You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixed the CS0436 build error from PrimitivesR3BridgeGeneratedAttribute (#2176, #2194). Bumps ReactiveUI.Primitives to 6.0.0, which moves the R3 bridge generator out of the runtime package. Projects using InternalsVisibleTo (e.g. test projects) build again, and the <Analyzer Remove=... /> workaround is no longer needed.
Path parameters now use generated request building instead of reflection (#2174), so they work with AddRefitGeneratedClient and NativeAOT. Now covers enum, Guid, DateTime/DateTimeOffset/DateOnly/TimeOnly/TimeSpan, all integer widths (incl. Int128/UInt128/Half), and any IFormattable (#2193).
✨ Features
reactiveui/refit@b592413509791e267aba66f24e2cf2be9ec1508a feat: add generated request building support for path parameters in the URL. (#2174) @calebkiage @glennawatson
reactiveui/refit@9bc675408e2950b54f7e96911f8c6b9754f39e3f feat: support more path parameter types in generated request building (#2193) @glennawatson
🌱 New contributors since the last release: @calebkiage
💖 Thanks to all the contributors: @calebkiage, @glennawatson
13.0.0
🗞️ What's Changed
Refit 13 is a major release focused on security hardening and a brand-new testing package.
Security hardening (#2181) — closes issues found in a security audit. XML deserialization is now protected against XXE (external entity) attacks, the Newtonsoft.Json integration no longer honours unsafe TypeNameHandling by default (blocking type-confusion/deserialization attacks), and sensitive values (auth headers, tokens) are now redacted from exception and log output. This is the main reason for the major version bump: if you relied on permissive Newtonsoft type handling you may need to opt back in explicitly.
New Refit.Testing package (#2184) — a first-party way to stub and verify Refit clients in tests without spinning up a real HttpClient. Supply canned responses for interface calls and assert which requests your code made, instead of hand-rolling HttpMessageHandler fakes.
R3 bridge analyzer fix (#2186) — corrects the removal target for the R3 bridge analyzer.
CI and documentation tidy-ups for SonarCloud on fork pull requests.
✨ Features
reactiveui/refit@cc24382535a48c24e15100a3f58914a6e4fe8dcc feat: security hardening from audit (XXE, Newtonsoft type handling, redaction) (#2181) @glennawatson
reactiveui/refit@339cb8d39e16d05770217902ad9794f0fe289869 feat: add Refit.Testing package for stubbing and verifying clients (#2184) @glennawatson
🧹 General Changes
reactiveui/refit@5d272c8dc2d691d8c793abe64f1b9e430fdbec4f ci: run SonarCloud on fork pull requests @glennawatson
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson
12.1.0
🗞️ What's Changed
✨ Features
reactiveui/refit@89f17aec24691e38a9b9f87238276e6b754ef981 feat: AOT-safe generated-only client DI registration and case-insensitive problem+json detection (#2172) @glennawatson
reactiveui/refit@b31e9fe53f6d64c6e5597efd367cbddb123022a4 feat: read sent request body and synchronously inspect the error body on ApiException (#2175) @glennawatson
🐛 Fixes
reactiveui/refit@e3ec13ffa2a8867ce93245b892bfe731d2acc96a fix: correctly annotate error out parameters for nullable flow (#2177) @HulinCedric
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric
🤖 Automated services that contributed: @renovate[bot]
12.0.0
Overview
Refit 12.0 is a large release centred on a near-complete rewrite of how requests are built. The source generator now constructs HTTP requests inline at compile time instead of going through the reflection pipeline, making generated clients faster and friendly to trimming and Native AOT. On top of that foundation it adds response streaming, JSON Lines, naming-convention presets, and a batch of long-standing fixes. Two small, well-scoped breaking changes are called out below.
This release also removed netstandard2.0 and netstandard2.1 support. You should to use net462/net8 as your base lines, and use multiple targets if you need to target both.
Highlights
Reflection-free, AOT-ready source generation. Eligible interface methods now have their request (URI, headers, body, request properties) built directly in generated code, with the reflection request-builder kept only as a fallback for shapes that cannot be generated inline. Form bodies flatten through compiled, source-generated field descriptors. The generator itself was modernised and optimised, and ships analyzer diagnostics and code fixes. There is also a generated-only client-creation mode and a build-time switch for generated request building.
IAsyncEnumerable<T> response streaming. Stream large responses, auto-detecting a JSON array vs JSON Lines from the content type, generated inline on the hot path.
JSON Lines request bodies.[Body(BodySerializationMethod.JsonLines)] plus a streaming JsonLinesContent (application/x-ndjson), wired through both the reflection and source-gen paths.
Naming-convention presets.RefitSettings.CamelCase() / SnakeCase() / KebabCase() configure query keys, form-url-encoded keys, and JSON body property names consistently, plus snake/kebab URL key formatters. Opt-in, so existing behaviour is unchanged.
Response ergonomics.EnsureSuccessStatusCodeAsync() / EnsureSuccessfulAsync() are now available directly on IApiResponse<T>; a new IsSuccessfulWithContent (and HasContent) gives a single, mock-safe success-with-content check; nullable annotations on IApiResponse<T> were corrected to be sound.
URL and route control. Opt-in RFC 3986 / HttpClient-style URL resolution via RefitSettings.UrlResolution, and RefitSettings.AllowUnmatchedRouteParameters to leave an unmatched {token} for a DelegatingHandler to rewrite.
Faster JSON. A fast-path serialization option (SystemTextJsonContentSerializer.GetFastPathJsonSerializerOptions()) and buffered/streamed request-body modes that run through it.
Smaller additions.[Query(SerializeNull = true)] to send a null property as key= instead of omitting it, and a public UniqueName.ForType<T>() to resolve the generated IHttpClientFactory client name.
Fixes. Multipart Guid/DateTime/DateTimeOffset/TimeSpan (and DateOnly/TimeOnly) are sent as plain text (#2016); property-level [Query(delimiter, prefix)] is honoured when flattening complex objects (#1334); [Query(Format = "")] serializes a complex value via ToString() (#1281); and IApiResponse<T> no longer shadows base members (#1933).
Breaking changes and migration
IApiResponse<T> no longer shadows base members. The new-shadowed Error, ContentHeaders, IsSuccessStatusCode, and IsSuccessful members are removed from the generic interface. Source that reads these still compiles (they bind to the inherited base members), but code compiled against v8-v11 that bound to the generic-interface slots needs a recompile. If you relied on IsSuccessful to narrow Content to non-null on an IApiResponse<T>-typed value, switch to HasContent / IsSuccessfulWithContent.
The default System.Text.Json serializer now reads numbers from JSON strings (NumberHandling = AllowReadingFromString). Opt back out with NumberHandling = JsonNumberHandling.Strict on your JsonSerializerOptions.
reactiveui/refit@e28a38438ebd16e94b41de860cc609820377170c feat: generate request construction to avoid reflection pipeline (#2150) @glennawatson
reactiveui/refit@98982b48d27a94e0d3caac0d692ccc927db00d2c feat: reflection-free generated form serialization, opt-in null values, and public UniqueName (#2164) @glennawatson
reactiveui/refit@bf488d6a0849184eb1d1b72368fb0d7b5c5b019f feat: improve generated clients for AOT (#2151) @glennawatson
♻️ Refactoring
reactiveui/refit@3fd4ce6f0d76405c69c5681cc4a660ab3a708d9f refactor: replace System.Reactive with ReactiveUI.Primitives and integrate observable test helpers (#2152) @glennawatson
reactiveui/refit@c7c14b43f9ff954cf5249a6c25e526b5bdf75eb6 refactor: align Refit with rxui coding standards and modernize (#2149) @glennawatson
⚡ Performance
reactiveui/refit@3717256d32f6dac0503e66aad68795fe1929a2f7 perf: modernize and optimize the Refit source generator (#2148) @glennawatson
🧹 General Changes
reactiveui/refit@0aae034524fef8a3b56074e56edc21d15f771bb7 build: update StyleSharp.Analyzers to 3.13.4 and align editorconfig (#2163) @glennawatson
reactiveui/refit@be087067732c838d320c98654bf8dc6368cb7884 Fix: serialize body by runtime type for interface/abstract parameters (#2118) (#2119) @HulinCedric
reactiveui/refit@d58ce5a3a5d815ec93fac22cd38e2b1ba15dc246 fix: keep only baseline analyzer on legacy toolchains (#2136) @glennawatson
reactiveui/refit@10ab2ce39ddd40f52eb0b5cb427f4caa969e96e9 fix: handle empty responses and edge cases in JSON serialization (#2138) @ChrisPulman @glennawatson
reactiveui/refit@f9a24abf09056d12d238d8cf15a3b123f1bc1aec fix: clearer error when a response has no request message (#2141) @glennawatson
🌱 New contributors since the last release: @HulinCedric
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric, @PressXtoChris
🤖 Automated services that contributed: @renovate[bot]
11.0.1
🗞️ What's Changed
🧹 General Changes
reactiveui/refit@484edf6e67310493766b9e4010793bdeaacfb1d7 build: default examples to IsPackable=false @glennawatson
📌 Other
reactiveui/refit@8652c5e7ac8189dc85aa3748dca1808b3c3c825d Proposal to fix 2115 (#2116) @xIceFox
🌱 New contributors since the last release: @xIceFox
💖 Thanks to all the contributors: @glennawatson, @xIceFox
11.0.0
⚠️ This is a breaking release (major: 10.x → 11.0.0)
11.0.0 reworks Refit's error/exception model and tightens interface validation. Most apps will compile, but code that inspects ApiResponse.Error, reads StatusCode, or catches transport exceptions around Refit calls will need changes. These are the same breaking changes that briefly shipped in the now‑delisted 10.1.7 and were reported by the community in #2114.
💡 Need a drop‑in, non‑breaking replacement for 10.1.6? Use 10.2.0 — it is 10.1.6 re‑signed with a valid certificate (the 10.1.6 cert was revoked, see #2114). Move to 11.0.0 when you're ready to adopt the changes below.
💥 What changed & how to migrate
1. ApiResponse<T>.Error is now ApiExceptionBase? (was ApiException?) (#2052)
A new abstract base ApiExceptionBase now sits under both ApiException and the new ApiRequestException. ApiExceptionBase does not expose Content / HasContent — those still live on ApiException.
// beforestring?body=response.Error?.Content;// after — narrow to ApiException firstif(response.ErrorisApiExceptionapiEx){string?body=apiEx.Content;// Content/HasContent are on ApiException}
2. New ApiRequestException wraps transport/connection failures (#2052)
Exceptions thrown by HttpClient.SendAsyncbefore a response arrives — HttpRequestException (DNS/host unreachable), TaskCanceledException (timeouts), etc. — are now wrapped in ApiRequestException : ApiExceptionBase, carrying the full request context. For ApiResponse<T> return types these are now surfaced via .Error instead of only being thrown, so you no longer need a separate try/catchandIsSuccessful check.
// catching transport errors: catch the base (or ApiRequestException) nowcatch(ApiExceptionBaseex){/* covers ApiException + ApiRequestException */}
3. ApiResponse<T>.StatusCode is now nullable (HttpStatusCode?) (#2052)
When the request never reached the server there is no status code. Code that assumed a non‑null value must handle null:
intcode=(int)response.StatusCode;// ❌ won't compile / may throwint?code=(int?)response.StatusCode;// ✅ handle the no-response case
4. Stricter interface validation + enum name handling (#2068)
Synchronous return types are now only permitted for generated/non‑public interface members (RestMethodInfo enforces the rule), and the System.Text.Json enum converter now maps serialized names both ways (including JsonStringEnumMemberName on .NET 9+). Interfaces that previously relied on unsupported sync members may now fail generation.
🗞️ What's Changed
✨ Features & Enhancements
Create ApiRequestException for wrapping SendAsync exceptions (new error model) by @PressXtoChris in #2052
Support sync interface members & enum names by @ChrisPulman in #2068
Add AddRefitClient overloads and tests by @ChrisPulman in #2084
... (truncated)
10.2.0
NOTE
This is a re-release of v10.1.6 which had a certificate revoked.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates the Refit dependency from version 10.1.6 to 13.1.0. While the Codacy analysis indicates the change is up to standards, the upgrade spans three major versions that introduce significant breaking changes not addressed in this PR. Specifically, Refit v11 changed 'ApiResponse.StatusCode' to a nullable type and 'ApiResponse.Error' to 'ApiExceptionBase', while v12 removed shadowed members from the generic 'IApiResponse' interface. Given that only the version string in 'Directory.Packages.props' was modified, there is a high probability of compilation errors or runtime regressions in any code that consumes these Refit responses.
About this PR
The transition from Refit 10 to 13 requires explicit code changes to handle the new nullable HttpStatusCode and the ApiExceptionBase error model. No such changes were found in the PR, which increases the risk of runtime exceptions when processing API responses.
Test suggestions
Verify that error handling logic correctly handles ApiExceptionBase and can still access response content when narrowed to ApiException.
Verify that logic reading ApiResponse.StatusCode handles the new nullable HttpStatusCode? return type.
Confirm that existing Refit interfaces comply with the stricter validation rules for synchronous members introduced in version 11.
Test that JSON deserialization still works as expected with the updated default NumberHandling (AllowReadingFromString).
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that error handling logic correctly handles ApiExceptionBase and can still access response content when narrowed to ApiException.
2. Verify that logic reading ApiResponse.StatusCode handles the new nullable HttpStatusCode? return type.
3. Confirm that existing Refit interfaces comply with the stricter validation rules for synchronous members introduced in version 11.
4. Test that JSON deserialization still works as expected with the updated default NumberHandling (AllowReadingFromString).
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Upgrading to Refit 13.1.0 from 10.1.6 introduces multiple breaking changes. Per the v11 release notes, 'ApiResponse.StatusCode' is now nullable and 'ApiResponse.Error' is now 'ApiExceptionBase'. You must verify that existing code accessing these properties is updated to handle nulls and perform necessary type checks to access 'Content'. Additionally, verify compatibility with the removal of shadowed members in 'IApiResponse' introduced in v12.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency file.NETPull requests that update .NET code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
.NET
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Pinned Refit at 13.1.0.
Release notes
Sourced from Refit's releases.
13.1.0
🗞️ What's Changed
CS0436build error fromPrimitivesR3BridgeGeneratedAttribute(#2176, #2194). BumpsReactiveUI.Primitivesto 6.0.0, which moves the R3 bridge generator out of the runtime package. Projects usingInternalsVisibleTo(e.g. test projects) build again, and the<Analyzer Remove=... />workaround is no longer needed.AddRefitGeneratedClientand NativeAOT. Now coversenum,Guid,DateTime/DateTimeOffset/DateOnly/TimeOnly/TimeSpan, all integer widths (incl.Int128/UInt128/Half), and anyIFormattable(#2193).✨ Features
🧹 General Changes
🔗 Full Changelog: reactiveui/refit@v13.0.0...13.1.0
🙌 Contributions
🌱 New contributors since the last release: @calebkiage
💖 Thanks to all the contributors: @calebkiage, @glennawatson
13.0.0
🗞️ What's Changed
Refit 13 is a major release focused on security hardening and a brand-new testing package.
TypeNameHandlingby default (blocking type-confusion/deserialization attacks), and sensitive values (auth headers, tokens) are now redacted from exception and log output. This is the main reason for the major version bump: if you relied on permissive Newtonsoft type handling you may need to opt back in explicitly.Refit.Testingpackage (#2184) — a first-party way to stub and verify Refit clients in tests without spinning up a realHttpClient. Supply canned responses for interface calls and assert which requests your code made, instead of hand-rollingHttpMessageHandlerfakes.✨ Features
🧹 General Changes
📝 Documentation
📌 Other
🔗 Full Changelog: reactiveui/refit@v12.1.0...v13.0.0
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson
12.1.0
🗞️ What's Changed
✨ Features
🐛 Fixes
📝 Documentation
📦 Dependencies
🔗 Full Changelog: reactiveui/refit@v12.0.0...12.1.0
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric
🤖 Automated services that contributed: @renovate[bot]
12.0.0
Overview
Refit 12.0 is a large release centred on a near-complete rewrite of how requests are built. The source generator now constructs HTTP requests inline at compile time instead of going through the reflection pipeline, making generated clients faster and friendly to trimming and Native AOT. On top of that foundation it adds response streaming, JSON Lines, naming-convention presets, and a batch of long-standing fixes. Two small, well-scoped breaking changes are called out below.
This release also removed netstandard2.0 and netstandard2.1 support. You should to use net462/net8 as your base lines, and use multiple targets if you need to target both.
Highlights
IAsyncEnumerable<T>response streaming. Stream large responses, auto-detecting a JSON array vs JSON Lines from the content type, generated inline on the hot path.[Body(BodySerializationMethod.JsonLines)]plus a streamingJsonLinesContent(application/x-ndjson), wired through both the reflection and source-gen paths.RefitSettings.CamelCase()/SnakeCase()/KebabCase()configure query keys, form-url-encoded keys, and JSON body property names consistently, plus snake/kebab URL key formatters. Opt-in, so existing behaviour is unchanged.EnsureSuccessStatusCodeAsync()/EnsureSuccessfulAsync()are now available directly onIApiResponse<T>; a newIsSuccessfulWithContent(andHasContent) gives a single, mock-safe success-with-content check; nullable annotations onIApiResponse<T>were corrected to be sound.RefitSettings.UrlResolution, andRefitSettings.AllowUnmatchedRouteParametersto leave an unmatched{token}for aDelegatingHandlerto rewrite.SystemTextJsonContentSerializer.GetFastPathJsonSerializerOptions()) and buffered/streamed request-body modes that run through it.[Query(SerializeNull = true)]to send a null property askey=instead of omitting it, and a publicUniqueName.ForType<T>()to resolve the generatedIHttpClientFactoryclient name.Guid/DateTime/DateTimeOffset/TimeSpan(andDateOnly/TimeOnly) are sent as plain text (#2016); property-level[Query(delimiter, prefix)]is honoured when flattening complex objects (#1334);[Query(Format = "")]serializes a complex value viaToString()(#1281); andIApiResponse<T>no longer shadows base members (#1933).Breaking changes and migration
IApiResponse<T>no longer shadows base members. Thenew-shadowedError,ContentHeaders,IsSuccessStatusCode, andIsSuccessfulmembers are removed from the generic interface. Source that reads these still compiles (they bind to the inherited base members), but code compiled against v8-v11 that bound to the generic-interface slots needs a recompile. If you relied onIsSuccessfulto narrowContentto non-null on anIApiResponse<T>-typed value, switch toHasContent/IsSuccessfulWithContent.System.Text.Jsonserializer now reads numbers from JSON strings (NumberHandling = AllowReadingFromString). Opt back out withNumberHandling = JsonNumberHandling.Stricton yourJsonSerializerOptions.🗞️ What's Changed
💥 Breaking Changes
✨ Features
♻️ Refactoring
⚡ Performance
🧹 General Changes
🔗 Full Changelog: reactiveui/refit@v11.2.0...v12.0.0
... (truncated)
11.2.0
🗞️ What's Changed
🐛 Fixes
🔗 Full Changelog: reactiveui/refit@v11.1.0...v11.2.0
🙌 Contributions
💖 Thanks to all the contributors: @glennawatson
11.1.0
🗞️ What's Changed
🐛 Fixes
🧹 General Changes
📝 Documentation
📦 Dependencies
🔗 Full Changelog: reactiveui/refit@v11.0.1...v11.1.0
🙌 Contributions
🌱 New contributors since the last release: @HulinCedric
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric, @PressXtoChris
🤖 Automated services that contributed: @renovate[bot]
11.0.1
🗞️ What's Changed
🧹 General Changes
📌 Other
🔗 Full Changelog: reactiveui/refit@v11.0.0...11.0.1
🙌 Contributions
🌱 New contributors since the last release: @xIceFox
💖 Thanks to all the contributors: @glennawatson, @xIceFox
11.0.0
11.0.0 reworks Refit's error/exception model and tightens interface validation. Most apps will compile, but code that inspects
ApiResponse.Error, readsStatusCode, or catches transport exceptions around Refit calls will need changes. These are the same breaking changes that briefly shipped in the now‑delisted10.1.7and were reported by the community in #2114.💥 What changed & how to migrate
1.
ApiResponse<T>.Erroris nowApiExceptionBase?(wasApiException?) (#2052)A new abstract base
ApiExceptionBasenow sits under bothApiExceptionand the newApiRequestException.ApiExceptionBasedoes not exposeContent/HasContent— those still live onApiException.2. New
ApiRequestExceptionwraps transport/connection failures (#2052)Exceptions thrown by
HttpClient.SendAsyncbefore a response arrives —HttpRequestException(DNS/host unreachable),TaskCanceledException(timeouts), etc. — are now wrapped inApiRequestException : ApiExceptionBase, carrying the full request context. ForApiResponse<T>return types these are now surfaced via.Errorinstead of only being thrown, so you no longer need a separatetry/catchandIsSuccessfulcheck.3.
ApiResponse<T>.StatusCodeis now nullable (HttpStatusCode?) (#2052)When the request never reached the server there is no status code. Code that assumed a non‑null value must handle
null:4. Stricter interface validation + enum name handling (#2068)
Synchronous return types are now only permitted for generated/non‑public interface members (
RestMethodInfoenforces the rule), and the System.Text.Json enum converter now maps serialized names both ways (includingJsonStringEnumMemberNameon .NET 9+). Interfaces that previously relied on unsupported sync members may now fail generation.🗞️ What's Changed
✨ Features & Enhancements
ApiRequestExceptionfor wrappingSendAsyncexceptions (new error model) by @PressXtoChris in #2052AddRefitClientoverloads and tests by @ChrisPulman in #2084... (truncated)
10.2.0
NOTE
This is a re-release of v10.1.6 which had a certificate revoked.
🗞️ What's Changed
🐛 Fixes
🧹 General Changes
📦 Dependencies
📌 Other
🔗 Full Changelog: reactiveui/refit@10.0.1...10.1.6
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman
🤖 Automated services that contributed: @renovate[bot]
Commits viewable in compare view.