This is the release candidate of v4.

v4 is a ground-up redesign: more than twice the performance, stronger security by default, full Native AOT support, and many new features, including support for C# 15 union types. It is feature-compatible and wire-compatible with v3, but contains breaking changes; see the v4 README and its "Migrating from v3" section before upgrading.

.NET 11 has been released, and this version is built with its release SDK. Unless something major comes up, the next release will be v4.0.0.

Please report any problems in the Issues.

Changes since preview.2

New

• [MessagePackObject(EnumAsString = true)] writes the enums of a type by name.

Behavior changes

• Nullable annotations are enforced by default (ValidateNullableAnnotations), on both serialization and deserialization. The SignalR hub protocol's default options leave it off.
• A constructor parameter that the payload omits takes its declared default value.
• Typeless: a non-generic class derived from Collection<T>, List<T>, Dictionary<K, V> and the like is written the way v3 wrote it, each element with its type name, and payloads written by v3 for such a class are readable again (#2321).
• An int key above 65,535 is an error (MsgPack008), and MaxBufferedMessageSize must be positive.
• The reflection tier writes the same bytes as the source generator for a type that overrides a property in map mode.
• Analyzers: MsgPack101 / MsgPack108 report CultureInfo, TimeZoneInfo, System.Type and ExpandoObject, which no default chain serves; MsgPack113 / MsgPack115 follow a container read into a helper method.

Dependencies

• SerializerFoundation 1.4.1 and NativeCompressions 1.3.2.
• The netstandard assets require Microsoft.Bcl.AsyncInterfaces and System.IO.Pipelines 8.0.0 instead of 10.0.0.

This is the second preview of v4.

v4 is a ground-up redesign: more than twice the performance, stronger security by default, full Native AOT support, and many new features, including support for C# 15 union types. It is feature-compatible and wire-compatible with v3, but contains breaking changes; see the v4 README and its "Migrating from v3" section before upgrading.

Unless something major comes up, the next release will be v4.0.0, after .NET 11 is released.

Please report any problems in the Issues.

This is the first preview of v4.

v4 is a ground-up redesign: more than twice the performance, stronger security by default, full Native AOT support, and many new features, including support for C# 15 union types.

The basic API shape is unchanged, and v4 is feature-compatible and wire-compatible with v3 (v3 and v4 read each other’s output). It does, however, contain many breaking changes; see the v4 README and its “Migrating from v3” section before upgrading.

Please report any problems in the Issues.

What's Changed

• Add opt-in non-reflective object comparer for NativeAOT by @hydraxman in #2308

New Contributors

• @hydraxman made their first contribution in #2308

Full Changelog: v3.1.11...v3.1.12

Security fix

• Fix LZ4 decompression integer overflow bug

Full Changelog: v3.1.10...v3.1.11

Security fix

• Fix LZ4 decompression integer overflow bug

Full Changelog: v2.5.305...v2.5.307

Security fix

• Fixes Unescaped dot metacharacters in AssemblyNameVersionSelectorRegex cause catastrophic backtracking

Other fixes

• Consolidation of AssemblyBuilderAccess when generating dynamic assemblies by @MarcusChr in #2119

New Contributors

• @MarcusChr made their first contribution in #2119

Full Changelog: v3.1.9...v3.1.10

Security fix

• Fixes Unescaped dot metacharacters in AssemblyNameVersionSelectorRegex cause catastrophic backtracking

Full Changelog: v2.5.303...v2.5.305

What's Changed

Security fix

• Fix Nested arrays can blow past buffer length limits via 7fd78bb

Other fixes

• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @BertanAygun in #2183
• Update v2.x to build again by @AArnott in #2264
• Add more types to the default disallow list of named types to be deserialized by @AArnott in #2263
• Add several known unsafe 'gadgets' to the disallow list by @AArnott in #2269
• Revise end-of-life date for version 2.x by @AArnott in #2282
• Fix OldSpec byte[] encoding emitting unsupported str8 headers by @AArnott with @Copilot in #2287
• v2 to master by @AArnott in #2295
• Fix build warning and Windows build break by @AArnott in #2300
• Fix source generator snapshot ordering by @AArnott in #2303
• Test before versioned release build by @AArnott in #2304

Full Changelog: v3.1.8...v3.1.9

Security Fix

• Fix Nested arrays can blow past buffer length limits via 7fd78bb

Full Changelog: v2.5.302...v2.5.303