diff --git a/entity-framework/core/what-is-new/ef-core-3.0/breaking-changes.md b/entity-framework/core/what-is-new/ef-core-3.0/breaking-changes.md index 746e169ba9..2a97f5d67e 100644 --- a/entity-framework/core/what-is-new/ef-core-3.0/breaking-changes.md +++ b/entity-framework/core/what-is-new/ef-core-3.0/breaking-changes.md @@ -44,6 +44,7 @@ Changes that we expect to only impact database providers are documented under [p | [Throw if multiple compatible backing fields are found](#throw-if-multiple-compatible-backing-fields-are-found) | Low | | [Field-only property names should match the field name](#field-only-property-names-should-match-the-field-name) | Low | | [AddDbContext/AddDbContextPool no longer call AddLogging and AddMemoryCache](#adddbc) | Low | +| [AddEntityFramework* adds IMemoryCache with a size limit](#adddbc) | Low | | [DbContext.Entry now performs a local DetectChanges](#dbe) | Low | | [String and byte array keys are not client-generated by default](#string-and-byte-array-keys-are-not-client-generated-by-default) | Low | | [ILoggerFactory is now a scoped service](#ilf) | Low | @@ -929,7 +930,7 @@ modelBuilder **Old behavior** -Before EF Core 3.0, calling `AddDbContext` or `AddDbContextPool` would also register logging and memory caching services with D.I through calls to [AddLogging](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.loggingservicecollectionextensions.addlogging) and [AddMemoryCache](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.memorycacheservicecollectionextensions.addmemorycache). +Before EF Core 3.0, calling `AddDbContext` or `AddDbContextPool` would also register logging and memory caching services with DI through calls to [AddLogging](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.loggingservicecollectionextensions.addlogging) and [AddMemoryCache](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.memorycacheservicecollectionextensions.addmemorycache). **New behavior** @@ -943,6 +944,27 @@ EF Core 3.0 does not require that these services are in the application's DI con If your application needs these services, then register them explicitly with the DI container using [AddLogging](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.loggingservicecollectionextensions.addlogging) or [AddMemoryCache](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.memorycacheservicecollectionextensions.addmemorycache). +### AddEntityFramework* adds IMemoryCache with a size limit + +[Tracking Issue #12905](https://github.com/aspnet/EntityFrameworkCore/issues/12905) + +**Old behavior** + +Before EF Core 3.0, calling `AddEntityFramework*` methods would also register memory caching services with DI without a size lime. + +**New behavior** + +Starting with EF Core 3.0, `AddEntityFramework*` will register a IMemoryCache service with a size limit. If any other services added afterwords depend on IMemoryCache they can quickly reach the default limit causing exceptions or degraded performance. + +**Why** + +Using IMemoryCache without a limit could result in uncontrolled memory usage if there is a bug in quiery cache logic or the queries are generated dynamically. Having a default limit mitigates a potential DoS attack. + +**Mitigations** + +In most cases calling `AddEntityFramework*` is not necessary if `AddDbContext` or `AddDbContextPool` is called as well. Therefore the best mitigation is to remove the `AddEntityFramework*` call. +If your application does needs these services, then register a IMemoryCache implementation explicitly beforehand with the DI container using [AddMemoryCache](https://docs.microsoft.com/dotnet/api/microsoft.extensions.dependencyinjection.memorycacheservicecollectionextensions.addmemorycache). + ### DbContext.Entry now performs a local DetectChanges