Changelogs

Every change made to Sisk is recorded through the changelog. You can view the changelogs for all Sisk versions here.

Migrating from 1.6 to 1.7 #

Sisk 1.7.0 ships Sisk.HttpServer, Sisk.Cadente, Sisk.Cadente.CoreEngine and Sisk.IniConfiguration 1.7.0. Sisk.Documenting, Sisk.Documenting.Html and Sisk.Monitoring ship as 1.7.0-rc3, and Sisk.ModelContextProtocol as 1.7.0-rc1. Read the full 1.7.0 changelog for every change.

Breaking changes #

• Route.UseRegex can no longer be set. The property is obsolete and only reports whether the route is a RegexRoute. Create a RegexRoute instead. Route attributes with UseRegex = true and the [RegexRoute] attribute keep working. See regex routes.

  // before
  router.Map(new Route(RouteMethod.Get, @"^/items/(?<id>\d+)$", action) { UseRegex = true });
  
  // after
  router.Map(new RegexRoute(RouteMethod.Get, @"^/items/(?<id>\d+)$", action));

• Request bodies are limited to 100 MB by default. The default value of HttpServerConfiguration.MaximumContentLength changed from 0 (unlimited) to 100 MB. The limit also applies to request streams and to WebSocket messages. Set it to 0 to restore the previous behavior. See getting the request body.

  using var app = HttpServer.CreateBuilder()
      .UseConfiguration(config => config.MaximumContentLength = 0)
      .Build();

• Static routes are tested before dynamic routes. Regex routes, prefix routes (including file servers) and custom matching routes are tested after every static route, regardless of their registration order. See matching precedence.

• Duplicate route names throw at startup. Two or more routes with the same Name cause an ArgumentException when the server starts, while Router.CheckForRouteCollisions is enabled (the default).

• File server routes are prefix routes. Router.MapFileSystem and HttpFileServer.CreateServingRoute create a PrefixRoute instead of a regex route, and are no longer affected by ForceTrailingSlash.

• RouteMethod.Any includes QUERY. Routes mapped with MapAny also answer QUERY requests. The numeric value of RouteMethod.Any changed, so recompile code that stores or compares it.

• CORS preflight respects UseCors. The automatic OPTIONS response no longer sends CORS headers for routes with UseCors = false, and routes explicitly mapped for OPTIONS handle the request instead. See preflight requests.

• Cadente rejects malformed requests. Invalid request methods and targets, unsupported Transfer-Encoding values and conflicting Content-Length headers are rejected, and header blocks larger than 8 KB receive 431 Request Header Fields Too Large. See Cadente request validation.

Discontinued packages #

Sisk.BasicAuth, Sisk.SslProxy and Sisk.ServiceProvider are no longer maintained and are deprecated on NuGet, with no replacement package. Remove them from your projects:

• Replace Sisk.BasicAuth with your own request handler that validates the Authorization header.
• Replace Sisk.SslProxy with the native SSL support of the Cadente engine.
• Replace Sisk.ServiceProvider with the portable configuration built into Sisk.HttpServer through UsePortableConfiguration.

New features #

• Custom route matching through Route.Match, RouteMatch, Route.IsStatic and Route.AllowRewrites, and the new prefix routes.
• Support for the HTTP QUERY method with MapQuery, Route.Query, [RouteQuery] and the Accept-Query header.
• Atomic context values through HttpContext.Interlocked.
• The %{$key} access log term, which prints values of the request bag, and the safe file writing helpers LogStream.SafeWriteToFile and LogStream.SafeAppendToFile.
• In Cadente: pipelined keep-alive requests, WriteInlineContent and WriteInlineContentAsync, and a redirect to HTTPS for plain HTTP requests received on an SSL port.
• In the extensions: parameter examples and LlmsApiExporter.FooterText in Sisk.Documenting, skills and the 2026-07-28 protocol revision in Sisk.ModelContextProtocol, and HTTP traffic, latency, route and exception telemetry in the Sisk.Monitoring dashboard.

Other behavior changes #

• The HttpListener engine dispatches each request to the thread pool, so a slow request no longer delays the next accepted connection. Its ContextAbortedToken returns CancellationToken.None instead of throwing.
• Exceptions thrown by server handlers at the end of a request, and while writing logs, are written to the error log instead of escaping to the HTTP engine. See exceptions thrown by handlers.
• CORS responses send Vary: Origin when the allowed origin depends on the request.
• The %ri access log term uses the client address resolved at the start of the request.
• Sisk.HttpServer targets .NET 8, .NET 9 and .NET 10. Sisk.Cadente and Sisk.Cadente.CoreEngine target .NET 9 and .NET 10 and publish their debug symbols as .snupkg packages.