Upgrading MessagePack 0.8 to 1
Breaking0.8.5 → 1.9.11Breaking4Security2New43Changed31Fixed41Other6
SecuritySecurity fixes are included in this release, detailed in the project's security advisory.GHSA-7q36-4xx7-xcxf ↗
BreakingUpgrade verdict
4 breaking changes and 2 security fixes.
In plain terms
- The code generator tool is no longer bundled inside the NuGet package. You now get it as a separate download from the release page.
- The mpc.exe code generator is no longer shipped inside the NuGet package.
- TypelessFormatter now deserializes primitive arrays as primitive arrays instead of object arrays, which changes behavior for existing callers.
- ContractlessStandardResolver now uses DynamicObjectTypeFallbackResolver instead of PrimitiveObjectResolver.
Must act Top 5 of 6 that need code or config changes
Target frameworks requirement changed in 1.7.3: .NETFramework4.5, .NETStandard1.4 → .NETFramework4.5, .NETFramework4.7, .NETStandard1.6, .NETStandard2.0.
What you must change
Breaking4
Removes mpc.exe from the MessagePack NuGet package; download mpc.zip from the release page instead.
mpc.exeRemoves mpc.exe from the MessagePack NuGet package.
mpc.exeFixes TypelessFormatter converting primitive arrays to object arrays, a breaking change.
TypelessFormatterContractlessStandardResolver now uses DynamicObjectTypeFallbackResolver instead of PrimitiveObjectResolver.
ContractlessStandardResolverDynamicObjectTypeFallbackResolverPrimitiveObjectResolverSecurity2
Security fixes are included in this release, detailed in the project's security advisory.
Fixes a deserializer security issue that allowed unbounded memory allocations from relatively small MessagePack payloads.