Skip to content

Upgrading Npgsql 3 to 4

Breaking3.2.7 → 4.1.14Breaking1Security2New1Changed2Fixed17Other2

Full comparisonBack to Npgsql
BreakingUpgrade verdict

1 breaking change and 2 security fixes.

In plain terms
  • Version 4.1.0 accidentally broke compatibility with some libraries. This release undoes almost all of those changes so they work again.
  • This release patches a serious security flaw, so everyone using this package should update.
  • If extra unencrypted data arrives after the secure connection is set up, the connection now fails instead of ignoring it.
Must act 3 items need code or config changes

Target frameworks requirement changed in 4.1.0-preview2: .NETFramework4.5, .NETFramework4.5.1, .NETStandard1.3, .NETStandard2.0 → .NETCoreApp3.0, .NETFramework4.6.1, .NETStandard2.0, .NETStandard2.1.

Adds microsoft.bcl.asyncinterfaces 1.1.0, system.memory 4.5.3, system.runtime.compilerservices.unsafe 4.6.0, system.text.json 4.6.0, system.valuetuple 4.5.0.

Drops netstandard.library, system.collections.specialized, system.componentmodel.typeconverter, system.data.common, system.diagnostics.process, system.globalization.extensions, system.net.nameresolution, system.net.networkinformation, system.net.security, system.reflection.typeextensions, system.threading.thread.

Moves system.threading.tasks.extensions 4.3.0 → 4.5.3. Your build may pick other versions.

What you must change

Breaking1
Rolls back most of the unintentional breaking changes introduced in 4.1.0, restoring compatibility with libraries such as EF Core 2.2 and Marten.
4.1.1GitHub ReleaseSummarizedView source
Security2
Fixes a high-severity security vulnerability (CVE-2024-32655); all users are advised to upgrade.
High · CVSS 8.1
4.0.14GitHub ReleaseSummarizedView source
Throws if additional unencrypted bytes are left after SSL negotiation.
4.0.13GitHub ReleaseSummarizedView source