Documentation
Hardened plugin releases
3 September 2026. 14 NuGet packages, 351 passing tests. Public type names did not change. Several defaults did.
Plugin READMEs remain the code-level source of truth. This page is the upgrade map for host apps already on 1.x. Hub write-up: docs/hardened-releases.md.
Shipped versions
| Package | Version | Tests | Kind |
|---|---|---|---|
| Plugin.Maui.DeepLinks | 1.0.6 | 43 | Breaking default |
| Plugin.Maui.PushRouter | 1.0.6 | 24 | Breaking default |
| Plugin.Maui.SmartUpload | 1.0.6 | 24 | Breaking default |
| Plugin.Maui.FeatureFlags | 1.0.7 | 45 | Breaking default |
| Plugin.Maui.ApiResilience | 1.0.8 | 13 | Default change |
| Plugin.Maui.FileVault | 1.0.8 | 31 | Behavior |
| Plugin.Maui.SecureSession | 1.0.6 | 26 | Additive |
| Plugin.Maui.DeviceSession | 1.0.6 | 21 | Additive |
| Plugin.Maui.AppLock | 1.0.5 | 20 | Additive |
| Plugin.Maui.BackgroundTasks | 1.0.6 | 10 | Behavior |
| Plugin.Maui.OfflineSync | 1.0.9 | 13 | Behavior |
| Plugin.Maui.Observability | 1.0.7 | 23 | Packaging |
| Plugin.Maui.NetworkMonitor | 1.0.7 | 28 | Metadata |
| Plugin.Maui.AppUpdate | 1.0.6 | 30 | Packaging |
Breaking defaults
Hosts that relied on “empty means allow everything” or cleartext HTTP must opt back in.
- Plugin.Maui.DeepLinks 1.0.6
Empty Hosts / CustomSchemes reject incoming links. http:// needs AllowInsecureHttp. PermissiveMode restores the old open behavior.
- Plugin.Maui.PushRouter 1.0.6
Navigation uses registered Map keys or DefaultRoute only. Set AllowUnmappedPayloadRoutes to accept raw payload Shell paths.
- Plugin.Maui.SmartUpload 1.0.6
Upload endpoints must be https. Set RequireHttps = false only for local development.
- Plugin.Maui.FeatureFlags 1.0.7
RemoteUri must be https. Optional SignatureKey verifies X-FeatureFlags-Signature as HMAC-SHA256 hex.
- Plugin.Maui.ApiResilience 1.0.8
Offline queue file is AES-256-GCM. PersistRequestBodies = false stores a redacted placeholder.
Suggested upgrade order
- DeepLinks and PushRouter — inbound URI / push navigation can stop if allowlists are empty.
- SmartUpload and FeatureFlags — cleartext http:// endpoints fail closed.
- ApiResilience — confirm the encrypted queue still drains after the first run.
- FileVault — switch UI stats to GetStatisticsAsync.
- SecureSession / DeviceSession — opt into the stricter flags if the threat model needs them.
- AppLock, BackgroundTasks, OfflineSync, Observability — take the behavior fixes; no host config required.
- NetworkMonitor, AppUpdate — bump for metadata / packaging only.
Install
dotnet add package Plugin.Maui.DeepLinks --version 1.0.6
dotnet add package Plugin.Maui.PushRouter --version 1.0.6
dotnet add package Plugin.Maui.SmartUpload --version 1.0.6
dotnet add package Plugin.Maui.FeatureFlags --version 1.0.7
dotnet add package Plugin.Maui.ApiResilience --version 1.0.8Back to getting started or the package catalog.
Next step
Build with Nuvyntra Labs
Browse production NuGet packages, or reach the lab if you want to evaluate research or compose a plugin set.