using Dynamic Routing can safely remain on 24.1.0 (.NET 9); 25.0.0, 25.0.1 (.NET 10).

📦 Reference SDK 10.0.401. Runtime 10.0.12 patch (version 25.0.1)

SDK: 10.0.401
Patched version: 25.0

Version 25.0.1 includes upgraded solutions of all Ocelot packages based on .NET SDK 10.0.401, released on September 8, 2026. For more details about SDK 10.0.401 a.k.a. Runtime 10.0.12, see the .NET 10.0.12 Release Notes as part of .NET 10 Release Notes.

Features of version 25.0.1

Logbook

_{ba90c50 by Raman Maksimchuk on Monday, September 14 at 21:54 →}
Release version 25.0.1 for SDK 10.0.401 | +semver: patch
_{7fac820 by Raman Maksimchuk on Monday, September 14 at 15:08 →}
Ref SDK 10.0.401 (Runtime 10.0.12) to release Ocelot v25.0.1 and Ocelot.Testing v25.0.1
_{65686d4 by Raman Maksimchuk on Friday, August 28 at 14:12 →}
Don't upload code coverage for Release-mode DLLs as a second uploaded report, since it breaks the coverage process for Debug DLLs
_{5a59e96 by Raman Maksimchuk on Wednesday, August 26 at 15:45 →}
IDE0130 Namespace Ocelot.AcceptanceTests.* does not match folder structure, expected Ocelot.Acceptance.*
_{30c2e08 by Raman Maksimchuk on Tuesday, August 18 at 20:24 →}
Finalize the docs for version 25.0

Full Changelog: 25.0.0...25.0.1

Assets 7

25.0.0 ⚠️

raman-m released this 29 Jul 16:39

25.0.0

78c983d

Warning

Critical Hotfix for Dynamic Routing users. Please upgrade to 25.0.2 ASAP❗

Upgrade to .NET 10 SDK (TFM `net10.0`, version 25.0) a.k.a. the .NET 10 release

Milestone: .NET 10 👈
Codenamed: .NET 10
Read the Docs: Ocelot 25.0 with PDF
Target Framework Monikers: net8.0, net9.0, net10.0

ℹ️ About

On November 11th, 2025, the .NET team announced the release of the .NET 10 framework:

.NET Blog: Announcing .NET 10

This major release upgrades the Ocelot package TFMs to net10.0 in addition to the current net8.0 and net9.0. Thus, the current Ocelot supported frameworks are .NET 8 LTS, .NET 9 STS, and .NET 10 LTS.

Additionally, in this major release the Ocelot team focused on preparing the codebase and its ecosystem for the .NET 10 SDK (.NET 10 milestone), while also extracting several integrated extension packages from the v24.1 monorepo into their own dedicated repositories to speed up delivery and reduce release coupling. As a result of these DevOps activities, the Ocelot repository now hosts only two package projects — Ocelot (src folder) and Ocelot.Testing (testing folder) — along with two solutions, Ocelot.slnx and Ocelot.Samples.slnx, which can be opened or built only if the .NET 10 SDK is installed. Since the extension packages now live in separate repositories, a new Release Radar status page has been introduced to track their progress.

This major version also includes the following feature updates:

A built-in Quality of Service (QoS) circuit breaker (express edition) that works out of the box without requiring the Polly library.
Significant enhancements to the WebSockets feature, including WebSockets middleware overriding and the addition of Security Options to the WebSockets pipeline.
Improved Configuration experience that merges multiple ocelot.*.json files, keeping users' extended properties available during Ocelot app startup and at runtime via the standard IConfiguration service in the DI container.

Finally, because the repository has a new folder structure, the development team recommends recloning or even reforking the Ocelot repository for a successful upgrade to the new version in order to avoid potential build errors.

As a best practice, the release strategy has been aligned with .NET SDK monthly patches (usually available between the 10th and 15th of each month). The development team will therefore also aim to roll out monthly Ocelot patches that reference the new .NET SDK patched versions. Ocelot patches will follow the form of a beta or patched version major.minor.*, where * is the Ocelot patch number corresponding to the newly available .NET SDK patch.

Ideally, the Ocelot team expects accelerated releases with more frequent minor/patch versions, because DevOps is now prepared for the new release strategy and offers fast delivery.

For successful contributions, maintainers will announce an identity-verification procedure (details for first-time contributors will be published soon).

🆕 What's New?

Quality of Service: A "Built-in Circuit Breaker" feature implementation was added by @ocelot-ot in pull request #2385 — no Polly required. ⭐

   Ocelot's QoS schema no longer strictly depends on the external Ocelot.QualityOfService.Polly package to provide circuit breaking and timeout enforcement. A lightweight, thread-safe circuit breaker (Closed → Open → HalfOpen → Closed) ships in the Ocelot core package, supporting both count-based and FailureRatio-based modes.
   The two implementations are mutually exclusive: the last of AddQualityOfService() or AddPolly() registered on the OcelotBuilder wins.
   See the built-in QoS documentation for full details, including the AddQualityOfService<THandler>() extensibility point for overriding server error codes.

WebSockets: The "Overridable WebSocket buffer size" feature and custom middleware injection were added by @erannevo in pull request #2387.

  The previously hard-coded DefaultWebSocketBufferSize is now a protected virtual property that can be overridden by subclassing.
  The Middleware Injection feature was extended with a WebSocketsProxyMiddleware override on the OcelotPipelineConfiguration class, allowing a fully custom WebSocket middleware to be injected into the pipeline.
  Refer to the "Sample" section to understand how to utilize the new feature.

WebSockets: The "SecurityOptions support for the WebSocket pipeline" feature was added by @CurtisRobertOliver in pull request #2406.

Previously, IP allow/block-list Routing "Security Options" were not enforced for WebSocket upgrade requests (a.k.a. the CONNECT HTTP method), allowing them to bypass IP security. WebSocket upgrade requests are now intercepted by the same IPSecurityPolicy used for regular HTTP requests, and denied upgrades now correctly return 403 Forbidden.