sgcWebSockets .NET release notes

Every public release of the .NET build of sgcWebSockets, newest first. Each version lists what was added, what was fixed and anything that changes behaviour, exactly as it is written in the history file that ships with the product.

sgcWebSockets .NET product page

sgcWebSockets .NET 2026.10.0 Latest

  • 2026.10.0: 2026 October
  • NewAdded .NET 10 support, the library now also targets net10.0.
  • NewMCP server and client now support the MCP 2026-07-28 specification. The same server answers both the new stateless clients and the existing 2025-11-25 clients such as VS Code and Claude, so nothing changes for the clients you already have. New in 2026-07-28: server/discover, the protocol version and client details sent with every request, the Mcp-Method and Mcp-Name request headers (checked by the server), cache hints on list results and the new error codes.
  • NewMCP subscriptions/listen: a client can open one long lived stream to receive tools, prompts and resources list changes and resource updates. The existing Send notification methods reach these clients too, and the stream is closed cleanly when the server stops (enabled by default).
  • NewMCP client: it tries the 2026-07-28 protocol first and falls back to 2025-11-25 when the server does not support it, remembering the answer per server, and tool parameters marked with x-mcp-header are sent as request headers.
  • NewNew HSTS option for the HTTP servers (SecurityOptions.HSTS_Options, off by default). When enabled, every response sent over TLS includes the Strict-Transport-Security header, which is what SSL Labs needs to give an A+ grade. The header is never sent over plain HTTP, and it is not added twice when your code already sets it.
  • FixedFixed the servers silently ignoring errors raised by Start, Stop or ReStart, for example when the port is already in use. They are now reported through OnException.
  • FixedFixed ReStart, also used by the WatchDog, waiting forever when the server could not be stopped.
  • FixedFixed stopping a TCP server, and every server built on it, possibly waiting forever.
  • FixedFixed the HTTP.sys WebSocket server freezing on WriteData with a connection Guid, or when a client disconnected during Broadcast or WriteData, a regression of 2026.9.0.
  • FixedFixed the HTTP.sys server reporting Active as True after a failed start, never releasing its URL reservations when stopped (error 183 on the next start), and failing to start with OAuth2 when the URLs are set only through Bindings.
  • FixedFixed several crashes, memory leaks and memory corruption in the HTTP.sys server, mainly with Asynchronous enabled, in HighPerf mode and in 64-bit applications.
  • FixedFixed possible deadlocks in the WebSocket, HTTP, HTTP/2, TCP, UDP and protocol components, with NotifyEvents neAsynchronous or neSynchronous, when an event handler used the component while other connections were reporting events or disconnecting.
  • FixedFixed possible crashes when queued events were delivered for a component or connection that had already been freed, with NotifyEvents neAsynchronous.
  • FixedFixed a small memory leak in the WebSocket and HTTP servers when several clients connected at the same time to a newly started server.
  • FixedFixed a small memory leak in servers using the IOCP IOHandler when connections were closed while the server was starting.
  • FixedFixed possible memory corruption and crashes when a WebSocket or HTTP server was stopped while clients were sending data.
  • FixedFixed a small memory leak and an open socket handle in servers using the IOCP IOHandler when stopped while new connections were being accepted.
  • FixedFixed a broadcast that excluded a connection reaching nobody at all.
  • FixedFixed a WebSocket client with Authentication.Token.JWT never connecting, it failed with the message that a host is required.
  • FixedFixed an access violation when a WebSocket client is destroyed while it is still connected, for example when the application is closed without disconnecting first. The read thread could still be reading through the TLS handler, which was freed before the thread had stopped. It happened with every NotifyEvents mode.
  • FixedFixed a race when a server connection is closed with Close from a thread other than its own, for example from a timer or another connection. The connection thread went on reading the socket and closed it while the Close frame was being sent and the peer answer was being read, which raised an access violation that was hidden.
  • FixedFixed memory leaks in the MCP server (one connection per session), in WriteData when the stream could not be read, and in queued messages and pending notifications when a component is destroyed.
  • FixedFixed several AI components reading a field from the answer and getting the whole JSON block instead of the value. It affected the function call name in Gemini, the container details in Anthropic, and the message role and the message text in DeepSeek and Ollama.
  • FixedFixed OpenAI image requests failing with a 'Missing required parameter' error when the prompt, or any other text, contained a double quote. The text is now escaped correctly.
  • FixedFixed the text of OpenAI image and audio requests travelling with the spaces replaced by %20, so the AI received a distorted prompt.
  • FixedFixed the requests sent to the AI providers being invalid when the text held a double quote, a backslash or a line break, so the provider answered with an error. It affected the chat messages, the prompts, the instructions and the system messages of OpenAI, Anthropic, Gemini, DeepSeek, Grok, Mistral and Ollama.
  • FixedFixed the system message getting lost when it was sent together with the user message to Ollama, only the user message travelled.
  • FixedFixed the MCP client 2025-11-25 notification stream over HTTP not raising any event.
  • FixedFixed the MCP server over stdio not answering a request for an unknown method.
  • FixedFixed the MCP client raising an unclear error when the server answers an HTTP error without a JSON body, for example a plain 401.
  • FixedFixed the SChannel IO handler leaving a copy of the private key in the Windows key store for every connection using a PFX file, and not sending the client certificate on Windows 11 and Windows Server 2022.
  • FixedFixed concurrent SChannel connections using a certificate from the Windows certificate store failing the handshake or crashing.
  • FixedFixed 64-bit SChannel applications negotiating TLS 1.2 instead of TLS 1.3 on Windows 11 and Windows Server 2022.
  • FixedFixed an access violation on TLS servers using the IOCP IOHandler when the server writes to a client that has just disconnected abruptly. The failed write closed the connection and freed its TLS session while that session was still encrypting the message.
  • FixedFixed the OAuth2 server rejecting DPoP proofs signed with RSA keys.
  • FixedFixed JWT tokens being signed with a signature that was plain Base64 instead of base64url, and the header being read without decoding it, so tokens holding certain characters were rejected by other libraries and by this one.
  • FixedFixed non-ASCII claims written by other JWT libraries being read one character per byte, so a name holding an accent came back as two wrong characters. Claims written as escapes are now read as well, including the alg header itself.
  • FixedFixed the custom claims of a JWT header or payload getting lost when the options were copied.
  • FixedFixed the metadata list of WebAuthn being read with plain Base64 instead of base64url, so the FIDO metadata could not be loaded.
  • FixedFixed the HTTP.sys server not answering requests for a missing file, so the client waited until its timeout. It now responds with 404 or 500.
  • FixedFixed the HTTP/2 client resending already answered requests after a reconnection, and reconnecting in an endless loop when a pending request could not be sent.
  • FixedFixed the HTTP/2 async requests and the MQTT QoS 1 and QoS 2 publish raising an exception when the stream was not at position 0.
  • FixedFixed server sent events on the HTTP.sys server, which never worked because the response headers were sent as content, and on Linux the header lines ended with the wrong character.
  • FixedFixed an HTTP POST request with the header Accept: text/event-stream being answered as a server sent events connection instead of reaching the server.
  • FixedFixed HTTP header values not being read when there is no space after the colon.

sgcWebSockets .NET 2026.9.0

  • 2026.9.0: 2026 September
  • NewNew AllowUnsignedWebhooks option on the Cryptohopper client, False by default. The webhook signature is now always verified, and this option is the explicit way to accept an unsigned payload when no ClientSecret is configured.
  • NewNew Throttle.AsyncResubscribe option on the WebSocket API clients, True by default. The paced replay after a reconnect now runs on a background worker, so the connect notification returns straight away instead of waiting for the whole watchlist to be sent. Set it to False for the previous inline behaviour.
  • NewNew OnBinanceUserStreamSubscribed event, raised when the user data stream acknowledgement arrives, so readiness no longer has to be discovered by polling a property.
  • NewThe Deribit WebSocket client now reads expires_in and refresh_token from the authentication reply and refreshes the authorisation before it expires, so a long lived session no longer loses it silently.
  • NewNew OnQueueDrained event and PendingCount property, matching the Delphi ones. OnQueueDrained is raised when the outgoing queue of a connection goes from holding messages to being empty, and PendingCount reports how many messages are still queued across the three priority levels.
  • FixedFixed access violations when a WebSocket API component was freed while its client was still connected, because it never removed itself from the list the message handler walks, and when a client was detached while a paced message was waiting for its slot in the Throttle window. Two heartbeat timer threads also leaked for every component destroyed, which is why a clean shutdown occasionally faulted.
  • FixedFixed private subscriptions never being replayed after a reconnect, so the component reported the reconnect as successful while the order, balance and fill feeds were silently gone. It affects Bitstamp, Coinbase, Deribit, Huobi, Kraken spot and futures, Kucoin, MEXC and ThreeCommas. Frames carrying a short lived credential, a token, a JWT, a nonce or a challenge signature, are rebuilt with a fresh one at replay time instead of being resent.
  • FixedFixed the reconnect replay running before or without authentication on BitMEX, Bitfinex, Crypto.com, Deribit and Kraken futures. It is now sent after the authentication acknowledgement.
  • FixedFixed Kucoin replaying stored frames with the id they were first sent with, while the id counter is reset on connect, so an acknowledgement could not be matched to its request, and Deribit never removing a private channel from its subscription list on unsubscribe, so it was replayed for the life of the process.
  • FixedFixed money being rounded before it was signed across the exchange clients, where a fixed eight decimal mask turned a size such as 0.000000004 into zero. Values are now written losslessly, in plain decimal, with a dot separator regardless of the system locale. It affects Binance, Bybit, Cex, Cryptohopper, Kucoin, MEXC and ThreeCommas.
  • FixedFixed Huobi building its signature timestamp from the local date and the UTC time, so on a host outside UTC the signed timestamp landed close to a full day away and every private request failed for part of the day, which read as an intermittent authentication problem.
  • FixedFixed every private POST on the Kraken futures REST client being sent as a GET with the body discarded, which affected send, edit and cancel order, transfer and withdrawal. The parameters and the body were also passed in the wrong order.
  • FixedFixed signing and request defects that made a private call fail outright: the Bitstamp OpenBankWithdrawal body was signed and sent empty, the Coinbase JWT for private WebSocket subscriptions was minted without the mandatory nonce and included the query string in the uri claim, the Bitget WebSocket login sent its timestamp in milliseconds where Unix seconds are required, the MEXC futures signed POST declared JSON while sending a form encoded body, and BitMEX AmendOrder was sent with no authentication headers at all.
  • FixedFixed five Binance REST methods that could not work: historical trades called the recent trades endpoint with no API key, the transfer history query was a POST to the endpoint that creates a transfer, ChangePositionMode was a GET where a POST is required, seven futures analytics routes produced a path that does not exist, and PlaceLimitMakerOrder never sent the mandatory price.
  • FixedFixed the Binance WebSocket client building a different stream name when unsubscribing than when subscribing, for kline, mark price, index price and all market mark price, so the stream kept running, the wrong key stayed in the subscription list and the orphaned stream was re-subscribed on every reconnect.
  • FixedFixed the Binance spot testnet market data URL pointing at the REST host instead of wss://stream.testnet.binance.vision, the user stream timer not being released on teardown, and the listen key DELETE running synchronously inside the disconnect notification, so OnDisconnect and the WatchDog waited for the full HTTP timeout when the endpoint was unreachable.
  • FixedFixed six Kucoin REST request construction defects, affecting the order type in four listing methods, stop orders by client oid, the withdrawal quotas request, futures deposit margin and spot GTT orders.
  • FixedFixed OKX trading operation failures, such as a rejected order, never reaching OnOKXError, because only a message with event set to error was treated as an error. Two channel constants also pointed at the wrong channel, estimated prices subscribed instruments and grid sub orders subscribed grid positions.
  • FixedFixed the Kraken addOrderStatus and cancelOrderStatus replies being discarded, so with RawMessages False the application never learned whether its order was accepted. An unrecognised event is no longer dropped silently either.
  • FixedFixed a successful Bitfinex authentication acknowledgement being reported as a failure, because the handler read code and msg, which are absent when the status is OK.
  • FixedFixed the Huobi v2 dispatcher handling only ping and req, so subscription replies and pushed data reached no handler, unbounded recursion in the Huobi raw message path when RawMessages is True, and the Huobi futures class connecting to the spot host while sending futures topics.
  • FixedFixed a Huobi client configured with an ApiKey silently losing public market data. The credentials move the connection to the private endpoint, which does not serve the market data schema. Such a subscription is now refused and reported through OnHuobiError, use a second component without credentials for market data.
  • FixedFixed the GateIO futures connection using the spot protocol. Selecting futures changed the URL and nothing else, so the login, the ping and every subscription still used the spot channel names.
  • FixedFixed the Kraken spot WebSocket client connecting to the v2 endpoint while building and parsing the v1 schema, so none of the subscription or status events fired. It now connects to v1 by default, the schema it implements. Set Version to 2 only if you handle the frames yourself.
  • FixedFixed the Kraken futures options copy calling itself, which raised a stack overflow, the Kraken futures REST options property setter having an empty body, and the Kraken options classes dropping credentials and log settings when assigned from an object of their own type.
  • FixedFixed the Cryptohopper webhook accepting any payload as authentic when no ClientSecret was configured, which is the default, and computing the signature over text decoded with the system code page, so a valid signature failed on a host whose code page is not UTF-8. It is now verified over the bytes as received.
  • FixedFixed credential headers surviving a redirect to another host and an HTTPS to HTTP downgrade in the ready made API clients. The protections existed but were left off, and are now on by default.
  • FixedFixed the JSON parser deciding the document type before skipping whitespace, producing invalid output when a name was added twice with different types, removing the quotes from any string whose first character is a brace or a bracket, and depending on the system locale for number output.
  • FixedFixed every MEXC protobuf decoder failing on the first binary frame, because each one called an inherited method that was declared abstract, so the protobuf market data path could not deliver a single message. The incremental depth bids branch also split the price and the quantity of one entry across different list elements.
  • RemovedRemoved support for the AppRTC protocol and the RTCMultiConnection API. The TsgcWSPServer_AppRTC and TsgcWSAPIServer_RTCMultiConnection classes, their sources and their demos have been deleted.
  • RemovedRemoved support for the Flash fallback, which reached end of life in 2020. The TsgcWSFallBack_Flash class, the FallBack.Flash property and the trpFlash transport have all been deleted.
  • BreakingThe trpFlash member has been removed from TwsTransport and the remaining members have been renumbered to stay aligned with the Delphi enum across the DLL boundary. Any code that persisted or transmitted the numeric transport value must be revisited.
  • BreakingRemoved the TestNet property from the MEXC futures options. The testnet address was identical to the production one, so enabling it switched nothing and a signed test order was sent to production with a live key. MEXC has retired its futures testnet, the spot TestNet is unaffected.
  • BreakingBinance PlaceLimitMakerOrder now takes a price, which is required because the order is rejected without it, and the fromId, orderListId and fromAllocationId parameters are now 64 bit, since the aggregate trade id on the busy pairs has already passed the 32 bit range.
  • BreakingType changes on the exchange clients: the Kucoin VisibleSize property and the Kraken WebSocket order price and volume properties are now strings, and the Cex order amount and price parameters are now Double. The previous types held four decimals and could not represent the values these fields carry.
  • BreakingThe Kraken spot WebSocket client now connects to v1 by default instead of v2. See the corresponding fix above.
  • BreakingWith an ApiKey configured, OnKrakenFuturesConnect now fires after the challenge has been received rather than before it, which is the point at which private subscriptions can actually be signed.
  • BreakingThe Cryptohopper webhook now rejects a payload when no ClientSecret is configured. Set AllowUnsignedWebhooks to True for the previous behaviour.
  • BreakingStripAuthOnCrossHostRedirect and NoInsecureRedirect now default to True on the ready made API clients.

sgcWebSockets .NET 2026.8.0

  • 2026.8.0: 2026 August
  • NewA graceful STOMP Disconnect now waits until the broker confirms it with a receipt, so nothing is lost when closing. The new DisconnectTimeout option controls how long to wait (10 seconds by default, 0 returns immediately as before).
  • NewThe WebSocket server now limits how many control frames a client may send each second (100), so it cannot be flooded with pings.
  • NewThe SChannel server can now check the certificate of the clients that connect to it. Set SSLOptions.VerifyCertificate to True and the client certificate goes through the same checks a client applies to a server certificate, the chain and the dates, without the host name check. SSLOptions.VerifyCertificate_Options.FailIfNoCertificate decides what happens when a client sends none, rejecting the connection when True and letting it in when False (False by default). Until now the server never asked the client for a certificate.
  • FixedFixed TLSOptions.Version being ignored by the SChannel IO handler. On Windows 11 and Windows Server 2022 it was not read at all, on Windows 10 asking for tls1_3 silently gave TLS 1.2, and leaving it undefined switched SSL 3.0, TLS 1.0 and TLS 1.1 back on. Version is now honoured on both paths, the negotiated version is checked when the handshake completes and the connection fails if it falls outside what was asked for, SSL 3.0 is never requested, and asking for tls1_3 where the platform cannot provide it fails with a message saying why.
  • FixedFixed the SChannel IO handler losing every TLS setting on the connections opened on the side, such as an HTTP redirect to another host, and on the client IO handler a SChannel server builds for the connections it opens itself. The clones came back empty, so they ran with VerifyCertificate off and no cipher list, TLS version or ALPN list, and nothing reported it. They now carry the full configuration.
  • FixedFixed the SChannel connections after a TLS renegotiation: a new certificate was accepted with no check of the chain or the host name, and the record sizes of the original cipher were kept, so everything sent and received was laid out with the wrong sizes. The full check now runs again whenever the certificate is not the one already accepted, the connection is dropped when it does not pass, and the sizes are read again on every handshake.
  • FixedFixed a client using the SChannel IO handler never noticing that the connection was gone when the other end dropped it without a TLS close notification, as happens when a proxy restarts. OnDisconnect never fired, Connected stayed True and the reconnect and WatchDog machinery never ran.
  • FixedFixed a client using the SChannel IO handler never completing a TLS 1.3 connection. The session ticket the server sends straight after the handshake left the client waiting for data the server had already sent, so the connection never opened and neither OnConnect nor OnError ever fired.
  • FixedThe TLS handshake and every read of the SChannel IO handler are now bounded. The handshake honours ConnectTimeout instead of covering only the TCP connect, so a peer that accepts the socket and then goes silent no longer blocks the thread for ever, and a peer that sends a record a few bytes at a time can no longer hold the reader past the read deadline.
  • FixedFixed a startup race in the SChannel IO handler where two connections opened at the same time could see initialization as complete before it actually was, an intermittent access violation. A single connection's handshake error could also unload the shared SSPI library while other SChannel connections were still using it.
  • FixedA connection using the SChannel IO handler now sends the TLS close notification before closing, on clients and servers, so a normal disconnect is no longer seen by the other end as a connection cut short, which several exchanges log or rate-limit. It is sent only when it can go out immediately, so closing is never delayed.
  • FixedFixed every exchange WebSocket API resending its whole subscription list in one burst after reconnecting, on a connection a few milliseconds old, so an exchange that limits messages per second closed it straight away and the cycle repeated. The replay is now paced. It affects Binance, Bitfinex, Bitget, Bitmex, Bitstamp, Bybit, Cex, CexPlus, Coinbase, CryptoCom, Deribit, GateIO, Huobi, Kraken, Kucoin, MEXC and OKX.
  • FixedFixed memory leaks and random crashes when stopping the IOCP/EPOLL server engine while it was busy, and a buffer lost on every message processed with worker threads, a leak that grew with traffic.
  • FixedFixed the IOCP and EPOLL servers leaking connections and handles, and crashing, on several cleanup paths: a client dropping the line right after being accepted (a port scan or aborted TLS handshake), a client aborting while a read was pending, a connection released twice when the server was stopped mid-cleanup, an aborted connection consuming an accept slot that was never returned, and a use-after-free with worker threads enabled.
  • FixedFixed HTTP keep-alive not working on the IOCP and EPOLL servers. The connection was closed after each request, so the server filled with sockets in TIME_WAIT. Connections now stay open between requests, as with the classic thread engine.
  • FixedFixed a memory leak in the Linux (EPOLL) server where every HTTP request leaked pieces of the parsed request, growing with request size until the server ran out of memory. The classic thread engine was not affected.
  • FixedFixed the EPOLL server (Linux) sharing one connection queue across all its worker threads, where one or two threads did almost all the work while the rest stayed idle. Each worker now has its own queue.
  • FixedFixed the TLS IOCP and EPOLL servers writing past the end of their read buffer when a client sent several encrypted records together, which could overwrite adjacent memory and crash the server, and crashing when a connection could not be set up, for example at the connection limit or when a client dropped during the handshake. The plain TCP servers already handled this correctly.
  • FixedFixed an "invalid pointer operation" crash in clients using ConnectTimeout, when the connection attempt finished as its helper thread was being disposed of.
  • FixedThe WebSocket server now validates the opening handshake as the standard requires. A missing or non-13 version is refused, a handshake that does not finish within ten seconds is closed, and the number and length of headers are limited. A configured allowed-origins list is now also applied when a client sends no origin at all.
  • FixedThe WebSocket connection now rejects invalid frames instead of accepting them: data frames masked by a server, frames setting reserved bits no active extension defines, and close messages whose reason text carried an invalid close code.
  • FixedThe WebSocket client now builds its handshake key with a secure random generator, and the server's user name and password check now takes the same time whether or not the password is close to correct, so the response time no longer leaks a hint.
  • FixedWhen a client closes a WebSocket connection, the server now sends its own close message back before disconnecting, completing the closing handshake instead of just dropping the connection. This is now the default.
  • FixedFixed the MQTT client building invalid packets that brokers rejected: a CONNECT with a user name but no password (or the reverse), and any MQTT 5 packet carrying a larger block of properties. Also fixed it getting stuck after a broken packet on plain TCP, and two threads publishing at once picking the same packet identifier.
  • FixedFixed the MQTT 5 client misreading broker replies and reading past the end of a packet. A CONNACK Maximum QoS was read from the wrong byte, SUBSCRIBE and UNSUBSCRIBE replies with a long reason text reported the wrong QoS levels, and a truncated packet made it hand whatever followed in memory to the application as property values. Lengths and properties are now checked against the packet before being read.
  • FixedThe MQTT 5 client now honours what the broker tells it: it uses the Keep Alive returned in the CONNACK including for its first ping, passes the real reason code and server reference to OnMQTTDisconnect, raises OnMQTTAuth on an authentication challenge, and delivers a message arriving with only a Topic Alias under its real topic.
  • FixedFixed several problems with MQTT QoS 2 publishing. The client now sends the correct follow-up confirmation instead of re-sending the original message, discards a message the broker rejected instead of retrying forever, flags re-sent messages as duplicates, and retries on a sensible schedule instead of on every timer tick.
  • FixedSTOMP messages are now delivered exactly as the broker sent them. Multi-line bodies lost their line breaks and an invisible end-of-frame character was left at the end. The client now uses content-length to read the body, so it can contain any character including line breaks and binary zeros, and header values with special characters are escaped following the STOMP 1.1 and 1.2 rules.
  • FixedFixed STOMP frames being lost. Several frames packed into one WebSocket message are all processed now, a frame split across two messages is reassembled, and frames received as binary WebSocket messages are no longer ignored. A malformed frame now fires OnSTOMPError and closes the connection, as the specification requires.
  • FixedSTOMP ACK and NACK now send the headers required by the negotiated version: id for 1.2, message-id plus subscription for 1.1, message-id for 1.0. NACK is no longer sent on STOMP 1.0. Heart-beats now start only after the server confirms the connection and use the agreed intervals, closing the connection if the server goes silent so the WatchDog can reconnect.
  • FixedSTOMP fixes for ActiveMQ: the message priority header was sent without its colon separator so priority was ignored, and unsubscribing did not detect whether the subscription was durable.
  • FixedFixed the STOMP client reading far outside a frame when a broker sent a very large content-length, because the check was done with 32 bit maths and overflowed. A body larger than the maximum frame size is now refused, and a frame is limited to 1024 headers.
  • FixedThe AMQP 1.0 client is now protected against a bad broker: reading past the end of its buffer when a frame arrives in small pieces, a frame declaring an invalid header size, messages nested too deeply, a small message crafted to expand into a huge amount of memory, arrays whose items are not text symbols, and a text or symbol field declaring four gigabytes out of a small frame.
  • FixedThe default maximum frame size for AMQP 0.9.1 and 1.0 is now 1 MB instead of practically unlimited, so a broker cannot make the client hold an enormous frame in memory. You can still raise it. The AMQP 0.9.1 client now also closes the connection with "not implemented" on an unrecognized command, as the specification requires.
  • FixedHTTP/2 header compression is now protected against crafted headers: a small block expanding into a huge amount of memory, a length wrapping around to a negative value, and a read one byte past the end of a block. A malformed compressed header now closes the connection cleanly with the correct error, and continuation frames must belong to the stream they started on.
  • FixedThe HTTP/2 connection now rejects abuse that could crash it or exhaust memory and CPU: a DATA frame for a stream never opened, a flood of PRIORITY frames building unlimited hidden streams, reuse of a stream number, a flood of empty continuation frames, confusion after a stream reset, and an error code that could read outside a fixed internal table.
  • FixedFixed HTTP/2 memory growth where reset streams were never cleaned up. The client now also checks that a response's declared length matches what arrived, and rejects conflicting duplicate content-length headers.
  • FixedFixed a misleading error when a TLS connection failed, for example "error:00000006:lib(0):func(0):EVP lib". The real reason reported by OpenSSL was discarded before the exception was raised, it is now shown.
  • FixedImproved the errors reported when loading certificates and using newer algorithms. ML-KEM-768 explains that it needs OpenSSL 3.5 or later and shows the version found, a failed legacy provider reports which provider could not be loaded and where it was searched, and a PKCS#12 file using an old algorithm such as RC2 40-bit explains how to enable the legacy provider.
  • FixedFixed a pending OpenSSL error being left behind when the certificate file contained the certificate and private key together, which could affect a later call, and real errors while reading the certificate chain being ignored. The OpenSSL options to disable old TLS versions, compression and renegotiation and to prefer the server cipher order were also ignored with OpenSSL 1.1 or later, and are now applied.
  • FixedFixed the OAuth2 server sending the authorization code to whatever address the request asked for. The redirect address was never compared with the one registered, so a crafted link could deliver a user's authorization code to somebody else's site. It must now match exactly.
  • FixedThe OAuth2 server now cleans the application name and requested scopes before showing them on the sign-in page and strips line breaks from the values used to build the redirect address, closing two ways crafted text could run script or add headers. Also fixed it using memory it had already released when the sign-in page ended up empty.
  • FixedFixed the WebAuthn server trusting the FIDO metadata file without checking it. With no root certificate set the check was skipped entirely, so a forged file could make the server accept a fake authenticator. The file is now refused when there is nothing to check it against, and the download verifies the server certificate, using the Windows certificate store with no setup.
  • FixedFixed the WebAuthn server reading past the end of the certificate extension it examines when a device registers. The decoder checked nothing, so a truncated or deeply nested extension could make the server read unrelated memory and hand it back, run out of stack, or stop. Every field is now checked, nesting is limited and malformed extensions are refused.
  • FixedFixed the limit on the number of response headers in the HTTP client never being applied, so a server could send an endless stream of headers until the client ran out of memory. The limit is now enforced.
  • FixedFixed the MCP server writing its internal connection id as a message on the event stream a client opens with GET, which clients such as VS Code GitHub Copilot reported as "Failed to parse message". The session id is still returned in the mcp-session-id header. This also covers the HTTP.sys server.
  • FixedFixed the MCP server checking where a request came from only when it carried a header browsers never send, so the check never ran for the case it was meant to stop. A web page the user visited could reach an MCP server on their own machine, list its tools, run them and read the results. The origin is now checked on every request, including the browser's preliminary check. If your MCP client runs in a browser, set ValidateOrigin to False.
  • FixedFixed the Files protocol deleting and writing files outside the folder it was given. The incoming file name was used almost as it came, and on Windows forward slashes were kept, so a peer could send a name such as ../../../file and reach anywhere on the disk. The delete side had no protection at all. Names are now reduced to a plain file name and checked, on server and client.
  • FixedFixed seven STUN attributes reading past the end of the packet when a peer declared a length shorter than the field carried, which could hand unrelated memory to the application or stop the client. It affects the two ICE control attributes, the reservation token, requested address family, requested transport, even port flag, address error code and ICMP attribute.
  • FixedFixed the Binance Spot user data stream, which stopped working when Binance retired the listenKey endpoints it was built on. Account, order and balance updates now come from the Binance WebSocket API, over a second connection the component opens by itself and renews after a reconnection. The events arrive in the same shape, so your existing handlers keep working. The new subscription is signed, so Binance.ApiSecret must now be set as well as Binance.ApiKey. Binance.us and Futures still use a listenKey, so Binance.ListenKeyOnDisconnect now applies only to those two. When a private stream cannot be opened, the error now reports the status the server returned and the message Binance sent back, instead of only "ListenKey cannot be empty.".
  • FixedFixed the OKX keepalive, it now sends the ping text message the exchange requires instead of a WebSocket ping, and reconnects when no pong comes back. OnOKXSubscribed and OnOKXUnsubscribed now fire on the subscription reply, they never did before.
  • FixedFixed the KuCoin keepalive, it now sends the ping message the exchange requires instead of a WebSocket ping, and the pingTimeout returned when the connection opens is used to reconnect when no pong comes back.
  • FixedFixed random crashes in the OnException event of the TCP and HTTP/2 components. The exception was destroyed by the thread that raised it before the event ran, so the handler read freed memory and reported a wrong class name. It now receives a valid copy.

sgcWebSockets .NET 2026.7.0

  • 2026.7.0: 2026 July
  • NewYou can tell Connect() to wait until the connection is fully ready before it returns, so nothing runs against a half-ready connection during quick reconnects.
  • NewThe sgc protocol can now remember recent messages per channel, and a client that drops and reconnects automatically receives whatever it missed.
  • NewNew optional HTTP-client protections: drop the Authorization and Cookie headers if a redirect sends you to another site, and block a redirect that downgrades HTTPS to HTTP (both off by default).
  • NewThe HTTP client can retry a request automatically when the server is busy or a connection hiccups, waiting longer each time and honoring the server's Retry-After hint (off by default); the OpenAI, Anthropic and Gemini clients use this too.
  • FixedFixed a crash that could occur if the same connection was reported disconnected twice, which could bring the server down under strict memory managers.
  • FixedFixed a clean disconnect over TLS taking several seconds; it now finishes immediately and still reports the disconnect exactly once.
  • FixedFixed a memory-exhaustion weakness when reading the trailing headers of a chunked response; the number of trailer lines is now limited and their values are read correctly.
  • FixedImproved redirect handling so relative redirect addresses become full URLs correctly, and the request method and body are kept on 307 and 308 redirects.
  • FixedFixed the client giving up on a cookie when its expiry date couldn't be read; it's now treated as a session cookie, and Max-Age still wins over Expires.
  • FixedFixed a possible read past the buffer in the MQTT 5 client when a broker claimed more data than it actually sent; lengths are now checked first.
  • FixedFixed a similar read past the buffer in the AMQP 1.0 client when decoding a UUID; it now checks the length first and reports a clean error otherwise.
  • FixedHardened the STUN/TURN parser against bad packets, fixing an infinite loop, several reads past the buffer (including IPv6 addresses), and missing length checks.
  • FixedFixed memory-safety bugs in the UDP client and server (including DTLS) when disconnecting, so a socket is no longer freed twice or left dangling and event handlers get valid peer info.
  • FixedFixed a memory bug in the DLL used by the .NET and other language bindings, where returned text could point to already-freed memory; the text now stays valid after the call.
  • FixedFixed streamed (Server-Sent Events) responses losing all but the first event when several arrived together, or losing an event split across two reads; this restores token-by-token streaming for the AI/LLM clients.
  • FixedHardened the WebAuthn server: challenges now use a secure random generator, each challenge can be used only once, and the clone check follows the latest rules so a zero counter can't slip through.
  • FixedThe OAuth2 authorization server now creates its codes and tokens with a secure random generator and compares the client secret in constant time to close a timing leak.
  • FixedJWT signatures are now checked in constant time, and a token with a valid signature but a bad claim is now rejected instead of accepted.
  • FixedHardened the AMQP client against a bad server: frames on a channel that was never opened are rejected, and the agreed maximum frame size is enforced as soon as the header arrives.
  • FixedAdded internal limits so a misbehaving peer can't grow memory without bound (the MQTT pending-message queue, the sgc protocol's per-connection subscriptions, and the WAMP server's pending calls)..
  • FixedFixed Kraken request IDs that could repeat within a millisecond or go backwards after a clock change, which Kraken rejected; they're now always increasing.
  • FixedFixed the BitMEX client sending its expiry time in milliseconds when BitMEX expects seconds; it's now sent in seconds.
  • FixedFixed the MEXC client signing the plain parameters while sending the encoded ones, which broke the signature for anything needing URL-encoding; they're now encoded before signing.
  • FixedFixed the Cryptorobotics client sending two values swapped in some by-hash calls, which hit the wrong item; they're now sent correctly.
  • FixedFixed the Deribit client never refreshing its login token, so private calls failed after about 15 minutes; it now refreshes in time and retries once if needed.
  • FixedFixed the Forex client hiding an error while reading the account ID, which quietly left you subscribed to prices but not orders, positions or margin; the problem is now reported.
  • FixedFixed a memory-safety bug when broadcasting to a channel while a client was disconnecting, which could read freed memory; the client list is now held while the broadcast runs.
  • FixedHardened the raw-TCP end-of-frame scanner against a bad stream that could read past the buffer or recurse too deeply.
  • FixedAdded a nesting-depth limit when decoding AMQP field tables, so a deeply nested value can't overflow the stack.
  • FixedHTTP session IDs in the built-in Indy HTTP server now use a secure random generator, and a small off-by-one that stopped the character "0" from ever appearing is fixed.
  • FixedFixed a crash and a possible memory corruption when reading OpenAI message attachments, and fixed an unrelated value being read when the reply had no "incomplete details".
  • FixedFixed the server leaking a connection and its socket every time a login failed while authentication was enabled.
  • FixedFixed the AMQP client accepting a frame that claimed a negative or impossibly large size.

sgcWebSockets .NET 2026.6.0

  • 2026.6.0: 2026 June
  • NewNew Kafka client component (TsgcWSPClient_Kafka): native Apache Kafka client that speaks the binary Kafka wire protocol over raw TCP.
  • NewNew Demo in the folder "Demos/02.WebSocket_Protocols/13.Kafka" showing the main features of the Kafka client: connect, produce, subscribe and poll, topic administration and offset management.
  • NewNew TsgcWebSocketFirewall BotDetection: IP-based bot classification (verified search-engine crawlers, datacenter/hosting ranges, blocklisted IPs) using known-bot CIDR ranges, datacenter ASN ranges, forward-confirmed reverse DNS (FCrDNS) and DNSBL lookups. Classify-only: results are exposed through the new OnBotDetected event and GetBotClassification method without blocking connections.
  • NewImproved Firewall demo (Demos\04.WebSocket_Other_Samples\13.Firewall): new "Bot Detection" tab to configure known-bot ranges, datacenter detection, reverse DNS verification and DNSBL zones, with a live "Classify IP" tester.
  • NewNew TsgcWebSocketFirewall IPv6 support: blacklist and whitelist CIDR matching now works for IPv6 addresses and ranges up to /128, GeoIP loads the GeoLite2 IPv6 country blocks, the bot-range database accepts IPv6 CIDR ranges, and bot detection resolves IPv6 reverse DNS and DNSBL (ip6.arpa) lookups. Addresses are normalized (IPv4-mapped, compressed and zone forms) so a client is tracked consistently across spellings. IPv4 behaviour is unchanged.
  • NewNew STDIO transport for the MCP server and client. The MCP server can now run over standard input/output through the new TsgcAI_MCP_Server_Stdio host, so it can be spawned as a local subprocess by MCP clients.
  • FixedFixed path traversal in TsgcWebSocketHTTPServer static file serving (HTTP/1.x and HTTP/2): a URL containing "../" could read files outside DocumentRoot. The resolved path is now canonicalized and rejected when it escapes the document root.
  • FixedFixed possible HTTP response header injection (CRLF) in TsgcWebSocketServer_HTTPAPI: CR and LF characters are now stripped from response header values such as Location, ETag and Server.
  • FixedFixed cross-thread use-after-free in TsgcIdSSLIOHandlerSocketSChannel (SChannel SSL): Readable and RecvEnc now access SSL.Handle inside the SSL critical section (DoEnterCS/DoLeaveCS), matching SendEnc/Connected/CloseSSL and preventing a race when another thread closes the connection mid-read.
  • FixedFixed WebSocket frame parsing when a frame header arrives split across TCP segments under high throughput. The fixed-size header fields (16-bit/64-bit extended payload length and the 4-byte mask key) are now read in full before being parsed, instead of indexing a read buffer that held fewer bytes than requested. With range checking disabled this could yield a corrupt payload length and drop or garble the message. (Thanks to Jacques for the fix).
  • FixedFixed possible Denial of Service in TsgcWebSocketServer, TsgcWebSocketHTTPServer and TsgcWebSocketServer_HTTPAPI (http.sys): a client could exhaust server memory with oversized messages, endless message fragmentation or a permessage-deflate "zip-bomb". Messages are now bounded by a maximum size and rejected (close 1009) when exceeded.
  • FixedFixed 64-bit WebSocket frame length parsing: a length with the high bit set is now rejected instead of being truncated.
  • FixedFixed Bug TIdSSLIOHandlerSocketOpenSSL: the peer-verification callback could fail open and accept an untrusted certificate even when verification was requested. Enable the new TIdSSLOptions.StrictVerify option to enforce the OpenSSL verification result.
  • FixedFixed Bug TIdCustomHTTPServer: the chunked transfer-encoding trailer-header loop was unbounded, allowing a memory and CPU exhaustion DoS. It is now bounded by MaximumHeaderLineCount.
  • FixedFixed excessive memory usage serving static files from DocumentRoot in TsgcWebSocketHTTPServer (HTTP/1.x and HTTP/2). Each request loaded the whole file into memory with a TMemoryStream per connection, so large files or many concurrent downloads could exhaust RAM (for example 100 connections serving a 1 GB file used about 100 GB), and slow-reading clients kept those copies resident. Files are now streamed from disk with a read-only shared TFileStream, so server memory stays flat regardless of file size and connection count.
  • FixedFixed wrong MQTT 5.0 property identifiers in TsgcWSPClient_MQTT: the Subscription Identifier property in PUBLISH packets was written as 0x11 (Session Expiry Interval) instead of 0x0B, and the Server Reference property in DISCONNECT packets was written as 0x22 (Topic Alias Maximum) instead of 0x1C, so strict MQTT 5.0 peers could misparse or reject the packets.
  • FixedFixed Bug TsgcWSPClient_STOMP (and the STOMP broker clients): with the default HeartBeat settings (Enabled = True, Outgoing = 0) the client flooded the server with heart-beat frames, because on connect the WebSocket client heartbeat interval was set to 0 seconds and the timer fired continuously.
  • FixedFixed TsgcWSPClient_AMQP1 not sending messages larger than the negotiated max-frame-size; the outgoing transfer is now split across multiple frames, so large AMQP 1.0 messages are delivered.
  • FixedFixed WAMP v1 PUBLISH writing the exclude and eligible lists in the wrong order and the server ignoring them, so the publisher could receive its own event and the exclude/eligible filtering had no effect.
  • FixedFixed TsgcWSPClient_Files routing file-sent-error notifications to the component instead of the target connection, so the client was never told a transfer failed.
  • FixedFixed TsgcWSPServer_Presence not freeing empty channels (DeleteChannel was a no-op), so channels accumulated for the lifetime of the server.
  • FixedFixed E2EE EC public keys being emitted with explicit curve parameters instead of the named-curve form, which strict importers rejected; OpenSSL reads both forms.
  • FixedFixed the Server-Sent Events fallback sending the retry value multiplied by 1000 (about 50 minutes for the 3000 default); the configured value in milliseconds is now sent unchanged.
  • FixedFixed TsgcSTUNClient building the transaction id from a low-entropy ASCII range; it now uses a full 96-bit cryptographically-random transaction id.
  • FixedFixed TsgcTURNClient ChannelData length field including the padding bytes, which broke interop with standard TURN servers; the length now excludes padding per RFC 5766.
  • FixedFixed TsgcWSAPI_Bybit option market using swapped production and testnet stream hosts.
  • FixedFixed TsgcWSAPI_Kraken spot subscriptions producing malformed JSON when a reqId was set; the reqId is now appended instead of overwriting the message head.
  • FixedFixed TsgcWSAPI_MEXC mini-tickers stream never being created due to an inverted check, so mini-ticker subscriptions returned no data.

sgcWebSockets .NET 2026.5.0

  • 2026.5.0: 2026 May
  • NewNew TsgcWSAPI_Forex component: supports unified REST + streaming for Forex.com.
  • NewNew Demo for Forex.com: GUI demo in "Demos\05.Crypto\22.Forex" covering login, connectivity ping, live market watch, positions, active orders, trade history, stop/limit history and simulate trade, with credentials persisted to sgcForexDemo.ini.
  • NewNew TsgcWSPClient_Lightstreamer component: generic Lightstreamer TLCP 2.5 client, reusable for any Lightstreamer server (Forex.com, IG Markets, etc.). Implements create_session, bind_session, control (subscribe / unsubscribe) and the LOOP auto-rebind + subscription replay after reconnect.
  • NewImproved EPOLL IOHandler (Linux): new properties AcceptBatchSize, WaitTimeoutMS and HandshakeTimeoutMS.
  • NewImproved EPOLL IOHandler (Linux): EPOLLOUT-driven write backpressure. When send() returns EAGAIN on a partial write, the remaining bytes are captured in a per-connection pending buffer and the socket is re-armed with EPOLLIN|EPOLLOUT; the reactor flushes the tail on the next EPOLLOUT event.
  • NewImproved IOCP IOHandler (Windows): new ThreadAffinity property (default False) on TsgcIndy_IO_Engine. When enabled, engine threads are pinned round-robin to logical cores via SetThreadAffinityMask, reducing cross-core cache traffic on high-core-count systems.
  • NewImproved IOCP IOHandler (Windows): new TsgcIndy_IO_EngineMetrics record and readonly Metrics property exposing AcceptsPosted, AcceptsCompleted, ReadsPosted, ReadsCompleted, ActiveConnections, BytesRead and BytesWritten counters. Metrics are maintained by the engine with critical-section-protected increments.
  • NewImproved IOCP IOHandler (Windows): new SendBufferSize, ReceiveBufferSize and TCPNoDelay properties on TsgcIndy_IOHandler_IO_IOCP. Applied in AfterAccept via setsockopt (SO_SNDBUF, SO_RCVBUF, TCP_NODELAY) so per-connection tuning no longer requires a custom OnConnect handler.
  • NewImproved IOCP IOHandler (Windows): TsgcPerIoDataPool capacity raised from 256 to 2048, avoiding the GetMem/FreeMem heap fallback under high connection concurrency. Measured +15-18% WebSocket throughput on loopback benchmarks.
  • NewImproved MCP Server: built-in OAuth 2.1 flow for browser-based connectors (claude.ai). Auto-serves /.well-known/oauth-authorization-server (RFC 8414), /.well-known/oauth-protected-resource (RFC 9728), /oauth/register (RFC 7591 DCR), /oauth/authorize (HTML consent form) and /oauth/token (PKCE S256 + refresh tokens).
  • NewImproved MCP Server: CORS support with origin reflection and HSTS (Strict-Transport-Security: max-age=31536000) on all responses; OPTIONS preflight returns 204 with full Access-Control-* headers.
  • FixedFixed MCP Server: missing/invalid credentials now return 401 Unauthorized with a WWW-Authenticate: Bearer header pointing at the protected resource metadata, instead of 500 Internal Server Error. Required for OAuth discovery by browser-based MCP clients.
  • FixedFixed MCP Server: OPTIONS requests no longer hit the JSON-RPC parser (was returning 500 "Invalid jsonrpc Value"). CORS preflight is now handled before authentication and before the MCP body parser.
  • FixedFixed IOCP IOHandler (Windows): TsgcIndy_IO_Engine_IOCP_Base.DoStopThreads was calling WaitForMultipleObjects on an array of DWORD thread IDs (FThreadsId) instead of thread HANDLES.
  • FixedFixed IOCP IOHandler (Windows): pending I/O operations on sockets are now cancelled on shutdown and on per-socket close.
  • FixedFixed IOCP IOHandler (Windows): replaced the fragile Overlapped.Internal = STATUS_PENDING probe in DoFreePerIoData with an explicit Completed: Boolean flag on TsgcPerIoData.
  • FixedFixed IOCP/EPOLL IOHandler worker pool: TsgcIndy_IO_WorkOpThread.Run issued sleep(1) on every iteration, including after a task was processed, capping each worker at ~1000 ops/s even when the queue had backlog.
  • FixedFixed MCP Server: tool descriptions, prompt messages and resource contents containing non-ASCII characters broke MCP client connections because the JSON body was not ASCII-safe while the HTTP header declared charset=utf-8.
  • FixedFixed MCP Server: tool, prompt, resource, root, template, completion-ref and completion-argument 'name' fields containing non-ASCII characters were emitted/read as raw UTF-16 code points rather than JSON \uXXXX escapes.
  • FixedFixed HTTP/2 WebBrokerBridge: "Invalid pointer operation" on sgcFree(oResponse) in TsgcWSHTTPServer.OnHTTP2RequestEvent when DataSnap REST handled an HTTP/2 HEADERS-only frame.

sgcWebSockets .NET 2026.4.0

  • 2026.4.0: 2026 April
  • NewNew TsgcWSFirewall component: full-featured firewall for WebSocket servers with IP blacklist/whitelist (CIDR support), brute force protection with auto-ban, SQL injection detection, XSS detection, rate limiting, and flood protection.
  • NewNew Demo for Server Firewall: shows the main features of the new Firewall and is located in the folder: "Demos\04.WebSocket_Other_Samples\13.Firewall".
  • NewNew Demo for HTTP/2 Large File Transfer: server + client demo for testing 1GB+ file downloads via HTTP/2, located in "Demos\20.HTTP_Protocol\13.HTTP2_LargeFile_Transfer".
  • NewNew OAuth2 Client Token Revocation support (RFC 7009): Revoke() method with OnBeforeRevokeToken, OnAfterRevokeToken, and OnRevokeTokenError events.
  • NewNew OAuth2 Client Token Introspection support (RFC 7662): Introspect() method with OnBeforeIntrospectToken, OnAfterIntrospectToken, and OnIntrospectTokenError events.
  • NewNew OAuth2 Client Device Authorization Grant (RFC 8628): auth2DeviceCode grant type with automatic polling, OnDeviceCode and OnDeviceCodeExpired events.
  • NewNew OAuth2 Server Token Revocation endpoint (RFC 7009): /sgc/oauth2/revoke with OnOAuth2AfterRevokeToken event.
  • NewNew OAuth2 Server Token Introspection endpoint (RFC 7662): /sgc/oauth2/introspect with OnOAuth2AfterIntrospectToken event.
  • NewNew OAuth2 Server Device Authorization endpoint (RFC 8628): /sgc/oauth2/device and /sgc/oauth2/device/verify with OnOAuth2DeviceAuthorization and OnOAuth2DeviceCodeVerification events.
  • NewNew OAuth2 Server Resource Owner Password Credentials grant handling (password grant_type).
  • NewNew OAuth2 Server Device Code token exchange (urn:ietf:params:oauth:grant-type:device_code grant_type).
  • NewNew OAuth2 Client DPoP support (RFC 9449): sender-constrained tokens via DPoPOptions with ES256/RS256 signing, automatic DPoP proof JWT generation, JWK thumbprint calculation (RFC 7638), and DPoP-Nonce retry handling.
  • NewNew OAuth2 Client DPoP methods: GetDPoPProof() for resource requests, GetDPoPJWKThumbprint() for token binding verification.
  • NewNew OAuth2 Server DPoP support (RFC 9449): DPoP proof validation, JWK thumbprint token binding, token_type DPoP issuance, and OnOAuth2ValidateDPoP event.
  • NewImproved Deflate extension: the speed has been improved specially for small messages. (Thanks to Michael for the fix).
  • NewNew Gemini API: Google Gemini integration with Content Generation (with streaming), Vision, Structured JSON Output, Tool Use (function calling), Token Counting, Embeddings, and Model listing.
  • NewNew DeepSeek API: DeepSeek integration with Chat Completions (with streaming), Vision, Tool Use (function calling), and Model listing.
  • NewNew Ollama API: Ollama local LLM integration with Chat Completions (with streaming), Model Management (show, pull, delete, list tags), and Embeddings.
  • NewNew Grok API: xAI Grok integration with Chat Completions (with streaming), Vision, Tool Use (function calling), and Model listing.
  • NewNew Mistral API: Mistral AI integration with Chat Completions (with streaming), Vision, Structured JSON Output, Tool Use (function calling), Embeddings, and Model listing.
  • FixedFixed HTTP/2 server-side streaming for large responses: Eliminates out-of-memory crashes when serving large files and reduces peak server memory.
  • FixedFixed HTTP/2 client-side memory reallocation when receiving large responses: payload buffer now uses a capacity growth strategy with platform-specific caps (128 MB on Win32, 1 GB on Win64) instead of reallocating on every DATA frame.
  • FixedFixed HTTP/2 SSL write deadlock on large file transfers: WINDOW_UPDATEs are now queued and flushed between read iterations instead of being written inline during frame processing, preventing both client and server from blocking simultaneously on SSL_write.
  • FixedFixed HTTP/2 Integer overflow for files larger than 2 GB: changed FrameLength, Offset, WindowSize, PayLoadCapacity, ReadWindowSize, and flow control accumulators from Integer to Int64.
  • FixedFixed HTTP/2 stream state: RST_STREAM frames received on idle streams (after stream cleanup) now gracefully transition to closed instead of raising a PROTOCOL_ERROR.
  • FixedFixed HPACK encoder: GetBestMatchingIndex now correctly returns static table name-only matches, preventing compression errors on HTTP/2 connections.
  • FixedFixed HPACK encoder: Huffman bit mask uses correct shift-left operation.
  • FixedFixed HPACK decoder: byte count and available bytes calculations now correctly account for the buffer offset.
  • FixedFixed SetBytesFromInteger: intermediate byte extractions now masked with $FF to prevent range check errors on values like WINDOW_UPDATE increments.
  • FixedFixed typed pointer incompatibilities when compiling with the option active "Typed @ operator".
  • FixedFixed JWT RSA signing: vLength parameter in DoSignRSA was declared as Integer instead of TIdNativeUInt, causing potential stack corruption on 64-bit platforms. (Thanks to Gabriel for the fix).
  • FixedFixed Win64 pointer truncation in sgcHTTP_API_OpenAI: mciSendCommand calls used Cardinal() cast on pointers, replaced with NativeUInt().
  • FixedFixed OAuth2 Server: SetOAuth2Options memory leak fixed.
  • FixedFixed Bitfinex access violation when unsubscribe from a channel.
  • FixedFixed memory leaks in Indy Servers caused by thread-unsafe lazy initialization of FSpecifications and FConnections fields. Concurrent Indy worker threads could race on creation, orphaning instances.

sgcWebSockets .NET 2026.3.0

  • 2026.3.0: 2026 February
  • NewAdded Client events: OnBeforeDisconnect, OnRedirect, OnLoadBalancerError.
  • NewAdded sgc Protocol Client component (TsgcWSProtocol_sgc_Client) with Subscribe, UnSubscribe, UnSubscribeAll, Broadcast, RPC, Notify, Publish, GetSession, StartTransaction, Commit, RollBack, WriteData methods and OnSubscription, OnUnSubscription, OnEvent, OnSession, OnAcknowledgment, OnRPCResult, OnRPCError events.
  • NewAdded sgc Protocol Server component (TsgcWSProtocol_sgc_Server) with Publish, RPCResult, RPCError, Broadcast, ClearQueue methods and OnBeforeSubscription, OnSubscription, OnUnSubscription, OnNotification, OnRPC, OnRPCAuthentication events.
  • NewAdded Broker Client component (TsgcWSBroker_Client) with OnConnect, OnDisconnect, OnMessage, OnError events.
  • NewAdded SocketIO Client Ping method.
  • NewAdded Binance Futures subscribe/unsubscribe methods: ContinuousKLine, CompositeIndex, ContractInfo, AssetIndex, AllAssetIndex, IndexPrice, IndexPriceKLine, MarkPriceKLine.
  • NewAdded STOMP Protocol Client component (TsgcWSProtocol_STOMP_Client) with Subscribe, Unsubscribe, Send, Ack, Nack, Begin, Commit, Abort methods and OnSTOMPConnected, OnSTOMPMessage, OnSTOMPReceipt, OnSTOMPError events.
  • NewAdded STOMP RabbitMQ Client component (TsgcWSProtocol_STOMP_RabbitMQ_Client) with CreateQueue, DeleteQueue, BindQueue, UnBindQueue, CreateExchange, DeleteExchange methods for RabbitMQ integration.
  • NewAdded STOMP ActiveMQ Client component (TsgcWSProtocol_STOMP_ActiveMQ_Client) for ActiveMQ integration.
  • NewAdded WAMP v1 Protocol Client component (TsgcWSProtocol_WAMP_Client) with Prefix, Subscribe, UnSubscribe, Call, CancelCall, Publish methods and OnWAMPWelcome, OnWAMPCallResult, OnWAMPCallError, OnWAMPEvent events.
  • NewAdded WAMP v2 Protocol Client component (TsgcWSProtocol_WAMP2_Client) with Subscribe, UnSubscribe, Publish, Call, Register, UnRegister, Yield methods and OnWAMP2Welcome, OnWAMP2Subscribed, OnWAMP2Event, OnWAMP2Result, OnWAMP2Error, OnWAMP2Challenge events.
  • NewAdded E2EE Protocol Client component (TsgcWSProtocol_E2EE_Client) with SendDirectMessage, SendGroupMessage, SendDirectMessage_Bytes, SendGroupMessage_Bytes, CreateGroup, DeleteGroup methods and OnE2EEMessage, OnE2EEBeforeEncrypt, OnE2EEAfterDecrypt events.
  • NewAdded Presence Protocol Client component (TsgcWSProtocol_Presence_Client) with Subscribe, UnSubscribe methods and OnPresenceData, OnPresenceSubscribed, OnPresenceUnSubscribed events.
  • NewAdded Presence Protocol Server component (TsgcWSProtocol_Presence_Server) with OnPresenceSubscribe, OnPresenceUnSubscribe, OnPresenceData events.
  • NewAdded Broker Protocol Server component (TsgcWSProtocol_Broker_Server) for WebSocket message brokering.
  • NewAdded Bitfinex API Client component (TsgcWS_API_Bitfinex).
  • NewAdded BitMEX API Client component (TsgcWS_API_Bitmex).
  • NewAdded Bitstamp API Client component (TsgcWS_API_Bitstamp).
  • NewAdded Bybit API Client component (TsgcWS_API_Bybit).
  • NewAdded CEX.IO API Client component (TsgcWS_API_Cex).
  • NewAdded CEX.IO Plus API Client component (TsgcWS_API_CexPlus).
  • NewAdded Coinbase API Client component (TsgcWS_API_Coinbase).
  • NewAdded Discord API Client component (TsgcWS_API_Discord).
  • NewAdded FXCM API Client component (TsgcWS_API_FXCM).
  • NewAdded Huobi API Client component (TsgcWS_API_Huobi) with spot and futures (TsgcWS_API_Huobi_Futures) support.
  • NewAdded Kraken API Client component (TsgcWS_API_Kraken) with spot and futures (TsgcWS_API_Kraken_Futures) support.
  • NewAdded Kucoin API Client component (TsgcWS_API_Kucoin) with spot and futures (TsgcWS_API_Kucoin_Futures) support.
  • NewAdded MEXC API Client component (TsgcWS_API_MEXC) with spot and futures (TsgcWS_API_MEXC_Futures) support.
  • NewAdded OKX API Client component (TsgcWS_API_OKX).
  • NewAdded OpenAI Realtime API Client component (TsgcWS_API_OpenAI).
  • NewAdded Pusher API Client component (TsgcWS_API_Pusher).
  • NewAdded SignalR API Client component (TsgcWS_API_SignalR).
  • NewAdded SignalR Core API Client component (TsgcWS_API_SignalRCore).
  • NewAdded 3Commas API Client component (TsgcWS_API_ThreeCommas).
  • NewAdded XTB API Client component (TsgcWS_API_XTB).
  • NewAdded WhatsApp Client component (TsgcWhatsApp_Client_Base) for WhatsApp Cloud API integration.
  • NewAdded RCON Client component (TsgcLib_RCON_Client) for remote console protocol.
  • NewAdded Amazon IoT Client component (TsgcIoT_Amazon_Client) with MQTT-based connectivity, SignatureV4, Custom Authentication and Certificate options.
  • NewAdded Azure IoT Client component (TsgcIoT_Azure_Client) with MQTT-based connectivity, SAS authentication, Device Twins, Direct Methods and Cloud-to-Device messaging.
  • NewAdded HTTP Web Push Client component (TsgcHTTP_WebPush_Client) with VAPID support for sending push notifications.
  • NewAdded WebPush Server API component (TsgcWSServer_API_WebPush).
  • NewAdded MCP (Model Context Protocol) Server API component (TsgcWSServer_API_MCP).
  • NewNew Anthropic Claude API: Added TsgcHTTP_API_Anthropic .NET wrapper with Messages (streaming), Vision, Tool Use, Extended Thinking, Documents, Citations, Web Search, MCP, Code Execution, Models, Token Counting, Files, and Message Batches APIs.
  • NewSynchronized sgcWebSockets.cs DLL imports with all new sgcWebSockets.dll exports.
  • FixedFixed AMQP 0.9.1: Parameter ordering, field-table encoding, spec-incorrect data types, missing channel IDs, read-loop data loss, and a thread-safety race condition.
  • FixedFixed AMQP 1.0: Serialization errors, missing frame fields, multiple memory leaks, connection state handling, heartbeat activation, and thread safety.
  • FixedFixed some minor memory leaks.

sgcWebSockets .NET 2026.2.0

  • 2026.2.0: 2026 February
  • NewAdded sgcWebSocket.module.js as an ES module version (thanks to Francesco for the file).
  • FixedFixed Indy Server bug: Authentication was not working even though it was enabled.
  • FixedFixed Indy Client bug: The ReadTimeOut property was not set properly when using TLS 1.3+ (thanks to Francesco for reporting it).

sgcWebSockets .NET 2026.1.0

  • 2026.1.0: 2026 January
  • FixedFixed some minor bugs.

sgcWebSockets .NET 2025.10.0

  • FixedFixed Bug MultipartFormData: when HTTPUploadFiles.RemoveBoundaries was true and the file size was zero, the file was created with the boundaries included.
  • FixedFixed Bug Server: when KeepAlive property was active, the built-in javascript libraries return an error 404.
  • FixedFixed Bug Server: when Authentication was not enabled, if the client send a request with an Authorization header, by default the connection was closed.
  • FixedFixed Bug ServerSentEvents: when sending multiple messages the headers were included in the message.
  • FixedFixed Bug ServerSentEvents: the initial message was sent twice.

sgcWebSockets .NET 2025.9.0

  • NewUpdated the Telegram libraries to the version 1.8.54. (Windows, Android, iOS, Linux64 and OSX).
  • NewUpdated sgcIndy to the latest version.
  • FixedFixed Bug Telegram: the android64 library requires to be built with a 16KB page size from November 2025.
  • FixedFixed Bug sgcIndy: the cipherlist is now set before loading the certificates to allow to set for example the security level. (Thanks to Preben for the fix)
  • FixedFixed Bug OnHandshake event: UTF-8 characters were not encoded properly when adding new headers.
  • FixedFixed Bug Indy Server: if Authentication.Basic was enabled, the server didn't return the Basic Realm when the Authentication header was wrong.

sgcWebSockets .NET 2025.8.0

  • FixedFixed some minor bugs.

sgcWebSockets .NET 2025.7.0

  • NewUpdated the OpenSSL libraries to the version 3.5.1
  • FixedFixed Bug WhatsApp: when sending an url or path, the message was not decoded properly.
  • FixedFixed Memory Leak MQTT Client.
  • FixedFixed some minor bugs.

sgcWebSockets .NET 2025.6.0

  • FixedFixed Bug internal method was calling OnMessage event instead of OnError.
  • FixedFixed Bug sgcIndy: function RSA_set0_key, only is required for openssl 1.1+.
  • FixedFixed Bug sgcIndy: if EVP_PKEY_base_id function is not available use the EVP_PKEY_is_a function instead.
  • FixedFixed Bug Binance: the websocket messages were not processed. (Thanks to Alex for the fix).
  • FixedFixed Bug Indy Server: if Authentication was enabled, if the HTTP Request hasn't any authentication, the connection was accepted although Authentication.AllowNonAuth was set to false.
  • FixedFixed Bug JWT: some internal openssl objects were not properly destroyed after signing or validating.
  • FixedFixed Bug JWT: error evaluating if the algorithms TIdHashSHA384 or TIdHashSHA512 were available.

sgcWebSockets .NET 2025.5.0

  • FixedFixed in Server APIs: when http/2 was enabled, the response was empty.
  • FixedFixed in Server APIs: when using more than one Server API only the last assigned API was working.
  • FixedFixed Bug MQTT: When reading the MQTT 5 properties, if the size of the packet was 2 bytes or more, the message was not parsed successfully.
  • FixedFixed Bug MQTT: When reading the Remaining Length of the packet, if was greater than 128, the message was not parsed successfully.

sgcWebSockets .NET 2025.4.0

  • FixedFixed bug in OAuth2 Client: When changing the local server port, the old port was not removed from the bindings list.
  • FixedFixed bug in MultipartFormData: When extracting files, the internal stream was not using UTF-8 encoding.
  • FixedFixed bug in MQTT Client: memory leak if the component was destroyed before the event OnDisconnect was called.

sgcWebSockets .NET 2025.3.0

  • NewAdded support for .NET 9.0
  • FixedFixed Bug sgcIdSSLOpenSSLHeaders, the method X509_STORE_CTX_free was not properly defined.
  • FixedFixed Bug sgcIdSSLOpenSSLHeader, the method ECDH_compute_key was not properly defined.

sgcWebSockets .NET 2025.2.0

  • NewImproved Socket.IO Client, new property HandShakeAuthToken to set the authentication token when required.
  • NewImproved Socket.IO sample, the previous online server has been closed and now has been replaced by a new one.
  • FixedFixed Bug MQTT Client when using mqtt5 the payload had some invalid characters.
  • FixedFixed Bug MQTT Client when the connection is over TCP a message received in multiple packets was not decoded properly.
  • FixedFixed Bug Telegram Client reading the Sender User Id in a group. (Thanks to Michael for the fix).
  • FixedFixed Bug HTTP2 Server, Authentication Basic was not working although it was enabled.

sgcWebSockets .NET 2025.1.0

  • FixedImproved RequestInfo class, added BodyAsText and BodyAsBase64 to read the content of a Post Request.
  • FixedImproved the performance of the WebSocket Extension PerMessage-Deflate. (Thanks to Michael for the patch).
  • FixedFixed Bug TsgcWebSocketClient when using Connect, if the ConnectTimeout was greater than zero, it may appear a conflict.
  • FixedFixed Bug HTTP/2 Client connecting using openssl 3.0 and tls 1.3.
  • FixedFixed Bug OpenSSL when setting Version TLS 1.3 and MinVersion TLS 1.2, only TLS 1.2 was available.

Get the current release

Every licence includes a year of updates, and the trial is the full product.

sgcWebSockets .NET All release notes