MessagePack.Annotations

What's Changed

Security fix

• Fix Nested arrays can blow past buffer length limits via 7fd78bb

Other fixes

• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @BertanAygun in #2183
• Update v2.x to build again by @AArnott in #2264
• Add more types to the default disallow list of named types to be deserialized by @AArnott in #2263
• Add several known unsafe 'gadgets' to the disallow list by @AArnott in #2269
• Revise end-of-life date for version 2.x by @AArnott in #2282
• Fix OldSpec byte[] encoding emitting unsupported str8 headers by @AArnott with @Copilot in #2287
• v2 to master by @AArnott in #2295
• Fix build warning and Windows build break by @AArnott in #2300
• Fix source generator snapshot ordering by @AArnott in #2303
• Test before versioned release build by @AArnott in #2304

Full Changelog: v3.1.8...v3.1.9

What's Changed

• Update README built-in supported types list with missing types by @AArnott with @Copilot in #2278
• perf: drop redundant char* fixed in MessagePackWriter.Write(string) by @unsafePtr in #2258
• Fix CS8669 warning in generated MessagePack.GeneratedMessagePackResolver.g.cs by @AArnott with @Copilot in #2279

New Contributors

• @AArnott with @Copilot made their first contribution in #2278
• @unsafePtr made their first contribution in #2258

Full Changelog: v3.1.7...v3.1.8

What's Changed

• Add scoped to MessagePackWriter.Write(ReadOnlySpan<T>) methods by @AArnott in #2271
• Fix security issues in master by @AArnott in #2274

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes

• 26d4e74 GHSA-382j-8mxh-c7x2 Reject invalid DateTime ext lengths for CWE-789
• b9cb605 GHSA-vh6j-jc39-fggf Use iteration for skipping msgpack structures for CWE-674
• 719e690 GHSA-hv8m-jj95-wg3x Bound LZ4 input reads for CWE-125

Moderage severity advisory fixes

• 2b5a500 GHSA-v72x-2h86-7f8m Guard LZ4 decompression length for CWE-409
• f093bdc GHSA-qhmf-xw27-6rqr Reject nested typeless blocklist bypass for CWE-502
• f077798 GHSA-2f33-pr97-265q Default MVC input formatter to UntrustedData for CWE-1188
• 25a3493 GHSA-2x83-8g95-xh59 Limit untrusted ExpandoObject maps for CWE-407
• b414e6d GHSA-wfr3-xj75-pfwh Guard dynamic union depth for CWE-674
• 0555f07 GHSA-w567-gjr2-hm5j Validate Unity blit lengths for CWE-789
• 9b5783a GHSA-cxmj-83gh-fp49 Fix CWE-789 multidimensional array allocation validation
• f96fcf0 GHSA-q2h6-ghwm-5qm8 Use secure lookup comparer for CWE-407
• b3af7cf GHSA-cj9g-3mj2-g8vv Guard JSON conversion depth for CWE-674
• 66ad089 GHSA-cj9g-3mj2-g8vv Avoid JSON separator recursion for CWE-674
• 082ba7d GHSA-cj9g-3mj2-g8vv Guard typeless JSON depth for CWE-674

Fixes with no security advisory

• fb0fe9f Honor TypeFormatter options hooks for CWE-470
• c1c06a6 Fix WriteRawX methods to advance by written length
• 46c6a0f Fix CWE-190 map header length overflow

Full Changelog: v3.1.6...v3.1.7

What's Changed

• Add several known unsafe 'gadgets' to the disallow list by @AArnott in #2270

Full Changelog: v3.1.5...v3.1.6

What's Changed

• Remove unneeded GetTypeInfo() calls by @Bykiev in #2206
• Use 'Write' instead of 'WriteInt32' for union type keys by @VictorNicollet in #2212
• Fix various disposable issues by @Bykiev in #2224
• fix: prevent StackOverflow in Equals with recursive generic constraints by @khuongntrd in #2226
• Add more types to the default disallow list of named types to be deserialized by @AArnott in #2256
• Fix release workflow by @AArnott in #2268
• Fix Incorrect DateTimeOffset Serializer by @T0PP1ng in #2225
• Revert DateTimeOffset encoding change by @AArnott in #2262

New Contributors

• @Bykiev made their first contribution in #2206
• @VictorNicollet made their first contribution in #2212
• @T0PP1ng made their first contribution in #2225
• @khuongntrd made their first contribution in #2226

Full Changelog: v3.1.4...v3.1.5

What's Changed

• Fix SkipClrVisibilityChecks to notice private fields in base classes by @AArnott in #2153
• Promote analyzers to AnalyzerReleases.Shipped.md by @hanachiru in #2169
• Add memory size check to GetMemoryCheckResult by @AArnott in #2172
• AccessModifier was added to generated code. by @Nirklav in #2185

New Contributors

• @hanachiru made their first contribution in #2169

Full Changelog: v3.1.3...v3.1.4

What's Changed

• Fix stackoverflow on analyzer by @neuecc in #2150

Full Changelog: v3.1.2...v3.1.3

ff3af77

See our migration guide . Details blog article

What's new

• AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.

• AOT source generation is hugely improved.

• Support most or all of the data types that DynamicObjectResolver supported.

• Support for serializing private members.

• [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate .

• Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.

• Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute] .

• New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.

Unity

• Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

• Fix bug unsafe formatter by @pCYSl5EDgo in #1584

• Bump Microsoft.NET.StringTools from 17.4.0 to 17.5.0 by @dependabot in #1588

• Add built-in formatters for several more System.Numerics types by @AArnott in #1597

• Bump ReactiveProperty from 8.2.0 to 9.1.2 by @dependabot in #1592

• Set nullable in unity by @Y-YoL in #1600

• Convert mpc and msbuild task package to a roslyn source generator by @AArnott in #1599

• Merge master into develop by @AArnott in #1601

• Bring back support for the additional allow types by @AArnott in #1602

• Report diagnostics instead of throw from TypeCollector by @AArnott in #1605

• Enable P2P generic test by @AArnott in #1604

• Avoid copying data twice in MessagePackWriter.MemoryCopy when running… by @AlanLiu90 in #1607

• Bump Nerdbank.GitVersioning from 3.5.119 to 3.6.128 by @dependabot in #1615

• Bump Microsoft.Build.Locator from 1.4.1 to 1.5.5 by @dependabot in #1613

• Bump Microsoft.CodeAnalysis.PublicApiAnalyzers from 3.3.3 to 3.3.4 by @dependabot in #1612

• Merge master into develop by @AArnott in #1620

• Bump NUnit3TestAdapter from 4.3.1 to 4.4.2 by @dependabot in #1614

• Bump System.Collections.Immutable from 6.0.0 to 7.0.0 by @dependabot in #1611

• Fix the errant package dependency in source generator package by @AArnott in #1622

• Fix ILookup<TKey, TElement> deserialized behavior by @AArnott in #1623

• Merge latest Library.Template by @AArnott in #1640

• Bump Microsoft.NET.StringTools from 17.5.0 to 17.6.3 by @dependabot in #1629

• Rollback package dependency versions for analyzers by @AArnott in #1641

• move code depending on UnityEditor into separate assembly by @NorbertNemec in #1649

• remove MessagePackWindow in Unity by @neuecc in #1651

• Union type collect by @Scormave in #1634

• Switch from MSBuild properties to an AdditionalFiles json file by @AArnott in #1667

• Fix analyzer when only MessagePack.Annotations is referenced by @AArnott in #1674

• Allow applying [MessagePackFormatter] on parameters by @AArnott in #1678

• Revert "Allow applying [MessagePackFormatter] on parameters" by @AArnott in #1679

• Allow applying [MessagePackFormatter] on parameters and return values by @AArnott in #1680

• Remove long to int truncation of stream position by @AArnott in #1685

• Fix releases links in README text by @KonH in #1688

• Better constrain dictionary detection by @AArnott in #1687

• Create FUNDING.yml by @AArnott in #1693

• Workaround mono runtime bug by @AArnott in #1696

• Support to analyze records by @nenoNaninu in #1698

• Add MESSAGEPACK_FORCE_AOT preprocessor directive by @brwhelan-msft in #1701

• .NET 8 Update(1): stylecop related small update by @pCYSl5EDgo in #1727

• .NET 8 Update(0): global.json, Dockerfile, Packages by @pCYSl5EDgo in #1726

• .NET 8 Update(2): TargetFrameworks by @pCYSl5EDgo in #1728

• .NET 8 Update(3): Microsoft.CodeAnalysis.Analyzers v3.3.4 by @pCYSl5EDgo in #1729

• Bump Newtonsoft.Json from 13.0.2 to 13.0.3 by @dependabot in #1656

• .NET 8 Update(4): System.Collections.Frozen by @pCYSl5EDgo in #1730

• .NET 8 Update(5): System.Collections.Generic.PriorityQueue<TElement, TPriority> by @pCYSl5EDgo in #1731

• .NET 8 Update(6): CollectionsMarshal for ListFormatter by @pCYSl5EDgo in #1732

• Merge latest Library.Template by @AArnott in #1737

• Source Generator configuration via attributes instead of .json file by @AArnott in #1736

• Merge master to develop by @AArnott in #1741

• Bump Microsoft.CodeAnalysis.Analyzers from 3.3.3 to 3.3.4 by @dependabot in #1633

• Bump Microsoft.CodeAnalysis to 4.8.0 for tests by @AArnott in #1742

• Bump NUnit3TestAdapter from 4.4.2 to 4.5.0 by @dependabot in #1654

• Improved UnityShims for better code sharing by @Scormave in #1585

• Drop support for roslyn 3.8 by @AArnott in #1749

• IEnumerable serialize improvement: Enumerable.TryGetNonEnumeratedCount by @pCYSl5EDgo in #1751

• AOT by default by @AArnott in #1743

• Add a [CompositeResolver] attribute that triggers source generation by @AArnott in #1754

• Merge Library.Template update by @AArnott in #1763

• Bump MicrosoftCodeAnalysisTestingVersion from 1.1.2-beta1.23509.1 to 1.1.2-beta1.24074.2 by @dependabot in #1765

• Bump System.Memory from 4.5.4 to 4.5.5 by @dependabot in #1764

• .NET 8 Update(8): Update Benchmarks not using Dynamic PGO and BinaryFormatter by @pCYSl5EDgo in #1746

• Bump ReactiveProperty from 9.3.4 to 9.5.0 by @dependabot in #1779

• fixing issue with backing field naming and serialization failing by @epitka in #1785

• Bump Microsoft.NET.StringTools from 17.8.3 to 17.9.5 by @dependabot in #1782

• Bump MicrosoftCodeAnalysisTestingVersion from 1.1.2-beta1.24074.2 to 1.1.2-beta1.24121.1 by @dependabot in #1781

• Merge latest Library.Template by @AArnott in #1788

• Bump MsgPack.Cli from 0.9.0-beta2 to 1.0.1 by @dependabot in #1766

• Bump xunit.runner.console from 2.6.5 to 2.7.0 by @dependabot in #1792

• Bump Microsoft.CodeAnalysis.ResxSourceGenerator from 3.11.0-beta1.23525.2 to 3.11.0-beta1.24122.1 by @dependabot in #1791

• Include all hand-written formatters in the source generated resolver by @AArnott in #1796

• Fix source generated formatters for records with string keys by @dmitry-bym in #1798

• Use LangVersion=12 everywhere except code that Unity compiles by @AArnott in #1801

• Feature/1804 locate formatters only if has elements inside by @nmi-relewise in #1805

• Enable ignoring fields by using [NonSerialized] by @mookid8000 in #1808

• Source generated formatters that support private members by @AArnott in #1802

• Reduce nuget dependencies by @thompson-tomo in #1812

• Merge master and dependency updates into develop by @AArnott in #1814

• Fix source generator handling of inaccessible custom formatters by @AArnott in #1818

• Activate analyzers and source generator by default by @AArnott in #1822

• Add ExcludeFormatterFromSourceGeneratedResolverAttribute by @AArnott in #1824

• Bump xunit to 2.8.1 by @AArnott in #1834

• Raise perf tracking events when formatters are dynamically generated by @AArnott in #1829

• Bump Microsoft.NET.StringTools from 17.9.5 to 17.10.4 by @dependabot in #1840

• Bump Nerdbank.Streams from 2.10.72 to 2.11.74 by @dependabot in #1839

• Eliminate #if regions related to unity by @AArnott in #1825

• Merge latest Library.Template by @AArnott in #1841

• Preserve code comments when adding attributes to fields by @AArnott in #1842

• Add .NET 8 target to mpc by @AArnott in #1832

• Merge master to develop by @AArnott in #1846

• Fix handling of formatters following the singleton pattern by @AArnott in #1850

• Update migration docs by @AArnott in #1858

• Report missing [MessagePackObject] attribute for generic types by @AArnott in #1859

• Unity consumes messagepack as a nuget package instead of source by @neuecc in #1734

• Allow writing to init property setters of generic classes on .NET 6+ by @AArnott in #1879

• Fix issues about the equality of AnalyzerOptions and FormatterDescriptor by @AlanLiu90 in #1874

• Merge master to develop by @AArnott in #1880

• Fix some source generator issues by @AlanLiu90 in #1873

• Faster multi-element serialization for primitive types by @pCYSl5EDgo in #1872

• Remove Unity related symbols from Nuget projects by @pCYSl5EDgo in #1888

• Simd Accelerated bool[] deserialize by @pCYSl5EDgo in #1890

• Merge latest Library.Template by @AArnott in #1891

• Avoid regenerating all formatters when only one object/union/enum changes by @AlanLiu90 in #1884

• Dependency updates by @AArnott in #1892

• Fix UnsafeBlitFormatter for the case of endianess mismatch by @pCYSl5EDgo in #1894

• Offer code fix for MsgPack011: partial modifier required by @AArnott in #1893

• Build beta instead of alpha by @AArnott in #1896

• Offer code fix to ignore unattribute members of MessagePackObject types by @AArnott in #1898

• Fix UnsafeBlitFormatterBase by @pCYSl5EDgo in #1900

• Allow applying [MessagePackFormatter] on parameters and return values by @AArnott in #1901

• Fix and improve generated formatters by @AArnott in #1905

• Honor ExcludeFormatterFromSourceGeneratedResolverAttribute by suppressing certain warnings by @AArnott in #1907

• Fix diagnostic and code fix for MsgPack011 on nesting types by @AArnott in #1910

• Make source generation cancellable by @AlanLiu90 in #1912

• Fix some source generator issues by @AlanLiu90 in #1921

• Lower language version requirement of source generated resolver by @AlanLiu90 in #1926

• Adjusted MsgPack004 to support records by @N-Olbert in #1932

• Update test project to ensure default language version of generated code is C# 7.3 by @AlanLiu90 in #1934

• Add ignore case option to EnumAsStringFormatter by @iguskov1810 in #1936

• Improve handling of array types in source generation by @AArnott in #1960

• Honor key name overrides in source-generated formatters by @AArnott in #1962

• Merge latest Library.Template by @AArnott in #1964

• Bump SpanJson from 4.0.0 to 4.2.0 by @dependabot in #1913

• Adjusted MsgPack004 to support records by @N-Olbert in #1946

• Bump nunit from 3.14.0 to 4.2.2 by @dependabot in #1944

• Bump Microsoft.CodeAnalysis.ResxSourceGenerator from 3.11.0-beta1.24225.1 to 3.11.0-beta1.24415.1 by @dependabot in #1942

• Add MessagePackSerializer.Typeless.Deserialize overload that takes ReadOnlyMemory<byte> by @AArnott in #1959

• Drop unused System.CodeDom package version by @AArnott in #1965

• Merge master to develop by @AArnott in #1966

• MPC String Value From Key Attribute Fix by @alimakki in #1963

• Fix AOT README anchor by @alimakki in #1967

• Support formatters for CompositeResolverAttribute by @AlanLiu90 in #1922

• Make CompositeResolverAttribute much more useful by @AArnott in #1968

• Add MsgPack014 analyzer and code fix by @AArnott in #1969

• Avoid GetSemanticModel in analyzer by @AArnott in #1970

• Bump Microsoft.NET.StringTools from 17.10.4 to 17.11.4 by @dependabot in #1976

• Bump Nerdbank.Streams from 2.11.74 to 2.11.79 by @dependabot in #1974

• Merge latest Library.Template by @AArnott in #1977

• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @BertanAygun in #1978

• Fix detecting duplicate keys by @pkindruk in #1971

• Add AOT formatter support for init properties and required members by @AArnott in #1980

• Fix analyzers to not mis-interpret source generated formatters as user-defined by @AArnott in #1982

• Rename test class for improved discoverability by @AArnott in #1984

• Replace DynamicMethod use with private-capable Ref.Emit by @AArnott in #1981

• Reader/Writer touch-ups by @AArnott in #1987

• Reconcile AllowPrivate behavior by @AArnott in #1990

• Allow trimming of benchmarked frameworks by @AArnott in #1988

• Bump BenchmarkDotNetVersion from 0.13.12 to 0.14.0 by @dependabot in #1973

• Fix pack to include analyzers (more reliably) by @AArnott in #1994

• Drop .NET 6 support by @AArnott in #1991

• Fix embedded types being generated in resolver by @AlanLiu90 in #2000

• Migration improvements: deserializing constructors and less-frequent partial requirements by @AArnott in #2002

• Add analyzers to help recognize breaking changes by @AArnott in #2003

• Fix handling of name collisions in type hierarchies by @AArnott in #2006

• Build 3.0-rc.1 by @AArnott in #2004

• Build nuget package with semver v2 by @AArnott in #2009

• Update published security policy by @AArnott in #2010

• Use a collision-resistant hash algorithm for untrusted data by @AArnott in #2014

• Use a collision-resistant hash algorithm for untrusted data by @AArnott in #2015

• Secure by default by @AArnott in #2013

• Avoid collecting members when it doesn't have [Key] by @AlanLiu90 in #2016

• Remove PackageReference to older MessagePack version by @AArnott in #2018

• Merge master to develop by @AArnott in #2019

• Merge latest Library.Template by @AArnott in #2020

• Add scoped modifier to in parameters of ref struct by @AArnott in #2021

• Ignore abstract implementations of IMessagePackFormatter<T> by @AArnott in #2022

• Suppress MsgPack004 on private base members when only public is interesting by @AArnott in #2023

• Avoid collecting fields with custom formatter recusively by @AlanLiu90 in #2028

• Support nesting formatters within generic data types by @AArnott in #2030

• Apply scoped in more places by @jaredpar in #2029

• Use generic type argument used for custom formatters by @AArnott in #2031

• Use simpler C# syntax for nullable value types by @AArnott in #2032

• Fix simplified name for ValueTuple by @AlanLiu90 in #2033

• Avoid crashing with stack overflow on recursive generic type parameter constraints by @AArnott in #2036

• Bump dependency versions for .NET 8.0 era by @AArnott in #2041

• Fix mis-fire of MsgPack003 on use of Collection<T> by @AArnott in #2037

• Refactor reading fixint, fixmap, fixarray, fixstr by @pkindruk in #2026

• Avoid allocating an ImmutableArray<T>.Builder during deserialization by @AArnott in #2044

• Allow SequencePool to Clear self by @nmi-relewise in #2043

• Revert untrusted data default by @AArnott in #2045

• Bump SpanJson from 4.2.0 to 4.2.1 by @dependabot in #2051

• Bump ReactiveProperty from 9.5.0 to 9.6.0 by @dependabot in #2053

• Bump xunit.runner.console from 2.9.0 to 2.9.2 by @dependabot in #2052

• Fix bugs in serializing long numbers by @AArnott in #2055

• Add MessagePackPrimitives class by @AArnott in #1986

• Fix an issue about comparing generic type parameter constraints by @AlanLiu90 in #2056

• Fix issues about code analysis and code fix of MsgPack003 by @AlanLiu90 in #2057

• Reconcile T4 templates and source code by @AArnott in #2062

• Fix serializing BigInteger and Decimal by @AlanLiu90 in #2061

• Merge master to develop by @AArnott in #2064

• SequencePool support MemoryPool. by @pengweiqhca in #2063

• Fix issues about Memory/ReadOnlyMemory/ReadOnlySequence in Source Generator by @AlanLiu90 in #2059

• Fix repo url by @tomap in #2065

• Fix bugs for Hardware Intrinsics by @pCYSl5EDgo in #2070

• Bump Xunit.SkippableFact from 1.4.13 to 1.5.23 by @dependabot in #2078

• ci: put set of GitHub Actions workflows to run build and release by @guitarrapc in #2081

• Set MaximumObjectGraphDepth to TrustedData by @neuecc in #2073

• CI moves to GitHub Actions by @neuecc in #2074

New Contributors

• @Y-YoL made their first contribution in #1600

• @AlanLiu90 made their first contribution in #1607

• @NorbertNemec made their first contribution in #1649

• @nenoNaninu made their first contribution in #1698

• @brwhelan-msft made their first contribution in #1701

• @epitka made their first contribution in #1785

• @dmitry-bym made their first contribution in #1798

• @nmi-relewise made their first contribution in #1805

• @mookid8000 made their first contribution in #1808

• @thompson-tomo made their first contribution in #1812

• @N-Olbert made their first contribution in #1932

• @iguskov1810 made their first contribution in #1936

• @alimakki made their first contribution in #1963

• @BertanAygun made their first contribution in #1978

• @pkindruk made their first contribution in #1971

• @jaredpar made their first contribution in #2029

• @pengweiqhca made their first contribution in #2063

• @tomap made their first contribution in #2065

• @guitarrapc made their first contribution in #2081

Full Changelog : v2.5.108...v3.0.3

Contributors

AArnott, mookid8000, and 23 other contributors

Security fix

• Fix LZ4 decompression integer overflow bug

Full Changelog: v2.5.305...v2.5.307

Security fix

• Fixes Unescaped dot metacharacters in AssemblyNameVersionSelectorRegex cause catastrophic backtracking

Full Changelog: v2.5.303...v2.5.305

Security Fix

• Fix Nested arrays can blow past buffer length limits via 7fd78bb

Full Changelog: v2.5.302...v2.5.303

This is a merge release, combining the security fix from the https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.205 release with the several security fixes from the https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.301 release.

Security release

This release fixes 2 high severity and 9 moderate severity security vulnerabilities as listed below.

This release is missing #2269 from the v2.5.205 release. We recommend folks adopt the v2.5.302 release which has all the security fixes combined.

High severity advisory fixes

• 696b4a7 GHSA-vh6j-jc39-fggf Use iteration for skipping msgpack structures for CWE-674
• 3538bc1 GHSA-hv8m-jj95-wg3x Bound LZ4 input reads for CWE-125

Moderage severity advisory fixes

• 853429a GHSA-v72x-2h86-7f8m Guard LZ4 decompression length for CWE-409
• 826f17c GHSA-qhmf-xw27-6rqr Reject nested typeless blocklist bypass for CWE-502
• c98d31f GHSA-2f33-pr97-265q Default MVC input formatter to UntrustedData for CWE-1188
• ae90f2b GHSA-2x83-8g95-xh59 Limit untrusted ExpandoObject maps for CWE-407
• 940b850 GHSA-wfr3-xj75-pfwh Guard dynamic union depth for CWE-674
• e01f07c GHSA-w567-gjr2-hm5j Validate Unity blit lengths for CWE-789
• dc6f632 GHSA-cxmj-83gh-fp49 Fix CWE-789 multidimensional array allocation validation
• e97f71e GHSA-q2h6-ghwm-5qm8 Use secure lookup comparer for CWE-407
• 7b12e5b GHSA-cj9g-3mj2-g8vv Guard JSON conversion depth for CWE-674
• a3c8a18 GHSA-cj9g-3mj2-g8vv Avoid JSON separator recursion for CWE-674
• 9674352 GHSA-cj9g-3mj2-g8vv Guard typeless JSON depth for CWE-674

Fixes with no security advisory

• 814bc4c Honor TypeFormatter options hooks for CWE-470
• b0f8c5e Fix WriteRawX methods to advance by written length
• 0124048 Fix CWE-190 map header length overflow

What's Changed

• Fix repo url by @tomap in #2065
• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @BertanAygun in #2183
• Add more types to the default disallow list of named types to be deserialized by @AArnott in #2263
• Add several known unsafe 'gadgets' to the disallow list by @AArnott in #2269

New Contributors

• @tomap made their first contribution in #2065

Full Changelog: v2.5.192...v2.5.205

What's Changed

• Fix repo url by @tomap in #2065
• Update DynamicAssembly usage to honor different AssemblyLoadContext's by @BertanAygun in #2183

New Contributors

• @tomap made their first contribution in #2065

Full Changelog: v2.5.192...v2.5.198