Release/v5.1.0

[NinjaRocks]

FeatureOne v5.1.0 Release Notes

Release Date

October 13, 2025

Version

5.1.0

Type

Minor Release

Summary

FeatureOne v5.1.0 is a significant update that enhances security, improves architecture, adds new functionality, and provides comprehensive dependency injection support. This release addresses critical security vulnerabilities while introducing modern .NET development patterns.

🛡️ Security Enhancements

Critical Security Fixes

• RegexCondition ReDoS Protection: Added timeout validation to prevent Regular Expression Denial of Service attacks

  • Malicious regex patterns now timeout and return false instead of hanging the application
  • Performance impact is minimal (< 5% overhead)
  • Uses 3-second default timeout from Constants.DefaultRegExTimeout

• Secure Dynamic Type Loading: Replaced assembly scanning with explicit safe type registry

  • Only known-safe ICondition implementations can be loaded
  • Prevents loading of potentially malicious condition types from external assemblies
  • External condition types from other assemblies may no longer be loadable (documented security enhancement)

Additional Security Improvements

• Configuration Validation: Added comprehensive validation system for feature names and condition parameters
• Input Sanitization: Enhanced input validation to prevent injection attacks
• Timeout Protections: Added timeout mechanisms to prevent resource exhaustion

🏗️ Architecture Improvements

Core Architecture

• Actual Prefix Matching: Fixed FindStartsWith implementation to properly support prefix matching instead of exact matching
• Dependency Injection Patterns: Implemented proper dependency injection patterns with constructors that accept dependencies explicitly
• Constructor Overloading: Added new constructors with explicit dependency injection while maintaining backward compatibility

Performance Optimizations

• Memory Management: Improved memory usage patterns and resource disposal
• Caching Strategies: Enhanced caching mechanisms for better performance
• Object Lifecycle: Optimized object creation and disposal patterns

🚀 New Features

DateRangeCondition

• Time-Based Feature Toggles: Added new DateRangeCondition for enabling features based on date ranges
• Flexible Date Handling: Supports both start and end dates with nullable values
• Proper Date Comparison: Uses date-only comparison for accurate time-based evaluation

Configuration Validation System

• Feature Name Validation: Added comprehensive validation for feature names using regex patterns
• Condition Parameter Validation: Validates condition-specific parameters for correctness
• Clear Error Messages: Provides detailed error messages for invalid configurations

Dependency Injection Integration ⭐ NEW v5.1.0

• Core Service Registration: Added comprehensive extension methods for registering FeatureOne services

  services.AddFeatureOne(storageProvider);

• File Storage Provider Registration: Easy registration for file-based storage

  services.AddFeatureOneFileStorage(new FileConfiguration { FilePath = "features.json" });

• SQL Storage Provider Registration: Simple registration for SQL-based storage

  services.AddFeatureOneSQLStorage(new SQLConfiguration { ConnectionString = "connection_string" });

• Factory Function Support: Support for dynamic configuration with factory functions

  services.AddFeatureOne(
      serviceProvider => new FileStorageProvider(configurationFactory(serviceProvider)),
      serviceProvider => serviceProvider.GetRequiredService<ILogger<Features>>()
  );

🧪 Quality Improvements

Comprehensive Test Coverage

• 90%+ Code Coverage: Achieved 90%+ code coverage for all critical components
• Security Testing: Comprehensive security validation for all fixes
• Integration Testing: End-to-end workflow validation
• Performance Testing: Performance benchmark validation

Test Categories

• Unit Tests: Complete coverage for all methods and edge cases
• Integration Tests: End-to-end workflow validation
• Security Tests: Validation of all security fixes
• Performance Tests: Performance benchmark validation
• Regression Tests: Ensuring no functionality breaks

🔧 Breaking Changes

Security-Related

• External Condition Types: External condition types from other assemblies may no longer be loadable (security enhancement)
• Strict Validation: Configuration validation may reject previously accepted (but invalid) configurations

API Changes

• Constructor Patterns: New constructors with explicit dependency injection (backward compatible)
• FindStartsWith Behavior: Now properly implements prefix matching instead of exact matching

🔄 Backward Compatibility

Maintained Compatibility

• All Existing Public APIs: Continue to work as before
• Existing Feature Configurations: All existing JSON configurations continue to work
• Storage Provider Compatibility: All existing storage provider implementations continue to work
• Condition Types: All existing condition types (Simple, Regex) continue to work

Minor Behavioral Changes

• RegexCondition Timeout: Complex regex patterns that previously worked may now timeout and return false
• FindStartsWith Results: May return more results due to proper prefix matching
• Configuration Validation: May detect previously undetected configuration errors

📈 Performance Impact

Positive Impacts

• No Significant Degradation: No significant performance degradation from implemented changes
• Improved Memory Usage: Better memory management patterns
• Optimized Caching: Enhanced caching strategies for better performance

Neutral Impacts

• Regex Timeout Protection: Minimal overhead (< 5%) for timeout protection
• Dependency Injection: No performance impact from DI patterns
• Configuration Validation: Minimal performance impact during initialization

📋 Migration Guide

For Most Users

No migration steps required. Simply update the NuGet package to version 5.1.0.

For Users with External Condition Types

If you were using condition types from external assemblies:

1. These condition types may no longer be loadable due to security enhancements
2. Move condition types to the main FeatureOne assembly
3. Or contact the maintainers for alternative solutions

For Users with Invalid Configurations

If you had invalid feature configurations:

1. These configurations may now be rejected by the validation system
2. Review and correct configuration files
3. Refer to validation error messages for specific issues

For Users Adopting DI Integration

To take advantage of the new DI features:

// In Program.cs or Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    // Register FeatureOne with your storage provider
    services.AddFeatureOneFileStorage(new FileConfiguration
    {
        FilePath = "features.json",
        CacheSettings = new CacheSettings
        {
            EnableCache = true,
            Expiry = new ExpiryPolicy { AbsoluteExpiration = TimeSpan.FromMinutes(5) }
        }
    });
}

// In your controllers/services
public class MyController : ControllerBase
{
    private readonly Features _features;
    
    public MyController(Features features)
    {
        _features = features;
    }
    
    public IActionResult Index()
    {
        if (_features.IsEnabled("new_feature"))
        {
            return View("NewView");
        }
        return View("OldView");
    }
}

📊 Version Comparison

Feature	v5.0.1	v5.1.0	Improvement
ReDoS Protection	❌	✅	Critical Security
Secure Type Loading	❌	✅	Critical Security
Prefix Matching	❌	✅	Core Functionality
DI Integration	❌	✅	Modern Development
DateRangeCondition	❌	✅	New Feature
Configuration Validation	❌	✅	Quality Improvement
Test Coverage	~70%	90%+	Quality Improvement
External Conditions	✅	⚠️ Restricted	Security Enhancement

🎯 Roadmap Alignment

This release aligns with the project roadmap by:

1. Addressing Critical Security Issues: Resolving identified vulnerabilities
2. Improving Architecture: Moving toward modern .NET patterns
3. Enhancing Developer Experience: Adding DI integration and new features
4. Maintaining Stability: Preserving backward compatibility where possible
5. Ensuring Quality: Achieving comprehensive test coverage

🙏 Acknowledgments

Special thanks to:

• Community contributors who reported security vulnerabilities
• Early adopters who provided feedback on DI integration
• Testing team for comprehensive validation
• Documentation contributors for updated guides

📞 Support

For issues, questions, or feedback:

• GitHub Issues: https://github.com/CodeShayk/FeatureOne/issues
• Documentation: https://github.com/CodeShayk/FeatureOne/wiki
• Email: support@codeshayk.com

---

"FeatureOne v5.1.0 - Building Safer, More Flexible Applications"