sgcWebSockets release notes

Every public release of sgcWebSockets, newest first. Each version lists what was added, what was fixed and anything that changes behaviour, exactly as it is written in the history file that ships with the product.

sgcWebSockets product page · Download

sgcWebSockets 2026.10.0 Latest

  • 2026.10.0: 2026 October
  • NewTsgcOpenAPI_Client: new property UserAgent to set the User-Agent header sent with every request, set it to an empty string to omit the header.
  • NewNew OnBeforeHeartBeat event on the WinHTTP WebSocket client, so the application can send its own keep-alive message every HeartBeat interval.
  • NewWebSocket client: when the server refuses the connection (for example 401 Unauthorized because the access token has expired), the body of the server answer is now available in the OnException event with TsgcWSConnectionClient(Connection).HandshakeResponseBody, so the application can see why it was refused.
  • NewNew QueueOptions.DrainedMode property, to choose when the OnQueueDrained event is raised. qdmTransition (default) keeps the current behaviour: the event is raised when the outgoing queue of a connection becomes empty. qdmEveryPass raises it on every pass of the connection loop, on the connection's own thread, even when no queue level is enabled, so the application can send its own pending data from that thread. It applies to the WebSocket client, server and HTTP server with the default IOHandler.
  • NewAI Chat images: ChatWithImage sends an image to the AI, the new OnChatImage event is raised when the AI answers with an image, and the new ImageOutput option lets Gemini answer with images and keep editing them message after message. The OpenAI image edit request now supports the gpt-image-1 options and several input images.
  • NewAI Chat can ask the AI to answer with JSON that follows a schema you provide, on OpenAI, Anthropic, Gemini, DeepSeek, Ollama, Grok and Mistral. The new ChatJSON method asks again when an answer cannot be read.
  • NewNew TsgcAIDocumentExtractor component: give it a PDF or an image and a JSON schema, and get validated JSON back from OpenAI, Anthropic, Gemini and the other vision models. Built in presets for invoices, receipts and identity documents, a confidence value for every field, one automatic retry when the answer does not follow the schema, and an optional local OCR with the new TsgcAIOCRTesseract component, used always or only when the vision request fails.
  • NewAI Chat accepts PDF documents and several files in one message: new ChatWithDocument, ChatWithAttachments and ChatJSONWithAttachments methods. PDF files are sent to OpenAI, Anthropic and Gemini as they are.
  • NewAI Chat: new TLSOptions property to choose the OpenSSL version and the TLS options used by the provider requests.
  • NewNew TsgcAIOCRWindows component: local OCR with the text recognition built into Windows 10 and later, no installation needed. The document extractor can use it or Tesseract.
  • NewMCP server and client now support the MCP 2026-07-28 specification. The same server answers both the new stateless clients and the existing 2025-11-25 clients such as VS Code and Claude, so nothing changes for the clients you already have. New in 2026-07-28: server/discover, the protocol version and client details sent with every request, the Mcp-Method and Mcp-Name request headers (checked by the server), cache hints on list results and the new error codes. New MCPOptions.Cache, Instructions and Extensions options on the server.
  • NewMCP subscriptions/listen: a client can open one long lived stream to receive tools, prompts and resources list changes and resource updates. The existing Send notification methods reach these clients too, the stream is closed cleanly when the server stops, and the new ListenersCount and NotifySubscriptions members are available on the server component (MCPOptions.Subscriptions, enabled by default).
  • NewMCP multi round trip requests: a tool, prompt or resource can now ask the client for input (a form, a web page, an AI answer or the client roots) and continue when the client calls again with the answers. The state kept between calls is signed and expires (MCPOptions.MRTR, 600 seconds by default). On the client, the new OnMCPInputRequired event answers these requests, and the existing roots, sampling and elicitation handlers answer them automatically.
  • NewMCP Tasks extension: a long running tool can return a task that the client checks until it finishes, can answer when the task needs input, and can cancel (MCPOptions.Tasks on the server, off by default; CreateTask and the OnMCPTaskCancel and OnMCPTaskUpdate events). The client declares support with MCPOptions.Tasks.Enabled and follows the task automatically, raising OnMCPTaskCreated, OnMCPTaskStatus and OnMCPTaskCompleted.
  • NewMCP client: new MCPOptions.ProtocolEra (Auto by default). Auto tries the 2026-07-28 protocol first and falls back to 2025-11-25 when the server does not support it, remembering the answer per server. New Discover method, OnMCPDiscover and OnMCPListChanged events, and tool parameters marked with x-mcp-header are sent as request headers.
  • NewMCP client authorization (MCPOptions.Authorization, off by default): on a 401 the client finds the authorization server by itself, registers with a client id metadata document or dynamic registration, signs in with PKCE, checks the issuer of the answer and keeps the credentials per authorization server, refreshing the token when it expires. New OnMCPAuthorizationURL and OnMCPAuthorizationCredentials events. The built-in authorization server of the MCP server now sends and advertises the issuer, and checks client registrations more strictly.
  • NewNew TsgcAIVoiceAgent: a realtime voice agent that listens, detects turns, talks back and calls tools, over OpenAI Realtime or Gemini Live, on WebSocket or WebRTC. Built in audio on Windows, Android and iOS, a G.711 path for telephony, server, semantic or client voice activity detection, barge-in, live transcripts, and tools from the OnToolCall event or from an MCP client.
  • NewNew TsgcHTMLAuth component and session stores for sgcHTML applications: session cookie, login and logout, idle session close and failed login limit. sgcHTML pages are also protected against cross site request forgery when the authentication component is used.
  • NewsgcHTML routes accept path parameters, for example /customers/{id}/edit, can be limited to the HTTP methods you choose, and read the headers, cookies and body of the request. New DispatchDirect method and a new unit to test sgcHTML pages without a socket.
  • NewsgcHTML realtime and navigation: server sent events can now carry the updates instead of WebSocket, with automatic fallback and replay of the updates missed while disconnected, also on the plain HTTP server. New navigation options in the page template change pages without a full reload, keeping the scroll position and what the user was typing.
  • NewNew AI Data Pack for sgcHTML. Ask a grid, a data table or a pivot a question in plain language and it filters, sorts, groups, limits or highlights the rows, fills a form from pasted text and suggests values for a column. It works with no API key, does not send your rows to the AI provider unless you allow it, and every suggestion is checked against your own columns and accepted by a person. Includes the new TsgcHTMLComponent_InlineAIPrompt component and the demo 18.AIData.
  • NewNew Web Push for sgcHTML applications, to reach a user whose browser is closed (Enterprise and All-Access editions only). New notification inbox and notification preferences components on every edition, over WebSocket or server sent events. The notification component delivers in the page when the user is looking at it and as a web push when not.
  • NewNew AI page generator in the visual designer. Describe the page in plain language, or point it at a screenshot, a mockup or a photo of a sketch, and it builds the page out of your own components and applies it only when you accept. The settings are under Tools, Options, Third Party. The design surface now reads and writes the page as JSON.
  • NewNew MCP Apps support: an sgcHTML page can be shown inside Claude, ChatGPT and VS Code. The MCP server behind TsgcWSAPIServer_MCP is reachable as MCPServer, so MCP Apps can be published over HTTP and WebSocket, and the new InlineAssets option writes the stylesheet and the script inside the document. New demo 19.MCPApp.
  • NewNew TsgcHTMLComponent_Geolocation component for sgcHTML: reads the GPS position of the browser once or continuously and sends latitude, longitude, accuracy, altitude, heading and speed to the server, by form post, WebSocket or redirect. It can show a locate button with the current position or work hidden in the page.
  • NewsgcHTML Lazarus demos: the run time demos are now available for Lazarus and Free Pascal, each one as a console server and an optional desktop window. The Lazarus package now includes the sgcHTML CRUD and MCP Apps units.
  • NewNew CRUD component for sgcHTML: the list with search and paging, the form, the delete and the code that writes in one component, over a dataset or your own SQL, with a version field against overwrites, child lists and CSV export. New IDE wizard Tools, New sgcHTML CRUD page, the new sgcHTMLGen command line tool that writes a CRUD page in Object Pascal or C#, and the new MessageSession method on the HTMX engine to check a form sent over the socket against the session behind it.
  • NewsgcHTML CameraScanner: new RedirectURL property, after a scan the browser opens that page with the scanned code, for example a search page (empty by default).
  • NewsgcHTML CameraScanner: new PolyfillURL property, loads a barcode decoder on browsers that have none built in, like every browser on iPhone and iPad (empty by default).
  • NewsgcHTML Pagination: new HTMXGet, HTMXTarget and HTMXInclude properties, the page links load the next page with htmx (hx-get with page=N) and keep the normal link for browsers without JavaScript (empty by default, the output is unchanged).
  • NewsgcHTML AutoComplete: new acHTTP mode and SearchURL property, the suggestions are requested over plain HTTP with htmx while the user types, with the same debounce and minimum length, and the server answers with GetResultsFragmentHTML.
  • NewsgcHTML Grid: new SortMode (gsmServer), SortURL, SortField, SortDescending, HTMXTarget, HTMXInclude and ServerFilter properties, the header cells sort on the server with htmx (hx-get with sort=Field or sort=-Field) and an optional filter row sends one f.<Field> input per column while the user types, keeping the current sort (client sort by default, the output is unchanged).
  • NewsgcHTML Grid: new column properties Sortable, Filterable and FilterKind (gfkText, gfkRange), with the server sort a column that is not Sortable keeps a plain title, with ServerFilter a column that is not Filterable gets an empty cell and a gfkRange column gets two inputs f.<Field>.from and f.<Field>.to, the browser side sort skips a column that is not Sortable, and the server pager now keeps the current server sort and HTMXInclude (defaults keep the output unchanged).
  • NewNew htmx attribute constants for hx-put, hx-delete, hx-vals and hx-include.
  • NewsgcHTML pages switch to a right-to-left layout automatically for Arabic, Hebrew, Persian, Urdu and the other right-to-left languages: the page reads from the right, loads the right-to-left Bootstrap stylesheet (now included in the library) and the components mirror, from the sidebar and the steppers to the chat and the grid. Left-to-right pages do not change. New HtmlDir and Dir properties force a direction when you need one (empty, automatic, by default). New demo 22.RTL.
  • NewsgcHTML Presence: the Online, Away, Busy and Offline status words are now translated in the 17 built-in languages.
  • NewNew post-quantum cryptography in the sgcCrypto pack, in pure Object Pascal with no external library: ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) keys as SubjectPublicKeyInfo, PKCS#8 and PEM, the X-Wing hybrid key encapsulation, X.509 certificates and requests with post-quantum keys, and JWT signing with ML-DSA (RFC 9964). Checked with the NIST known answer tests, with new demos.
  • NewThe cryptography of the library is hardened against timing attacks (RSA blinding, constant time elliptic curve and Ed25519, AES and GHASH without secret indexed tables). Private keys are verified on import, signatures that are not minimal DER are rejected, and the certificate chain validation enforces path length and name constraints. HMAC signed JWT tokens accept a binary secret through the new SecretBase64URL property.
  • NewNew native TLS 1.3 and TLS 1.2 engine in Object Pascal, client and server, with no OpenSSL and no SChannel, on the Indy handler and on the IOCP and EPOLL servers. It negotiates the hybrid post-quantum groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024), ALPN, SNI and client certificates, and the new UseSystemRoots property uses the certificates the operating system already trusts. TLSOptions.Version is the lowest version allowed: tls1_2, the default, negotiates TLS 1.2 and TLS 1.3, and tls1_3 only TLS 1.3. For TLS 1.2 only, list only TLS 1.2 suites in NativeTLS_Options.CipherSuites.
  • NewThe IOCP and EPOLL servers can now use a TLS library other than OpenSSL. Write a TLS provider for your library, for example SecureBlackbox, and the event-driven engine drives it exactly like the built-in one.
  • NewServers: new SSLOptions.AllowPlainText property (disabled by default) lets a TLS server also accept plain HTTP and WebSocket connections on the same port, detecting TLS from the first byte the client sends. SSLOptions.PlainTextPolicy serves, redirects (308 to https) or rejects (400) the plain connections, SSLOptions.PlainTextTimeout sets how long to wait for the first byte, and the new Connection.TLS property and Server.IsTLS(AContext) method (usable in OnCommandGet) tell which transport is in use. Works with the default, IOCP and EPOLL IOHandlers.
  • NewNew SAML 2.0 service provider, TsgcSAMLServiceProvider: single sign-on with Entra ID, Okta, AD FS, Google Workspace, Keycloak or any SAML identity provider.
  • NewNew LDAP and Active Directory client, TsgcLDAPClient: sign users in with their directory password over LDAPS or StartTLS, search the directory and read group membership, nested groups included.
  • NewNew TsgcTOTPAuthenticator: one-time codes for Google Authenticator, Microsoft Authenticator and similar apps, with the enrolment link for the QR code, replay protection and recovery codes.
  • NewNew OpenID Connect client, TsgcHTTP_OIDC_Client: sign in with Google, Microsoft or any OpenID provider with automatic discovery, and validate ID tokens and bearer tokens on your server.
  • NewNew TsgcMailOAuth2: OAuth2 tokens for Microsoft 365 and Gmail, ready to send and read mail over SMTP, IMAP and POP3 without storing passwords.
  • NewPasskeys in the WebAuthn server: several passkeys per user, sign in without a user name, passkey autofill, synced passkey detection and a new event to keep passkeys in your own database.
  • NewThe new authentication components are included in the Enterprise and All-Access editions and in the sgcAuth pack, with a demo for each one in Demos.Authentication.
  • NewNew TsgcSSEClient: Server-Sent Events (EventSource) client with automatic reconnect and Last-Event-ID resume, the server retry field honoured, typed events, reconnect backoff with jitter, and OnBeforeConnect to set TLS, proxy and authentication. The new TsgcSSEParser reads any text/event-stream, for example LLM streaming responses and MCP Streamable HTTP.
  • NewNew HSTS option for the HTTP servers (SecurityOptions.HSTS_Options, off by default). When enabled, every response sent over TLS includes the Strict-Transport-Security header, which is what SSL Labs needs to give an A+ grade. The header is never sent over plain HTTP, and it is not added twice when your code already sets it.
  • FixedC++Builder: the headers generated for sgcSSL_DTLS, sgcQUIC_TLS and sgcQUIC_Crypto failed to compile with "Type name expected" on PEVP_PKEY, PEVP_MD and PSSL_SESSION when DTLS or QUIC is enabled. The OpenSSL header unit now declares these OpenSSL types for C++.
  • FixedC++Builder 10 to 13 runtime packages failed to link with "Unable to open file VCL.MENUS.OBJ" because they did not import the vcl package used by the HTML units. The C++Builder packages now import the same VCL, image, internet and REST packages as the Delphi packages.
  • FixedFixed the C++ header generated for sgcSSL_SChannel_Indy failing to compile with the classic C++Builder compiler bcc32 (E2347 on the Chain and Context properties of TsgcSChannelContext).
  • FixedOpenAPI Server: the local Swagger UI assets set in SwaggerUIAssetsPath were not loaded and served as UTF-8, so the characters of recent swagger-ui-bundle.js versions were mangled.
  • FixedOpenAPI Server: Endpoint.BasePath replaced the server url of the spec instead of being prepended to it, so the class route of a code first API was lost, and the served spec still advertised the old server url, so the Swagger UI requests did not reach the routes. BasePath is now prepended to the spec server url and the served spec advertises the effective base path.
  • FixedFixed the servers silently ignoring errors raised by Start, Stop or ReStart, for example when the port is already in use. They are now reported through OnException.
  • FixedFixed ReStart, also used by the WatchDog, waiting forever when the server could not be stopped.
  • FixedFixed stopping a TCP server, and every server built on it, possibly waiting forever.
  • FixedFixed the HTTP.sys WebSocket server freezing on WriteData with a connection Guid, or when a client disconnected during Broadcast or WriteData, a regression of 2026.9.0.
  • FixedFixed the HTTP.sys server reporting Active as True after a failed start, never releasing its URL reservations when stopped (error 183 on the next start), and failing to start with OAuth2 when the URLs are set only through Bindings.
  • FixedFixed several crashes, memory leaks and memory corruption in the HTTP.sys server, mainly with Asynchronous enabled, in HighPerf mode and in 64-bit applications.
  • FixedFixed possible deadlocks in the WebSocket, HTTP, HTTP/2, TCP, UDP and protocol components, with NotifyEvents neAsynchronous or neSynchronous, when an event handler used the component while other connections were reporting events or disconnecting.
  • FixedFixed possible crashes when queued events were delivered for a component or connection that had already been freed, with NotifyEvents neAsynchronous or SGC_EVENT_DISPATCH enabled.
  • FixedFixed QueueMessages never delivering fragmented messages, delivering a message twice when its handler raised an exception, and delivering messages for connections already freed.
  • FixedFixed a small memory leak in the WebSocket and HTTP servers when several clients connected at the same time to a newly started server.
  • FixedFixed a small memory leak in servers using the IOCP or EPOLL IOHandler when connections were closed while the server was starting.
  • FixedFixed possible memory corruption and crashes when a WebSocket or HTTP server was stopped while clients were sending data, and on Linux with the EPOLL IOHandler the stop could never return.
  • FixedFixed servers using the EPOLL IOHandler on Linux leaving file descriptors open every time they were stopped, so a server restarted many times could run out of them.
  • FixedFixed a small memory leak and an open socket handle in servers using the IOCP IOHandler when stopped while new connections were being accepted.
  • FixedFixed a broadcast that excluded a connection reaching nobody at all.
  • FixedFixed a WebSocket client with Authentication.Token.JWT never connecting, it failed with the message that a host is required.
  • FixedFixed a connection accepted by a Linux server using the EPOLL IOHandler being left unserved now and then, so the client waited until its own timeout and the server reported nothing. The IO threads could end up watching the same event queue and leaving another queue with no thread on it, and every connection handed to that queue was never read.
  • FixedFixed an access violation when a WebSocket client is destroyed while it is still connected, for example when the application is closed without disconnecting first. The read thread could still be reading through the TLS handler, which was freed before the thread had stopped. It happened with every NotifyEvents mode, most often with the native TLS 1.3 handler.
  • FixedFixed a race when a server connection is closed with Close from a thread other than its own, for example from a timer or another connection. The connection thread went on reading the socket and closed it while the Close frame was being sent and the peer answer was being read, which raised an access violation that was hidden.
  • FixedFixed memory leaks in the MCP server (one connection per session), in WriteData when the stream could not be read, and in queued messages and pending notifications when a component is destroyed.
  • FixedFixed the mask file not being uploaded when editing an image with OpenAI. It was sent as normal text instead of as a file, so edits using a mask never worked.
  • FixedFixed a crash in the AI Chat component when Gemini answered with an image instead of text.
  • FixedFixed several AI components reading a field from the answer and getting the whole JSON block instead of the value. It affected the function call name in Gemini, the container details in Anthropic, and the message role and the message text in DeepSeek and Ollama.
  • FixedFixed the AI Chat component dropping the maximum tokens setting when a temperature was set too with Gemini, so only the temperature was sent.
  • FixedFixed OpenAI image requests failing with a 'Missing required parameter' error when the prompt, or any other text, contained a double quote. The text is now escaped correctly.
  • FixedFixed the text of OpenAI image and audio requests travelling with the spaces replaced by %20, so the AI received a distorted prompt.
  • FixedFixed the requests sent to the AI providers being invalid when the text held a double quote, a backslash or a line break, so the provider answered with an error. It affected the chat messages, the prompts, the instructions and the system messages of OpenAI, Anthropic, Gemini, DeepSeek, Grok, Mistral and Ollama, and also the AI Chat component.
  • FixedFixed the system message getting lost when it was sent together with the user message to Ollama, only the user message travelled.
  • FixedFixed a crash in the AI Chat component while receiving a streamed answer from Gemini, when the answer started with an image instead of text.
  • FixedFixed the BaseUrl of the AI Chat options being ignored by every provider except Ollama, so the requests could not be sent through a proxy or a local gateway.
  • FixedFixed the MCP client not answering roots, sampling and elicitation requests from a 2025-11-25 server, and the MCP server not processing those answers. The client now also declares these capabilities when the handler is assigned, and answers Method not found when it is not.
  • FixedFixed the MCP client 2025-11-25 notification stream over HTTP not raising any event.
  • FixedFixed the MCP server over stdio not answering a request for an unknown method.
  • FixedFixed an MCP server engine assigned to the MCPServer property losing its events, so for example subscriptions answered with an empty response.
  • FixedFixed the built-in MCP authorization server consent page failing, the PKCE check needing the OpenSSL libraries on Delphi 7, and the metadata advertising https on a plain HTTP local server.
  • FixedFixed the MCP client raising an unclear error when the server answers an HTTP error without a JSON body, for example a plain 401.
  • FixedFixed the form of the CRUD component saving nothing. It was written without the fields that say which component and which record it belongs to, and without the mark that sends it to the server, so pressing Save reloaded the page and wrote nothing.
  • FixedFixed component properties whose value was written to the page without encoding, so a value holding HTML or a script could change the page. It affected element identifiers, CSS classes and values, links, titles, placeholders and several collection items.
  • FixedFixed the heading of a section of a designed page being written to the page without encoding.
  • FixedFixed sgcHTML pages opening two WebSocket connections, so every update pushed by the server was applied twice.
  • FixedFixed an error when copying the columns of a grid or the layout of a pivot.
  • FixedFixed multi line text losing its line breaks when a page sent it to the server.
  • FixedFixed a grid losing the settings of its columns, for example the width or the title, every time it was loaded again from a dataset.
  • FixedFixed a multi line edit writing its content twice, once as an attribute and once as the text.
  • FixedFixed the pivot writing numbers with the decimal separator of the computer, so the same page looked different on another machine.
  • FixedFixed the demo server that hosts the online demos closing the connection when a page sent a message without a type.
  • FixedFixed the sgcHTML CameraScanner camera image covering its own buttons when the scanner is shown inside a Modal or another component.
  • FixedFixed ML-KEM reading past the end of a ciphertext that was too short, and both encapsulation and decapsulation now run the input checks the standard requires.
  • FixedFixed the SChannel IO handler leaving a copy of the private key in the Windows key store for every connection using a PFX file, and not sending the client certificate on Windows 11 and Windows Server 2022.
  • FixedFixed concurrent SChannel connections using a certificate from the Windows certificate store failing the handshake or crashing.
  • FixedFixed 64-bit SChannel applications negotiating TLS 1.2 instead of TLS 1.3 on Windows 11 and Windows Server 2022.
  • FixedFixed TLS servers using the IOCP or EPOLL IOHandler hanging every connection when a custom SSL handler was assigned in OnSSLGetHandler, and ignoring the TCPKeepAlive settings.
  • FixedFixed the BIO_ADDRINFO record of the OpenSSL headers using the field order of Linux on Windows.
  • FixedFixed an access violation on TLS servers using the IOCP or EPOLL IOHandler when the server writes to a client that has just disconnected abruptly. The failed write closed the connection and freed its TLS session while that session was still encrypting the message.
  • FixedFixed SChannel (sgcSSL_WinSSPI) assertion failure on Win64 when compiling the sources with a Record field alignment different from 8.
  • FixedFixed JWT signing and validation with RSA and ECDSA keys, and memory corruption in 32-bit applications, when OpenSSL is linked statically with sgcIdSSLOpenSSL_Static.
  • FixedFixed the OAuth2 server rejecting DPoP proofs signed with RSA keys on Delphi 2009 and newer.
  • FixedFixed JWT tokens being signed with a signature that was plain Base64 instead of base64url, and the header being read without decoding it, so tokens holding certain characters were rejected by other libraries and by this one.
  • FixedFixed non-ASCII claims written by other JWT libraries being read one character per byte, so a name holding an accent came back as two wrong characters. Claims written as escapes are now read as well, including the alg header itself.
  • FixedFixed the custom claims of a JWT header or payload getting lost when the options were copied.
  • FixedFixed RS256, RS384 and RS512 JWT verification always failing on Delphi 7.
  • FixedFixed the metadata list of WebAuthn being read with plain Base64 instead of base64url, so the FIDO metadata could not be loaded.
  • FixedFixed the HTTP.sys server, and TsgcHTTPServer over HTTP/2, not answering requests for a missing file, so the client waited until its timeout. They now respond with 404 or 500.
  • FixedFixed the HTTP/2 client resending already answered requests after a reconnection, and reconnecting in an endless loop when a pending request could not be sent.
  • FixedFixed the HTTP/2 async requests and the MQTT QoS 1 and QoS 2 publish raising an exception when the stream was not at position 0.
  • FixedFixed server sent events on the HTTP.sys server, which never worked because the response headers were sent as content, and on Linux the header lines ended with the wrong character.
  • FixedFixed an HTTP POST request with the header Accept: text/event-stream being answered as a server sent events connection instead of reaching the server.
  • FixedFixed HTTP header values not being read when there is no space after the colon.
  • FixedFixed request bodies with accented or other non ASCII characters arriving as question marks on Delphi 7 to Delphi 2007.
  • FixedFixed the CloudFront signed URLs of TsgcHTTP_Amazon_AWS_SignedURL, whose signature was not URL safe encoded as Amazon requires.
  • FixedFixed \uXXXX escapes in JSON being decoded to the wrong character on Delphi 7.
  • FixedFixed DecodeBase64URLAsString returning garbage on Delphi 7.
  • FixedFixed a crash on Delphi 2009 when a stream was created from a byte array, the text encoding was left empty.
  • FixedFixed the QUIC OpenSSL imports, the QUIC TLS callbacks and the Opus codec declaring 8 byte parameters on Delphi 7, where they must be 4.
  • FixedFixed the sgcWebSockets packages failing to compile in sgcQUIC_TLS.pas (undeclared TsgcTLS13Context and GQUICNativeTickets) when the native crypto engine is enabled but QUIC is not, for example with the standard Indy library or an edition without the QUIC pack.
  • FixedThe package project files now list every unit of the library, several were missing.
  • FixedTsgcWebView2: fixed ZoomFactor being lost when set at design time or before the browser finished initializing.
  • FixedFixed WebRTC connections that sometimes failed to start (about 1 in 10) because the session id in the offer was too large, so browsers rejected it.

sgcWebSockets 2026.9.0

  • 2026.9.0: 2026 September
  • NewNew sgcWebRTC package: a native WebRTC media engine for Delphi and C++ Builder, TsgcRTCPeerConnection, with audio and video calls, screen sharing and SCTP data channels. It runs as pure code, with no browser or WebView control, on Windows, Linux, macOS, iOS and Android.
  • NewNew sgcCrypto package: AES and ChaCha20/XChaCha20-Poly1305 AEAD, SHA-2/SHA-3, Argon2, scrypt, HKDF, Ed25519, Ed448, X25519, X448, secp256k1, RSA key generation, X.509 certificate and CSR generation, and the post-quantum ML-KEM, ML-DSA and SLH-DSA algorithms.
  • NewNew sgcHTML components: CameraScanner, a live camera panel that reads barcodes and QR codes with the browser's own built in scanner and always offers a manual entry fallback, NumPad, CommandPalette and EmptyState.
  • NewNew sgcHTML demos, five complete applications with sign in, a database and printable reports, under Demos\60.HTML\01.RunTime: warehouse management (13.Warehouse), point of sale (14.POS), reporting portal (15.Reports), multi tenant SaaS control plane (16.SaaS) and field service dispatch (17.FieldService).
  • NewNew "Runtime vs Design-Time" help topic and demos, showing how to build sgcHTML pages by dropping the same components on a VCL form instead of composing them in code.
  • NewNew ExportFolder property on the sgcHTML design host, where the designed page is written when the export route runs. It is empty by default, and while it is empty an export writes nothing.
  • NewNew PartialRequestTimeout option on the EPOLL and IOCP IOHandlerOptions, off by default. An HTTP request body that does not all arrive within a single readiness event or completion, for example a large POST split across packets, used to be dropped with the connection closed and no reply. The server now waits for the rest of it, on a separate thread pool so a slow client cannot hold up the others.
  • NewNew ForwardedHeaders property on TsgcWebSocketFirewall, off by default, which recovers the real client address when the server sits behind a reverse proxy. The address carried in X-Forwarded-For or X-Real-IP is only believed when the connection itself arrives from an address listed in TrustedProxies, so a client cannot invent one, and the chain is read from the right, past the number of proxies given in TrustedHops, because the leftmost entry is the one the client supplied. Once resolved it replaces the connection IP, so the blacklist, the whitelist, GeoIP, the custom rules, the events and your own handler code all see the end client instead of the proxy, and the original socket address stays available as PeerIP. Resolution runs on every request, because a proxy reuses one connection for requests from different clients. RateLimit.MaxConnectionsPerIP still counts the sockets opened by the proxy, since it measures connections rather than callers. The settings behave the same way on the http.sys server as on the Indy one.
  • NewNew Kraken WebSocket v2 API component, TsgcWSAPI_Kraken_V2, alongside the existing v1 one. It implements the method/params/req_id protocol across the six public channels, the executions and balances private channels, and the add, amend, edit, cancel, cancel all, cancel all after, batch add and batch cancel verbs, with its own events. The v1 component is unchanged.
  • NewThe Huobi WebSocket API component now opens a second connection internally when an ApiKey is configured, so one component instance serves public market data and private account data at the same time. The public API is unchanged.
  • NewNew UseServerTimeOffset option on the Binance REST and WebSocket clients, off by default. REST_API.SyncServerTime measures the difference between the exchange clock and the local one and applies it to every signed request from then on, so a client whose clock has drifted no longer has its private requests rejected.
  • NewNew Throttle.PaceBatch option on the WebSocket API clients, True by default. A subscription which carries more streams than fit in one frame is split into several, and that burst is now paced like any other, so a single call with hundreds of streams no longer trips the message rate limit of the exchange.
  • NewNew Throttle.AsyncResubscribe option on the WebSocket API clients, True by default. The paced replay after a reconnect now runs on a background worker, so the connect notification returns straight away instead of waiting for the whole watchlist to be sent.
  • NewThe Deribit WebSocket client now reads expires_in and refresh_token from the authentication reply and refreshes the authorisation before it expires, so a long lived session no longer loses it silently.
  • NewNew AllowUnsignedWebhooks option on the Cryptohopper client, False by default. The webhook signature is now always verified, and this option is the explicit way to accept an unsigned payload when no ClientSecret is configured.
  • NewNew overloads of NewMarketOrder and NewLimitOrder on the Cex Plus WebSocket client which take the amount of the order.
  • NewImproved OpenAPI Server: the request validation now also checks the header and the cookie parameters, with the new ValidateHeaderParams, ValidateCookieParams and EnforceRequired options, and the schema keywords the validator does not implement are reported when the specification is loaded, through the new Validation.Warnings property.
  • NewImproved OpenAPI Client: added support for cookie parameters and for the complete OpenAPI parameter serialization rules, matrix, label, simple, form, spaceDelimited, pipeDelimited and deepObject, with explode and allowReserved. New AddArray and AddObject methods.
  • NewImproved JWT Server: new Validations.Leeway option, the clock skew allowed when the exp, nbf and iat claims are checked. It defaults to 60 seconds.
  • NewThe QUIC and HTTP/3 client and server now support IPv6. An address that carries a colon, such as ::1, is treated as an IPv6 address, and a URL can carry it in brackets, https://[::1]:443/. A host name is now resolved over both families, where before only IPv4 was tried, so a name published with AAAA records only can now be reached. The HTTP/3 listener with no Host set serves both families through a single socket.
  • NewNew Host property on HTTP3Options, the address the HTTP/3 listener binds. It is empty by default, which binds every interface, and it takes an IPv4 address, an IPv6 address or a host name. Use it when the HTTP/3 listener has to stay on one interface, because that listener owns a single socket and does not read Bindings.
  • NewNew OnQueueDrained event on the WebSocket client, server and HTTP server, raised when the outgoing queue of a connection goes from holding messages to being empty. It is raised on the connection thread, right after the queue is drained and before the next read, so a relay can hand out the next credit without waiting. Because it is not marshalled through NotifyEvents, the handler must not touch the user interface.
  • NewNew PendingCount property on TsgcWSConnection, the number of messages still queued for that connection, summed across the three priority levels. It returns 0 when nothing is queued and reading it allocates nothing, so it can be polled to run a credit window instead of a stop and wait exchange.
  • NewNew exports on the library, sgcWSClient_Connection_PendingCount, sgcWSServer_Connection_PendingCount, sgcWSClient_OnQueueDrained and sgcWSServer_OnQueueDrained, which carry the new PendingCount property and OnQueueDrained event across to the .NET wrapper and to any other host that consumes sgcWebSockets.dll. They are appended, so the existing export order is unchanged.
  • NewNew Revocation options on the SChannel settings of the servers, SSLOptions.SChannel_Options.Revocation, so a server that asks its clients for a certificate can also check whether that certificate has been revoked. The client side already had them. Check selects how much of the client chain is looked up (off by default), Timeout bounds the whole CRL and OCSP lookup so an unreachable responder cannot hold up the handshake (5 seconds by default), CacheOnly uses only what Windows has already cached and never goes to the network (off by default), and IgnoreRevocationOffline and IgnoreNoRevocationCheck decide whether a client is still let in when the responder cannot be reached or when its certificate publishes no revocation information (both on by default). A certificate confirmed revoked is always refused. Setting Preset to tlspSecureDefaults now turns the check on for the server too, as it already did for the client.
  • FixedFixed access violations on the WebSocket server when Server.WriteData or Broadcast, including a Broadcast to a channel, used a connection while it was being freed on another thread.
  • FixedFixed access violations when a WebSocket component or one of its API components was freed while still connected, or while the WatchDog, HeartBeat, reconnect replay or Throttle threads were running. Those threads are now stopped, and the API detached from its client, before any destructor releases what they read. Two heartbeat timer threads also leaked for every component destroyed.
  • FixedFixed HTTP requests bigger than about 1 MB being dropped with no reply at all when the client did not send an Expect: 100-continue header. The request body was pulled into the header buffer, which then passed its size limit and the connection was closed.
  • FixedFixed server connections never being released on the EPOLL engine once the client closed, on both plain and SSL connections. The connection stayed in the server list, OnDisconnect never fired and every Broadcast kept writing to it.
  • FixedFixed the EPOLL engine closing a connection whenever a single socket read filled the receive buffer, so any HTTP request or WebSocket message larger than about 32 KB lost its data and was dropped with no reply. The socket is now drained into a buffer that grows as it needs to.
  • FixedFixed the EPOLL and IOCP engines dropping any request that did not arrive in a single socket read, and closing SSL connections when a TLS record arrived split across two TCP segments. Both are what happens at any MTU boundary, over a VPN, or whenever a client flushes the headers and the body separately. The engines now wait for the rest instead of giving up.
  • FixedFixed SSL responses being silently truncated on the EPOLL and IOCP engines when the client was slow to read, because the count of bytes the send call actually took was ignored. Two error checks on that path also used the numeric Windows socket error values, so on Linux neither a full send buffer nor a connection reset by the peer was recognised.
  • FixedFixed an access violation on the EPOLL and IOCP engines when a connection's HeartBeat timeout was detected while a WorkOpThreads worker was still handling that connection.
  • FixedFixed the sgc protocol server keeping a QoS level 2 message after the connection which published it had gone, so any other client could release it by naming its id and replay the publish under the original client's identity. Pending level 2 messages are now discarded when that connection closes. The QoS retry timer on the server and the client also walked the pending list with no lock while connection threads changed it.
  • FixedFixed the Presence server registering a member under the id sent by the client instead of the session id, so an entry under any other id was never removed when the connection closed and the next broadcast wrote through the freed connection. It also destroyed a roster owned member when the application refused a join through OnBeforeNewChannelMember, leaving a dangling pointer.
  • FixedFixed the Kafka decoder bounds check being defeated by an integer overflow, so a length near 2 GB passed the guard and the read went outside the frame buffer, and Skip was unchecked and could drive the offset negative. The arithmetic is now done in Int64, a negative offset is rejected and Skip is bounds checked.
  • FixedFixed the AMQP 1.0 decoder casting a wire selected class to a described list without checking it. Six descriptor codes, among them data, amqp-value and application-properties, resolve to sibling classes rather than descendants, so a virtual method was dispatched through a slot the real class does not have. An unregistered descriptor also called Create on a nil class reference.
  • FixedFixed the HTTP/2 path serving DocumentRoot files and forwarding requests before the Basic authentication gate had run, so a request carrying no credentials at all was answered with the protected file while the same request over HTTP/1.1 was correctly refused.
  • FixedFixed the OnBeforeCommand event not being taken into account on HTTP/2 and HTTP/3 requests, so an endpoint you had marked as public there, a login page for example, was still refused with the browser asking for a user and a password, while the very same endpoint over HTTP/1.1 was served correctly.
  • FixedFixed the options of the OnBeforeCommand event behaving differently on HTTP/2, where authorizing one authentication scheme also skipped the checks of the others. They now behave the same on every connection.
  • FixedFixed HTTP/3 requests following their own separate path instead of the one HTTP/1.1 requests follow, so the OpenAPI, MCP and REST API servers, the request forwarding, and the CORS, multi tenancy and metrics options never answered over HTTP/3. They all work over it now. The connection parameter of OnBeforeCommand, OnCommandGet and OnCommandOther is empty on HTTP/3, because an HTTP/3 request has no connection behind it.
  • FixedFixed the DLL server holding every callback result, including the authentication verdict, in a single unlocked field shared by all connections, so with two connections authenticating at the same time one verdict was read back by the other and wrong credentials were admitted. Credentials, approved upload filenames and forward settings crossed the same way. The HTTP API server and the Files protocol in the DLL are fixed too.
  • FixedFixed NewGuid being built from CreateGuid, which on Linux, macOS and iOS is a version 1 UUID made of the network card address and a timestamp, so only the low bits of the clock varied. It backs bearer tokens, OAuth client secrets, session ids and the watchdog secret, and those were predictable to anyone who had seen a single one of them. It now draws from the platform secure random source.
  • FixedFixed the sgcHTML designer listener binding every interface instead of loopback, so the whole network could reach the unauthenticated designer routes on a developer machine, and its export route writing files into any directory named in the query string. It now binds 127.0.0.1 only and exports to the new ExportFolder property.
  • FixedFixed the InputGroup component writing its type, name, value and placeholder attributes without escaping them, so a value containing a quote or an angle bracket could break out of the attribute and inject markup.
  • FixedFixed the OpenAI Realtime client sending the configured Azure API key to api.openai.com. With the Azure provider selected the default conversation method returned the OpenAI endpoint, so the key went to the wrong vendor and the Azure session could never be established. Assigning the options also dropped the provider and the Azure settings.
  • FixedFixed the JSON parser mishandling an array beginning with a line break, a value re-added with a different type, a string that looked like an array, and number formatting depending on the system locale. A floating point value that is not a real number was written out as NAN or INF, which no JSON parser can read, and is now written as null.
  • FixedFixed credential headers surviving a redirect to another host and an HTTPS to HTTP downgrade in the ready made API clients. The protections existed but were left off, enforced nothing on the Standard and Professional editions, and the cross origin strip cleared only the raw headers. They are now on by default.
  • FixedFixed the HTTP client repeating a request that should not be repeated. With retries switched on, a POST that the server had already carried out, and then dropped the connection on, was sent a second time, which could place a second order. Only GET, HEAD and OPTIONS are retried now, and a new Methods property in the retry options lets you allow others.
  • FixedFixed retries not counting towards the request limit, so a single call could send more requests than the limit allows, one more for every retry. A retry now takes a slot just like the first attempt, and when the limit is set to reject it is turned down instead of going out.
  • FixedFixed the response size limit (MaxResponseSize) measuring the compressed size of a reply instead of its size once unpacked, so a small compressed body that expanded into a very large one was accepted. This only affected builds using the Indy that comes with the IDE, the eSeGeCe Indy already checked it.
  • FixedFixed Abort leaving most requests running. Only three of the eight ways a request is sent registered themselves, so Abort did nothing for the other five, and with more than one request in flight it could only reach the last one that started. It now stops every request that is running.
  • FixedFixed private subscriptions (orders, balances, fills) never being replayed after a reconnect on Bitstamp, Coinbase, Deribit, Huobi, Kraken spot and futures, Kucoin, MEXC and ThreeCommas, so the reconnect looked successful while those feeds were silently gone.
  • FixedFixed the reconnect replay running before authentication on BitMEX, Bitfinex, Crypto.com, Deribit and Kraken futures, so subscriptions were issued on a session the exchange had not yet authenticated.
  • FixedFixed money being rounded before it was signed across the exchange REST and WebSocket clients, which could turn a very small size such as 0.000000004 into zero, quantise a value to ten decimals, send prices in scientific notation or cap them at fifteen significant digits. Every client now shares one formatter, which emits the shortest decimal that reads back as the very same value. The formatter has also been corrected at its edges: a very small amount was returned as 0, a very large one lost its decimals, and both ends could still come out in scientific notation. An amount that is not a real number, such as the result of a division by zero in the application, was sent as the text NAN, and is now reported as an error before anything is signed.
  • FixedFixed HTX and Huobi building their signature timestamp from the local date and the UTC time, so on a host outside UTC every private request could fail for part of the day.
  • FixedFixed every private request on the Kraken futures REST client (send, edit, cancel order, transfer, withdrawal) being sent as a GET with the body discarded, so none of them worked, and TsgcHTTPKrakenFutures_Options.Assign calling itself and raising a stack overflow.
  • FixedFixed the Kraken spot WebSocket client connecting to the v2 endpoint while speaking the v1 protocol, so no subscription or status event ever fired. It now connects to v1 by default.
  • FixedFixed the Binance WebSocket client re-subscribing an already unsubscribed kline, mark price, index price or all market mark price stream on every reconnect, and not splitting a large subscribe or unsubscribe call into batches, so a call over the exchange's stream count or frame size limit could be rejected while the client still believed it had succeeded.
  • FixedFixed OKX trading operation failures, such as a rejected order, never reaching OnOKXError.
  • FixedFixed every MEXC protobuf decoder raising an error on the first binary frame, so the protobuf market data path could not deliver a single message.
  • FixedFixed the Cryptohopper webhook accepting any payload as authentic when no ClientSecret was configured, which is the default, and its signature check failing on a host whose code page is not UTF-8.
  • FixedFixed a range of further signing, timestamp and request defects across Binance, Bitfinex, Bitstamp, Bitget, BitMEX, Coinbase, Cryptorobotics, Deribit, GateIO, Huobi, Kucoin, MEXC and OKX, among them BitMEX AmendOrder sent with no authentication headers at all, five Binance REST methods that could not work, and six Kucoin request construction defects.
  • FixedFixed JWT Server: the exp, nbf and iat claims were never validated, only the signature was, so a correctly signed token whose expiration had passed was accepted indefinitely and the Validations.Expiration option had no effect. Setting it to False still disables the check.
  • FixedFixed OpenAPI Server: a request body whose media type was not declared in the specification was validated as JSON anyway and one with no Content-Type at all was assumed to be JSON, both now answer 415, and a property declared readOnly is no longer accepted in a request body.
  • FixedFixed OpenAPI Server: a deeply nested JSON body could exhaust the stack of the connection thread and crash the server, because the check that runs before the parser had no depth limit.
  • FixedFixed OpenAPI Server: a regular expression that could not be compiled was ignored and the value treated as valid, and it was rebuilt on every request. Expressions are now cached, a value longer than 4096 characters is reported instead of being matched, and an invalid expression is reported as an error in the specification. On Delphi 7 to 2010 the pattern keyword cannot be enforced at all, which is now reported when the specification is loaded.
  • FixedFixed OpenAPI Client: the generated clients did not verify the certificate of the server while sending tokens and api keys, a value passed to a header parameter was written unchecked so a carriage return or line feed could add headers of its own, and an encoded slash in a path parameter was turned back into a real one, so a value such as ../../admin was sent as a path traversal.
  • FixedFixed OpenAPI Client: a multipart/form-data request was sent without the boundary in the header and carried only its first part, a PATCH carried no body at all, and a generated method for an OPTIONS, HEAD or TRACE operation sent nothing and returned an empty string with no error.
  • FixedFixed OpenAPI Client: an optional parameter could not send limit=0, an empty string or a boolean set to False, an optional floating point parameter was always sent as 0, a base URL that already contained a query string produced a second question mark, and the OAuth2 token was refreshed while still valid and never once it had expired.
  • FixedFixed OpenAPI Client: a response released a stream supplied by the caller, the routine that releases the objects of a class destroyed any object typed property and could free the same object twice, and an array of strings was written by reading object pointers as strings.
  • FixedFixed the HTTP/3 server refusing to start when the private key was protected by a password, reported as "HTTP/3 Server: encrypted private keys are not supported". The HTTP/3 listener now reads SSLOptions.Password just like the HTTPS one, so a single key file serves both. An encrypted key with no password set used to leave the server waiting forever on a prompt nobody could see, and now fails with a clear message instead.
  • FixedFixed ConnectTimeout being ignored on the QUIC and HTTP/3 clients. An unreachable server always took about 30 seconds whatever the property said, because the handshake was left to the SSL library and to its own budget. The configured value is now honoured, and it is 10 seconds by default.
  • FixedFixed the QUIC client never returning from WriteData and from Disconnect. Every write waited for an answer the peer was under no obligation to send, and the disconnect went through that same wait, so a program that connected and then closed never came back. A second write from another thread queued behind the first. Disconnect also reported failure even when it had worked.
  • FixedFixed the HTTP/3 client accepting any certificate while VerifyCertificate was True. The result of the check was worked out correctly and then discarded, so a certificate from an authority that is not trusted, or one issued to another host, was let through. The QUIC client was not affected.
  • FixedFixed the WebSocket client never raising OnDisconnect when the server closed one connection with Connection.Disconnect over TLS. The TLS handler is already closed by then, and the layer underneath only raises its disconnect notifications while it is still open, so nothing was reported and the read thread had already been stopped. The client was left reporting Active, holding a connection that no longer existed, and a later shutdown of the whole server could not recover it. The WatchDog never reconnected either, because it starts from that notification.
  • FixedFixed the connection teardown being skipped whenever the connection was already flagged as disconnected. Any code that correctly reported the peer as gone, including a write that failed with socket error 10052 to 10054, thereby cancelled the cleanup that closes the socket and raises OnDisconnect.
  • FixedFixed writes continuing to be attempted on a connection that had already been torn down, which reported one error per write for as long as the application kept writing.
  • FixedFixed OnError and OnException skipping the connection teardown when the application event handler raised an exception of its own.
  • FixedFixed TsgcWebSocketServer_HTTPAPI silently discarding queued messages. The component accepted a QueueOptions level and copied it to every connection, but nothing on the http.sys engine ever drained the queue, so a message written to a connection was never sent and no error was reported. The engine is driven by IOCP completions and has no per connection loop to drain from, the same reason iohIOCP and iohEPOLL cannot. The queue is now switched off as the server starts, the three levels are reset to qmNone and the OnError event reports it, so messages are written inline instead of being lost. A level assigned after the server is already listening is reset the same way on every new connection.
  • FixedFixed the MQTT client sending a publish without its properties, or with the properties of another message, when two or more threads published at the same time. The subscriber saw ResponseTopic and CorrelationData arrive empty, or belonging to a different message. Subscribe and UnSubscribe had the same problem with their own properties. A lock of your own around Publish is no longer needed.
  • BreakingRemoved support for the AppRTC protocol and the RTCMultiConnection API. The TsgcWSPServer_AppRTC and TsgcWSAPIServer_RTCMultiConnection components, their units and their demos have been deleted. Use TsgcRTCPeerConnection or the WebRTC protocol server instead.
  • BreakingRemoved support for the Flash fallback, which reached end of life in 2020. The FallBack.Flash options and published property, the Flash policy handler, the trpFlash transport and the WebSocketMain.swf and sgcWebSocketsFlash.js resources have all been deleted. Remove the FallBack.Flash lines from any .dfm that carries them, otherwise the form raises a property does not exist error, and the ordinal of every TwsTransport member after trpFlash has shifted by one.
  • BreakingWorkOpThreads on the EPOLL and IOCP IOHandler options no longer keeps a connection on the same thread, because a connection waiting for the rest of a request held up every other connection on that thread. Anything kept per thread, such as a database connection or a thread local cache, can no longer be assumed to follow a connection. WorkOpThreads now sets the smallest number of workers kept ready and the pool grows from there. The WorkOpRoundRobin property is gone, remove it from your code and from any .dfm that carries it.
  • BreakingTLSOptions.VerifyCertificate now binds the certificate to the host being connected to on the OpenSSL backend, as it already did on SChannel and Apple, so a chain valid certificate issued for a different host is rejected. A deployment which connected to a name its certificate does not carry will start failing. Connecting to a bare IP address still binds nothing, set OpenSSL_Options.X509Checks.Mode to include oslx509chIPAddress for that case.
  • BreakingThe HTTP/3 listener now refuses a request it cannot authenticate instead of serving it. A server configured with OAuth2, JWT or WebAuthn answers 401 on HTTP/3, because those schemes need TCP connection state an HTTP/3 request does not have. Basic authentication is unaffected and is still enforced.
  • BreakingWriteTimeout on the client components now defaults to 60 seconds instead of no limit at all, and it is applied on Linux, macOS, iOS and Android as well, where before it only ever took effect on Windows. A form saved before this change streams in a zero, which is read as unset and also gets the 60 second default. Set the property to a negative value to never time out.
  • BreakingOn the Standard and Professional editions, setting MaxChunkSize, UseExpect100Continue or UseChunkedTransferEncoding to a non-default value now raises an exception. These three cannot be implemented on the Indy that ships with Delphi, and until now they did nothing without saying so. At their default values they still do nothing.
  • BreakingStripAuthOnCrossHostRedirect and NoInsecureRedirect now default to True on the ready made API clients.
  • BreakingThe Cryptohopper webhook now rejects a payload when no ClientSecret is configured. Set AllowUnsignedWebhooks to True for the previous behaviour.
  • BreakingThe Kraken spot WebSocket client now connects to v1 by default instead of v2. See the corresponding fix above.
  • BreakingThe MEXC futures PlaceOrder and SetPositionLeverage methods changed their parameters to match the contract API which MEXC publishes, so code which calls them needs updating. PlaceOrder takes openType where it took positionSide, and SetPositionLeverage takes positionId, openType and positionType where it took marginMode. The TestNet property is gone as well, MEXC has retired its futures testnet, the spot TestNet is unaffected.
  • BreakingBinance PlaceLimitMakerOrder now takes a price, which is required because the order is rejected without it, and the fromId, orderListId and fromAllocationId parameters are now Int64 instead of Integer.
  • BreakingType changes on the exchange clients: the Kucoin VisibleSize property and the Kraken WebSocket order price and volume properties are now strings, and the Cex order amount and price parameters are now Double.
  • BreakingOpenAPI Client: the generated clients now verify the certificate of the server, set TLSOptions.VerifyCertificate to False for a self signed endpoint. The request body is now UTF-8 and an empty string serializes as "field": "", set JSONIgnoreEmptyStrings to True for the previous output. A response no longer frees a ResponseStream supplied by the caller, set OwnsResponseStream to True, and freeing the client from inside its own OnResponse, OnError or OnCancel handler now raises instead of hanging.
  • BreakingOpenAPI Server: the request validation now also checks the header and the cookie parameters, so a specification declaring a required header that used to pass will now answer 400, and an undeclared media type now answers 415. TsgcOpenAPIValidation_Options has new published properties, so a form saved with this version will not load in an older one, and TsgcOpenAPIJSONValidator.Validate takes two more parameters.
  • BreakingThe HTTP/3 client now really verifies the server certificate. TLSOptions.VerifyCertificate is True by default on TsgcHTTP3Client, but the result of the check was worked out and then thrown away, so every HTTP/3 client accepted any certificate, from any authority and issued to any host. The check is applied now. An HTTP/3 client that talks to a server with a self signed certificate, with a private authority that is not in the machine store, or with a certificate that does not name the host, stops connecting until the trust store or the certificate is put right. On TsgcQUICClient verification stays off by default, so nothing changes there unless you turn it on.
  • BreakingVerifyCertificate on the QUIC and HTTP/3 clients now also binds the certificate to the host being connected to, as it already did on the TLS transports, so a certificate that is chain valid but issued for another name is rejected. A bare IP address is matched against the IP entries of the certificate, which most certificates do not carry.
  • BreakingRemoved IdleTimeout from the QUIC server options. No part of the server ever read it, so it never did anything. Remove it from any .dfm that carries it, otherwise the form raises a property does not exist error.
  • BreakingDTLSOptions.VerifyCertificate now enforces the result of the certificate check. Until now the result was worked out and then thrown away, so with verification switched on a certificate from any authority, or one issued to another host, was accepted. Verification is off by default, and WebRTC is unaffected because it authenticates the other end by the fingerprint carried in the SDP.
  • BreakingDTLSOptions.RootCertFile is now the trust store used to verify the other end, which is what the same property already means on the TLS and QUIC transports. Before, it was loaded as this endpoint's own certificate. Put your own certificate in CertFile, which now reads a file holding the certificate together with its intermediates. A configuration that named a certificate in RootCertFile and a key in KeyFile while leaving CertFile empty is reported as an error when the component starts, so it cannot silently fall back to a generated certificate.
  • BreakingWith retries switched on, only GET, HEAD and OPTIONS are retried by default. If you were relying on a POST being retried, add it to RetryOptions.Methods. The ready made AI clients set this themselves, so their requests keep retrying as before.
  • BreakingA request stopped with Abort now raises EsgcHTTPAbort instead of an ordinary connection error, so you can tell your own abort apart from a connection that failed on its own.

sgcWebSockets 2026.8.0

  • 2026.8.0: 2026 August
  • NewThe setup now installs a CycloneDX software bill of materials, sbom.cdx.json, listing the components the library is built from with their versions and licences. Enterprise and All-Access state the versions of the customised Indy and its zlib, Core, Standard and Professional record that Indy is the one supplied with Delphi or C++ Builder.
  • NewUpdated zlib from 1.2.12 to 1.3.1, with the linked objects rebuilt for Delphi 7 to Delphi 13, 32 and 64 bit. 1.3.1 corrects CVE-2022-37434, a heap over-read in inflate.
  • NewNew QUIC client and server components, TsgcQUICClient and TsgcQUICServer. Requires Package sgcQUIC + sgcWebSockets Enterprise.
  • NewNew HTTP/3 client and server components, TsgcHTTP3Client and TsgcHTTP3Server. Requires Package sgcQUIC + sgcWebSockets Enterprise.
  • NewOpenSSL can now be linked inside the executable, so a TLS application no longer deploys the libcrypto and libssl DLLs. Add the sgcIdSSLOpenSSL_Static unit to the uses clause, remove it and the DLLs are loaded again as before. Clients and servers, 32 and 64 bit, Delphi XE2 or newer, OpenSSL 3.5.7.
  • NewNew WebBroker dispatcher component that serves sgcHTML pages from any WebBroker application (standalone, ISAPI...). Plain WebBroker cannot keep a WebSocket open, so host the same web module on the WebBrokerBridge server if you need live push.
  • NewNew sgcHTML input controls: searchable multiple-choice select, two-list transfer picker, time, date-and-time and date-range pickers, single and range sliders, colour picker, progress bar, context menu, badges and chips, and a resizable split panel.
  • NewNew sgcHTML QR code, barcode, signature pad and PDF viewer components, all drawn on the server with no browser library needed.
  • NewNew sgcHTML charts drawn entirely on the server: sparkline, heat map, tree map and candlestick.
  • NewNew sgcHTML pivot table and tree grid. The Grid can now export to Excel, show tree rows, reveal a detail panel under each row, and remember the user's column and sort choices.
  • NewNew sgcHTML real-time components that update over the WebSocket connection with no page refresh: presence list, activity feed, audit trail, job progress monitor and live log viewer. The Notification bell also updates its unread count live.
  • NewNew sgcHTML administration components: user-management table, impersonation banner and roles-and-permissions matrix. They draw the screen only, your own server still decides what each user may do.
  • NewThe sgcHTML Gantt chart can now be filled from a dataset, with bars dragged and resized and dependency lines between tasks. AutoComplete gained a server-driven mode that fetches suggestions as the user types.
  • NewsgcHTML pages now adapt to the screen size. On a phone the side menu folds away behind a menu button and the content uses the full width, on a desktop the page is unchanged. Set the new Responsive property to False for the previous fixed layout.
  • NewA graceful STOMP Disconnect now waits until the broker confirms it with a receipt, so nothing is lost when closing. The new DisconnectTimeout option controls how long to wait (10 seconds by default, 0 returns immediately as before).
  • NewNew STOMP ACKEx and NACKEx methods to pass the subscription id yourself, and a new NegotiatedVersion property telling you which STOMP version the server chose.
  • NewNew MaxRequestSize option on the HTTP/2 server to limit how large a single request body can be (no limit by default).
  • NewThe WebSocket server now limits how many control frames a client may send each second (100 by default), so it cannot be flooded with pings. Set MaxControlFramesPerSecond to 0 to remove the limit.
  • NewThe WebSocket server now accepts up to 10,000 simultaneous connections by default instead of an unlimited number. Change MaxConnections to raise or lower it, or set 0 for no limit.
  • NewNew DatagramsSupported property on a WebTransport session, telling you whether datagrams can really be sent.
  • NewNew SetReceiveTimeout method on the socket binding of a connection, the counterpart of SetSendTimeout, so a connection that goes silent fails cleanly instead of freezing the thread that was reading.
  • NewNew TCPKeepAlive and KeepAliveTimeout options for the IOCP and EPOLL servers (both off by default). They drop connections whose peer has gone away and connections left idle too long, so half-open sockets no longer pile up.
  • NewNew WorkOpRoundRobin option for the IOCP and EPOLL servers (off by default). With WorkOpThreads above zero, new connections could all land on one worker thread while the rest stayed idle, they are now spread evenly.
  • NewMCP server tools can now expose a complete JSON Schema for their input, declaring arrays with items, enums, integer and nullable types, nested objects and additionalProperties, which some MCP clients require and would otherwise reject.
  • NewThe MCP server now exposes more tool and server metadata for the 2025-11-25 protocol: the readOnlyHint annotation and annotation title, tool icons, server title, website and icons, and the tools/list execution.taskSupport declaration with the server tasks capability.
  • NewNew AllowedOrigins list on the MCP server's HTTP Streamable transport. When it holds entries, only pages served from those addresses can call the server from a browser. Wildcards are accepted, for example https://*.example.com. Leave it empty to keep the previous behaviour.
  • NewNew MaxConnections, HandshakeTimeout and IdleTimeout options on the DTLS component (1000 connections, 30 seconds, 10 minutes), so a flood of single packets from made up addresses no longer fills the server's memory. Set any of them to 0 to remove that limit.
  • NewA request that fails with an HTTP error status now reports the headers the server answered with, so Retry-After on an HTTP 429, or the rate limit counters exchanges return, can be read. The ready made API clients now raise EsgcHTTPAPIProtocolException, carrying the full response header list, GetHeader and RetryAfterMs (-1 when absent). It descends from the exception raised before, so existing handlers keep working, and the ResponseHeaders parameter of Post and Query is now filled on failure too.
  • NewNew SubscribeStreams and UnsubscribeStreams methods on the Binance WebSocket API, subscribing several streams with a single frame instead of one frame per stream. Binance closes a connection that sends it more than 5 messages per second, so subscribing a watchlist in a loop was enough to lose it.
  • NewNew Throttle option on the WebSocket API clients, a limiter on the messages the client sends, with MaxMessages (4 by default) and IntervalMs (1000 by default). It is off by default, set Throttle.Enabled to True. The OKX client uses 3, the limit that exchange documents.
  • NewOKX order prices and sizes can now be set as text, with the new PxAsString and SzAsString properties of TsgcWSOKX_Order and string overloads of PlaceLimitOrder, PlaceMarketOrder and AmendOrder. Useful on instruments whose tick or lot size has many decimals.
  • NewNew Binance.FuturesStreamEndpoint property for USD-M Futures, because Binance now serves its market data from two addresses. bfsePublic (the default) delivers the book ticker and depth streams, bfseMarket the aggregate trades, mark price, kline, mini ticker, ticker and liquidation streams. Subscribing to a stream the chosen endpoint does not deliver now raises an error naming the property. Binance also decommissioned the old USD-M addresses, so those connections were moved to the new ones. COIN-M Futures and the Futures TestNet are unchanged.
  • NewNew Revocation option on the SChannel client TLS options, TLSOptions.SChannel_Options.Revocation, checking whether the server certificate has been revoked. Check sets how much of the chain is checked (scrcDisabled by default, scrcEndCertificate, scrcChainExcludeRoot, scrcChain), Timeout bounds CRL and OCSP retrieval so an unreachable responder cannot stall the handshake (5000 ms), and CacheOnly uses only what Windows has cached. IgnoreRevocationOffline and IgnoreNoRevocationCheck are True by default, so turning the check on cannot break a connection that used to work. A revoked certificate is always rejected. TLSOptions.Preset tlspSecureDefaults enables it as scrcChainExcludeRoot.
  • NewNew VersionMin option on the SChannel TLS options, TLSOptions.SChannel_Options.VersionMin, on clients and servers. Version is the highest TLS version to use, and the exact one when no minimum is set, VersionMin the lowest accepted: Version tls1_3 with VersionMin tls1_2 accepts either and refuses anything older. Leaving both undefined, the default, now means the versions Windows enables by default instead of the fixed list used before.
  • NewNew UseStrongCrypto option on the SChannel TLS options, TLSOptions.SChannel_Options.UseStrongCrypto, off by default, asking Windows to disable the weak algorithms, cipher suites and protocol versions that remain enabled for compatibility. TLSOptions.Preset tlspSecureDefaults turns it on and raises VersionMin to tls1_2.
  • NewThe SChannel server can now check the certificate of the clients that connect to it. Set SSLOptions.VerifyCertificate to True and the client certificate goes through the same checks a client applies to a server certificate, the chain, the dates and the OnSChannelVerifyPeer event, without the host name check. SSLOptions.VerifyCertificate_Options.FailIfNoCertificate decides what happens when a client sends none, rejecting the connection when True and letting it in when False (False by default). Until now the server never asked the client for a certificate.
  • FixedFixed the SChannel client accepting a revoked server certificate even with TLSOptions.VerifyCertificate set to True, because the chain was built without asking for any revocation status. Turn the check on with the new Revocation option above. A revoked certificate is now rejected with CRYPT_E_REVOKED and reported to OnSChannelVerifyPeer as ecCryptRevoked, and the outcome is read from the chain itself, so a chain that is both revoked and rooted in an untrusted certificate can no longer be let through by a handler meant only to accept the unknown root.
  • FixedFixed TLSOptions.Version being ignored by the SChannel IO handler. On Windows 11 and Windows Server 2022 it was not read at all, on Windows 10 asking for tls1_3 silently gave TLS 1.2, and leaving it undefined switched SSL 3.0, TLS 1.0 and TLS 1.1 back on. Version is now honoured on both paths, the negotiated version is checked when the handshake completes and the connection fails if it falls outside what was asked for, SSL 3.0 is never requested, and asking for tls1_3 where the platform cannot provide it fails with a message saying why.
  • FixedFixed the SChannel IOHandler losing every TLS setting on the connections Indy opens on the side, an HTTP redirect to another host or an FTP data channel, and on the client IOHandler a SChannel server builds for the connections it opens itself. The clones came back empty, so they ran with VerifyCertificate off and no revocation checking, cipher list, TLS version, version floor or ALPN list, and nothing reported it. They now carry the full configuration. Assigning ALPNProtocols before the property has been read also works, which silently discarded the list until now.
  • FixedFixed the SChannel connections after a TLS renegotiation: a new certificate was accepted with no check of the chain or the host name, and the record sizes of the original cipher were kept, so everything sent and received was laid out with the wrong sizes. The full check now runs again whenever the certificate is not the one already accepted, the connection is dropped when it does not pass, and the sizes are read again on every handshake.
  • FixedFixed the zlib objects not being linked on Delphi 10 Seattle 64 bit, which selected the 32 bit objects for a 64 bit build and failed to compile.
  • FixedFixed every exchange WebSocket API resending its whole subscription list in one burst after reconnecting, on a connection a few milliseconds old, so an exchange that limits messages per second closed it straight away and the cycle repeated. The replay is now paced, and on Binance sent as combined frames. It affects Binance, Bitfinex, Bitget, Bitmex, Bitstamp, Bybit, Cex, CexPlus, Coinbase, CryptoCom, Deribit, GateIO, Huobi, Kraken, Kucoin, MEXC and OKX. Set Throttle.PaceResubscribe to False for the previous behaviour.
  • FixedFixed the OKX reconnect replay sending one frame per subscription, which spent one of the 480 subscribe, unsubscribe and login operations per hour OKX allows on a connection for every channel, so a large watchlist exhausted the budget after a few reconnections and the exchange started refusing subscriptions. The replay is now sent as combined frames, one operation for the whole set.
  • FixedFixed cookies set by a DataSnap or WebBroker application hosted on the bridge server. Cookies without an expiry date were serialized as a date in 1899, so browsers dropped them as already expired, and the HTTP.sys bridge reduced several cookies to one. They are now sent as session cookies, with all their attributes.
  • FixedFixed memory leaks and random crashes when stopping the IOCP/EPOLL server engine while it was busy, and a buffer lost on every message processed with worker threads, a leak that grew with traffic. Thanks to Andrea for contributing the patch these fixes are based on.
  • FixedFixed the IOCP and EPOLL servers leaking connections and handles, and crashing, on several cleanup paths: a client dropping the line right after being accepted (a port scan or aborted TLS handshake), a client aborting while a read was pending, a connection released twice when the server was stopped mid-cleanup, an aborted connection consuming an accept slot that was never returned, and a use-after-free with worker threads enabled.
  • FixedFixed an "invalid pointer operation" crash in clients using ConnectTimeout, when the connection attempt finished as its helper thread was being disposed of.
  • FixedFixed a memory leak in the Linux (EPOLL) server where every HTTP request leaked pieces of the parsed request, growing with request size until the server ran out of memory. The classic thread engine was not affected.
  • FixedFixed the EPOLL server (Linux) sharing one connection queue across all EPOLLThreads workers, where one or two threads did almost all the work while the rest stayed idle. Each worker now has its own queue.
  • FixedFixed HTTP keep-alive not working on the IOCP and EPOLL servers. The connection was closed after each request, so the server filled with sockets in TIME_WAIT. Connections now stay open between requests, as with the classic thread engine.
  • FixedFixed sgcHTML number fields, chart data and Grid CSV export breaking where the regional settings use a comma as decimal mark. Numbers are now always written with a dot, and CSV fields are quoted following the standard.
  • FixedFixed sgcHTML pages being very hard to use on a phone. The side menu now folds away behind a button on small screens, and the Scheduler, Calendar, Grid, heat map, stepper, QR code, sparkline, chart and Notification list scroll or shrink inside their own box. Pages also state the viewport by default.
  • FixedA link placed in an sgcHTML Notification, and a field label built from an unusual name in an sgcHTML form, are now cleaned before reaching the page, closing a way crafted text could run script in the browser.
  • FixedThe WebSocket server now validates the opening handshake as the standard requires. A missing or non-13 version is refused, a handshake that does not finish within ten seconds is closed, and the number and length of headers are limited. A configured allowed-origins list is now also applied when a client sends no origin at all.
  • FixedThe WebSocket connection now rejects invalid frames instead of accepting them: data frames masked by a server, frames setting reserved bits no active extension defines, and close messages whose reason text carried an invalid close code.
  • FixedThe WebSocket client now builds its handshake key with a secure random generator, and the server's user name and password check now takes the same time whether or not the password is close to correct, so the response time no longer leaks a hint.
  • FixedWhen a client closes a WebSocket connection, the server now sends its own close message back before disconnecting, completing the closing handshake instead of just dropping the connection. This is now the default.
  • FixedFixed the MQTT client building invalid packets that brokers rejected: a CONNECT with a user name but no password (or the reverse), and any MQTT 5 packet carrying a larger block of properties. Also fixed it getting stuck after a broken packet on plain TCP, and two threads publishing at once picking the same packet identifier.
  • FixedFixed the MQTT 5 client misreading broker replies and reading past the end of a packet. A CONNACK Maximum QoS was read from the wrong byte, SUBSCRIBE and UNSUBSCRIBE replies with a long reason text reported the wrong QoS levels, and a truncated packet made it hand whatever followed in memory to the application as property values. Lengths and properties are now checked against the packet before being read.
  • FixedThe MQTT 5 client now honours what the broker tells it: it uses the Keep Alive returned in the CONNACK including for its first ping, passes the real reason code and server reference to OnMQTTDisconnect, raises OnMQTTAuth on an authentication challenge, and delivers a message arriving with only a Topic Alias under its real topic.
  • FixedFixed several problems with MQTT QoS 2 publishing. The client now sends the correct follow-up confirmation instead of re-sending the original message, discards a message the broker rejected instead of retrying forever, flags re-sent messages as duplicates, and retries on a sensible schedule instead of on every timer tick.
  • FixedSTOMP messages are now delivered exactly as the broker sent them. Multi-line bodies lost their line breaks and an invisible end-of-frame character was left at the end. The client now uses content-length to read the body, so it can contain any character including line breaks and binary zeros, and header values with special characters are escaped following the STOMP 1.1 and 1.2 rules.
  • FixedFixed STOMP frames being lost. Several frames packed into one WebSocket message are all processed now, a frame split across two messages is reassembled, and frames received as binary WebSocket messages are no longer ignored. A malformed frame now fires OnSTOMPError and closes the connection, as the specification requires.
  • FixedSTOMP ACK and NACK now send the headers required by the negotiated version: id for 1.2, message-id plus subscription for 1.1, message-id for 1.0. NACK is no longer sent on STOMP 1.0. Heart-beats now start only after the server confirms the connection and use the agreed intervals, closing the connection if the server goes silent so the WatchDog can reconnect.
  • FixedSTOMP fixes for ActiveMQ: the message priority header was sent without its colon separator so priority was ignored, and unsubscribing did not detect whether the subscription was durable. Delphi 7 applications also sent the wrong line endings inside frames.
  • FixedFixed the STOMP client reading far outside a frame when a broker sent a very large content-length, because the check was done with 32 bit maths and overflowed. A body larger than the maximum frame size is now refused, and a frame is limited to 1024 headers.
  • FixedThe AMQP 1.0 client is now protected against a bad broker: reading past the end of its buffer when a frame arrives in small pieces, a frame declaring an invalid header size, messages nested too deeply, a small message crafted to expand into a huge amount of memory, arrays whose items are not text symbols, and a text or symbol field declaring four gigabytes out of a small frame.
  • FixedThe default maximum frame size for AMQP 0.9.1 and 1.0 is now 1 MB instead of practically unlimited, so a broker cannot make the client hold an enormous frame in memory. You can still raise it. The AMQP 0.9.1 client now also closes the connection with "not implemented" on an unrecognized command, as the specification requires.
  • FixedHTTP/2 header compression is now protected against crafted headers: a small block expanding into a huge amount of memory, a length wrapping around to a negative value, and a read one byte past the end of a block. A malformed compressed header now closes the connection cleanly with the correct error, and continuation frames must belong to the stream they started on.
  • FixedThe HTTP/2 connection now rejects abuse that could crash it or exhaust memory and CPU: a DATA frame for a stream never opened, a flood of PRIORITY frames building unlimited hidden streams, reuse of a stream number, a flood of empty continuation frames, confusion after a stream reset, and an error code that could read outside a fixed internal table. The HTTP/2 server also rejects header names and values containing line breaks or nulls, which prevents forged headers and request smuggling, and paths with spaces, control characters or no leading slash.
  • FixedFixed HTTP/2 memory growth where reset streams were never cleaned up, and the server closing a connection with "CONCURRENT STREAM limit has been exceeded" after about 100 requests because finished streams were still counted as active. The client now also checks that a response's declared length matches what arrived, and rejects conflicting duplicate content-length headers. Redirects and error responses from the built-in authentication were written to the wrong stream.
  • FixedFixed a misleading error when a TLS connection failed, for example "error:00000006:lib(0):func(0):EVP lib". The real reason reported by OpenSSL was discarded before the exception was raised, it is now shown.
  • FixedImproved the errors reported when loading certificates and using newer algorithms. ML-KEM-768 explains that it needs OpenSSL 3.5 or later and shows the version found, a failed legacy provider reports which provider could not be loaded and where it was searched, and a PKCS#12 file using an old algorithm such as RC2 40-bit explains how to enable the legacy provider.
  • FixedFixed a pending OpenSSL error being left behind when the certificate file contained the certificate and private key together, which could affect a later call, and real errors while reading the certificate chain being ignored. The OpenSSL options to disable old TLS versions, compression and renegotiation and to prefer the server cipher order were also ignored with OpenSSL 1.1 or later, and are now applied.
  • FixedFixed the TLS IOCP and EPOLL servers writing past the end of their read buffer when a client sent several encrypted records together, which could overwrite adjacent memory and crash the server, and crashing when a connection could not be set up, for example at the connection limit or when a client dropped during the handshake. The plain TCP servers already handled this correctly.
  • FixedFixed the DTLS connection writing past the end of its read buffer when a peer sent several records together in one datagram.
  • FixedFixed the OAuth2 server sending the authorization code to whatever address the request asked for. The redirect address was never compared with the one registered, so a crafted link could deliver a user's authorization code to somebody else's site. It must now match exactly.
  • FixedThe OAuth2 server now cleans the application name and requested scopes before showing them on the sign-in page and strips line breaks from the values used to build the redirect address, closing two ways crafted text could run script or add headers. Also fixed it using memory it had already released when the sign-in page ended up empty.
  • FixedFixed the WebAuthn server trusting the FIDO metadata file without checking it. With no root certificate set the check was skipped entirely, so a forged file could make the server accept a fake authenticator. The file is now refused when there is nothing to check it against, and the download verifies the server certificate, using the Windows certificate store with no setup (Delphi 2010 and newer).
  • FixedFixed the WebAuthn server reading past the end of the certificate extension it examines when a device registers. The decoder checked nothing, so a truncated or deeply nested extension could make the server read unrelated memory and hand it back, run out of stack, or stop. Every field is now checked, nesting is limited and malformed extensions are refused.
  • FixedFixed the limit on response headers in the HTTP client never being applied, so a server could send an endless stream of headers until the client ran out of memory. Setting MaxHeaderLines to 0, meaning no limit, had the opposite effect and discarded every response header including Content-Length and Location.
  • FixedFixed the MCP server writing its internal connection id as a message on the event stream a client opens with GET, which clients such as VS Code GitHub Copilot reported as "Failed to parse message". The session id is still returned in the mcp-session-id header. This also covers the HTTP.sys server.
  • FixedFixed the MCP server checking where a request came from only when it carried a header browsers never send, so the check never ran for the case it was meant to stop. A web page the user visited could reach an MCP server on their own machine, list its tools, run them and read the results. The origin is now checked on every request, including the browser's preliminary check. If your MCP client runs in a browser, list its address in AllowedOrigins or set ValidateOrigin to False.
  • FixedThe WinHTTP client now verifies the server certificate by default. It previously ignored an unknown authority, a wrong host name and an expired date, so a wss connection could be intercepted unnoticed. Set VerifyCertificate to False for the previous behaviour.
  • FixedFixed the Files protocol deleting and writing files outside the folder it was given. The incoming file name was used almost as it came, and on Windows forward slashes were kept, so a peer could send a name such as ../../../file and reach anywhere on the disk. The delete side had no protection at all. Names are now reduced to a plain file name and checked, on server and client.
  • FixedFixed the OpenAPI server letting requests through when EnforceSecurity was enabled but the event checking the credential was not assigned. Any request merely carrying an api key or Authorization header reached the operation, an undecodable Basic header was accepted, and scopes were not checked without a JWTSecret. Those requests now answer 401, so assign OnValidateAPIKey, OnValidateBasic or OnValidateBearer for the schemes your specification declares, or configure JWTSecret.
  • FixedFixed seven STUN attributes reading past the end of the packet when a peer declared a length shorter than the field carried, which could hand unrelated memory to the application or stop the client. It affects the two ICE control attributes, the reservation token, requested address family, requested transport, even port flag, address error code and ICMP attribute.
  • FixedFixed most TLS options being lost when copied from one component to another. Only the IO handler, ALPN protocols and OpenSSL options were copied, so the certificate files, password, root certificate, TLS version, verify depth, SChannel options and VerifyCertificate stayed empty, and a component set up this way ended up not verifying the certificate of the server it connected to.
  • FixedFixed a client using the SChannel IO handler never noticing that the connection was gone when the other end dropped it without a TLS close notification, as happens when a proxy restarts. OnDisconnect never fired, Connected stayed True and the reconnect and WatchDog machinery never ran.
  • FixedFixed a client using the SChannel IO handler never completing a TLS 1.3 connection. The session ticket the server sends straight after the handshake left the client waiting for data the server had already sent, so the connection never opened and neither OnConnect nor OnError ever fired.
  • FixedThe TLS handshake and every read of the SChannel IO handler are now bounded. The handshake honours ConnectTimeout instead of covering only the TCP connect, so a peer that accepts the socket and then goes silent no longer blocks the thread for ever, and a peer that sends a record a few bytes at a time can no longer hold the reader past the read deadline.
  • FixedFixed a startup race in the SChannel IO handler where two connections opened at the same time could see initialization as complete before it actually was, an intermittent access violation. A single connection's handshake error could also unload the shared SSPI library while other SChannel connections were still using it.
  • FixedA connection using the SChannel IO handler now sends the TLS close notification before closing, on clients and servers, so a normal disconnect is no longer seen by the other end as a connection cut short, which several exchanges log or rate-limit. It is sent only when it can go out immediately, so closing is never delayed.
  • FixedConnections using the Apple or Android TLS IO handlers now also send the TLS close notification before closing. With Apple Secure Transport it was written after the socket had gone, on Android none was produced, and with Apple Network.framework the connection was cancelled without telling it the stream was finished.
  • FixedFixed several problems talking to a SOCKS5 proxy when the address is a host name. The reply was read one byte short, so the first byte reached the application as data and the port was taken from the wrong position, an IPv6 address in a UDP reply had two bytes read as the port, and a host name longer than 248 characters wrote past the end of the request buffer.
  • FixedFixed OKX order prices and sizes being rounded to five decimals before they were sent, so an order on an instrument with a finer tick or lot size was not the order the application asked for, and a value below 0.00001 was sent as zero. Prices and sizes are now sent exactly as given, and the same applies to AmendOrder.
  • FixedFixed the Binance Spot user data stream, which stopped working when Binance retired the listenKey endpoints it was built on. Account, order and balance updates now come from the Binance WebSocket API, over a second connection the component opens by itself and renews after a reconnection. The events arrive in the same shape, so your existing handlers keep working. The new subscription is signed, so Binance.ApiSecret must now be set as well as Binance.ApiKey. Binance.us and Futures still use a listenKey, so Binance.ListenKeyOnDisconnect now applies only to those two. When a private stream cannot be opened, the error now reports the status the server returned and the message Binance sent back, instead of only "ListenKey cannot be empty.".
  • FixedFixed the diff depth stream on USD-M Futures when an update speed is asked for, the name of the stream was built in the wrong order so Binance never sent the depth updates. Asking for the stream without an update speed always worked and is unchanged.
  • FixedFixed unsubscribing from a depth stream that was subscribed with an update speed. The unsubscribe left the speed out, so it named a different stream, the updates kept arriving and the stream came back after every reconnection. UnSubscribePartialBookDepth and UnSubscribeDiffDepth now take the update speed, it is empty by default so existing code keeps working.
  • FixedFixed the OKX keepalive, it now sends the ping text message the exchange requires instead of a WebSocket ping, and reconnects when no pong comes back. OnOKXSubscribed and OnOKXUnsubscribed now fire on the subscription reply, they never did before.
  • FixedFixed the KuCoin keepalive, it now sends the ping message the exchange requires instead of a WebSocket ping, and the pingTimeout returned when the connection opens is used to reconnect when no pong comes back.
  • FixedFixed random crashes in the OnException event of the TCP and HTTP/2 components. The exception was destroyed by the thread that raised it before the event ran, so the handler read freed memory and reported a wrong class name. It now receives a valid copy.

sgcWebSockets 2026.7.0

  • 2026.7.0: 2026 July
  • NewYou can tell Connect() to wait until the connection is fully ready before it returns, so nothing runs against a half-ready connection during quick reconnects.
  • NewNew clustering component that links several servers together so channels, pub/sub and presence work across all of them, using either a built-in mesh (no extra software) or Redis (Enterprise).
  • NewThe sgc protocol can now remember recent messages per channel, and a client that drops and reconnects automatically receives whatever it missed.
  • NewNew optional HTTP-client protections: drop the Authorization and Cookie headers if a redirect sends you to another site, and block a redirect that downgrades HTTPS to HTTP (both off by default).
  • NewYou can now limit the size of a single piece (chunk) of a chunked response, so a server can't use up your memory (no limit by default).
  • NewThose redirect and size protections are now available directly on the ready-made API clients (AI/LLM, crypto exchanges, OAuth2, Google Cloud, WhatsApp, AWS SQS, WebPush), so you don't have to touch the low-level HTTP object.
  • NewNew option to send "Expect: 100-continue", which asks the server's permission before uploading a large body so it can refuse early (off by default).
  • NewNew option to send a request body in chunks instead of a fixed length, handy for streaming an upload whose size you don't know yet (off by default).
  • NewYou can now limit the total size of a response the client will accept, on top of the per-chunk limit (no limit by default).
  • NewNew cookie option that rejects cookies claimed for overly broad domains like "com" or "co.uk", preventing cookies that span unrelated sites (off by default).
  • NewThe same redirect and size protections are now on the HTTP/2 client, and the HTTP/3 client gains the response-size limit too.
  • NewNew OAuth2 login type (Identity Assertion Authorization Grant) for chaining identity across domains; the client runs the whole multi-step exchange for you, with new events to follow each step.
  • NewThe MCP client can now log in with OAuth2, fetching a token automatically and reusing it until it expires (it takes priority over an API key when enabled).
  • NewAuto-reconnect can now wait progressively longer between attempts with a little randomness, so many clients don't all reconnect at the same instant (the old fixed interval stays the default).
  • NewThe HTTP client can retry a request automatically when the server is busy or a connection hiccups, waiting longer each time and honoring the server's Retry-After hint (off by default); the OpenAI, Anthropic and Gemini clients use this too.
  • NewNew await-style calls so you can wait for an HTTP request, a WebSocket connect, or an AI chat without setting up event handlers, and cancelling now really stops the request.
  • NewYou can now cap how many outgoing messages queue up per connection and choose what happens when it's full (drop oldest, drop newest, or disconnect), with a new event that alerts you before anything is dropped (unlimited by default).
  • NewNew TLS preset that switches on certificate checking, TLS 1.2 or higher, and hostname verification all at once (the default leaves your current settings unchanged).
  • NewNew LastError value, plus a Connect version that hands back the error, so you can tell why a connect or send failed even without an error handler.
  • NewNew helper functions to read a certificate's subject and issuer names in the standard RFC 2253 text format.
  • NewSupport for the new HTTP QUERY method, which sends a search in the request body like a POST but stays safe and cacheable like a GET; available on the HTTP/1.x, HTTP/2, HTTP/3 and REST clients, and handled by the servers and the proxy.
  • NewThe WinHTTP WebSocket client now supports token/bearer and URL logins like the standard client (OAuth2, JWT and session logins still aren't available there, since it uses the Windows built-in networking and doesn't include Indy).
  • NewThe WinHTTP WebSocket client now exposes the OnHandshake event, so you can add your own headers to the connection request, just like the standard client.
  • NewEnd-to-end encryption (E2EE) can now confirm who you're really talking to: each side signs its encryption key with a long-term identity key and the other side checks the signature, so a server or relay in the middle can't quietly swap keys and listen in. It's off by default and fully backward compatible, works for both one-to-one and group chats, and adds events to approve or pin a peer's identity and to warn you when a peer's identity key changes.
  • NewMarket-data feeds now re-subscribe (by default false) automatically after the connection drops and reconnects, so you keep receiving data without re-subscribing yourself. Covers Binance, Kraken, Coinbase and about fourteen other exchanges, plus XTB's session-based streaming feed.
  • NewNew optional rate limiter on the ready-made REST API clients: cap how many requests you send in a time window so a burst doesn't get you temporarily banned by an exchange (off by default).
  • NewThe HTTP servers can now compress their replies with gzip or deflate whenever the client says it accepts them, which makes pages and JSON answers much smaller. It works both for files served from DocumentRoot and for replies you build yourself, it skips small bodies and anything that wouldn't get smaller, and it is off by default (new HTTPCompression option, available on the HTTP.sys server too). Only HTTP/1.1 replies are compressed for now.
  • NewYou can now tell the HTTP server which class to use when it creates a session, so you can store your own data inside it. Set SessionClass to your own descendant of TIdHTTPSession before you start the server, and the session id, the cookie, the timeout and the cleanup keep working exactly as before. If you need full control over where sessions are kept, you can now also assign your own SessionList.
  • NewThe WinHTTP WebSocket client can now write a log file. Set LogFile.FileName and turn LogFile.Enabled on, and it records when it connects and disconnects, and every text and binary message it sends and receives. Because the Windows built-in networking hands over messages that are already decoded, this log lists messages rather than the raw frames the standard client writes.
  • FixedFixed a crash that could occur if the same connection was reported disconnected twice, which could bring the server down under strict memory managers.
  • FixedFixed a clean disconnect over TLS taking several seconds; it now finishes immediately and still reports the disconnect exactly once.
  • FixedFixed a memory-exhaustion weakness when reading the trailing headers of a chunked response; the number of trailer lines is now limited and their values are read correctly.
  • FixedImproved redirect handling so relative redirect addresses become full URLs correctly, and the request method and body are kept on 307 and 308 redirects.
  • FixedFixed the client giving up on a cookie when its expiry date couldn't be read; it's now treated as a session cookie, and Max-Age still wins over Expires.
  • FixedFixed a possible read past the buffer in the MQTT 5 client when a broker claimed more data than it actually sent; lengths are now checked first.
  • FixedFixed a similar read past the buffer in the AMQP 1.0 client when decoding a UUID; it now checks the length first and reports a clean error otherwise.
  • FixedHardened the STUN/TURN parser against bad packets, fixing an infinite loop, several reads past the buffer (including IPv6 addresses), and missing length checks.
  • FixedFixed memory-safety bugs in the UDP client and server (including DTLS) when disconnecting, so a socket is no longer freed twice or left dangling and event handlers get valid peer info.
  • FixedThe HTTP client's log now hides secrets in request headers too (such as Authorization and exchange API keys), so turning on logging no longer writes keys or tokens to disk in clear text.
  • FixedFixed a possible read past the buffer in the WebRTC data-channel (SCTP) parser; chunk lengths are now checked so a bad packet can't read stray memory or echo it back.
  • FixedFixed a memory bug in the DLL used by the .NET and other language bindings, where returned text could point to already-freed memory; the text now stays valid after the call.
  • FixedFixed streamed (Server-Sent Events) responses losing all but the first event when several arrived together, or losing an event split across two reads; this restores token-by-token streaming for the AI/LLM clients.
  • FixedFixed streaming chat with OpenAI sending nothing to the stream event because the stream flag wasn't set; it now streams like the other providers.
  • FixedThe HTML login components now escape the values they display (user name, email, avatar, redirect URLs), so a malicious value can't inject script into the page.
  • FixedHardened the WebAuthn server: challenges now use a secure random generator, each challenge can be used only once, and the clone check follows the latest rules so a zero counter can't slip through.
  • FixedThe OAuth2 authorization server now creates its codes and tokens with a secure random generator and compares the client secret in constant time to close a timing leak.
  • FixedJWT signatures are now checked in constant time, and a token with a valid signature but a bad claim is now rejected instead of accepted.
  • FixedHardened the AMQP client against a bad server: frames on a channel that was never opened are rejected, and the agreed maximum frame size is enforced as soon as the header arrives.
  • FixedAdded internal limits so a misbehaving peer can't grow memory without bound (the MQTT pending-message queue, the sgc protocol's per-connection subscriptions, and the WAMP server's pending calls).
  • FixedWith OpenSSL StrictVerify on, the certificate is now also checked against the host name, so a valid certificate issued for a different host is rejected (IP-address connections and existing settings are unaffected).
  • FixedFixed Kraken request IDs that could repeat within a millisecond or go backwards after a clock change, which Kraken rejected; they're now always increasing.
  • FixedFixed the BitMEX client sending its expiry time in milliseconds when BitMEX expects seconds; it's now sent in seconds.
  • FixedFixed the MEXC client signing the plain parameters while sending the encoded ones, which broke the signature for anything needing URL-encoding; they're now encoded before signing.
  • FixedFixed the Cryptorobotics client sending two values swapped in some by-hash calls, which hit the wrong item; they're now sent correctly.
  • FixedFixed the Deribit client never refreshing its login token, so private calls failed after about 15 minutes; it now refreshes in time and retries once if needed.
  • FixedFixed the Forex client hiding an error while reading the account ID, which quietly left you subscribed to prices but not orders, positions or margin; the problem is now reported.
  • FixedFixed the gRPC client reporting success with an empty reply when a request couldn't be sent at all; a send failure is now reported as an error and triggers the retry policy.
  • FixedFixed a possible out-of-memory in the HTTP/2 client when a server sent a heavily compressed "zip-bomb" response; the decompressed size is now capped (64 MB by default).
  • FixedFixed a case where the HTTP/2 response-size limit could be bypassed by the final part of a response; the limit is now always enforced.
  • FixedFixed the HTTP/2 client waiting for the whole timeout after a failed request instead of failing straight away.
  • FixedFixed a memory-safety bug when broadcasting to a channel while a client was disconnecting, which could read freed memory; the client list is now held while the broadcast runs.
  • FixedHardened the raw-TCP end-of-frame scanner against a bad stream that could read past the buffer or recurse too deeply.
  • FixedThe HTTP API server now compares Basic-authentication passwords in constant time.
  • FixedAdded a nesting-depth limit when decoding AMQP field tables, so a deeply nested value can't overflow the stack.
  • FixedHTTP session IDs in the built-in Indy HTTP server now use a secure random generator, and a small off-by-one that stopped the character "0" from ever appearing is fixed.
  • FixedFixed a crash and a possible memory corruption when reading OpenAI message attachments, and fixed an unrelated value being read when the reply had no "incomplete details".
  • FixedMade the OpenAPI server's spec loading thread-safe and stopped your request handlers from running while its internal lock is held (which could deadlock or make requests wait in line); the served spec is now read safely and error text is properly escaped.
  • FixedFixed the server leaking a connection and its socket every time a login failed while authentication was enabled.
  • FixedFixed the OpenAI client crashing on replies that don't include a "message", such as streaming pieces or OpenAI-compatible servers like Ollama and LM Studio.
  • FixedFixed a rare crash in the fire-and-forget async helper where a task could free its own thread while it was still running.
  • FixedFixed the AMQP client accepting a frame that claimed a negative or impossibly large size.
  • FixedFixed the gRPC client so several calls made at the same time can no longer receive each other's replies, and a reply that arrives split across several network packets, or as several messages, is now reassembled correctly.
  • FixedFixed the WinHTTP WebSocket client's WriteAndWaitData always coming back empty. It sent the message and waited for the answer, but then threw the answer away, so the caller always got an empty string (or nothing at all for the stream version). The answer is now returned.

sgcWebSockets 2026.6.0

  • 2026.6.0: 2026 June
  • NewNew OpenAPI Server component: server-side OpenAPI 3.x request router for TsgcWebSocketHTTPServer. Loads an OpenAPI spec, validates incoming HTTP requests (path/query/header/body) against the spec, dispatches to user-supplied operation handlers and returns RFC 7807 problem+json on validation errors.
  • NewNew Demos in the folder "Demos/23.OpenAPI" showing the main features of the OpenAPI Server.
  • NewNew TsgcGRPCClient component: gRPC client over HTTP/2 (TsgcHTTP2Client) supporting the four RPC patterns (unary, server streaming, client streaming and bidirectional streaming), with channel options (compression and content-type), default and per-call metadata, deadlines, automatic retries with exponential backoff, client-side load balancing (Pick First and Round Robin), gRPC Health Checking (Check and Watch), Server Reflection, interceptors (logging, timeout, metadata) and OpenTelemetry metrics.
  • NewNew gRPC interfaces for Google Cloud services, built on TsgcGRPCClient with typed protobuf request and response classes and service-account JWT authentication: Pub/Sub, Speech-to-Text, Translation, Vision, Natural Language, Cloud Storage, BigQuery Storage and Vertex AI.
  • NewNew Demos in the folder "Demos/21.GRPC" showing the gRPC client (a generic client) and the Google Cloud service interfaces (Pub/Sub, Speech-to-Text, Translation, Vision, Natural Language, Cloud Storage, BigQuery and Vertex AI).
  • NewNew Kafka client component (TsgcWSPClient_Kafka): native Apache Kafka client that speaks the binary Kafka wire protocol over raw TCP.
  • NewNew Demo in the folder "Demos/02.WebSocket_Protocols/13.Kafka" showing the main features of the Kafka client: connect, produce, subscribe and poll, topic administration and offset management.
  • NewNew native Android TLS backend (iohAndroidTLS): runs TLS through the platform javax.net.ssl.SSLEngine via JNI, so Android apps deploy no OpenSSL libraries (no libssl.so / libcrypto.so). Validates against the Android system trust store with hostname verification, negotiates TLS 1.3 and supports ALPN on Android 10 (API 29) and later. Selected per platform through TLSOptions.IOHandler and uses the same TLSOptions API (VerifyCertificate, RootCertFile, CertFile, Password, ALPNProtocols). Requires Rad Studio XE8+.
  • NewNew native Apple TLS backend (iohAppleTLS) for iOS and macOS: runs TLS through the operating system, so apps deploy no OpenSSL .dylib. Auto-selects Network.framework (TLS 1.3) on macOS 10.14+ and iOS 12+ and falls back to Secure Transport (TLS 1.2) on older systems. Uses the system trust store with SNI and hostname verification, exposes the OnAppleTLSVerifyPeer event for custom validation, and supports a custom CA (RootCertFile), client certificate / mutual TLS (CertFile + Password) and ALPN. Requires Rad Studio XE6+.
  • NewNew Setup option "Include Resources": uncheck during installation to undefine SGC_RESOURCES in sgcVer.inc before package compilation, so the embedded JS resource is excluded, reducing the size of the apps.
  • NewNew sgcKEM_MLKEM768_Encapsulate and sgcKEM_MLKEM768_Decapsulate: ML-KEM-768 post-quantum encapsulation/decapsulation primitives (OpenSSL 3.5+).
  • NewNew sgcKEM_ECDH_P256_Encapsulate and sgcKEM_ECDH_P256_Decapsulate: ECDH-as-KEM over P-256 (NID_X9_62_prime256v1). Accepts a 65-byte uncompressed public key (Encapsulate) or 32-byte raw private scalar (Decapsulate), returns a 65-byte ephemeral-public-key ciphertext and 32-byte shared secret. Same TBytes API shape as the ML-KEM-768 pair so apps can switch between classical and post-quantum KEMs without code changes.
  • NewNew unit sgcSSL_AEAD with generic AEAD primitives sgcAEAD_Encrypt and sgcAEAD_Decrypt. Supports AES-128-GCM, AES-256-GCM and ChaCha20-Poly1305 via the TsgcAEAD_Cipher enum, accepts caller-supplied 12-byte nonce and arbitrary AAD, with 16-byte authentication tag appended to the ciphertext. Designed for use after KEM Decapsulate + HKDF in hybrid post-quantum / classical handshakes where the existing AES-256-GCM helpers in sgcSSL_E2EE are insufficient (no AAD, random IV).
  • NewNew sgcAEAD_EncryptPrefixed and sgcAEAD_DecryptPrefixed: convenience wrappers that produce/consume the self-contained "nonce(12) || ciphertext || tag(16)" blob layout used by Bouncy Castle GCM, JOSE A256GCM, libsodium crypto_aead_* and most HPKE-style wire protocols. EncryptPrefixed generates a fresh random 12-byte nonce via RAND_bytes; DecryptPrefixed slices the leading 12 bytes off the blob as the nonce.
  • NewNew TsgcWebSocketFirewall BotDetection: IP-based bot classification (verified search-engine crawlers, datacenter/hosting ranges, blocklisted IPs) using known-bot CIDR ranges, datacenter ASN ranges, forward-confirmed reverse DNS (FCrDNS) and DNSBL lookups. Classify-only: results are exposed through the new OnBotDetected event and GetBotClassification method without blocking connections.
  • NewImproved Firewall demo (Demos\04.WebSocket_Other_Samples\13.Firewall): new "Bot Detection" tab to configure known-bot ranges, datacenter detection, reverse DNS verification and DNSBL zones, with a live "Classify IP" tester.
  • NewNew TsgcWebSocketFirewall IPv6 support: blacklist and whitelist CIDR matching now works for IPv6 addresses and ranges up to /128, GeoIP loads the GeoLite2 IPv6 country blocks, the bot-range database accepts IPv6 CIDR ranges, and bot detection resolves IPv6 reverse DNS and DNSBL (ip6.arpa) lookups. Addresses are normalized (IPv4-mapped, compressed and zone forms) so a client is tracked consistently across spellings. IPv4 behaviour is unchanged.
  • NewNew STDIO transport for the MCP server and client. The MCP server can now run over standard input/output through the new TsgcAI_MCP_Server_Stdio host, so it can be spawned as a local subprocess by MCP clients.
  • NewNew MaxMessageSize property in the WebSocket servers (default 64 MB, 0 = unlimited) to limit the maximum message size.
  • NewNew SecurityOptions.EnforceWebSocketVersion (reply 426 when Sec-WebSocket-Version is not 13) and SecurityOptions.ValidateWebSocketKey (reject an invalid Sec-WebSocket-Key), both enabled by default.
  • NewNew MaxRequestBodySize property in TsgcWebSocketHTTPServer (default 64 MB, 0 = unlimited): rejects oversized HTTP request bodies to prevent memory exhaustion.
  • NewNew StrictRequestParsing property in TsgcWebSocketHTTPServer (default True): rejects an HTTP request that includes both Content-Length and Transfer-Encoding headers (request smuggling).
  • NewNew HTTP/2 Rapid Reset (CVE-2023-44487) protection: per-connection limits on RST_STREAM and control frames and a default maximum of 100 concurrent streams; abusive connections are closed with GOAWAY.
  • FixedFixed IPv6 CIDR matching in the TsgcWebSocketFirewall blacklist and whitelist: an IPv6 CIDR (for example 2001:db8::/32) was evaluated with IPv4 32-bit math and collapsed to zero, so it matched every IPv6 client. A whitelist entry then admitted all IPv6 connections and a blacklist entry blocked all of them. CIDR matching is now version-aware.
  • FixedFixed path traversal in TsgcWebSocketHTTPServer static file serving (HTTP/1.x and HTTP/2): a URL containing "../" could read files outside DocumentRoot. The resolved path is now canonicalized and rejected when it escapes the document root.
  • FixedFixed possible HTTP response header injection (CRLF) in TsgcWebSocketServer_HTTPAPI: CR and LF characters are now stripped from response header values such as Location, ETag and Server.
  • FixedFixed cross-thread use-after-free in TsgcIdSSLIOHandlerSocketSChannel (SChannel SSL): Readable and RecvEnc now access SSL.Handle inside the SSL critical section (DoEnterCS/DoLeaveCS), matching SendEnc/Connected/CloseSSL and preventing a race when another thread closes the connection mid-read.
  • FixedFixed memory leak in TsgcWebSocketServer_HTTPAPI (HTTP.sys server): client disconnections that arrived as failed IOCP completions were silently discarded, so connection objects accumulated and were only released when the server component was destroyed.
  • FixedFixed WebSocket frame parsing when a frame header arrives split across TCP segments under high throughput. The fixed-size header fields (16-bit/64-bit extended payload length and the 4-byte mask key) are now read in full before being parsed, instead of indexing a read buffer that held fewer bytes than requested. With range checking disabled this could yield a corrupt payload length and drop or garble the message. (Thanks to Jacques for the fix).
  • FixedFixed possible Denial of Service in TsgcWebSocketServer, TsgcWebSocketHTTPServer and TsgcWebSocketServer_HTTPAPI (http.sys): a client could exhaust server memory with oversized messages, endless message fragmentation or a permessage-deflate "zip-bomb". Messages are now bounded by a maximum size and rejected (close 1009) when exceeded.
  • FixedFixed 64-bit WebSocket frame length parsing: a length with the high bit set is now rejected instead of being truncated.
  • FixedFixed TsgcWebSocketServer_HTTPAPI (http.sys) not enforcing client frame masking: per RFC 6455 the server now closes a connection (close 1002) when a client sends an unmasked data frame, matching the other WebSocket servers.
  • FixedFixed Bug TIdSSLIOHandlerSocketOpenSSL: the peer-verification callback could fail open and accept an untrusted certificate even when verification was requested. Enable the new TIdSSLOptions.StrictVerify option to enforce the OpenSSL verification result.
  • FixedFixed Bug TIdCustomHTTPServer: the chunked transfer-encoding trailer-header loop was unbounded, allowing a memory and CPU exhaustion DoS. It is now bounded by MaximumHeaderLineCount.
  • FixedFixed excessive memory usage serving static files from DocumentRoot in TsgcWebSocketHTTPServer (HTTP/1.x and HTTP/2). Each request loaded the whole file into memory with a TMemoryStream per connection, so large files or many concurrent downloads could exhaust RAM (for example 100 connections serving a 1 GB file used about 100 GB), and slow-reading clients kept those copies resident. Files are now streamed from disk with a read-only shared TFileStream, so server memory stays flat regardless of file size and connection count.
  • FixedFixed Options.WriteTimeOut having no effect on Linux and other POSIX platforms. The send timeout (SO_SNDTIMEO) was applied only on Windows, and POSIX expects a timeval rather than a millisecond integer. It is now set correctly on POSIX, so a client that reads its response very slowly no longer blocks a server thread indefinitely.
  • FixedFixed wrong MQTT 5.0 property identifiers in TsgcWSPClient_MQTT: the Subscription Identifier property in PUBLISH packets was written as 0x11 (Session Expiry Interval) instead of 0x0B, and the Server Reference property in DISCONNECT packets was written as 0x22 (Topic Alias Maximum) instead of 0x1C, so strict MQTT 5.0 peers could misparse or reject the packets.
  • FixedFixed Bug TsgcWSPClient_STOMP (and the STOMP broker clients): with the default HeartBeat settings (Enabled = True, Outgoing = 0) the client flooded the server with heart-beat frames, because on connect the WebSocket client heartbeat interval was set to 0 seconds and the timer fired continuously.
  • FixedFixed TsgcWSPClient_AMQP1 not sending messages larger than the negotiated max-frame-size; the outgoing transfer is now split across multiple frames, so large AMQP 1.0 messages are delivered.
  • FixedFixed WAMP v1 PUBLISH writing the exclude and eligible lists in the wrong order and the server ignoring them, so the publisher could receive its own event and the exclude/eligible filtering had no effect.
  • FixedFixed TsgcWSPClient_Files routing file-sent-error notifications to the component instead of the target connection, so the client was never told a transfer failed.
  • FixedFixed TsgcWSPServer_Presence not freeing empty channels (DeleteChannel was a no-op), so channels accumulated for the lifetime of the server.
  • FixedFixed E2EE EC public keys being emitted with explicit curve parameters instead of the named-curve form, which strict importers rejected; OpenSSL reads both forms.
  • FixedFixed the Server-Sent Events fallback sending the retry value multiplied by 1000 (about 50 minutes for the 3000 default); the configured value in milliseconds is now sent unchanged.
  • FixedFixed TsgcSTUNClient building the transaction id from a low-entropy ASCII range; it now uses a full 96-bit cryptographically-random transaction id.
  • FixedFixed TsgcTURNClient ChannelData length field including the padding bytes, which broke interop with standard TURN servers; the length now excludes padding per RFC 5766.
  • FixedFixed TsgcWSAPI_Bybit option market using swapped production and testnet stream hosts.
  • FixedFixed TsgcWSAPI_Kraken spot subscriptions producing malformed JSON when a reqId was set; the reqId is now appended instead of overwriting the message head.
  • FixedFixed TsgcWSAPI_MEXC mini-tickers stream never being created due to an inverted check, so mini-ticker subscriptions returned no data.
  • BreakingRemoved TsgcWSAPI_FXCM component and the sgcWebSocket_API_FXCM unit (FXCM ForexConnect/REST/streaming API client). FXCM has retired its public trading API.

sgcWebSockets 2026.5.0

  • 2026.5.0: 2026 May
  • NewNew TsgcWSRateLimiter component: drop-in rate limiter for WebSocket/HTTP servers. Supports Token Bucket, Sliding Window and Fixed Window strategies, with PerIP / PerAPIKey / PerUser / PerEndpoint rules, daily/monthly quotas, and burst protection.
  • NewNew TsgcWSCircuitBreaker component: client-side circuit breaker that protects outbound HTTP calls made through any TsgcHTTPAPI_client subclass. When a target host (e.g., api.openai.com) starts failing, the breaker opens and subsequent calls fail fast in microseconds instead of hanging on timeouts.
  • NewNew TsgcWSAPIKeyManager component: full lifecycle manager for API keys - IssueKey, ValidateKey, RevokeKey, RotateKey (with grace period).
  • NewNew Demos for the 3 new infrastructure components, located in Demos\04.WebSocket_Other_Samples - 14.RateLimiter, 15.CircuitBreaker and 16.APIKeyManager. Each demo embeds a TsgcWebSocketHTTPServer plus a TsgcWebSocketClient, wires the new component to the server property, and demonstrates automatic connection / message rejection under flood, failure or unauthorized scenarios, with a live stats timer and event log.
  • NewNew TsgcWSAPI_Forex component: supports unified REST + streaming for Forex.com.
  • NewNew Demo for Forex.com: GUI demo in "Demos\05.Crypto\22.Forex" covering login, connectivity ping, live market watch, positions, active orders, trade history, stop/limit history and simulate trade, with credentials persisted to sgcForexDemo.ini.
  • NewNew TsgcWSPClient_Lightstreamer component: generic Lightstreamer TLCP 2.5 client, reusable for any Lightstreamer server (Forex.com, IG Markets, etc.). Implements create_session, bind_session, control (subscribe / unsubscribe) and the LOOP auto-rebind + subscription replay after reconnect.
  • NewImproved HTTP.sys Server: new FineTune property implementing OperatingMode property with opt-in ompHighPerf mode implementing N workers x M pre-posted async receives (MSDN High Performance pattern). Default ompClassic preserves existing behavior.
  • NewImproved HTTP.sys Server: THttpServerRequest and THttpServerResponse have been udpated to include more fields.
  • NewImproved EPOLL IOHandler (Linux): new properties AcceptBatchSize, WaitTimeoutMS and HandshakeTimeoutMS.
  • NewImproved EPOLL IOHandler (Linux): EPOLLOUT-driven write backpressure. When send() returns EAGAIN on a partial write, the remaining bytes are captured in a per-connection pending buffer and the socket is re-armed with EPOLLIN|EPOLLOUT; the reactor flushes the tail on the next EPOLLOUT event.
  • NewImproved IOCP IOHandler (Windows): new ThreadAffinity property (default False) on TsgcIndy_IO_Engine. When enabled, engine threads are pinned round-robin to logical cores via SetThreadAffinityMask, reducing cross-core cache traffic on high-core-count systems.
  • NewImproved IOCP IOHandler (Windows): new TsgcIndy_IO_EngineMetrics record and readonly Metrics property exposing AcceptsPosted, AcceptsCompleted, ReadsPosted, ReadsCompleted, ActiveConnections, BytesRead and BytesWritten counters. Metrics are maintained by the engine with critical-section-protected increments.
  • NewImproved IOCP IOHandler (Windows): new SendBufferSize, ReceiveBufferSize and TCPNoDelay properties on TsgcIndy_IOHandler_IO_IOCP. Applied in AfterAccept via setsockopt (SO_SNDBUF, SO_RCVBUF, TCP_NODELAY) so per-connection tuning no longer requires a custom OnConnect handler.
  • NewImproved IOCP IOHandler (Windows): TsgcPerIoDataPool capacity raised from 256 to 2048, avoiding the GetMem/FreeMem heap fallback under high connection concurrency. Measured +15-18% WebSocket throughput on loopback benchmarks.
  • NewImproved MCP Server: built-in OAuth 2.1 flow for browser-based connectors (claude.ai). Auto-serves /.well-known/oauth-authorization-server (RFC 8414), /.well-known/oauth-protected-resource (RFC 9728), /oauth/register (RFC 7591 DCR), /oauth/authorize (HTML consent form) and /oauth/token (PKCE S256 + refresh tokens).
  • NewImproved MCP Server: CORS support with origin reflection and HSTS (Strict-Transport-Security: max-age=31536000) on all responses; OPTIONS preflight returns 204 with full Access-Control-* headers.
  • NewNew sgcKEM_CreateMLKEM768Keys: generates an ML-KEM-768 post-quantum keypair (PEM and raw bytes).
  • FixedFixed MCP Server: missing/invalid credentials now return 401 Unauthorized with a WWW-Authenticate: Bearer header pointing at the protected resource metadata, instead of 500 Internal Server Error. Required for OAuth discovery by browser-based MCP clients.
  • FixedFixed MCP Server: OPTIONS requests no longer hit the JSON-RPC parser (was returning 500 "Invalid jsonrpc Value"). CORS preflight is now handled before authentication and before the MCP body parser.
  • FixedFixed HTTP.sys Server: context leak on ERROR_MORE_DATA in TsgcHTTPServerAPI.DoExecute. The accept loop now grows the buffer and retries HttpReceiveHttpRequest on the same request id, and releases orphaned contexts on all error paths.
  • FixedFixed HTTP.sys Server: TsgcWSConnectionServer_HTTPAPI.DoSendHTTP_Response no longer sets HTTP_SEND_RESPONSE_FLAG_MORE_DATA on the final response.
  • FixedFixed IOCP IOHandler (Windows): TsgcIndy_IO_Engine_IOCP_Base.DoStopThreads was calling WaitForMultipleObjects on an array of DWORD thread IDs (FThreadsId) instead of thread HANDLES.
  • FixedFixed IOCP IOHandler (Windows): pending I/O operations on sockets are now cancelled on shutdown and on per-socket close.
  • FixedFixed IOCP IOHandler (Windows): replaced the fragile Overlapped.Internal = STATUS_PENDING probe in DoFreePerIoData with an explicit Completed: Boolean flag on TsgcPerIoData.
  • FixedFixed IOCP/EPOLL IOHandler worker pool: TsgcIndy_IO_WorkOpThread.Run issued sleep(1) on every iteration, including after a task was processed, capping each worker at ~1000 ops/s even when the queue had backlog.
  • FixedFixed MCP Server: tool descriptions, prompt messages and resource contents containing non-ASCII characters broke MCP client connections because the JSON body was not ASCII-safe while the HTTP header declared charset=utf-8.
  • FixedFixed HTTP API request body decoding: TsgcWSComponent_Server.DoHTTPRequestAPI was reading the inbound HTTP body via ReadStringFromStream without specifying an encoding, defaulting to ASCII. Any non-ASCII byte was substituted with '?' before reaching event handlers.
  • FixedFixed MCP Server: tool, prompt, resource, root, template, completion-ref and completion-argument 'name' fields containing non-ASCII characters were emitted/read as raw UTF-16 code points rather than JSON \uXXXX escapes.
  • FixedFixed HTTP/2 WebBrokerBridge: "Invalid pointer operation" on sgcFree(oResponse) in TsgcWSHTTPServer.OnHTTP2RequestEvent when DataSnap REST handled an HTTP/2 HEADERS-only frame.

sgcWebSockets 2026.4.0

  • 2026.4.0: 2026 April
  • NewAdded Support for Rad Studio 13.1: the new platform WinARM64EC is supported.
  • NewNew TsgcWSFirewall component: full-featured firewall for WebSocket servers with IP blacklist/whitelist (CIDR support), brute force protection with auto-ban, SQL injection detection, XSS detection, rate limiting, and flood protection.
  • NewNew Demo for Server Firewall: shows the main features of the new Firewall and is located in the folder: "Demos\04.WebSocket_Other_Samples\13.Firewall".
  • NewNew Demo for HTTP/2 Large File Transfer: server + client demo for testing 1GB+ file downloads via HTTP/2, located in "Demos\20.HTTP_Protocol\13.HTTP2_LargeFile_Transfer".
  • NewNew HTTP/2 debug logging: frame send/receive, WINDOW_UPDATE increments, and streaming chunk reads are logged via LoggerPro when {$DEFINE SGC_DEBUG} is enabled in sgcVer.inc.
  • NewImproved MQTT Client: new property RcvMsg to get access to the latest MQTT message received from the server.
  • NewNew TsgcTCPClient component: full-featured TCP client based on the WebSocket client infrastructure, supporting TLS/SSL, proxy, watchdog and protocol integration. Protocols (MQTT, AMQP, STOMP, WAMP, etc.) can now use either TsgcTCPClient or TsgcWebSocketClient via their Client property.
  • NewNew OAuth2 Client Token Revocation support (RFC 7009): Revoke() method with OnBeforeRevokeToken, OnAfterRevokeToken, and OnRevokeTokenError events.
  • NewNew OAuth2 Client Token Introspection support (RFC 7662): Introspect() method with OnBeforeIntrospectToken, OnAfterIntrospectToken, and OnIntrospectTokenError events.
  • NewNew OAuth2 Client Device Authorization Grant (RFC 8628): auth2DeviceCode grant type with automatic polling, OnDeviceCode and OnDeviceCodeExpired events.
  • NewNew OAuth2 Server Token Revocation endpoint (RFC 7009): /sgc/oauth2/revoke with OnOAuth2AfterRevokeToken event.
  • NewNew OAuth2 Server Token Introspection endpoint (RFC 7662): /sgc/oauth2/introspect with OnOAuth2AfterIntrospectToken event.
  • NewNew OAuth2 Server Device Authorization endpoint (RFC 8628): /sgc/oauth2/device and /sgc/oauth2/device/verify with OnOAuth2DeviceAuthorization and OnOAuth2DeviceCodeVerification events.
  • NewNew OAuth2 Server Resource Owner Password Credentials grant handling (password grant_type).
  • NewNew OAuth2 Server Device Code token exchange (urn:ietf:params:oauth:grant-type:device_code grant_type).
  • NewNew OAuth2 Client DPoP support (RFC 9449): sender-constrained tokens via DPoPOptions with ES256/RS256 signing, automatic DPoP proof JWT generation, JWK thumbprint calculation (RFC 7638), and DPoP-Nonce retry handling.
  • NewNew OAuth2 Client DPoP methods: GetDPoPProof() for resource requests, GetDPoPJWKThumbprint() for token binding verification.
  • NewNew OAuth2 Server DPoP support (RFC 9449): DPoP proof validation, JWK thumbprint token binding, token_type DPoP issuance, and OnOAuth2ValidateDPoP event.
  • NewImproved Deflate extension: the speed has been improved specially for small messages. (Thanks to Michael for the fix).
  • NewNew TsgcWebView2 component: visual VCL wrapper for Microsoft Edge WebView2 with navigation, JavaScript (async/sync/init scripts), cookie management, download control, profile management, print, audio/mute, certificate handling, context menus, favicon, virtual host mapping, screenshot capture, and 20+ events. Supports Delphi 7 through Delphi 13.
  • NewNew Demo for WebView2 Browser: shows navigation, JavaScript execution, cookies, print, mute, clear data, virtual host mapping and event logging. Located in "Demos\50.Other\WebView2_Browser".
  • NewNew Gemini API: Google Gemini integration with Content Generation (with streaming), Vision, Structured JSON Output, Tool Use (function calling), Token Counting, Embeddings, and Model listing.
  • NewNew DeepSeek API: DeepSeek integration with Chat Completions (with streaming), Vision, Tool Use (function calling), and Model listing.
  • NewNew Ollama API: Ollama local LLM integration with Chat Completions (with streaming), Model Management (show, pull, delete, list tags), and Embeddings.
  • NewNew Grok API: xAI Grok integration with Chat Completions (with streaming), Vision, Tool Use (function calling), and Model listing.
  • NewNew Mistral API: Mistral AI integration with Chat Completions (with streaming), Vision, Structured JSON Output, Tool Use (function calling), Embeddings, and Model listing.
  • FixedFixed HTTP/2 server-side streaming for large responses: Eliminates out-of-memory crashes when serving large files and reduces peak server memory.
  • FixedFixed HTTP/2 client-side memory reallocation when receiving large responses: payload buffer now uses a capacity growth strategy with platform-specific caps (128 MB on Win32, 1 GB on Win64) instead of reallocating on every DATA frame.
  • FixedFixed HTTP/2 SSL write deadlock on large file transfers: WINDOW_UPDATEs are now queued and flushed between read iterations instead of being written inline during frame processing, preventing both client and server from blocking simultaneously on SSL_write.
  • FixedFixed HTTP/2 Integer overflow for files larger than 2 GB: changed FrameLength, Offset, WindowSize, PayLoadCapacity, ReadWindowSize, and flow control accumulators from Integer to Int64.
  • FixedFixed HTTP/2 stream state: RST_STREAM frames received on idle streams (after stream cleanup) now gracefully transition to closed instead of raising a PROTOCOL_ERROR.
  • FixedFixed HPACK encoder: GetBestMatchingIndex now correctly returns static table name-only matches, preventing compression errors on HTTP/2 connections.
  • FixedFixed HPACK encoder: Huffman bit mask uses correct shift-left operation.
  • FixedFixed HPACK decoder: byte count and available bytes calculations now correctly account for the buffer offset.
  • FixedFixed SetBytesFromInteger: intermediate byte extractions now masked with $FF to prevent range check errors on values like WINDOW_UPDATE increments.
  • FixedFixed typed pointer incompatibilities when compiling with the option active "Typed @ operator".
  • FixedFixed JWT RSA signing: vLength parameter in DoSignRSA was declared as Integer instead of TIdNativeUInt, causing potential stack corruption on 64-bit platforms. (Thanks to Gabriel for the fix).
  • FixedFixed Win64 pointer truncation in sgcHTTP_API_OpenAI: mciSendCommand calls used Cardinal() cast on pointers, replaced with NativeUInt().
  • FixedFixed OAuth2 Server: SetOAuth2Options memory leak fixed.
  • FixedFixed AWS Signature V4: fixed query string parameter sorting in canonical request.
  • FixedFixed Bitfinex access violation when unsubscribe from a channel.
  • FixedFixed memory leaks in Indy Servers caused by thread-unsafe lazy initialization of FSpecifications and FConnections fields. Concurrent Indy worker threads could race on creation, orphaning instances.
  • BreakingThe OnMQTTPublishEx event has changed the signature adding a new parameter aMessage of type TsgcWSMQTTMessage.

sgcWebSockets 2026.3.0

  • 2026.3.0: 2026 March
  • NewNew MQTT OnMQTTPublishEx event: provides the published message payload as a TsgcWSMQTTPublishData object with Value (string), Bytes (TBytes) and Stream (TMemoryStream) properties.
  • NewIndy Servers now support SChannel, so OpenSSL libraries are no longer needed on Windows for TLS.
  • NewNew OpenAI: Added Responses API, Fine-Tuning Jobs, Audio Speech, Batch and Uploads APIs, modernized Chat Completions, and new demo tabs for all features.
  • NewNew Anthropic Claude API: Added Messages (with streaming), Vision, Tool Use, Extended Thinking, Documents/PDF, Citations, Prompt Caching, Structured JSON Output, Web Search, MCP Server integration, Code Execution, Files, and Message Batches APIs, and new demo tabs for all features.
  • NewNew AMQP 0.9.1 Features: Basic.Nack, Exchange-to-Exchange bindings, Publisher Confirms, Connection.Blocked/Unblocked, OAuth/JWT token refresh, and incoming Basic.Ack handling.
  • NewThe Crypto API Demo has been split into multiple demos, one for each API provider.
  • NewNew Bitget REST & WebSocket API.
  • NewNew Gate.io REST & WebSocket API.
  • NewNew Deribit REST & WebSocket API.
  • NewNew Crypto.com REST & WebSocket API.
  • NewNew HTX REST API (Huobi rebrand).
  • NewUpdated Huobi WebSocket API URLs from huobi.pro to htx.com.
  • NewUpdated Binance REST & WebSocket API.
  • NewUpdated Bitstamp REST API.
  • NewUpdated Huobi WebSocket API.
  • NewUpdated CEX Plus WebSocket API.
  • NewUpdated BitMEX REST & WebSocket API.
  • NewUpdated OKX WebSocket API.
  • NewUpdated Bybit REST & WebSocket API.
  • NewUpdated Kraken REST API.
  • NewUpdated Coinbase REST API.
  • NewUpdated 3Commas REST API.
  • NewUpdated KuCoin REST & WebSocket API.
  • NewUpdated MEXC REST & WebSocket API.
  • NewUpdated Discord API from version 6 to version 10.
  • NewUpdated component icons.
  • FixedFixed Setup Error: Installing sgcWebSockets for Delphi 7 with sgcIndy raised an error about IdFIPS.pas.
  • FixedFixed AMQP 0.9.1: Parameter ordering, field-table encoding, spec-incorrect data types, missing channel IDs, read-loop data loss, and a thread-safety race condition.
  • FixedFixed AMQP 1.0: Serialization errors, missing frame fields, multiple memory leaks, connection state handling, heartbeat activation, and thread safety.
  • FixedFixed some minor memory leaks.

sgcWebSockets 2026.2.0

  • 2026.2.0: 2026 February
  • NewImproved OpenAPI Parser: Now allows converting OpenAPI files to Pascal using the command line.
  • NewImproved OpenAPI Parser: The executable is now compiled for Win32 and Win64. A new folder, "bin64", has been added for the 64-bit version.
  • NewNew OpenAPI Library: sgcOpenAPI.dll allows you to call the OpenAPI parser from a DLL.
  • NewNew OpenAPI API: When creating the Pascal interface file, you can now modify its content using a custom sgcOpenAPI_API.dll.
  • NewNew Demo for OpenAPI API: The folder "Demos\sgcOpenAPI_api" includes a Delphi demo of the sgcOpenAPI API.
  • NewImproved E2EE Components: Added support for group messages using group sender keys.
  • NewUpdated E2EE Demo: Added new options such as creating groups, joining, leaving, deleting, and sending group messages.
  • NewImproved OpenAI RealTime Client: The new method AppendInputAudioBuffer allows sending audio streams manually without using an Audio Recorder component.
  • NewAdded sgcWebSocket.module.js as an ES module version (thanks to Francesco for the file).
  • FixedFixed Indy Server bug: Authentication was not working even though it was enabled.
  • FixedFixed Indy Client bug: The ReadTimeOut property was not set properly when using TLS 1.3+ (thanks to Francesco for reporting it).
  • FixedFixed some minor setup bugs.
  • FixedFixed HTTP/2 Client demo: Now waits until the client has disconnected before processing a new request.

sgcWebSockets 2026.1.0

  • 2026.1.0: 2026 January
  • NewNew Protocol E2EE (End-to-End Encryption) where messages are encrypted end-to-end and only the communicating clients can read them. Available only for All-Access subscribers.
  • NewNew Demo E2EE: in the folder "Demos\02.WebSocket_Protocols\12.E2EE" there is a demo showing how the Server/Client E2EE work.
  • NewAdded support for Lazarus 4.4
  • NewImproved AMQP1 Client: added support for AMQP 1.0 over WebSockets.
  • NewImproved AMQP1 Client: added support for CBS Authentication (SAS Tokens and JWT).
  • NewUpdated the AMQP1 Demo to show how to connect to Azure Service Bus using AMQP1 over WebSockets and using CBS Authentication.
  • NewImproved Setup: now compiles and installs the sgcWebSockets package in Lazarus (before only extracts the files).
  • FixedFixed Bug MCP: when compiling the unit sgcMCP_Classes.pas under Lazarus an error was raised.
  • FixedFixed Bug Indy Server: access violation when running on Linux64.
  • FixedFixed Bug SignalR: when using Cookie authentication, the websocket connection was not using the cookie value.
  • FixedFixed Bug Setup: when installing sgcWebSockets with sgcIndy already installed under Delphi 7, the sgcIndy path was not found.
  • FixedFixed Bug Lazarus: when compiling the package there was an error in the sgcProtoBuf unit name.
  • FixedFixed Bug sgcSSL_WinSSPI: some definitions may cause an ambiguous error when compiling on cbuilder.

sgcWebSockets 2025.10.0

  • NewNew Component TsgcWSAPIClient_MCP implements the MCP Cilent specification.
  • NewNew Demo MCP Client showing the main features of the MCP Client, can be found in the folder "Demos\15.AI\03.MCP\02.MCP_Client".
  • NewImproved MCP Server: now supports Streamable HTTP.
  • NewImproved MCP Server: now supports Authentication using Custom Headers or API Key.
  • NewNew Client Component TsgcWSAPI_MEXC: Implements the WebSocket & HTTP API Spot API from MEXC (centralized cryptocurrency exchange).
  • NewNew Client Component TsgcWSAPI_MEXC_Futures: Implements the WebSocket & HTTP API Futures API from MEXC (centralized cryptocurrency exchange).
  • NewUpdated CryptoAPI demo showing the main features of the MEXC API. It's in the folder "05.Crypto\01.CryptoAPI".
  • NewImproved Setup: now the uninstaller is digitally signed.
  • NewImproved HTTP Server: new event OnHTTPUploadBeforeCreatePostStream which is fired before the stream is created.
  • NewImproved HTTP Client: new property keep-alive to maintain the connection alive between requests.
  • NewImproved Google Cloud Clients: new property TLSOptions to customize the secure connection options. Apply to Google Cloud FCM, Calendar and PubSub Clients.
  • FixedFixed Bug MCP component: when returning a json-rpc error, the node error was not set properly.
  • FixedFixed Bug MultipartFormData: when HTTPUploadFiles.RemoveBoundaries was true and the file size was zero, the file was created with the boundaries included.
  • FixedFixed Memory Leak in the STOMP ActiveMQ Client Component.
  • FixedFixed Memory Leak in the STOMP RabbitMQ Client Component.
  • FixedFixed Bug Server: when KeepAlive property was active, the built-in javascript libraries return an error 404.
  • FixedFixed Bug Server: when Authentication was not enabled, if the client send a request with an Authorization header, by default the connection was closed.
  • FixedFixed Bug ServerSentEvents: when sending multiple messages the headers were included in the message.
  • FixedFixed Bug ServerSentEvents: the initial message was sent twice.

sgcWebSockets 2025.9.0

  • NewNew Component TsgcWSAPIServer_MCP implements the MCP Server specification, currently supports: Tools, Prompts and Resources requests.
  • NewNew Demo MCP Server showing the main features of the MCP Server, can be found in the folder "Demos\15.AI\03.MCP\01.MCP_Server".
  • NewUpdated the Telegram libraries to the version 1.8.54. (Windows, Android, iOS, Linux64 and OSX).
  • NewUpdated sgcIndy to the latest version.
  • NewImproved setup: added a remainder to configure the platform in the IDE if unavailable. (Thanks to Peter for the suggestion).
  • NewImproved sgcIndy Setup: added the parameter "/debug" to get a warning message if there is any error while compiling the Embarcadero package.
  • FixedFixed Bug Telegram: the android64 library requires to be built with a 16KB page size from November 2025.
  • FixedFixed Bug sgcIndy: the cipherlist is now set before loading the certificates to allow to set for example the security level. (Thanks to Preben for the fix)
  • FixedFixed Bug sgcIndy: Cannot assign a TIdSSLX509Checks to a TIdSSLOptions_Internal.
  • FixedFixed Bug sgcIDE Expert: the form was not displayed with the correct size.
  • FixedFixed Bug OnHandshake event: UTF-8 characters were not encoded properly when adding new headers.
  • FixedFixed Bug AMQP: the internal function sgcWriteAMQPFieldTable was passing all the values as a string.
  • FixedFixed Bug TsgcOpenAIClass.DoReadDouble: when the decimal separator wasn't set to '.' the returned value was invalid. (Thanks to Pierre for the fix)
  • FixedFixed Bug OpenAPI Parser: optional Boolean parameters can't send a False parameter in the querystring, now the boolean has been replaced by TsgcOpenAPIBoolean.
  • FixedFixed Bug DataSnap HTTP/2 Server: OPTION requests where not processed and the connection was not closed.
  • FixedFixed Bug Indy Server: if Authentication.Basic was enabled, the server didn't return the Basic Realm when the Authentication header was wrong.
  • BreakingOpenAPI: Optional Boolean Parameters have been replace by the enum TsgcOpenAPIBoolean = (oapiBoolNull, oapiBoolFalse, oapiBoolTrue).

sgcWebSockets 2025.8.0

  • NewAdded Support for Rad Studio 13 Florence.
  • NewThe WebAuthn Server Component passed the full FIDO Conformance Test using the Conformance Self-Validation Testing tool.
  • NewImproved Servers: Added a new Authorization protocol in the property Authentication.WebAuthn.
  • NewImproved WebAuthn: new event "OnWebAuthnUnauthorized" which is called when a request is not authorized and will be disconnected here you can configure which endpoints require WebAuthn Authentication and which not.
  • NewImproved sgcIndy Setup: the Embarcadero IP Abstraction units are now compiled with the sgcIndy version installed.
  • NewImproved sgcIndy Setup, Added support for CBuilder 64-bits IDE.
  • NewImproved sgcIndy Setup: Added the Platform "Windows 64-bit Modern" for CBuilder.
  • NewImproved IOCP Server when using TCP Connections. If in the event OnTCPConnection, the property Connection.Transport is set to trpTCP, the event OnConnect will be fired instead of waiting till receive the first message.
  • FixedFixed Bug Setup, when installing the enterprise edition without the custom indy version returned the error E2003: Undeclared identifier: 'DoProcessHTTP'.
  • FixedFixed Bug sgcIndy: when installing community edition and then the registered version, the original indy package was not restored when sgcIndy was uninstalled.
  • FixedFixed Bug sgcIndy: the setup wasn't disabling the package msedge when setting compatibility mode to true.
  • FixedFixed Bug sgcIndy: after uninstalling sgcIndy an rtl.bpl error was raised after closing the IDE.
  • FixedFixed Bug sgcIndy: when multiple editions were installed a Runtime error maybe raised when opening the IDE.
  • FixedFixed Bug sgcIndy: when compiling IdSSLOpenSSLHeaders_static for iOS, error E2009: Incompatible types: "Calling conventions differ".
  • BreakingRenamed CERT_NAME_BLOB to CERTIFICATE_NAME_BLOB in the unit sgcSSL_WinSSPI to avoid name conflict with other libraries.
  • BreakingRenamed the property HeartBeat.HearBeatType to HeartBeat.HeartBeatType.

sgcWebSockets 2025.7.0

  • NewImproved WebAuthn: added support for PS256, PS384 and PS512 algorithms.
  • NewImproved WebAuthn: new property WebAuthnOptions.MDS to configure the Fido Metadata Service.
  • NewImproved HTTP.SYS: added support for the WebAuthn protocol.
  • NewUpdated the OpenSSL libraries to the version 3.5.1
  • NewImproved STOMP Protocol: added a new event OnSTOMPPing to handle the pings sent/received.
  • NewImproved Clients using OpenSSL: new property TLSOptions.OpenSSL_Options.X509Checks to enable validate HostName and IPAddress in X509 Certificates.
  • NewImproved sgcIndy: new property TIdSSLIOHandlerSocketOpenSSL.SSLOptions.X509Checks to enable validate HostName and IPAddress in X509 Certificates.
  • FixedFixed Bug WhatsApp: when sending an url or path, the message was not decoded properly.
  • FixedFixed Bug sgcVer.inc: rearrange some compiler directives to avoid incompatiblities between editions.
  • FixedFixed Memory Leak WebSocket WinHTTP Client.
  • FixedFixed Memory Leak Google Calendar Client.
  • FixedFixed Memory Leak UDP Server and Client.
  • FixedFixed Memory Leak ByBit Client.
  • FixedFixed Memory Leak HTTP.SYS Server.
  • FixedFixed Memory Leak when using the SGC_HTTPAPI_STATIC compiler directive.
  • FixedFixed Memory Leak MQTT Client.
  • FixedFixed Memory Leak WebAuthn Server Component.
  • FixedFixed Bug setup, when installing for CBuilder 12 the setup failed to install the components for the IDE 64bits.
  • FixedFixed some minor bugs.

sgcWebSockets 2025.6.0

  • NewImproved OpenAI Assistant: new event OnFunctionCall which allows to interface OpenAI models with your code, database, applications...
  • NewUpdated the OpenAI Assistant Demo with a new Assistant "Delphi Weather Bot" showing how it works.
  • NewImproved Whatsapp API: updated api to v20.
  • NewImproved Whatsapp API: new method SendMessageReaction.
  • NewImproved Whatsapp API: the SendMessage methods now include a new optional parameter called options where you can reply to a message passing the message-id.
  • NewImproved Telegram API: added more than 100 new methods to the api.
  • NewImproved Google PubSub Client: updated to the latest version the methods for projects subscriptions and topics.
  • NewImproved RSA unit: the function sgcRSA_GetPRSAFromCOSE only works for openssl 1.1+.
  • NewImproved WebAuthn: added support for the algorithm EDDSA.
  • NewImproved WebAuthn: new Event OnWebAuthnRegistrationValidateCertificate, allows to verify the certificate with your own methods or assign a root certificate if not provided.
  • NewImproved WebAuthn: new Event OnWebAuthnMetadata, allows to provide a custom metadata if the authenticator is not found in the Fido MDS file.
  • NewImproved WebAuthn: new property WebAuthnOptions.DefaultOptions to provide the default values of the Registration and Authentication Options Request.
  • NewImproved WebAuthn: included more validations for the certificate fields.
  • NewImproved WebAuthn: now validates the type of the request json fields.
  • NewImproved OpenAPI Parser: added support for OneOf elements.
  • NewImproved sgcIndy: new function sgcIdSSLOpenSSL.GetOpenSSLErrors to obtain the list of the latest errors.
  • NewImproved setup: now supports Rad Studio 64bits for sgcWebSockets Basic editions.
  • FixedImproved SignalRCore: added the SignalRCore.SkipNegotiation property to skip connection negotiation and establish a WebSocket connection directly.
  • FixedFixed Bug CBuilder: calling the method SendMessage on some components returned an error.
  • FixedFixed Bug SignalR: the initial http request was creating a log file by default.
  • FixedFixed Bug using the method RegisterProtocol(aProtocol: string) if this was called before assigning the events, the events were not called.
  • FixedFixed Bug internal method was calling OnMessage event instead of OnError.
  • FixedFixed Bug sgcIndy: function RSA_set0_key, only is required for openssl 1.1+.
  • FixedFixed Bug sgcIndy: decoding UTC DataTime.
  • FixedFixed Bug sgcIndy: if EVP_PKEY_base_id function is not available use the EVP_PKEY_is_a function instead.
  • FixedFixed Bug Binance: the websocket messages were not processed. (Thanks to Alex for the fix).
  • FixedFixed Bug Indy Server: if Authentication was enabled, if the HTTP Request hasn't any authentication, the connection was accepted although Authentication.AllowNonAuth was set to false.
  • FixedFixed Bug JWT: some internal openssl objects were not properly destroyed after signing or validating.
  • FixedFixed Bug JWT: error evaluating if the algorithms TIdHashSHA384 or TIdHashSHA512 were available.
  • FixedFixed Bug AI Components: removed some memory leaks while destroying the internal objects.
  • FixedFixed Bug TsgcHTTP1Client: when calling an Async method, the default request was not assigned internally.

sgcWebSockets 2025.5.0

  • NewImproved WebAuthn Server: new events to handle better the Options request/response for the Registration and Authentication flows.
  • - OnWebAuthnRegistrationOptionsRequest: allows to cancel an undesired registration request.
  • - OnWebAuthnRegistrationOptionsResponse: allows to customize the registration options response.
  • - OnWebAuthnAuthenticationOptionsRequest: the parameter CredentialRecord has been changed to a list of CredentialRecords.
  • - OnWebAuthnAuthenticationOptionsResponse: allows to customize the authentication options response.
  • NewImproved the WebAuthn demo to show how to store multiple credential records.
  • NewNew Component TsgcWSAPI_OpenAI, implements OpenAI Realtime API Beta using the websocket protocol as transport.
  • NewNew Demo showing the main features of the TsgcWSAPI_OpenAI client component. It's located in the folder "Demos\15.AI\01.QuickStart\06.RealTime".
  • NewNew Component TsgcAudioRecorderWave, allowing to record microphone audio as PCM16 and store into a wave file.
  • NewImproved Setup: added a new About button when the setup has finished with the credits.
  • NewImproved TsgcHTTPRequest Class: added the property Headers which contains all the HTTP Headers of the request.
  • FixedFixed in Server APIs: when http/2 was enabled, the response was empty.
  • FixedFixed in Server APIs: when using more than one Server API only the last assigned API was working.
  • FixedFixed Bug MQTT: When reading the MQTT 5 properties, if the size of the packet was 2 bytes or more, the message was not parsed successfully.
  • FixedFixed Bug MQTT: When reading the Remaining Length of the packet, if was greater than 128, the message was not parsed successfully.
  • FixedFixed Bug Setup, the third-party libraries were not extracted in the correct folder.
  • BreakingDeleted the BlockChain API Component.
  • BreakingThe event OnWebAuthnAuthenticationRequest has been renamed to OnWebAuthnAuthenticationOptionsRequest.

sgcWebSockets 2025.4.0

  • NewNew WebAuthn Server Component: Implements the WebAuthn Server Specification, a web standard for secure, passwordless authentication. Currently in BETA.
  • NewNew WebAuthn Demo: Demonstrates how to register and authenticate using the TsgcWSAPIServer_WebAuthn component. Available in the folder "Demos\20.HTTP_Protocol\12.WebAuthn".
  • NewWebAuthn Attestation Formats Supported: None, Packed, TPM, AndroidKey, Apple, and FidoU2F.
  • NewWebAuthn Algorithms Supported: ES256 and RS256.
  • NewImproved the SGC Protocol Demo "Demos\02.WebSocket_Protocols\01.SGC_Generic_PubSub_Protocol" now includes SSL support and allows configuration of the QoSLevel on both server and client components.
  • FixedFixed bug in OAuth2 Client: When changing the local server port, the old port was not removed from the bindings list.
  • FixedFixed bug in WebBroker HTTP/2 Server: The DoBeforeOnCommand function was not properly defined.
  • FixedFixed bug in AMQP1 Client: When reading a timestamp value, the decoded result was incorrect in some cases.
  • FixedFixed bug in AMQP1 Client: Reading an empty map resulted in an integer overflow exception.
  • FixedFixed bug in AMQP1 Client: Binary data was not decoded properly.
  • FixedFixed bug in AMQP1 Client: When reading a UUID, the internal offset value was not updated correctly.
  • FixedFixed bug in OpenAI Azure Client: The endpoint used for transcription requests was incorrect.
  • FixedFixed bug in OpenAI Demo: Located in Demos\15.AI\01.QuickStart\04.ChatGPT. When sending the context of previous requests, failures could occur due to improperly encoded JSON strings.
  • FixedFixed bug in MultipartFormData: When extracting files, the internal stream was not using UTF-8 encoding.
  • FixedFixed bug in Setup: When using the /extract command, if the Delphi version was not installed, the extraction process failed.
  • FixedFixed bug in MQTT Client: memory leak if the component was destroyed before the event OnDisconnect was called.

sgcWebSockets 2025.3.0

  • NewAdded Support for Rad Studio 12.3
  • NewImproved Setup, a new option "Build Rad Studio IDE Win64" allows to install the package for the 64-bit IDE, by default is disabled.
  • NewImproved TsgcWebSocketClient, when using SChannel there is a new event "OnSChannelVerifyPeer" to validate manually the certificate.
  • NewImproved HTTPClient, when using SChannel there is a new event "OnSChannelVerifyPeer" to validate manually the certificate.
  • NewImproved TCPClient, when using SChannel there is a new event "OnSChannelVerifyPeer" to validate manually the certificate.
  • NewImproved OpenAPI Google Demos, when using service account to authenticate if the subject and scope are not defined, a default value is set.
  • NewImproved TsgcWebSocketClient_WinHTTP, the OnHandshake event is now called before connecting, allowing customization of the WebSocket HTTP headers.
  • NewImproved HTTP.SYS Server, the reason response code table has been updated to include all possible values.
  • NewImproved sgcIndy, added two functions: IdOpenSSLSetLoadFuncsCallback and IdOpenSSLSetUnLoadFuncsCallback to load additional openssl functions using the dll already loaded.
  • NewImproved sgcIndy, new demo LoadCustomFunctions which shows how to use the new callback for loading additional openssl functions.
  • NewImproved TsgcHTTP1Client, new methods for async requests: GetAsync, PostAsync, PutAsync... the response is received asynchronously in the event OnAsyncResult of the component.
  • FixedFixed Bug WebPush was not working whe compiling for Win64.
  • FixedFixed Bug sgcIdSSLOpenSSLHeaders, the method X509_STORE_CTX_free was not properly defined.
  • FixedFixed Bug sgcIdSSLOpenSSLHeader, the method ECDH_compute_key was not properly defined.
  • FixedFixed Bug CBuilder error "reference to HRESULT is ambiguous".
  • FixedFixed Bug CBuilder error "expected unqualified-id" in the SChannel units.
  • FixedFixed Bug HTTP.SYS Server, all HTTP responses were sent with a fixed response code 200.
  • FixedFixed Bug HTTP/2 Demo, the server was only accepting tls1_3 while the client was using tls1_2.

sgcWebSockets 2025.2.0

  • NewImproved Socket.IO Client, new property HandShakeAuthToken to set the authentication token when required.
  • NewImproved Socket.IO sample, the previous online server has been closed and now has been replaced by a new one.
  • NewImproved Setup, now if detects the IDE is running aborts the installation until it's closed.
  • NewImproved HTTP.SYS Server to handle Partial Requests. Added the following properties:
  • - THttpServerRequest: Range.
  • - THttpServerResponse: AcceptRanges, ContentRangeStart, ContentRangeEnd and ContentRangeInstanceLength.
  • NewImproved TsgcWebSocketHTTPServer, new event OnBeforeCommand which allows to customize the response, authorize or not a request... before is done internally.
  • FixedFixed Bug MQTT Client when using mqtt5 the payload had some invalid characters.
  • FixedFixed Bug MQTT Client when the connection is over TCP a message received in multiple packets was not decoded properly.
  • FixedFixed Bug TLS and Android, when using ALPN, the accepted value returned was not properly decoded.
  • FixedFixed Bug Pusher Client, error processing subscription event without data.
  • FixedFixed Bug Telegram Client reading the Sender User Id in a group. (Thanks to Michael for the fix).
  • FixedFixed Bug DataSnap+HTTP.SYS Server the value of the funciton TsgcWebRequestHTTPAPI.GetHeaderValue was returning always empty string.
  • FixedFixed Bug AMQP1_Client reading an internal TThreadList.
  • FixedFixed Bug HTTP2 Server, Authentication Basic was not working although it was enabled.

sgcWebSockets 2025.1.0

  • NewImproved OpenAPI Parser, added support for multipart/form-data requests.
  • NewImproved OpenAI Assistant Demo, now can load the existing assistants created using other tools like openAI Playground.
  • NewImproved OpenAI Assistant, now supports Streaming the responses using Server-Sent events streams.
  • NewImproved OpenAI Assistant Demo, there is a new checkbox called Streaming to indicate if the response is using streaming or not.
  • NewImproved TsgcHTTP1Client, added the following events: OnSSLGetHandler and OnSSLAfterCreateHandler.
  • NewImproved OpenAPI Client, added the following events: OnSSLVerifyPeer, OnSSLGetHandler and OnSSLAfterCreateHandler.
  • NewImproved Coinbase Client, updated to support the Advanced Trade WebSocket & REST API.
  • NewImproved Crypto Demo Sample, to show the main features onf the Coinbase Client.
  • NewImproved the performance of the WebSocket Extension PerMessage-Deflate. (Thanks to Michael for the patch).
  • FixedFixed Bug MQTT Client in some cases the MQTT ACK it may not be sent.
  • FixedFixed Bug TsgcWebSocketClient when using Connect, if the ConnectTimeout was greater than zero, it may appear a conflict.
  • FixedFixed Bug OpenAPI Parser when the content of the body is "application/x-www-form-urlencoded" it was sending as json by default.
  • FixedFixed Bug OpenAPI Parser when generating the content as "application/x-www-form-urlencoded" for Dynamic Arrays.
  • FixedFixed Bug OpenAPI Parser reading class properties where the name contains characters like "[]".
  • FixedFixed Bug TsgcWSHTTP2WebBrokerBridgeServer component, when using the default content-type, the charset was removed automatically when setting the content-type.
  • FixedFixed Bug sgcWebSockets Packages from XE5 to D12 the ObjOutput and HppOutput was set to the directory ..\libDXE4 (Thanks to Robert for letting me know).
  • FixedFixed Bug HTTP/2 Client connecting using openssl 3.0 and tls 1.3.
  • FixedFixed Bug OpenSSL when setting Version TLS 1.3 and VersionMin TLS 1.2, only TLS 1.2 was available.

Get the current release

Every licence includes a year of updates, and the trial is the full product.

sgcWebSockets All release notes