sgcOpenAPI 2026.8.0 Latest
- 2026.8.0: 2026 August
- NewUpdated the zlib library from 1.2.12 to 1.3.1, which corrects CVE-2022-37434, a heap over-read in inflate that was present in 1.2.12.
- NewThe Code-First OpenAPI server can now invoke your annotated methods directly. Create a TsgcOpenAPICodeFirstDispatcher, register your service instance with RegisterController and assign it to the new Dispatcher property of the OpenAPI server. Each operation is routed to the method that produced it, the parameters are bound from the path, the query string, the headers or the body following the sgcFromPath, sgcFromQuery, sgcFromHeader and sgcFromBody attributes, and a function result is serialized to JSON and sent with the status code declared in sgcResponse. A method that also takes a TsgcOpenAPIServerContext parameter receives the request context and writes the response itself, so it can answer 201, 204 or 404 as needed. Operations without a controller method still reach the OnRequest event as before.
- NewThe OpenAPI Parser can now leave endpoints out of the generated code, which is useful with large specifications where only a few endpoints are needed. In the wizard, untick the methods you do not want on the list of parsed methods. From the command line, use -x (or -exclude) with a comma separated list of "VERB endpoint" entries, for example -x "GET /pets,DELETE /pets/{petId}", or pass the name of a file with one entry per line. The same list can be set with the exclude key of the configuration file loaded with -c, and the command line replaces the list read from the file.
- NewThe OpenAPI Parser can now generate only the classes that the selected endpoints use. Leaving endpoints out did not make the generated file much smaller, because a class was created for every schema of the specification even when no selected endpoint used it. On a specification with 310 endpoints and 1096 schemas, keeping only the 5 authentication endpoints produced a file of 2 MB, and now produces one of 36 KB. In the wizard, tick "Remove Unused Classes" on the parser options page. From the command line, use -p (or -prune), which can also be set with the prune key of the configuration file loaded with -c. The command line option also removes the classes that no endpoint of the specification uses, even when all the endpoints are generated.
- FixedFixed Bug Code-First: the route declared at class level was applied twice, once as the server url and again on every path, so a service routed /api/v1 with a method routed /tasks was published at /api/v1/api/v1/tasks. The paths of the generated specification are now relative to the server url, so the service is published at /api/v1/tasks. Clients that were calling the duplicated path must be updated.
- FixedFixed Bug the OpenAPI server answered a request with the first route whose shape fitted it, so a literal path could be handled by a templated route registered before it, for example /tasks/stats answered by /tasks/{taskId}. A literal segment now wins over a parameter segment at the same position.
- FixedFixed Bug Code-First: two methods routed to the same verb and path were accepted silently, which produced a specification with the same method repeated inside one path and left one of the two methods unreachable. The specification generator and RegisterController now both raise an error naming the verb, the path and the two methods involved. The same path served with different verbs, for example GET and POST on /tasks, remains valid and keeps working.
- FixedFixed Bug Code-First: enum parameters only accepted their ordinal value, so a request that sent the member name, which is what the generated specification advertises, silently bound the first member. Enum parameters now bind by name first, ignoring case, and fall back to the ordinal. A value outside the range of the enum no longer produces an invalid value, it binds the lowest member of the enum instead.
- FixedFixed Bug unit sgcHTTPServer_OpenAPI was not deployed in the setup.
- FixedFixed Bug OpenAPI Parser: when an operation declared error responses but its successful response had no content, for example a DELETE that answers 204 and 404, the generated method created the response object but did not pass it to the request. The client raised an exception instead of returning the error, and the caller was left with an unassigned response. The generated code now passes the response object, so the error is returned and is available in the ErrorNNN property, for example Error404.
- FixedFixed Bug OpenAPI Client: a response that returned an array leaked one object per item, because the array class never released the objects it read. Those objects are now freed when the response is destroyed, and reading twice into the same array no longer leaks either. Fixed too an access violation raised when the payload of an array response was not a JSON array.
- FixedFixed Bug OpenSSL: when a TLS connection failed, the real OpenSSL error was discarded and the exception showed a misleading text, for example "error:00000006:lib(0):func(0):EVP lib". Now the exception shows the error reported by OpenSSL.
- FixedFixed Bug OpenSSL: when the certificate file contained the certificate and the private key together, an error was left pending inside OpenSSL and could affect later calls. Real errors while reading the certificate chain were ignored too. Both cases are now handled properly.
- FixedFixed Bug OpenSSL: the SSL options (disable old TLS versions, disable compression, disable renegotiation and server cipher preference) were ignored when using OpenSSL 1.1 or later. Now they are applied.
- FixedFixed Bug OpenSSL: enabling the legacy provider did nothing when legacy.dll could not be found. The failure was silent and showed up later as a confusing certificate error. Now it reports which provider could not be loaded and where it was searched.
- FixedFixed Bug OpenSSL: improved the error when a PKCS#12 certificate (.p12 or .pfx) cannot be read because it uses an old algorithm such as RC2 40-bit. OpenSSL 3 moved those algorithms to the legacy provider, and the message now explains how to enable it.
- FixedFixed Bug OpenSSL: the error reported when a PKCS#12 private key fails to load named the certificate function instead of the private key function.
- FixedFixed Bug OpenAPI Server: when EnforceSecurity was enabled and the matching validation event was not assigned, the security scheme passed instead of failing, so any request that merely carried an api key or an Authorization header reached the operation. A Basic header whose contents could not be decoded, or which had no user and no password, was accepted too, and a scope declared in the specification was not checked when no JWTSecret was configured. The schemes now fail closed. If you enabled EnforceSecurity without assigning OnValidateAPIKey, OnValidateBasic or OnValidateBearer, those requests now answer 401, so assign the event for the schemes your specification declares, or configure JWTSecret.
- FixedFixed Bug OpenSSL: a TLS connection could write past the end of its read buffer when the other side sent several encrypted records together in the same packet, which could crash the application or corrupt memory next to the buffer. The buffer was told it had more free space than it really had.
- FixedFixed Bug HTTP Client: the limit on the number of response headers was never applied, so a server could send an endless stream of headers until the client ran out of memory. Setting MaxHeaderLines to 0, which is documented as no limit, had the opposite effect and discarded every response header, including Content-Length and Location.
- FixedFixed Bug HTTP Client: an NTLM authentication reply shorter than expected was read past its end, so the challenge used to answer it could be taken from unrelated memory and the client could crash. The reply is now checked before it is used, including its signature and its message type.
- FixedFixed Bug SOCKS Proxy: a UDP reply bigger than the buffer of the caller was copied past the end of that buffer, and a reply that was truncated or declared an unknown address type was read past its end. Replies are now validated and the copy is limited to the size of the buffer.
- FixedFixed Bug TLS Options: copying the TLS options from one component to another lost most of them. Only the IO handler, the ALPN protocols and the OpenSSL options were copied, so the certificate files, the password, the root certificate, the TLS version, the verify depth, the SChannel options and VerifyCertificate were left at their empty values, and a component set up this way did not verify the certificate of the server it connected to.
- FixedFixed Bug SOCKS Proxy: several problems when the address is a host name instead of an IP address. The reply from the proxy was read one byte short, so the first byte of the answer reached the application as if it were data, and the port was taken from the wrong position. In the reply to a UDP request, an IPv6 address had two of its bytes read as the port. A host name longer than 248 characters also wrote past the end of the buffer used to build the request.
- FixedFixed Bug HTTP Client: NTLM authentication now reports clearly that it cannot run, instead of sending an empty answer that no server can accept. The routines that calculate the NTLM response are not available unless SGC_NATIVE_CRYPTO is enabled in the project, and until now the client sent an empty response and the server answered 401 again, which looked like a wrong user name or password. On Windows nothing changes, NTLM is handled by the operating system through SSPI.
- FixedFixed Bug OpenAPI Parser: the Import column on the list of parsed methods could not be ticked, so every endpoint of the specification was always generated. The column is editable now, and only the methods left ticked are written to the generated unit. The list also shows the endpoint of each method and adds a box to filter it by method name or endpoint, buttons to select all, select none or invert the selection, and a counter of how many methods are selected. The selection is kept when moving back and forward through the wizard, and it is cleared when a different specification is loaded.