Download Latest Version v1.6.3 source code.zip (846.2 kB)
Email in envelope

Get an email when there's a new version of Sisk Framework

Home / 1.6.3
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-06-02 7.2 kB
0
v1.6.3 source code.tar.gz 2026-06-02 649.1 kB
0
v1.6.3 source code.zip 2026-06-02 846.2 kB
0
Totals: 3 Items   1.5 MB 0

This patch release includes new APIs, bug and security fixes, compatibility improvements, and package updates across the Sisk ecosystem.

New router mapping API

The new Router.Map(...) API provides a consistent way to register route actions, route objects, static route types, and file-system handlers. It replaces the older SetRoute(...) and SetObject(...) naming with APIs that make the type of mapping explicit.

Shortcuts are available for common HTTP methods through MapGet, MapPost, MapPut, MapDelete, MapPatch, MapOptions, MapHead, and MapAny. The MapInstance(...), MapType(...), and MapFileSystem(...) methods cover object, type, and file-system mappings.

:::csharp
var router = new Router();

router.MapGet("/health", request => new HttpResponse(200));
router.MapPost("/users", request => new HttpResponse(201));

The existing SetRoute(...) and SetObject(...) methods remain compatible but are now deprecated. New applications should use the corresponding Map... APIs.

Routing and HTTP changes

  • Added support for the HTTP QUERY method to Sisk.HttpServer and Sisk.Cadente.
  • Added duplicate route-name detection to Router.
  • Added IDisposable support to the default and abstract WebSocket engine implementations.
  • Added the helper method PathHelper.EnsureDirectoryExistance(...) for creating required directories without changing HTTP server behavior.
  • Fixed an issue where routes configured for any HTTP method did not match incoming requests correctly.
  • Fixed an issue where request-body buffering could exceed the configured request size limits.
  • Fixed a regression where before-response handlers no longer followed their legacy execution behavior.
  • Fixed thread-safety and cleanup issues that could occur when EventSource and WebSocket connections were disposed or closed.
  • Fixed an issue where WebSocket receive operations could consume unbounded memory when processing large messages.
  • Fixed an issue where synchronous LogStream writes could bypass bounded-channel backpressure.

File server

  • Added directory index support through HttpFileServerHandler.AllowIndex, serving index.html or index.htm when available.
  • Fixed a security issue where symlinks and reparse points could be used to access files outside the configured file-server root.
  • Fixed an issue where text-file responses could omit the correct charset for the detected encoding.

Cadente

  • Added a disconnect CancellationToken for client connections and improved connection lifecycle handling.
  • Added TLS probing and optional redirection of plain HTTP requests received by HTTPS listeners.
  • Added the CADENTE_DISABLE_VERBOSE environment variable to disable verbose logging.
  • Fixed an issue where listeners were not rebuilt after fatal accept errors and could retry transient socket failures without delay.
  • Fixed request-validation issues where Cadente accepted invalid HTTP protocol versions, empty request targets, URI fragments, obsolete folded headers, conflicting request framing, and non-digit Content-Length values.
  • Fixed an issue where a request body ending before its declared length did not surface as an EndOfStreamException.
  • Fixed issues where chunked responses could be framed incorrectly and malformed chunked requests were not rejected consistently.
  • Fixed an issue where SSL options were not propagated to additional listening hosts.
  • Fixed an issue where required HTTP headers could be omitted from error responses serialized by Cadente.
  • Fixed issues with header flushing and stream forwarding in fixed-length responses.
  • Reduced allocations in HTTP processing and header serialization.

Authentication and security

  • Breaking: Fixed an insecure default where the Sisk.BasicAuth handler could allow requests when authentication was not configured or could not be validated. The handler now returns an unauthorized response. Applications that relied on the previous behavior must configure authentication before upgrading.
  • Breaking: Fixed an insecure default where the monitoring dashboard could accept requests without a configured credential validator. Configure a credential validator before exposing the dashboard.
  • Fixed an issue where malformed Basic authentication headers were not rejected correctly by Sisk.BasicAuth and Sisk.Monitoring.

These security-sensitive defaults may reject requests that earlier versions accepted when authentication or HTTP framing was invalid. No public APIs were removed in this release.

Monitoring

  • Added persistent monitoring storage and health-state tracking.
  • Added server uptime and start-time information to health views.
  • Added downloads for captured log streams backed by files.
  • Fixed an issue where meter readings could grow without bounds by storing them in limited time buckets.

API documentation

  • Added hooks to ApiDocumentationHandler for customizing generated documentation behavior.
  • Added canonical names to documented API members.
  • Reorganized documentation content and exporter types into dedicated namespaces.
  • Fixed an issue where HTML documentation could lose Markdown rendering when using the public CommonMark conversion API.

Commits

Source: README.md, updated 2026-06-02