Bump Ocelot from 24.1.0 to 25.0.0

[dependabot]

Updated Ocelot from 24.1.0 to 25.0.0.

Release notes

Sourced from Ocelot's releases.

25.0.0

Upgrade to .NET 10 SDK (TFM net10.0, version 25.0) a.k.a. the .NET 10 release

Milestone: .NET 10 👈
Codenamed: .NET 10
Read the Docs: Ocelot 25.0 with PDF
Target Framework Monikers: net8.0, net9.0, net10.0

ℹ️ About

On November 11th, 2025, the .NET team announced the release of the .NET 10 framework:

• .NET Blog: Announcing .NET 10

This major release upgrades the Ocelot package TFMs to net10.0 in addition to the current net8.0 and net9.0. Thus, the current Ocelot supported frameworks are .NET 8 LTS, .NET 9 STS, and .NET 10 LTS.

Additionally, in this major release the Ocelot team focused on preparing the codebase and its ecosystem for the .NET 10 SDK (.NET 10 milestone), while also extracting several integrated extension packages from the v24.1 monorepo into their own dedicated repositories to speed up delivery and reduce release coupling. As a result of these DevOps activities, the Ocelot repository now hosts only two package projects — Ocelot (src folder) and Ocelot.Testing (testing folder) — along with two solutions, Ocelot.slnx and Ocelot.Samples.slnx, which can be opened or built only if the .NET 10 SDK is installed. Since the extension packages now live in separate repositories, a new Release Radar status page has been introduced to track their progress.

This major version also includes the following feature updates:

• A built-in Quality of Service (QoS) circuit breaker (express edition) that works out of the box without requiring the Polly library.
• Significant enhancements to the WebSockets feature, including WebSockets middleware overriding and the addition of Security Options to the WebSockets pipeline.
• Improved Configuration experience that merges multiple ocelot.*.json files, keeping users' extended properties available during Ocelot app startup and at runtime via the standard IConfiguration service in the DI container.

Finally, because the repository has a new folder structure, the development team recommends recloning or even reforking the Ocelot repository for a successful upgrade to the new version in order to avoid potential build errors.

As a best practice, the release strategy has been aligned with .NET SDK monthly patches (usually available between the 10th and 15th of each month). The development team will therefore also aim to roll out monthly Ocelot patches that reference the new .NET SDK patched versions. Ocelot patches will follow the form of a beta or patched version major.minor.*, where * is the Ocelot patch number corresponding to the newly available .NET SDK patch.

Ideally, the Ocelot team expects accelerated releases with more frequent minor/patch versions, because DevOps is now prepared for the new release strategy and offers fast delivery.

For successful contributions, maintainers will announce an identity-verification procedure (details for first-time contributors will be published soon).

🆕 What's New?

• ⭐ Quality of Service: A "Built-in Circuit Breaker" feature implementation was added by @​ocelot-ot in pull request #​2385 — no Polly required. ⭐

  Ocelot's QoS schema no longer strictly depends on the external Ocelot.QualityOfService.Polly package to provide circuit breaking and timeout enforcement.
  A lightweight, thread-safe circuit breaker (Closed → Open → HalfOpen → Closed) ships in the Ocelot core package, supporting both count-based and FailureRatio-based modes.
  The two implementations are mutually exclusive: the last of AddQualityOfService() or AddPolly() registered on the OcelotBuilder wins.
  See the built-in QoS documentation for full details, including the AddQualityOfService<THandler>() extensibility point for overriding server error codes.

• WebSockets: The "Overridable WebSocket buffer size" feature and custom middleware injection were added by @​erannevo in pull request #​2387.

  The previously hard-coded DefaultWebSocketBufferSize is now a protected virtual property that can be overridden by subclassing.
  The Middleware Injection feature was extended with a WebSocketsProxyMiddleware override on the OcelotPipelineConfiguration class, allowing a fully custom WebSocket middleware to be injected into the pipeline.
  Refer to the "Sample" section to understand how to utilize the new feature.

• WebSockets: The "SecurityOptions support for the WebSocket pipeline" feature was added by @​CurtisRobertOliver in pull request #​2406.
  ... (truncated)

25.0.0-beta.4

Pre-release 4 for .NET 10 SDK (version 25.0.0-beta.4)

Milestone: .NET 10

This is Pre-release 4 for the .NET 10 SDK.

Version 25.0.0-beta.4 includes upgraded solutions and NuGet packages based on .NET SDK 10.0.302, released on July 14, 2026. For more details about SDK 10.0.302 (Runtime 10.0.10), see the Release notes.

Development teams can start migrating their Ocelot-based projects using this Pre-release 4 to upgrade to the .NET 10 SDK with Long-Term Support (LTS).

☝️ The .NET 10 milestone cycle is complete

This is the final beta pre-release for the current release cycle (milestone .NET 10). The Ocelot development team is currently preparing the stable release, focusing on documentation quality and finalizing the latest DevOps activities for the extension packages.

Stay updated — subscribe to Ocelot releases! 👇

25.0.0-beta.3

Pre-release 3 for .NET 10 SDK (version 25.0.0-beta.3)

Milestone: .NET 10

This is Pre-release 3 for the .NET 10 SDK.

Version 25.0.0-beta.3 includes upgraded solutions and NuGet packages based on .NET SDK 10.0.300, released on May 12, 2026. For more details about SDK 10.0.300 (Runtime 10.0.8), see the Release notes.

Development teams can start migrating their Ocelot-based projects using this Beta 3 release to upgrade to the .NET 10 SDK with Long-Term Support (LTS).

25.0.0-beta.2

Pre-release 2 for .NET 10 SDK (version 25.0.0-beta.2)

Milestone: .NET 10

This is Pre-release 2 for the .NET 10 SDK.

Version 25.0.0-beta.2 includes upgraded solutions and NuGet packages based on .NET SDK 10.0.201, released on March 12, 2026.
For more details about SDK 10.0.201, see the Release notes.

Development teams can start migrating their Ocelot-based projects using this Beta 2 release to upgrade to the .NET 10 SDK with Long-Term Support (LTS).

25.0.0-beta.1

Pre-release for .NET 10 SDK (version 25.0 Beta 1)

Milestone: .NET 10

ℹ️ About

This is a pre-release for the .NET 10 SDK 10.0.103.
Most features function as usual, with a minor warning for developers and teams who utilize service discovery via Kubernetes.

⚠️ Warning

1. The Ocelot.Provider.Kubernetes extension package is under development. Specifically, the PollKube provider is unstable since it is still in development.
   Do not upgrade to the current beta version or use it at your own risk. Other Kubernetes providers, such as Kube and WatchKube, should function correctly.

2. The Ocelot.Provider.Eureka extension package is under development. The integrated Steeltoe.Discovery.Eureka package requires an upgrade to version 4.1.0.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)