Skip to content

Document ASP.NET Core breaking changes in .NET 11#37228

Open
halter73 wants to merge 3 commits into
mainfrom
halter73/port-net11-breaking-changes
Open

Document ASP.NET Core breaking changes in .NET 11#37228
halter73 wants to merge 3 commits into
mainfrom
halter73/port-net11-breaking-changes

Conversation

@halter73
Copy link
Copy Markdown
Member

@halter73 halter73 commented Jun 4, 2026

Ports dotnet/docs#54188 into this repo, per the .NET 10 precedent (#36693). The ASP.NET Core breaking-change content now lives in dotnet/AspNetCore.Docs rather than dotnet/docs.

Adds 12 new per-entry pages plus an overview under aspnetcore/breaking-changes/11/, and wires them into aspnetcore/toc.yml under the existing ASP.NET Core 11 group, mirroring the ASP.NET Core 10 block.

Process disclosure

A prior agent audited the 975 first-parent merges that landed on dotnet/aspnetcore main since the release/10.0 branch point and produced a candidate list of 16 verified 11-only breaking changes, with citations to each PR. The original docs pass was dotnet/docs#54188; this PR ports those pages over with relative category links rewritten to the absolute /dotnet/core/compatibility/categories#… form used elsewhere in this repo. Both agents are Claude models running with Copilot CLI; both pages and this PR description are AI-assisted and marked accordingly (ai-usage: ai-assisted in front matter).

Entries

# Page Source PR(s) Type of change
1 ConcurrencyLimiter middleware removed #64020 Binary/source incompatible
2 Obsolete Blazor APIs removed #62755 Source incompatible
3 Microsoft.OpenApi upgraded to 3.x #65415, #66998 Source incompatible
4 SqlClient AAD providers moved to a separate package #66179 Behavioral change
5 WebAssemblyHostBuilder loads env vars into IConfiguration #64578 Behavioral change
6 Blazor enhanced navigation no longer preloads resources #63544 Behavioral change
7 Blazor custom event registration throws when name matches a browser event #64774 Behavioral change
8 Passkey sign-in enforces email/phone confirmation and lockout #65024 Behavioral change
9 OpenAPI server URL no longer has a trailing slash when PathBase is empty #64716 Behavioral change
10 Kestrel tightens HTTP protocol compliance #66669, #66671 Behavioral change
11 Response compression always emits Vary: Accept-Encoding #55092 Behavioral change
12 Hosting emits OpenTelemetry HTTP semantic-convention tags by default #64851, #64854, #65825 Behavioral change

All 12 PRs were verified release/10.0..main-only via git merge-base --is-ancestor against the merge SHA. PR dates are not reliable because some 11-only PRs report a GitHub "merged" date earlier than the branch point (e.g., #63544).

Decisions worth a second look

  1. Consolidations. I combined Kestrel #66669 + #66671 into one entry, and observability #64851 + #64854 + #65825 into one. Each pair/triple is closely related and the PRs were merged within days of each other. If you'd rather have one row per PR, I can split.
  2. Skipped entry. I left out dotnet/aspnetcore#65686 ("Replace Newtonsoft.Json with System.Text.Json in dotnet-user-secrets"). The audit rated it low-confidence: the only visible difference is that secrets.json on disk now uses \u00XX escapes for non-ASCII, but IConfiguration unescapes those at read time so app code is unaffected. Add it back if you want a tooling-only callout.
  3. OpenAPI 2→3 classification. I labeled this "Source incompatible" with a note in the page that it can also affect binary compatibility for prebuilt libraries. "Source/Binary incompatible" is also defensible. Easy switch if you prefer.
  4. ConcurrencyLimiter pin-back recommendation. I verified that Microsoft.AspNetCore.ConcurrencyLimiter 9.x and 10.x are still on NuGet and recommended them as a short-term escape hatch. Reasonable?
  5. Passkey sign-in bypass guidance. A rubber-duck review caught that my initial draft suggested overriding SignInManager<TUser>.PreSignInCheck to bypass the new checks for passkey sign-in. That was unsafe: PreSignInCheck doesn't know which sign-in method called it, so the override would affect every sign-in path. I removed that paragraph and replaced it with "update user records (e.g., mark the email as confirmed) rather than removing the checks." Please confirm that's the guidance you'd give.
  6. Microsoft.OpenApi 3.x migration code. Same rubber-duck pass also caught that I told readers to change transformer parameter types from OpenApiSchema to IOpenApiSchema. The transformer interfaces actually still take OpenApiSchema (I verified against the current IOpenApiSchemaTransformer in dotnet/aspnetcore); what changed is the surface area of the nested types it exposes (extensions are JsonNode now instead of OpenApiAny, nested schema collections expose IOpenApiSchema, etc.). I rewrote that section. Could use a second look from an OpenAPI SME.

Things I'm explicitly flagging

  • Anything missing? Reviewers familiar with the ASP.NET Core .NET 11 work should catch any breaking changes that aren't in the audit. The audit window covered all 975 first-parent merges on aspnetcore/main since the .NET 10 branch point through approximately 2026-06-03; anything merged since then isn't covered.
  • Backport candidates. Passkey sign-in and the SqlClient AAD package split look like good candidates for .NET 10 servicing if that's of interest. Not requesting backports — just flagging.
  • Preview-version attribution. I used "Preview 1" or "Preview 3" only where the audit explicitly said so, or where the PR merge date made it unambiguous. Most entries use a plain ".NET 11" version label. If you have the exact preview-to-PR mapping handy, I'm happy to tighten.
  • Style. I followed the structure of existing .NET 10 entries (e.g., aspnetcore/breaking-changes/10/cookie-authentication-api-endpoints.md). The Microsoft Style Guide pass — active voice, no gerund leads, lead-with-reason — was applied to the new content; a documentarian eye on phrasing is still welcome.

Port notes

  • Ported from dotnet/docs#54188; that PR will be closed in favor of this one once this merges. The dotnet/docsaspnet/core/breaking-changes/11/overview redirect is owned by dotnet/docs and is out of scope for this PR.
  • Only mechanical change from the source PR: relative ../../categories.md#… links rewritten to the absolute /dotnet/core/compatibility/categories#… form already used in aspnetcore/breaking-changes/10/.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>


Internal previews

Toggle expand/collapse
📄 File 🔗 Preview link
aspnetcore/breaking-changes/11/blazor-custom-event-name-collision.md aspnetcore/breaking-changes/11/blazor-custom-event-name-collision
aspnetcore/breaking-changes/11/blazor-enhanced-nav-preloading-disabled.md aspnetcore/breaking-changes/11/blazor-enhanced-nav-preloading-disabled
aspnetcore/breaking-changes/11/blazor-obsolete-apis-removed.md aspnetcore/breaking-changes/11/blazor-obsolete-apis-removed
aspnetcore/breaking-changes/11/concurrencylimiter-removed.md aspnetcore/breaking-changes/11/concurrencylimiter-removed
aspnetcore/breaking-changes/11/http-activity-otel-semconv.md aspnetcore/breaking-changes/11/http-activity-otel-semconv
aspnetcore/breaking-changes/11/kestrel-strict-protocol-compliance.md aspnetcore/breaking-changes/11/kestrel-strict-protocol-compliance
aspnetcore/breaking-changes/11/microsoft-openapi-3x.md aspnetcore/breaking-changes/11/microsoft-openapi-3x
aspnetcore/breaking-changes/11/openapi-server-url-trailing-slash.md aspnetcore/breaking-changes/11/openapi-server-url-trailing-slash
aspnetcore/breaking-changes/11/overview.md aspnetcore/breaking-changes/11/overview
aspnetcore/breaking-changes/11/passkey-signin-enforces-confirmation-lockout.md aspnetcore/breaking-changes/11/passkey-signin-enforces-confirmation-lockout
aspnetcore/breaking-changes/11/response-compression-always-vary.md aspnetcore/breaking-changes/11/response-compression-always-vary
aspnetcore/breaking-changes/11/sqlclient-azure-extensions-required.md aspnetcore/breaking-changes/11/sqlclient-azure-extensions-required
aspnetcore/breaking-changes/11/wasm-env-vars-in-configuration.md aspnetcore/breaking-changes/11/wasm-env-vars-in-configuration
aspnetcore/toc.yml aspnetcore/toc

Adds 12 per-entry pages plus an overview under aspnetcore/breaking-changes/11/
and wires them into aspnetcore/toc.yml under the existing ASP.NET Core 11
group, mirroring the .NET 10 layout established in #36693.

Relative category links (../../categories.md#...) rewritten to the absolute
/dotnet/core/compatibility/categories#... form used elsewhere in this repo.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Kestrel in ASP.NET Core 11 makes two HTTP-protocol-compliance changes:

- HTTP/2 and HTTP/3 reject more connection-specific request headers, per RFC 9113 §8.2.2 and RFC 9114 §4.2.
- HTTP/1.1 closes the connection after a request that included both `Content-Length` and `Transfer-Encoding`, per the updated wording of RFC 9112.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: This was done for all versions of kestrel (and iis and httpsys). Not sure it needs calling out either.

Copy link
Copy Markdown
Collaborator

@guardrex guardrex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style NITs only. All updates applied. Looks GrEaT!

I also checked the Blazor breaking changes against the docs, and I don't see where reference content requires an update.

@tdykstra ... I noted a couple of reference articles that probably require updates for the breaking change on the Microsoft.Extensions.Caching.SqlServer package ...

BTW ... The metadata isn't in the correct order (ai-usage: ai-assisted should under the title), but it's trivial if it isn't changed. Done! 👍

Comment thread aspnetcore/breaking-changes/11/http-activity-otel-semconv.md Outdated
Comment thread aspnetcore/breaking-changes/11/microsoft-openapi-3x.md Outdated
Comment thread aspnetcore/breaking-changes/11/response-compression-always-vary.md Outdated
Comment thread aspnetcore/breaking-changes/11/sqlclient-azure-extensions-required.md Outdated
Comment thread aspnetcore/breaking-changes/11/passkey-signin-enforces-confirmation-lockout.md Outdated
Comment thread aspnetcore/breaking-changes/11/response-compression-always-vary.md Outdated
Comment thread aspnetcore/breaking-changes/11/sqlclient-azure-extensions-required.md Outdated
Comment thread aspnetcore/breaking-changes/11/wasm-env-vars-in-configuration.md Outdated
Comment thread aspnetcore/breaking-changes/11/blazor-custom-event-name-collision.md Outdated
Copy link
Copy Markdown
Contributor

Copilot AI commented Jun 4, 2026

@guardrex I've opened a new pull request, #37229, to work on those changes. Once the pull request is ready, I'll request review from you.

…eaking changes documentation (#37229)

* Initial plan

* Move ai-usage metadata under title in breaking changes docs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Comment thread aspnetcore/breaking-changes/11/http-activity-otel-semconv.md Outdated
Comment thread aspnetcore/breaking-changes/11/openapi-server-url-trailing-slash.md Outdated
Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants