.NET agent release notes

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Limited the number of Assess traces, Protect events, and observed routes that would be queued in memory when the agent encountered connection issues. (DOTNET-6515)

Enabled logging of method signatures and IL modifications by default when TRACE-level logging is enabled. (DOTNET-6517)

Added support for ServiceBus-only Azure Functions applications. (DOTNET-6519)

Added checks for existing tag ranges to avoid adding duplicates. (DOTNET-6525)

Fixed a memory leak related to struct dataflow. (DOTNET-6523)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Removed the agent.dotnet.feature_flags.enable_azure_functions_isolated_worker_support setting. The related functionality will always be enabled. (DOTNET-6518)

Disabled stored-xss when sql-injection is disabled. (DOTNET-6521)

Removed duplicate handling and logging of struct dataflow events. (DOTNET-6522)

Improved consistency of how Assess findings are cached. (DOTNET-6526)

Fixed invalid instrumentation for some types when struct dataflow is disabled. (DOTNET-6520)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Fixed a path-traversal-semantic-file-security-bypass false-positive when the Process.Threads property was read on Linux. (DOTNET-6512)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Fixed an issue with an improper data type when parsing `api.certificate.ca_file`. (DOTNET-6487)

The `Contrast.Agent` nuget package properly works with projects using packages.config (ASP.NET on .NET Framework). (DOTNET-6499)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Fixed an exception thrown by NLog in certain cases when running on Azure App Service. (DOTNET-6490)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

Updated the installer icons. (DOTNET-6011)

Added instructions for setting Linux environment variables to the Contrast.Agent package readme. (DOTNET-6011)

The Agent Explorer now uses the Avalonia UI framework. (DOTNET-6378)

Fixed a bug where the agent was sending an empty string URI to the communications library. (DOTNET-6284)

.NET Core: 6.0, 8.0, 9.0, and 10.0

.NET Framework: 4.7.1 and newer

There is now a single, unified installer for .NET Framework and .NET Core applications. (DOTNET-5381)

In addition to the individual NuGet packages, there is a single, unified NuGet package - 'Contrast.Agent'. (DOTNET-5704)

For Azure App Service, there is a single, unified site Extension - Contrast.NET.SiteExtension. (DOTNET-5704)

So that the upgrade service would handle future versions properly, the major version of the agent was bumped to 60.0.1 (needed to be higher than the .NET Framework agent, which was 51.x.x).

Like all major version changes, the upgrade service will not automatically update the agent to the new major version. This can be overridden by setting enable_major_version_upgrade: true in the upgrade service YAML file.

If the .NET Core agent is installed to a custom directory, upgrading to the single .NET agent will result in that custom directory no longer being used. The default directory is C:\Program Files\Contrast\dotnet, but if the .NET Framework agent is also installed to a custom directory, that custom directory will be used.

Paths to files have changed between the .NET Framework agent NuGet package and the new combined .NET agent NuGet package. To migrate from the Contrast.NET.Azure.AppService package to the Contrast.Agent package, paths in environment variables will likely need to be adjusted from, for example, \contrastsecurity\runtimes\win-x64\native\ContrasatProfiler.dll to \contrast\runtimes\win-x64\native\ContrastProfiler.dll.

The new Contrast .NET Agent will attempt to attach to both .NET Core and .NET Framework apps, even if only one of those agents was previously installed.

(Update) The single installer will handle upgrading regardless of whether the .NET Framework, .NET Core, or both are installed.