The .NET Insider – Issue #28

.NET 11 Preview 7 delivers updates across nearly every major part of the platform. Highlights include IEEE 754 decimal floating-point types, HTTP request compression, password-protected ZIP archives, Native AOT support for the dotnet CLI by default, new dotnet test controls, and more C# union-pattern work. ASP.NET Core gains Blazor circuit pausing and SSR caching, while .NET MAUI adds passkey authentication and incremental XAML Hot Reload. EF Core, F#, Windows Forms, the runtime, and SDK also receive considerable improvements.

CC# 15 will ship with .NET 11 and is available to try in Preview 7. Its headline features include union types, closed class hierarchies, a preview redesign of the unsafe model, constructor arguments for collection expressions, extension indexers, and labeled break and continue. Union types and closed hierarchies let developers express permitted cases directly in the type system and enable more exhaustive pattern matching. The memory-safety work remains experimental, and Microsoft is gathering feedback before finalizing the design.

Microsoft released .NET 10.0.11, .NET 9.0.19, and .NET 8.0.30, along with new .NET Framework servicing updates. The release addresses ten disclosed vulnerabilities affecting supported .NET versions, including remote code execution, privilege escalation, information disclosure, security bypass, and denial-of-service issues. Because these are security releases rather than routine feature updates, teams should review the relevant release notes, known issues, container images, and deployment workflows, then promptly move supported production workloads to the latest servicing level.

Starting with MSTest 4.4, you can publish and test projects as Native AOT applications. MSTest source generation records test classes, attributes, and invocation delegates before trimming, allowing ordinary MSTest code to run under a deployment model closer to production. The recommended approach is to retain fast managed tests while implementing a targeted native validation lane for deployment-sensitive code. Teams should also verify test-count parity, since a successful run can still miss unsupported test shapes if they ignore diagnostics.

Microsoft’s hosted Azure DevOps MCP Server is now generally available, giving compatible AI assistants contextual access to work items, repositories, pull requests, pipelines, and other project data without a locally hosted server. It uses Streamable HTTP and Microsoft Entra authentication, with support across GitHub Copilot in VS Code, Microsoft Foundry, Copilot Studio, Visual Studio, Copilot CLI, and the Copilot app. Some third-party clients still face Entra registration limitations, so the local server remains available where straightforward remote authentication is not yet supported.

New NuGet.org API keys are now limited to a maximum lifetime of 30 days, and keys created before August 17, 2026, will expire on November 1, 2026. The change reduces the exposure window for leaked publishing credentials and pushes package maintainers toward Trusted Publishing. That workflow uses OpenID Connect to issue short-lived credentials for approved CI/CD jobs, eliminating long-lived repository secrets. Maintainers should inventory publishing workflows now, update key rotation where necessary, and plan a migration to Trusted Publishing where supported.

Uno Platform combines a hosted documentation MCP server with a local, stateful app server so coding agents can both understand the framework and inspect a running application. Agents can capture screenshots, query the visual tree, interact with UI elements, and verify their own changes. The wider stack uses the official MCP C# SDK, Roslyn, Microsoft Agent Framework, and reusable Skills to generate and run cross-platform .NET apps in the browser. The architecture offers a useful lesson: separate stable knowledge from live application state.

Microsoft’s open-source code-testing-generator is a polyglot agent that generates unit tests that follow a repository’s existing language, framework, structure, and validation workflow. It researches the codebase, plans the work, writes and runs tests, checks assertions and requested scenarios, and confirms that the repository’s normal test command discovers them. In Microsoft’s internal 152-task benchmark, the specialized workflow completed 92.1% of tasks versus 78.9% for stock Copilot, with the largest gains appearing on vague prompts and requests tied to specific code changes.

Foundry Local can run specialized AI models beyond chat, including real-time speech recognition. This walkthrough builds a Windows-based .NET 10 console app that streams microphone audio to NVIDIA’s 0.6B Nemotron speech model and receives interim and final transcription results. Foundry Local handles model recognition, download, caching, execution-provider selection, loading, and unloading. Audio remains on the device, no cloud API key is required, and inference can continue without a network round trip after the initial model download.

Intelligent Terminal 0.2 can now connect its Agent Pane to locally hosted models through OpenAI-compatible endpoints, including models served by Ollama. The release also introduces /agent for running different agents in separate tabs, first-class OpenCode support, profile-level WSL agent configuration, image pasting, session search, token and cost visibility, and a more capable Autofix experience. It remains experimental, but the update points toward a terminal workflow where cloud and local agents can operate side by side without sharing context between tabs.

As coding models improve, oversized repository instruction files can become a liability rather than an advantage. Microsoft recommends preserving information that agents cannot consistently infer: non-obvious architectural boundaries, authoritative validation commands, team-specific technical choices, hard constraints, and links to sources of truth. Remove or relocate generic advice, exhaustive directory inventories, duplicated documentation, model-specific prompt folklore, and obsolete workarounds. A practical review method is to classify every instruction as keep, remove, move, or verify.

Damien Bod demonstrates how Aspire can compose an Angular frontend, an ASP.NET Core Backend for Frontend, a downstream API, and Auth0-based authentication in one application model. The AppHost coordinates development and production configuration, service references, secrets, startup ordering, and environment values, while YARP routes requests in both environments. The example shows how Aspire can make a security-focused BFF setup easier to run locally and carry into a containerized deployment without scattering orchestration details across the solution.

Visual Studio’s Pull Requests experience lets developers browse assigned and repository-wide PRs, inspect syntax-highlighted diffs, navigate changed types, leave buffered inline comments, approve changes, and merge without switching to a browser. A pull request can also be added directly to a Copilot conversation through the context menu or the #pullrequest:<id> reference. The result is a more integrated review workflow that combines repository context, solution-aware navigation, GitHub collaboration, and AI assistance inside the IDE.

Value objects replace loosely related primitives with immutable, self-validating types such as Money and Address. Nikola Knezevic compares traditional class-based implementations with C# records, which provide concise value-based equality with less boilerplate. The article also covers persistence using EF Core owned types and modern complex types. For new code, records are often the simplest starting point, while ComplexProperty gives EF Core a cleaner mapping model for value objects that have no identity of their own.