Changelog

May 18, 2026 · View on GitHub

All notable changes to the WebSpark.HttpClientUtility project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[2.5.1] - 2026-05-18

Changed

Bumped Microsoft.Extensions.Caching.Abstractions, Microsoft.Extensions.Caching.Memory, Microsoft.Extensions.Http from 10.0.7 to 10.0.8
Bumped Microsoft.NET.ILLink.Tasks from 10.0.7 to 10.0.8 across all projects
Bumped Microsoft.SourceLink.GitHub from 10.0.201/10.0.203 to 10.0.300
Bumped Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1
Bumped MSTest.TestAdapter and MSTest.TestFramework from 4.2.1 to 4.2.3
Bumped coverlet.collector from 10.0.0 to 10.0.1
Updated PackageValidationBaselineVersion to 2.5.0

Removed

CsvHelper 33.1.0 from WebSpark.HttpClientUtility.Crawler — confirmed unused, no source references
Markdig 1.2.0 from WebSpark.HttpClientUtility.Crawler — confirmed unused, no source references
xunit.abstractions 2.0.3 from WebSpark.HttpClientUtility.Testing — confirmed unused, Testing package is framework-agnostic

Security

No vulnerabilities found (dotnet list package --vulnerable --include-transitive clean across all projects)
No npm vulnerabilities (npm audit clean, 0 of 174 packages affected)

[2026-04-22] Archive run

Archived

.documentation/specs/pr-review/pr-12.md - archived as stale/completed artifact
.documentation/specs/pr-review/pr-13.md - archived as stale/completed artifact
.documentation/specs/pr-review/pr-14.md - archived as stale/completed artifact
.documentation/specs/pr-review/pr-15.md - archived as stale/completed artifact
docs/.nojekyll - archived as stale/completed artifact
docs/about/index.html - archived as stale/completed artifact
docs/api-reference/index.html - archived as stale/completed artifact
docs/assets/css/main.css - archived as stale/completed artifact
docs/assets/css/prism-tomorrow.css - archived as stale/completed artifact
docs/assets/images/favicon.ico - archived as stale/completed artifact
docs/assets/js/prism.min.js - archived as stale/completed artifact
docs/examples/crawler-harvested-scenarios/index.html - archived as stale/completed artifact
docs/examples/httpclient-decorator-pattern-scenarios/index.html - archived as stale/completed artifact
docs/examples/index.html - archived as stale/completed artifact
docs/favicon.ico - archived as stale/completed artifact
docs/features/index.html - archived as stale/completed artifact
docs/getting-started/index.html - archived as stale/completed artifact
docs/index.html - archived as stale/completed artifact
docs/robots.txt - archived as stale/completed artifact

Key decisions preserved

No additional durable decisions extracted from archived files

[2.5.0] - 2026-03-17

Added

Batch execution orchestration hardening and validation improvements
- Strengthened validation paths and result-statistics checks in test and demo flows
- Refined dependency resolution strategy in batch demo services for scoped lifetimes

Changed

Updated lockstep package versions for base and crawler packages to 2.5.0
Updated package metadata and release notes to reflect cumulative 2.3.x-2.5.x changes

Security

Incorporated npm dependency updates and security-driven patch upgrades from recent Dependabot activity

Notes

Non-breaking release focused on stability, maintenance, and release metadata alignment

[2.4.0] - 2026-03-17

Added

Batch execution demo UX enhancements in the web app
- Improved tooltip/popover initialization and batch-run interaction flow
- Refined sample endpoint configuration and operator guidance text

Changed

Updated .NET and npm dependency sets across the solution
- NuGet dependency rollups across projects
- Vite, ESLint, Stylelint, Bootstrap, and related frontend toolchain upgrades
Regenerated documentation site outputs and updated published docs content

Notes

No breaking API changes; release focused on tooling, docs, and user experience improvements

[2.3.0] - 2026-03-17

Added

Batch execution orchestration in the base package (opt-in via EnableBatchExecution)
- Environment x user x request x iteration combinatorial execution
- Template substitution for {key} placeholders and {{encoded_user_name}}
- Configurable concurrency throttling and cancellation boundaries
- Optional incremental progress reporting via IProgress<BatchProgress>
- Optional per-item streaming output via IBatchExecutionResultSink
- Thread-safe aggregated statistics with P50, P95, and P99 percentiles
- Deterministic response body hashing for comparison workflows
Interactive BatchExecution demo flow in the web app with capped runs and live polling updates

Changed

Updated NuGet package metadata to improve discoverability for batch orchestration
- Summary, description, package tags, and package release notes
Updated GitHub Pages source documentation and regenerated static docs output
Lockstep version bump for base and crawler packages to 2.3.0

Notes

Minor feature release with no breaking changes

[2.2.1] - 2025-01-02

🐛 Fixed

CRITICAL: Fixed cache key collision causing data leakage between authenticated requests
- Cache keys now include HTTP method, authentication provider, and relevant headers
- Authorization headers excluded from cache keys to prevent credential exposure
- Added warnings for caching POST/PUT/PATCH requests
CRITICAL: Fixed race condition in BearerTokenAuthenticationProvider token refresh
- Implemented thread-safe token refresh using semaphore-based locking
- Added double-check locking pattern to prevent multiple concurrent refresh calls
- Properly implemented IDisposable pattern for resource cleanup
CRITICAL: Fixed HttpClient instance sharing causing potential request interference
- Implemented named HttpClient ("WebSparkHttpClient") for better isolation
- Configured default settings (timeout: 100s, automatic decompression)
- Non-breaking change maintains backward compatibility
Fixed retry policy retrying non-transient HTTP errors (e.g., 404, 403)
- Now only retries transient failures: 408, 429, 500, 502, 503, 504
- Only retries timeouts and network errors without status codes
- Prevents wasting resources on permanent failures
Fixed resource leak in ConcurrentProcessor semaphore disposal
- Wrapped semaphore in using statement for automatic cleanup
- Prevents memory leaks on repeated calls to RunAsync
Fixed MemoryCacheManager.Dispose not fully implementing disposal pattern
- Added proper _disposed flag and double-dispose protection
- Safely disposes CancellationTokenSource with exception handling
- Clears _allKeys dictionary on disposal
Fixed duplicate content reading corrupting POST/PUT/PATCH request bodies
- Content string now read once and StringContent recreated
- Preserves original content type and encoding
- Fixes "stream already consumed" exception
Added configuration validation to prevent invalid options
- Validates MaxRetryAttempts (0-20), RetryDelay (0-5 min)
- Validates CircuitBreakerThreshold (> 0), CircuitBreakerDuration (0-1 hour)
- Fails fast with clear error messages on invalid configuration

🔒 Security

Cache keys now exclude Authorization headers to prevent credential leakage
Token refresh operations are now thread-safe with proper locking
Composite cache key generation prevents data leakage between different users

📝 Changed

Enhanced XML documentation for cache key generation strategy
Added comprehensive logging for cache operations and retry attempts
Improved error messages in configuration validation

✅ Verified

All 711 existing tests passing (100% success rate)
No breaking changes introduced
Test coverage maintained at baseline levels
Build successful on all target frameworks (net8.0, net9.0, net10.0)
Zero compiler warnings with TreatWarningsAsErrors=true

[2.2.0] - 2026-01-03

🚀 Added

Modern Vite/NPM Build Pipeline: Completely migrated WebSpark.HttpClientUtility.Web demo application from LibMan/CDN to NPM-managed Vite build system
- Automated bundling, minification, and tree-shaking for JavaScript and CSS
- Cache-busted hashed filenames with manifest-based asset injection
- Custom ViteAssetTagHelper for seamless Razor integration
- Auto-run npm install/build during .NET build process
Enhanced NuGet Package Quality: Production-ready package improvements
- Enabled Source Link for step-through debugging of library code
- Added symbol packages (.snupkg) for enhanced debugging experience
- Enabled package validation against baseline versions
- Repository URL and commit metadata embedded in packages
Trimming and AOT Readiness: Native AOT and trimming compatibility
- Added IL trimming and AOT analyzers to all library projects
- Annotated all reflection-based APIs with RequiresUnreferencedCode and RequiresDynamicCode
- Created global suppressions for test and demo projects
- Documented trimming-safe usage patterns
Zero-Warning Build Pipeline: Strict code quality enforcement
- Added ESLint, Stylelint, and Prettier with strict configurations
- Implemented zero-warning policy for both .NET and NPM builds
- Build fails on any lint warnings for maximum code quality
- Comprehensive linting and formatting documentation

🔧 Changed

Explicit Linker Version: Added explicit Microsoft.NET.ILLink.Tasks 10.0.1 reference to all projects for consistent trimming behavior
Demo Application Assets: Replaced all CDN/LibMan dependencies with NPM-managed Bootstrap, Bootstrap Icons, and custom code
Build Configuration: Enhanced .csproj files with automated asset building and cleaning

📝 Documentation

Added detailed build pipeline documentation for Vite workflow
Created migration summaries and verification checklists
Documented trimming annotation patterns and remaining work
Added NPM quick reference guide
Created comprehensive build status summaries

✅ Verified

All 237 unique tests passing (210 base + 27 crawler) with 711 total test runs across .NET 8, 9, and 10
Zero compiler warnings with TreatWarningsAsErrors=true
Zero ESLint, Stylelint, and Prettier warnings
Vite builds produce optimized, minified, cache-busted assets
Package validation passes for both base and crawler packages

📝 Notes

No Breaking Changes: All improvements are backward compatible
Library Code Unchanged: Enhancements focus on packaging, tooling, and demo application
Trimming Support: Library is now trim-compatible but not yet fully trim-safe (see remaining annotation work)
Demo Application Only: Vite/NPM changes only affect WebSpark.HttpClientUtility.Web demo app, not the library packages
Both base and crawler packages use lockstep versioning (both are 2.2.0)

[2.1.2] - 2025-12-03

🔒 Security

Fixed js-yaml prototype pollution vulnerability (GHSA-mh29-5h37-fv8m) - MODERATE severity
- Updated js-yaml from 3.14.1 to 3.14.2
- Updated js-yaml from 4.1.0 to 4.1.1
- Fixes prototype pollution in YAML merge (<<) operator
Fixed glob command injection vulnerability (GHSA-5j98-mcp5-4vw2) - HIGH severity
- Updated glob from 11.0.3 to 11.1.0
- Fixes command injection via -c/--cmd flag in glob CLI

📝 Notes

All Dependabot security alerts resolved
Zero npm audit vulnerabilities remaining
Security fixes apply to documentation build dependencies only (not runtime library)
No breaking changes or functional changes to library code

[2.1.1] - 2025-11-12

Fixed

GitHub Actions: Fixed package verification step failing with exit code 1
Added error handling to prevent grep failures
Changed wildcard pattern to avoid matching .snupkg files

Verified

All workflow steps complete successfully
Package contents verified for net8.0, net9.0, and net10.0

[2.1.0] - 2025-11-12

✨ Added

Multi-Targeting for .NET 10 (Preview): All projects now target net8.0, net9.0, and net10.0
- WebSpark.HttpClientUtility (base library)
- WebSpark.HttpClientUtility.Crawler (crawler extension)
- WebSpark.HttpClientUtility.Test (tests)
- WebSpark.HttpClientUtility.Crawler.Test (crawler tests)
- WebSpark.HttpClientUtility.Web (demo application)

🔧 Changed

Updated Microsoft.Extensions.Caching.Abstractions from 8.0.0 to 10.0.0
Updated Microsoft.Extensions.Caching.Memory from 8.0.1 to 10.0.0
Updated Microsoft.Extensions.Http from 8.0.1 to 10.0.0
Updated global.json to use .NET 10 SDK (10.0.100) with allowPrerelease
Bumped package version from 2.0.0 to 2.1.0 (minor version for new framework support)

✅ Verified

All 291 unique tests pass on net8.0, net9.0, and net10.0 (873 total test runs, 0 failures)
NuGet packages correctly include all three framework targets (lib/net8.0, lib/net9.0, lib/net10.0)
Strong-name signing intact for all targets
No breaking changes for existing consumers

📝 Notes

.NET 10 is in Preview - requires .NET 10 SDK for development
Consumers on .NET 8 or .NET 9 are unaffected (continues using existing builds)
This is a non-breaking, additive change
Both base and crawler packages use lockstep versioning (both are 2.1.0)

[2.0.0] - 2025-11-05

🎯 MAJOR RELEASE - Package Architecture Split

This release splits the monolithic package into two focused packages for better modularity and reduced package size.

📦 New Package Structure

WebSpark.HttpClientUtility (Base Package) - 163 KB

Core HTTP utilities: authentication, caching, resilience, telemetry
Supports .NET 8 LTS and .NET 9
10 dependencies (down from 13 in v1.x)
Zero breaking changes for users of core HTTP features

WebSpark.HttpClientUtility.Crawler (Extension Package) - 75 KB

Web crawling functionality: SiteCrawler, SimpleSiteCrawler
Robots.txt compliance, sitemap generation, HTML parsing
SignalR progress updates, CSV export
Requires base package [2.0.0] with exact version match
Breaking change: Must install separately and call AddHttpClientCrawler()

🚀 NO BREAKING CHANGES - Core HTTP Users

If you use only these features, your code continues to work with zero changes:

✅ HTTP request/response handling (IHttpRequestResultService)
✅ Authentication providers (Bearer, Basic, API Key)
✅ Caching (HttpRequestResultServiceCache)
✅ Resilience with Polly (HttpRequestResultServicePolly)
✅ Telemetry (HttpRequestResultServiceTelemetry)
✅ Concurrent requests (IConcurrentHttpRequestResultService)
✅ Fire-and-forget operations (IFireAndForgetService)
✅ Streaming (IHttpStreamingService)
✅ CURL command generation (ICurlCommandService)
✅ Mock services for testing (IMockHttpRequestResultService)

Migration: Simply upgrade to v2.0.0 - no code changes required!

⚠️ BREAKING CHANGES - Crawler Users

If you use web crawling features, follow this 3-step migration:

Step 1: Install the crawler package

dotnet add package WebSpark.HttpClientUtility.Crawler

Step 2: Add using directive

using WebSpark.HttpClientUtility.Crawler;

Step 3: Update DI registration

// Before (v1.x)
services.AddHttpClientUtility();

// After (v2.0.0)
services.AddHttpClientUtility();
services.AddHttpClientCrawler();  // NEW - Required for crawler features

That's it! All crawler functionality (ISiteCrawler, SiteCrawler, SimpleSiteCrawler, CrawlerOptions, etc.) works identically after these changes.

Added

Crawler Package: New WebSpark.HttpClientUtility.Crawler package with all web crawling features
Atomic Releases: Both packages always released together with identical version numbers (lockstep versioning)
JSON Lines Format: CurlCommandSaver now uses .jsonl format instead of CSV for better streaming and parsing

Changed

Package Dependencies: Base package reduced from 13 to 10 dependencies
CurlCommandSaver Format: Switched from CSV to JSON Lines format for improved debugging and tooling support
Lockstep Versioning: Both packages maintain identical version numbers (2.0.0)

Removed

Crawler Code from Base: Moved SiteCrawler, SimpleSiteCrawler, ISiteCrawler, CrawlerOptions, RobotsTxtParser, CrawlHub to separate package
Crawler Dependencies from Base: Removed HtmlAgilityPack, Markdig, CsvHelper dependencies from base package (now only in Crawler package)

Technical Details

Base Package: 163.23 KB, 10 runtime dependencies
Crawler Package: 75.39 KB, 4 crawler-specific dependencies + base package reference
Total Tests: 474 tests passing (420 base + 54 crawler) across .NET 8 and .NET 9
Build Quality: Zero compiler warnings with TreatWarningsAsErrors=true
Strong Name Signing: Both packages signed with same key for assembly compatibility

Migration Resources

Documentation: See Migration Guide
Support: For questions, open an issue on GitHub

[1.5.0] - 2025-11-02

Added

Comprehensive Documentation Website: Launched complete documentation site at https://markhazleton.github.io/WebSpark.HttpClientUtility/
- Getting Started Guide: Step-by-step instructions for installation and configuration
- Feature Documentation: Detailed guides for caching, resilience, telemetry, authentication, and web crawling
- API Reference: Complete API documentation with examples
- Code Examples: Real-world usage scenarios and best practices
- Live NuGet Stats: Real-time package version and download counts from NuGet API
Static Site Generator: Eleventy 3.0-based documentation with sub-second build times
Syntax Highlighting: Prism.js integration supporting C#, JavaScript, JSON, PowerShell, Bash, and Markup
Responsive Design: Mobile-first design supporting 320px to 1920px+ viewports
Progressive Enhancement: Core functionality works without JavaScript
Automated Deployment: GitHub Actions workflow for continuous documentation deployment

Improved

Package Metadata: Updated NuGet package to reference new documentation website
Developer Experience: Centralized documentation improves discoverability and learning
Performance: Documentation site achieves 95+ Lighthouse scores for Performance, Accessibility, and SEO
Build Pipeline: Automated documentation builds on every commit to main branch

Technical Details

Technology Stack: Eleventy 3.0, Node.js 20.x LTS, custom CSS with CSS custom properties
Build Time: ~0.4 seconds for complete site generation (6+ pages)
Deployment: GitHub Pages from /docs folder with automated GitHub Actions workflow
Cache Strategy: NuGet API data cached with fallback for offline builds
Path Strategy: Relative paths for maximum portability across environments

[1.4.0] - 2025-10-15

Added

.NET 8 LTS Support: Added multi-targeting for .NET 8 (LTS) alongside .NET 9 for broader compatibility
- Supports .NET 8.0 (LTS - Long Term Support until November 2026)
- Supports .NET 9.0 (Standard Term Support until May 2025)
- Allows teams on LTS versions to adopt the library immediately
Simplified DI Registration: New extension methods for common configuration patterns
- AddHttpClientUtilityWithCaching() - Quick setup with caching enabled
- AddHttpClientUtilityWithResilience() - Quick setup with Polly resilience
- AddHttpClientUtilityWithAllFeatures() - One-line registration with all features
Enhanced Documentation Structure: Reorganized documentation for better discoverability
- Separated getting started from configuration guides
- Added migration guide for teams moving from raw HttpClient
- Expanded examples for common scenarios

Improved

Developer Experience: Reduced setup time with convenience extension methods
Compatibility: Broader ecosystem support with .NET 8 LTS targeting
Documentation: Clearer organization and more comprehensive examples

Technical Details

Multi-Targeting: <TargetFrameworks>net8.0;net9.0</TargetFrameworks>
Package Validation: Enabled baseline validation against version 1.3.2
Build Configuration: Deterministic builds for reproducibility

[1.3.2] - 2025-01-15

Fixed

Test Reliability: Fixed CurlCommandSaver tests that were failing due to incorrect mock expectations
Mock Setup: Improved test mock patterns by switching from strict to loose mocking for better maintainability
Configuration Handling: Tests now correctly validate graceful degradation when configuration is missing

Technical Details

Corrected test expectation for missing CsvOutputFolder configuration - now properly validates warning logging instead of exception throwing
Simplified mock repository setup to use MockBehavior.Loose for more reliable test execution
Added comprehensive test for configuration-less scenario to ensure curl commands are still logged even when file output is disabled
All 252 tests now passing with improved test stability

[1.3.1] - 2025-01-14

Added

CurlCommandSaver Enhancements: Comprehensive improvements to the CurlCommandSaver functionality
- Batch Processing: Added configurable batch processing for improved performance when saving multiple cURL commands
- File Rotation: Automatic file rotation based on configurable maximum file size (default: 10MB)
- Sensitive Data Sanitization: Automatic redaction of sensitive headers (Authorization, API keys, tokens) and JSON content
- Retry Logic: Built-in retry mechanism with exponential backoff for file operations
- Configuration Options: New CurlCommandSaverOptions class with comprehensive configuration properties
Improved Resource Management: Enhanced disposal patterns in CurlCommandSaver with proper cleanup of timers and pending records

Improved

CurlCommandSaver Performance: Batch processing can handle up to 100 commands per batch with configurable flush intervals
Error Handling: More robust error handling with detailed logging for file operations
File Operations: Thread-safe file operations using SemaphoreSlim for concurrent access protection
Logging: Enhanced logging with correlation IDs and detailed operation metrics

Technical Details

Configuration Support: Full support for configuration via IConfiguration with fallback to defaults
Batch Processing Timer: Configurable timer-based batch flushing (default: 5 seconds)
Sensitive Headers List: Configurable list of headers to redact (Authorization, Api-Key, X-Api-Key, Password, Token)
File Rotation: Timestamp-based file naming for rotated files (yyyyMMdd_HHmmss format)

[1.3.0] - 2025-07-01

Breaking Changes

OpenTelemetry Modernization: Removed deprecated OpenTelemetry.Exporter.Jaeger package in favor of the modern OTLP exporter
API Changes: Updated AddWebSparkOpenTelemetryWithExporters method signature:
- Removed jaegerEndpoint parameter
- Kept otlpEndpoint parameter (supports Jaeger, Zipkin, and other OTLP-compatible systems)

Improved

Modern OpenTelemetry: Migrated to OTLP (OpenTelemetry Protocol) exporter which provides better compatibility
Reduced Dependencies: Eliminated deprecated package dependencies for a cleaner dependency tree
Enhanced Documentation: Updated OpenTelemetry configuration documentation to reflect OTLP-first approach
Build Stability: Resolved compilation issues related to deprecated Jaeger exporter

Technical Details

OTLP Support: The OTLP exporter supports multiple tracing backends including:
- Jaeger (via OTLP endpoint)
- Zipkin (via OTLP endpoint)
- Other OTLP-compatible systems
- Cloud-native observability platforms
Configuration: Simplified configuration with single otlpEndpoint parameter that works with all supported backends
Future-Proof: Using the recommended modern approach for OpenTelemetry exporters

[1.0.10] - 2025-05-24

Added

Streaming Support: Implemented comprehensive streaming functionality for large HTTP responses with configurable thresholds
OpenTelemetry Integration: Added full OpenTelemetry support with multiple exporters (Console, Jaeger, OTLP, InMemory)
OpenTelemetry Test Suite: Complete MSTest-based integration tests for OpenTelemetry functionality
StreamingHelper: New utility class for efficient processing of large responses over configurable size thresholds

Improved

Build Stability: Fixed all compilation errors and warnings for both .NET 8.0 and .NET 9.0 targets
Resource Management: Completed comprehensive audit of IDisposable usage and resource cleanup patterns
Test Framework Consistency: Standardized all tests to use MSTest framework instead of mixed frameworks
Memory Efficiency: Enhanced processing of large HTTP responses through streaming implementation
HttpRequestMessagePoolPolicy: Fixed .NET compatibility issues with HttpVersion and HttpRequestOptions

Fixed

Compilation Errors: Resolved HttpVersion reference issues in HttpRequestMessagePoolPolicy.cs
Duplicate Dispose: Fixed duplicate Dispose method implementation in MemoryCacheManager.cs
Empty StreamingHelper: Replaced empty StreamingHelper.cs file with complete implementation
Nullable Reference Warnings: Fixed nullable reference warnings in test files
Package Dependencies: Added missing OpenTelemetry exporter packages for complete telemetry support

Technical Improvements

HttpRequestResultService: Integrated StreamingHelper for efficient large response processing
Configuration Support: Added streaming threshold configuration support (10MB default)
Async Patterns: Proper async/await patterns with ConfigureAwait(false) throughout streaming implementation
Error Handling: Maintained proper error handling and logging patterns in streaming functionality
Test Coverage: All 75+ tests passing with comprehensive coverage of new features