Bump Refit from 10.1.6 to 14.0.0 - #13
Conversation
--- updated-dependencies: - dependency-name: Refit dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.
TIP This summary will be updated as you push new changes.
There was a problem hiding this comment.
Pull Request Overview
While this PR successfully updates the Refit package version, it currently lacks the necessary code modifications to handle significant breaking changes introduced between v10 and v14. Key risks include unhandled null StatusCodes, potential memory leaks due to changes in stream disposal, and a new exception model. Merging this PR in its current state will likely cause runtime failures. It is recommended to implement the required code adjustments and verify them against the provided test plan before proceeding.
About this PR
- This major version upgrade (v10 to v14) is performed without accompanying code changes, despite documented breaking changes in versions 11, 12, and 14. This creates a high risk of runtime regressions in API response handling and stream management.
Test suggestions
- Verify handling of nullable 'StatusCode' in 'IApiResponse' consumers.
- Validate error handling for transport-level failures (now wrapped in 'ApiRequestException').
- Ensure 'Stream' request bodies are correctly disposed by the calling code.
- Verify successful source generation for all existing Refit interfaces.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify handling of nullable 'StatusCode' in 'IApiResponse' consumers.
2. Validate error handling for transport-level failures (now wrapped in 'ApiRequestException').
3. Ensure 'Stream' request bodies are correctly disposed by the calling code.
4. Verify successful source generation for all existing Refit interfaces.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" /> | ||
| <PackageVersion Include="Nerdbank.GitVersioning" Version="3.10.85" /> | ||
| <PackageVersion Include="Refit" Version="10.1.6" /> | ||
| <PackageVersion Include="Refit" Version="14.0.0" /> |
There was a problem hiding this comment.
🔴 HIGH RISK
Upgrading to v14 introduces critical breaking changes that require code updates: 1. 'ApiResponse.StatusCode' is now nullable; ensure all consumers handle null cases to avoid runtime errors. 2. Refit 14 no longer disposes caller-supplied streams; audit the codebase for 'Stream' or 'multipart' parameters and ensure the caller now manages their lifecycle. 3. Update exception handling to account for 'ApiResponse.Error' changing from 'ApiException' to 'ApiExceptionBase'.
Updated Refit from 10.1.6 to 14.0.0.
Release notes
Sourced from Refit's releases.
14.0.0
Refit 14.0.0
Refit 14 is a major bug-fix and request-generation release. It fixes a broad set of correctness issues while completing the move to source-generated request building. Most clients can now build requests without runtime reflection, improving trimming, Native AOT support, startup time, and allocations.
What end users need to know
Refit.Reflectionpackage. Fully generated clients should not add it.ValueTask. This affects the success-guard methods,DefaultApiExceptionFactory.CreateAsync, and severalRefitSettingsdelegates. Most callers can continue toawaitthem; code that stores aTaskmay need.AsTask().ToString().ApiExceptionstack traces.AuthorizationHeaderValueGetterno longer sends a blankAuthorizationheader.Major fixes
InternalsVisibleToassemblies, and null parameter values round-trip correctly.Highlights
[PathPrefix], per-method[Timeout], absolute URLs with[Url], optional route segments, indexed query collections, header validation, and returning a builtHttpRequestMessagewithout sending it.IAsyncEnumerable<T>, and transport exceptions can be customized withTransportExceptionFactory.See the V14 migration details and complete feature documentation.
🗞️ What's Changed
💥 Breaking Changes
✨ Features
ReflectionTests(#2195) @TimothyMakkisonAttributeProviderfield when not empty (#2271) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison... (truncated)
14.0.0-beta.5
🗞️ What's Changed
💥 Breaking Changes
✨ Features
AttributeProviderfield when not empty (#2271) @TimothyMakkisonReflectionTests(#2195) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison♻️ Refactoring
🐛 Fixes
⚡ Performance
AllAttributesCachereplaceLazywith laziliy initialised code (#2211) @TimothyMakkisonStringBuilderwithValueStringBuilder(#2270) @TimothyMakkisonallowUnmatchedParameterbefore callingIndexOf(#2252) @TimothyMakkisonMethodImplOptions.AggressiveInlining(#2260) @TimothyMakkisonStringBuilderwithValueStringBuilderinRoundTripEscapePath(#2253) @TimothyMakkison🧹 General Changes
... (truncated)
14.0.0-beta.4
🗞️ What's Changed
💥 Breaking Changes
✨ Features
ReflectionTests(#2195) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison🐛 Fixes
⚡ Performance
AllAttributesCachereplaceLazywith laziliy initialised code (#2211) @TimothyMakkisonallowUnmatchedParameterbefore callingIndexOf(#2252) @TimothyMakkisonMethodImplOptions.AggressiveInlining(#2260) @TimothyMakkisonStringBuilderwithValueStringBuilderinRoundTripEscapePath(#2253) @TimothyMakkison🧹 General Changes
... (truncated)
14.0.0-beta.3
🗞️ What's Changed
💥 Breaking Changes
✨ Features
ReflectionTests(#2195) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison🐛 Fixes
⚡ Performance
AllAttributesCachereplaceLazywith laziliy initialised code (#2211) @TimothyMakkisonallowUnmatchedParameterbefore callingIndexOf(#2252) @TimothyMakkisonMethodImplOptions.AggressiveInlining(#2260) @TimothyMakkisonStringBuilderwithValueStringBuilderinRoundTripEscapePath(#2253) @TimothyMakkison🧹 General Changes
✅ Tests
... (truncated)
14.0.0-beta.2
🗞️ What's Changed
💥 Breaking Changes
✨ Features
ReflectionTests(#2195) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison🐛 Fixes
⚡ Performance
AllAttributesCachereplaceLazywith laziliy initialised code (#2211) @TimothyMakkison🧹 General Changes
✅ Tests
📝 Documentation
... (truncated)
14.0.0-beta.1
Summary
Refit 14 completes the shift to reflection-free, source-generated request building: interfaces whose methods all generate inline no longer touch the reflection request builder, so they are trim- and Native AOT-clean. The reflection request builder is now an opt-in package, and a few hot-path async members return
ValueTaskinstead ofTask. These are breaking changes - read the Breaking Changes below and the full v14 migration notes before upgrading.Alongside that, this release adds a batch of request-shaping features - the new
[Url],[PathPrefix],[Timeout], and[FormObject]attributes, optional{name?}URL segments, Server-Sent Events streaming, a per-type URL parameter formatter registry, optional/scoped authorization, building a request without sending it, and exposing call arguments to delegating handlers - plus bug fixes, a performance pass, and new analyzer diagnostics for invalid Refit interfaces.🗞️ What's Changed
💥 Breaking Changes
✨ Features
ReflectionTests(#2195) @TimothyMakkisonAddConfiguredRequestOptions(#2214) @glennawatson @TimothyMakkison🐛 Fixes
⚡ Performance
AllAttributesCachereplaceLazywith laziliy initialised code (#2211) @TimothyMakkison🧹 General Changes
✅ Tests
... (truncated)
13.1.0
🗞️ What's Changed
CS0436build error fromPrimitivesR3BridgeGeneratedAttribute(#2176, #2194). BumpsReactiveUI.Primitivesto 6.0.0, which moves the R3 bridge generator out of the runtime package. Projects usingInternalsVisibleTo(e.g. test projects) build again, and the<Analyzer Remove=... />workaround is no longer needed.AddRefitGeneratedClientand NativeAOT. Now coversenum,Guid,DateTime/DateTimeOffset/DateOnly/TimeOnly/TimeSpan, all integer widths (incl.Int128/UInt128/Half), and anyIFormattable(#2193).✨ Features
🧹 General Changes
🔗 Full Changelog: reactiveui/refit@v13.0.0...13.1.0
🙌 Contributions
🌱 New contributors since the last release: @calebkiage
💖 Thanks to all the contributors: @calebkiage, @glennawatson
13.0.0
🗞️ What's Changed
Refit 13 is a major release focused on security hardening and a brand-new testing package.
TypeNameHandlingby default (blocking type-confusion/deserialization attacks), and sensitive values (auth headers, tokens) are now redacted from exception and log output. This is the main reason for the major version bump: if you relied on permissive Newtonsoft type handling you may need to opt back in explicitly.Refit.Testingpackage (#2184) — a first-party way to stub and verify Refit clients in tests without spinning up a realHttpClient. Supply canned responses for interface calls and assert which requests your code made, instead of hand-rollingHttpMessageHandlerfakes.✨ Features
🧹 General Changes
📝 Documentation
📌 Other
🔗 Full Changelog: reactiveui/refit@v12.1.0...v13.0.0
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson
12.1.0
🗞️ What's Changed
✨ Features
🐛 Fixes
📝 Documentation
📦 Dependencies
🔗 Full Changelog: reactiveui/refit@v12.0.0...12.1.0
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric
🤖 Automated services that contributed: @renovate[bot]
12.0.0
Overview
Refit 12.0 is a large release centred on a near-complete rewrite of how requests are built. The source generator now constructs HTTP requests inline at compile time instead of going through the reflection pipeline, making generated clients faster and friendly to trimming and Native AOT. On top of that foundation it adds response streaming, JSON Lines, naming-convention presets, and a batch of long-standing fixes. Two small, well-scoped breaking changes are called out below.
This release also removed netstandard2.0 and netstandard2.1 support. You should to use net462/net8 as your base lines, and use multiple targets if you need to target both.
Highlights
IAsyncEnumerable<T>response streaming. Stream large responses, auto-detecting a JSON array vs JSON Lines from the content type, generated inline on the hot path.[Body(BodySerializationMethod.JsonLines)]plus a streamingJsonLinesContent(application/x-ndjson), wired through both the reflection and source-gen paths.RefitSettings.CamelCase()/SnakeCase()/KebabCase()configure query keys, form-url-encoded keys, and JSON body property names consistently, plus snake/kebab URL key formatters. Opt-in, so existing behaviour is unchanged.EnsureSuccessStatusCodeAsync()/EnsureSuccessfulAsync()are now available directly onIApiResponse<T>; a newIsSuccessfulWithContent(andHasContent) gives a single, mock-safe success-with-content check; nullable annotations onIApiResponse<T>were corrected to be sound.RefitSettings.UrlResolution, andRefitSettings.AllowUnmatchedRouteParametersto leave an unmatched{token}for aDelegatingHandlerto rewrite.SystemTextJsonContentSerializer.GetFastPathJsonSerializerOptions()) and buffered/streamed request-body modes that run through it.[Query(SerializeNull = true)]to send a null property askey=instead of omitting it, and a publicUniqueName.ForType<T>()to resolve the generatedIHttpClientFactoryclient name.Guid/DateTime/DateTimeOffset/TimeSpan(andDateOnly/TimeOnly) are sent as plain text (#2016); property-level[Query(delimiter, prefix)]is honoured when flattening complex objects (#1334);[Query(Format = "")]serializes a complex value viaToString()(#1281); andIApiResponse<T>no longer shadows base members (#1933).Breaking changes and migration
IApiResponse<T>no longer shadows base members. Thenew-shadowedError,ContentHeaders,IsSuccessStatusCode, andIsSuccessfulmembers are removed from the generic interface. Source that reads these still compiles (they bind to the inherited base members), but code compiled against v8-v11 that bound to the generic-interface slots needs a recompile. If you relied onIsSuccessfulto narrowContentto non-null on anIApiResponse<T>-typed value, switch toHasContent/IsSuccessfulWithContent.System.Text.Jsonserializer now reads numbers from JSON strings (NumberHandling = AllowReadingFromString). Opt back out withNumberHandling = JsonNumberHandling.Stricton yourJsonSerializerOptions.🗞️ What's Changed
💥 Breaking Changes
✨ Features
♻️ Refactoring
⚡ Performance
🧹 General Changes
🔗 Full Changelog: reactiveui/refit@v11.2.0...v12.0.0
... (truncated)
11.2.0
🗞️ What's Changed
🐛 Fixes
🔗 Full Changelog: reactiveui/refit@v11.1.0...v11.2.0
🙌 Contributions
💖 Thanks to all the contributors: @glennawatson
11.1.0
🗞️ What's Changed
🐛 Fixes
🧹 General Changes
📝 Documentation
📦 Dependencies
🔗 Full Changelog: reactiveui/refit@v11.0.1...v11.1.0
🙌 Contributions
🌱 New contributors since the last release: @HulinCedric
💖 Thanks to all the contributors: @ChrisPulman, @glennawatson, @HulinCedric, @PressXtoChris
🤖 Automated services that contributed: @renovate[bot]
11.0.1
🗞️ What's Changed
🧹 General Changes
📌 Other
🔗 Full Changelog: reactiveui/refit@v11.0.0...11.0.1
🙌 Contributions
🌱 New contributors since the last release: @xIceFox
💖 Thanks to all the contributors: @glennawatson, @xIceFox
11.0.0
11.0.0 reworks Refit's error/exception model and tightens interface validation. Most apps will compile, but code that inspects
ApiResponse.Error, readsStatusCode, or catches transport exceptions around Refit calls will need changes. These are the same breaking changes that briefly shipped in the now‑delisted10.1.7and were reported by the community in #2114.💥 What changed & how to migrate
1.
ApiResponse<T>.Erroris nowApiExceptionBase?(wasApiException?) (#2052)A new abstract base
ApiExceptionBasenow sits under bothApiExceptionand the newApiRequestException.ApiExceptionBasedoes not exposeContent/HasContent— those still live onApiException.2. New
ApiRequestExceptionwraps transport/connection failures (#2052)Exceptions thrown by
HttpClient.SendAsyncbefore a response arrives —HttpRequestException(DNS/host unreachable),TaskCanceledException(timeouts), etc. — are now wrapped inApiRequestException : ApiExceptionBase, carrying the full request context. ForApiResponse<T>return types these are now surfaced via.Errorinstead of only being thrown, so you no longer need a separatetry/catchandIsSuccessfulcheck.3.
ApiResponse<T>.StatusCodeis now nullable (HttpStatusCode?) (#2052)When the request never reached the server there is no status code. Code that assumed a non‑null value must handle
null:4. Stricter interface validation + enum name handling (#2068)
Synchronous return types are now only permitted for generated/non‑public interface members (
RestMethodInfoenforces the rule), and the System.Text.Json enum converter now maps serialized names both ways (includingJsonStringEnumMemberNameon .NET 9+). Interfaces that previously relied on unsupported sync members may now fail generation.🗞️ What's Changed
✨ Features & Enhancements
ApiRequestExceptionfor wrappingSendAsyncexceptions (new error model) by @PressXtoChris in #2052AddRefitClientoverloads and tests by @ChrisPulman in #2084... (truncated)
10.2.0
NOTE
This is a re-release of v10.1.6 which had a certificate revoked.
🗞️ What's Changed
🐛 Fixes
🧹 General Changes
📦 Dependencies
📌 Other
🔗 Full Changelog: reactiveui/refit@10.0.1...10.1.6
🙌 Contributions
💖 Thanks to all the contributors: @ChrisPulman
🤖 Automated services that contributed: @renovate[bot]
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)