RSSAmplifier

Sebastian Gingter · Jun 1, 2026

.NET News May 2026

Read inOriginalenesdefrptjazhit
0
Sign in to vote or save

gingter.org

May was a quieter month on the headline front than April, but the quiet was the productive kind. No GA that reshuffles your architecture decisions, no single announcement everyone is going to remember in a year. Instead it was a month of things getting better in ways that show up in your day-to-day rather than your roadmap.

.NET 11 Preview 4 landed on Patch Tuesday and brought a list of small, concrete improvements (the standout being the biggest Process overhaul in years). The May servicing release closed four more CVEs, and that is a good moment to talk about the data protection bug that broke loose at the very end of April, because the part everyone forgets is the part that actually keeps you exposed. Visual Studio got a Copilot update that finally lets the thing plan before it starts writing code. And the Critter Stack went GA for its 2026 versions by doing something I have wanted to see for years: it killed runtime code generation.

Let me walk through what actually mattered.

.NET 11 Preview 4: the boring-on-paper release that you actually feel

Preview 4 shipped on May 12, on the same day as Patch Tuesday. The release notes read like a list of small things, and that is exactly what makes it a good release.

The one I keep pointing people at: Process got its biggest update in years. If you have ever shelled out to an external tool from .NET, you know that the Process API has been one of those corners of the BCL that everyone has a helper class for, because the built-in surface always made you write the same plumbing. Preview 4 is the team finally going back and reworking it. That is the kind of maintenance work that does not trend on social media and saves real time for the people who hit it.

A few more library items worth a callout:

  • Span-based Deflate, ZLib, and GZip encoder/decoder APIs. This continues the theme from Preview 3 (Zstandard moved into the box there) of the compression story growing up. Span-based APIs mean you can compress and decompress without the allocation overhead that the stream-based path forces on you.
  • Floating-point hex formatting and parsing. Niche until you need it, and exact when you do. If you have ever tried to round-trip a double through text without losing the last bit, you know why this matters.
  • System.Text.Json picked up more improvements. STJ has reached the point where almost every release sands off another rough edge.

On the runtime side, the genuinely interesting structural detail is that the runtime libraries themselves are now compiled with runtime-async. Runtime Async has been the long-running story of the .NET 11 cycle, and Preview 3 took it out of the preview-API gate. Preview 4 is the team dogfooding it in the BCL. That is a strong signal about confidence in the feature, and it is also the kind of decision that flushes out the real-world edge cases before the rest of us hit them. JIT optimizations, hardware intrinsics, and code generation got another pass, as they do in every preview.

SDK and dotnet watch: hot reload reaches the phone

The SDK changes in Preview 4 are small but pointed.

The headline for anyone doing mobile work: dotnet watch now supports device selection for .NET MAUI and mobile projects, with hot reload working on Android and iOS. Mobile inner-loop has always been the weakest part of the MAUI story (you change one line and then wait while the whole thing redeploys), so bringing dotnet watch properly to the device is exactly the right place to invest. This is the kind of thing that decides whether building a mobile app feels like building a web app or feels like a punishment.

The rest of the SDK list:

  • Fish shell completions now match what Bash, Zsh, and PowerShell already had. A small quality-of-life win, and a nice acknowledgement that not everyone lives in the same shell.
  • CLI telemetry moved from Application Insights to OpenTelemetry. This is mostly an internal detail, but it is the consistent direction: OpenTelemetry is the observability story across the platform now, and the tooling using it too is the right kind of consistency.
  • An MCP Server template now ships in the SDK. dotnet new can scaffold an MCP server out of the box. The Model Context Protocol is becoming a first-class citizen rather than something you wire up by hand, and that lowers the barrier to building tools that AI agents can actually call.

ASP.NET Core and Blazor

The ASP.NET Core side of Preview 4 is a tidy set of fixes for real gaps.

HTTP QUERY support landed in generated OpenAPI documents. The QUERY method has been slowly making its way through the stack, and having it represented properly in your generated API description closes the loop for anyone who builds clients off that document.

Two Blazor items stood out. SupplyParameterFromTempData gives you a clean attribute-based way to flow data through TempData instead of reaching for the plumbing manually. And Blazor Server can now pause a circuit on the server’s initiative. Circuit lifetime management has always been one of the trickier parts of running Blazor Server at scale (idle circuits hold resources), so giving the server a way to pause them is a meaningful lever for anyone watching their per-connection cost.

EF Core 11 Preview 4: vectors, JSON, and time

EF Core 11 Preview 4 is small but the items are well chosen, and a couple of them tell you where the platform’s head is at.

Approximate vector search for SQL Server 2025 is the one that signals the most. Vector search has been creeping into the relational story release after release, and approximate (rather than exact) nearest-neighbour search is what makes vector queries actually scale. If you are building anything with embeddings on top of SQL Server, this is the API you have been waiting for.

The rest:

  • JSON mapping is now fully integrated into the relational model instead of sitting off to the side as a special case. JSON columns have been usable in EF for a while, but “usable” and “first-class” are different things, and this moves them into the model proper.
  • Temporal period properties can now map to CLR properties. If you use temporal tables, exposing the period columns as actual properties on your entity is a lot nicer than querying around them.
  • dotnet ef reads defaults from a dotnet-ef.json file. A small thing that removes a pile of repeated command-line flags from your muscle memory and your CI scripts.

C# 15 in Preview 4 was a polish pass rather than a headline. Clearer diagnostics for a misplaced #! shebang directive (relevant now that file-based apps are a real thing) and an opt-in compilation cache for the build server. The big C# 15 story (union types) was told in the earlier previews, and the work this month was elsewhere.

The data protection mess, and the part everyone forgets

The May servicing release (May 12) shipped .NET 10.0.8, 9.0.16, and 8.0.27 along with the .NET Framework updates, and closed four CVEs:

  • CVE-2026-32177 — Elevation of privilege in .NET 10/9/8 and .NET Framework 3.5 through 4.8.1
  • CVE-2026-35433 — Elevation of privilege in .NET 10/9/8
  • CVE-2026-32175 — Tampering in .NET 10/9/8
  • CVE-2026-42899 — Denial of service in .NET 10/9/8

Patch them. That part is routine.

The part that is not routine, and the reason I am giving security its own section this month, is the one that does not appear in the May list because it broke loose at the very end of April: CVE-2026-40372, the ASP.NET Core Data Protection bug. It is rated 9.1, and it deserves it.

Here is what happened. A regression in the Microsoft.AspNetCore.DataProtection packages, versions 10.0.0 through 10.0.6, caused the managed authenticated encryptor to compute its HMAC validation tag over the wrong bytes of the payload (and, in some cases, discard the computed hash entirely). The practical consequence is the bad kind: an attacker could forge payloads that pass the authenticity check. That means forged authentication cookies, forged antiforgery tokens, and the ability to decrypt previously protected payloads. Microsoft shipped .NET 10.0.7 out of band to fix it, because 10.0.6 was already breaking decryption in some apps in the field.

One piece of good news: the defective code path was introduced during .NET 10 development and was never backported, so .NET 8 and .NET 9 are not affected. If you are on 10, though, read the next paragraph twice.

Upgrading to 10.0.7 (or 10.0.8) is not the end of the job. The patch stops new forged tokens from validating, but any token an attacker already forged stays valid until you rotate the data protection key ring. The fix closes the door; it does not change the locks. If you ran any 10.0.0 through 10.0.6 build with data protection exposed to untrusted input, you have to assume the key material is compromised and rotate it. Tokens minted before the rotation keep working until the ring turns over. This is exactly the kind of remediation step that gets skipped because the patch “looks done”, and it is exactly the step that leaves you exposed if you skip it.

If you only do one thing off this article: check what version your production ASP.NET Core apps were running in April, and if it was anywhere in that range, rotate your keys.

Visual Studio 2026 May update: Copilot learns to plan first

The May update for Visual Studio 2026 (18.6.0 on May 12, with 18.6.1 and 18.6.2 following on May 20 and May 27) leaned into making the Copilot agent experience more deliberate, and the centrepiece is the new Plan agent.

The idea is straightforward and, in my experience, correct: before the agent writes a single line, it explores your codebase with read-only tools, asks clarifying questions, and drafts an implementation plan as a markdown file you can review and refine. Only then does it execute. Anyone who has watched an agent confidently charge off in the wrong direction (because it guessed at intent instead of asking) understands why this matters. The plan-first workflow turns “the agent did a lot of work I now have to throw away” into “the agent and I agreed on the approach, then it did the work”. That is the difference between a tool you trust with something real and a tool you only let near throwaway code.

The rest of the update supports the same theme:

  • A Skills panel lists every agent skill discovered from your workspace and user profile, so you can see, search, and edit what the agent actually knows how to do instead of guessing.
  • A context window indicator (a small donut ring on the chat box) shows how much of the context window the conversation has consumed. Sounds cosmetic. It is not. Knowing you are about to fall off the edge of the context window before the answers quietly get worse is genuinely useful.
  • A multi-file summary diff shows every change across a set of files in one view, with three acceptance levels: the whole changeset, per file, or per individual chunk. Reviewing what an agent produced is the actual bottleneck in agentic workflows, and a proper diff view is the right tool for it.

On the native side, the MSVC build tools moved to v14.51 with more C++23 conformance work, <flat_map> and <flat_set>, a reworked <regex>, and ARM SVE support.

The shape of these IDE updates keeps being the right one: real improvements to how the work flows, not a reshuffled toolbar.

The Critter Stack went GA, and it finally killed runtime code generation

May 24 was the big day for JasperFx: Marten 9.0, Polecat 4.0, and Wolverine 6.0 all went live, built on a shared JasperFx 2.0 foundation (with Weasel 9.0 underneath). Jeremy Miller had been building up to it all month, from the releases-are-underway post through the sneak peek, and the GA announcement laid out the through-line.

The headline themes are cold start, AOT compliance, and consolidation onto shared infrastructure. And the single change that drives most of it is one I have been waiting to see for a long time.

Marten 9.0 eliminated runtime code generation entirely. Marten has leaned on runtime code generation since the 4.0 release back in 2021, and it has always been the awkward part of the story: powerful, but the reason cold start was slow and AOT was off the table. Marten 9 replaces it with source generators for conventional projections. That single architectural decision is what makes cold start fast and what finally makes Marten viable under AOT. Source generation is the right answer here. The work happens at build time, where it belongs, instead of the first time your application has to serve a request.

A few specifics worth knowing if you are planning the upgrade:

  • Lightweight sessions (no identity map) are now the Marten default. This is a sensible default, but it is a behaviour change. If you have code that quietly relied on the identity map handing you back the same instance, that is the first thing to check.
  • Quick append with server timestamps is the default for the event store. Another good default, another change to be aware of.
  • Wolverine 6.0 kept its Roslyn-based runtime code generation, but you can now treat JasperFx.RuntimeCompiler as a development-only dependency, which trims your deployed image. So Wolverine’s cold-start and AOT story improves without the same wholesale rewrite Marten took on.
  • Polecat 4.0 moved further onto Marten’s shared internals, cutting duplication across the stack.

The Critter Stack has been one of the more deliberate stories in the .NET ecosystem, and this release is a good example of why. Killing runtime code generation is not a feature you can put on a marketing slide. It is the kind of architectural decision that determines whether your library can run in the environments people actually deploy to today (serverless, AOT, fast-scaling) and the team made it. There are migration guides on martendb.io, polecat.jasperfx.net, and wolverinefx.io, and given the default changes, you will want to read them rather than just bumping the version.

What May was, really

No single announcement from May is going to reshape anyone’s architecture the way April’s Agent Framework GA did. That is fine. Not every month is a turning point, and the months that are not are where most of the actual work gets done.

Preview 4 made .NET 11 a little nicer to live in, one small fix at a time. The servicing release closed four CVEs and reminded everyone that the data protection bug from late April is not done until you have rotated your keys. Visual Studio taught its agent to plan before it codes. And the Critter Stack went GA by making the unglamorous architectural decision that matters more than any feature on the page.

And as I write this, Build 2026 is kicking off in San Francisco. So next month’s edition is going to be a very different kind of busy.

Sources

Read the original on gingter.org ↗

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.