Project history · 2021-present

Built in public,
change by change.

A complete, curated account of the client from its first commit through today, grounded in the releases, pull requests, issues, and commit history that shipped it.

139
mainline commits reviewed
30
merged pull requests
15
GitHub releases
48
explained changes

What “complete” means here

This timeline covers all 16 release eras on the main branch and every merged pull request. The repository has no standalone issues; the linked NuGet issue is the only external issue that directly shaped a shipped workaround. Closed, unmerged dependency proposals are not presented as delivered changes.

January-July 2026

Current main

Unreleased

The client completed its HIBP API v3 surface, added first-class observability, and launched the documentation site with privacy-focused interactive examples.

Completed the HIBP API v3 contract

The client now covers the remaining breach, domain-verification, password, and stealer-log operations while providing typed API failures, subscription-level helpers, centralized HTTP behavior, and focused contract tests.

Added OpenTelemetry-ready diagnostics

A stable ActivitySource and Meter now expose request duration, failures, retries, and rate-limit behavior without requiring consumers to adopt a proprietary telemetry stack.

Launched the Astro documentation site

The project gained a GitHub Pages site with API reference content, self-hosted fonts, responsive layouts, code examples, and an automated deployment workflow.

Made documentation navigation work across screen sizes

Mobile readers received an accessible section dropdown and desktop navigation was corrected so the active API section remains easy to discover.

Added safe, interactive API demonstrations

The documentation can exercise public API routes, hash passwords locally with SHA-1 or NTLM, avoid browser password storage, and visualize exactly how k-anonymity protects plaintext credentials.

Brought the password privacy walkthrough to the landing page

A staged animation now explains local hashing, five-character range requests, anonymous suffix results, and local comparison, with follow-up refinements keeping the presentation stable and legible.

Refreshed dependencies and acceptance-test configuration

Two grouped dependency updates kept the .NET stack current, while acceptance tests became tolerant of an absent API-key environment value and breach-detail retrieval was aligned with the current service contract.

December 15, 2025

10.0.2-preview.1

preview

This preview substantially expanded the API surface before the complete v3 work landed on main.

Introduced domain and stealer-log clients

New focused interfaces and models added domain subscriptions, domain breach searches, stealer-log searches, additional password modes, and resilience registration for the expanded client set.

December 15, 2025

10.0.1

release

A publishing-focused patch made package creation and upload reliable with the modern .NET toolchain.

Replaced the legacy NuGet upload command

The release workflow moved to dotnet nuget push so package publishing uses the SDK already installed by the build.

Restored version history for MinVer

Checkout now fetches complete history without downloading unnecessary file blobs, giving MinVer the tags it needs while keeping CI efficient.

Simplified the final package upload

Redundant version-extraction steps were removed so the workflow publishes the package artifacts produced by the build directly.

December 10, 2025

10.0

release

The library moved to .NET 10 and refreshed its build, package, sample, and test foundations.

Upgraded the solution to .NET 10

The primary framework migration updated target frameworks, package versions, CI SDK selection, samples, and an AsyncEnumerable ambiguity exposed by the new runtime.

Kept the .NET 9 line current before migration

Grouped dependency updates covered the test SDK and core Microsoft extensions so the eventual runtime upgrade started from supported package versions.

Published the .NET 10 release line

The 10.0 release records the complete transition from 9.0.0, including all merged maintenance work that preceded the runtime upgrade.

November 14, 2024

9.0.0

release

The project adopted .NET 9 after a broad refresh of dependencies, versioning, and GitHub Actions.

Upgraded the client and samples to .NET 9

Target frameworks, build settings, CI, and package references moved together to the .NET 9 release line.

Published the .NET 9 release

The 9.0.0 release captures the runtime migration and all maintenance merged since 8.0.3.

August 15, 2024

8.0.3

release

This patch aligned shared configuration keys and refreshed dependencies without changing the public API.

Consolidated configuration and package upkeep

Shared option names replaced duplicated values while routine package and code cleanup kept the .NET 8 implementation maintainable.

May 1, 2024

8.0.2

release

The client tightened implementation boundaries and completed its subscription API behavior.

Completed subscription-status support

The missing subscription operation and convenience extension were added, with tests covering the new service response and its public behavior.

Improved asynchronous API consistency

Cancellation tokens now flow through client operations, awaits avoid capturing context, and exception paths are simpler and more predictable.

Reduced exposed implementation surface

Version updates and internal visibility changes kept implementation details out of the supported public contract.

February 8, 2024

8.0.1

release

Native AOT and trimming became supported deployment modes for all three packages.

Added Native AOT and trimming support

Source-generated JSON metadata, trim annotations, and AOT-safe client internals allow consumers to publish smaller native applications without reflection-dependent serialization.

Hardened the AOT release

Follow-up cleanup corrected accessibility and isolated inconsistent external acceptance tests so package validation remained deterministic.

November 16, 2023

8.0.0

release

The solution moved to .NET 8 and adopted the current Microsoft HTTP resilience stack.

Moved to .NET 8 and modern resilience APIs

The main packages and samples adopted .NET 8, while PollyExtensions switched to Microsoft.Extensions.Http.Resilience, making this a breaking resilience configuration change.

Added route-group integration for Minimal APIs

Community work added a MapGroup-based pattern for organizing HIBP routes and was followed by factory and acceptance-test refinements on main.

Improved test categorization and repeatability

Unit and acceptance tests received explicit traits and filters so local and CI runs can select the intended network boundary consistently.

January 18, 2023

7.0.0

release

The .NET 7 generation made client creation more flexible and expanded the sample integration patterns.

Upgraded to .NET 7

The solution adopted the .NET 7 target framework and corrected a nullable-reference warning discovered during the migration.

Added direct and factory-based client creation

Consumers gained a PwnedClient factory, non-DI construction, and Minimal API route-group examples for applications that do not want the default service-registration pattern.

March 10, 2022

2.0.2

release

A focused serialization fix restored reliable downstream password-model deserialization.

Corrected JSON model mutability

PwnedPassword properties changed from init-only setters where necessary so System.Text.Json could populate the model correctly for consuming applications.

Refreshed dependencies and documentation

Routine package cleanup and clearer README guidance accompanied the serialization correction.

March 5, 2022

2.0.1

release

This patch reorganized the client for maintainability and removed obsolete compatibility code.

Split the client into partial implementations

Endpoint families moved into partial-class files, making breaches, passwords, and pastes easier to evolve independently without changing the public client.

Removed the IsExternalInit compatibility shim

The project no longer carried a compiler shim that supported older targets after .NET 6 became the baseline.

Expanded tests and reduced repository asset size

Dedicated test projects improved coverage boundaries, while automated image optimization reduced the size of sample and documentation assets.

November 24, 2021

2.0.0

release

The first major rewrite adopted .NET 6 and C# 10, introduced resilience extensions, and revised abstractions namespaces.

Adopted .NET 6 and C# 10

All packages, samples, tests, and workflows moved to the new runtime and language, including global usings and broad source cleanup.

Introduced Polly resilience extensions

A separate package added retry and resilience registration without forcing Polly dependencies onto every core-client consumer.

Added and then refined the Blazor sample

Client and server sample projects demonstrated browser-hosted integration before later repository cleanup focused the maintained sample set.

Optimized project imagery

Automated image compression reduced the footprint of repository artwork included in documentation and samples.

September 1, 2021

1.0.4

release

The 1.x line separated reusable contracts from the HTTP implementation and stabilized NuGet publishing.

Created the abstractions package

Models and interfaces became independently consumable so applications could share HIBP contracts without taking a dependency on the concrete HTTP client.

Worked around NuGet dependency metadata generation

Publishing temporarily adjusted package metadata to avoid an upstream NuGet bug that could produce invalid dependency version ranges.

Stabilized the first release workflow

A sequence of preview tags and workflow corrections established repeatable version calculation and publication for both client packages.

Simplified the initial API design

The first external contribution reduced unnecessary complexity before the stable 1.x surface was finalized.

September 1, 2021

1.0.0

release

The first stable package delivered typed access to the core HIBP APIs and a functioning automated release pipeline.

Published the first stable client

The initial API, options, dependency-injection extensions, models, tests, and samples matured from the 0.0.x builds into the 1.0 contract.

Proved the package pipeline through early previews

The 0.0.x sequence repeatedly exercised MinVer, packing, NuGet upload behavior, and asset optimization so stable releases could be generated from repository tags.

Established build, PR, and security validation

Dedicated GitHub Actions workflows began compiling the solution, validating pull requests, running CodeQL, and publishing packages.

August 26-31, 2021

0.0.4

release

The project began as a typed .NET HTTP client with Minimal API examples, tests, and package automation.

Created the HIBP .NET client

The first commit established the core solution and HTTP client that became the foundation for every subsequent release.

Added the first Minimal API sample

A runnable sample showed how to register and expose the client from ASP.NET Core's then-new Minimal API programming model.

Published the initial public preview

Release 0.0.4 marked the first documented NuGet-ready version after the repository's build and publishing foundations were proven.