Skip to content

Upgrading Refit 6 to 7

Breaking6.3.2 → 7.2.22Breaking1Security3New12Changed33Fixed13Other124

Full comparisonBack to Refit
BreakingUpgrade verdict

1 breaking change and 3 security fixes.

In plain terms
  • How you configure authorization headers has changed, so existing setup code may need updating.
  • A flaw that let crafted input inject extra line breaks into requests is fixed.
  • CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
  • Updates a JSON library to a version that fixes a security issue.
Must act 4 items need code or config changes

Target frameworks requirement changed in 7.1.0: .NETFramework4.6.1, .NETStandard2.0, .NETStandard2.1, net5.0, net6.0 → .NETFramework4.6.2, .NETStandard2.0, net6.0, net8.0.

What you must change

Breaking1
Simplifies authorization configuration, changing how authorization is set up.
7.0.0-beta.1GitHub ReleaseSummarizedView source
Security3
Fixes a CRLF injection vulnerability.
7.2.22GitHub ReleaseSummarizedView source
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
Critical · CVSS 9.8
7.2.22GitHub AdvisoryOriginalView source
Updates System.Text.Json to v8.0.4 for a security fix.
System.Text.Json
7.2.0GitHub ReleaseSummarizedView source