This release introduces the following changes:
-
A new
SetAllowedDecompressionMethods()API was introduced in theSystem.Net.Httpintegration packages to limit the decompression methods they can use when extracting HTTP responses. While not recommended, this new option can be used to mitigate the recent CVE-2026-111497 vulnerability. See #2568 for more information (thanks @m3nax! ❤️) -
HTTP response payloads are no longer logged by default when encountering an error. A new
EnableSensitivePayloadLogging()API was added to opt out this new behavior. See #2558 for more information (thanks @zengqinglei and @m3nax! ❤️) -
All the .NET and third-party dependencies have been updated to their latest version.