Release 0.41.0-rc1000

[ipjohnson]

Cuts v0.41.0-rc1000. It carries the SSE single-write fix (#434) and the [ConditionalGet] SHA-1 tags and pooled buffer (#435).

File	From	To
docs/.vitepress/version.json	0.40.0-rc1000	0.41.0-rc1000
build-package.yaml RELEASE_LINE	0.41.0	0.42.0
AGENTS.md current line	0.40.0-rc1000	0.41.0-rc1000

What is in it

Five pull requests since v0.40.0-rc1000: #430, #431, #432, #434 and #435.

• Write each streamed item to the transport as one write #434 writes each streamed item to the transport as one write. An SSE event was three chunks and is now one.
• Tag conditional responses with SHA-1 and hold the body in a pooled MemoryStream #435 tags conditional responses with SHA-1 and holds the body in a pooled MemoryStream, so a large conditional response no longer allocates its body.
• Take ValidationModules 1.2.0 #431 takes ValidationModules 1.2.0, and Replace Hardened.Validation.SourceGenerator with ValidationModules' generator #432 replaces Hardened.Validation.SourceGenerator with ValidationModules' generator. EXPECTED is 65 since Replace Hardened.Validation.SourceGenerator with ValidationModules' generator #432.
• Move repeated project settings into props files, pack the solution, and prune redundant references #430 moves repeated project settings into props files and packs the solution. The packages' dependencies did not change.

Release notes

The generated notes list the titles. This section goes above them once the release exists.

Breaking changes

• Hardened.Validation.SourceGenerator is removed. Replace <PackageReference Include="Hardened.Validation.SourceGenerator" /> with <PackageReference Include="ValidationModules.SourceGenerator" Version="1.2.0" />. A nested type's validator is renamed from InnerValidator to Outer_InnerValidator. HRDV002, HRDV003 and HRDV004 are gone. A project with two [HardenedModule] classes now reports VM6001 (Replace Hardened.Validation.SourceGenerator with ValidationModules' generator #432).
• ValidationModules 1.2.0 changes [StringLength]. [StringLength(min, max)] no longer compiles, and [StringLength(n)] is now a maximum of n where it was a minimum. A value that times out a pattern answers 400 instead of 500 (Take ValidationModules 1.2.0 #431).
• Every entity tag [ConditionalGet] computes changes, because tags are now SHA-1. A client holding an old tag gets a 200 with the new tag on its first conditional request after the upgrade, and 304s after that. A response cache store an application wrote that outlives the deploy replays each entry's old tag until the entry expires (Tag conditional responses with SHA-1 and hold the body in a pooled MemoryStream #435).
• IOFilterProvider and AsyncEnumerableIoFilter each gained an optional IMemoryStreamPool constructor parameter. Source that calls them compiles unchanged. A binary compiled against 0.40.0 that calls either constructor must be rebuilt (Write each streamed item to the transport as one write #434).

Dry run

Run on main 439ae33d plus this branch's three edits, with Version=0.41.0-rc1000 exported as release.yaml sets it. Every restore used a scratch NUGET_PACKAGES, and ~/.nuget/packages has no 0.41.0-rc1000 directory afterwards.

• dotnet build Hardened.slnx --configuration Release -p:ContinuousIntegrationBuild=true built with no warnings.
• dotnet pack Hardened.slnx --no-build at 0.41.0-rc1000 gave 65 .nupkg and 52 .snupkg. Hardened.Web.Runtime.dll carries 0.41.0.0 and 0.41.0-rc1000+439ae33d.
• Each package was compared with its 0.40.0-rc1000 on nuget.org. The file lists and nuspec dependencies match, except for two expected changes:
  • Hardened.Requests.Runtime depends on ValidationModules.Runtime 1.2.0, not 1.1.0 (Take ValidationModules 1.2.0 #431).
  • Hardened.SourceGenerator gained Validation/RulesTargets.cs (Replace Hardened.Validation.SourceGenerator with ValidationModules' generator #432).
• A hardened-web application generated from the packed Hardened.Templates pinned 0.41.0-rc1000 and ValidationModules 1.2.0. It built with no warnings, the Library, DependencyModules and Web generators and ValidationModules.SourceGenerator 1.2.0 reached csc, and its 17 tests passed.
• The test suite was not run locally. It ran on Write each streamed item to the transport as one write #434 and Tag conditional responses with SHA-1 and hold the body in a pooled MemoryStream #435, and release.yaml runs it again before it pushes.

🤖 Generated with Claude Code