Archive

Friday, November 6, 2026
stories of the day

16stories
System.Text.Json
JSON Lines

Stop Hand-Rolling JSON Lines With WriteLine: .NET 11 Writes Them for You

.NET 11 gives System.Text.Json the writer that JSON Lines (JSONL) always lacked: new SerializeAsyncEnumerable overloads take an IAsyncEnumerable<T> and write it to a Stream or a PipeWriter in one call. With topLevelValues: true every record is emitted compactly followed by an LF, so the malformed files produced by hand-rolled WriteLine loops disappear. It ships in .NET 11 RC 2, not yet GA.

CodeBehind
Loops out of the View
DVDEV Community: #dotnet Elanat Framework 7 h ago

Return Templates in CodeBehind: moving loops out of the View

The CodeBehind .NET Core framework introduces Return Templates, a mechanism for keeping loops and conditionals out of the View when generating dynamic HTML. Instead of mixing @foreach into markup or concatenating HTML strings in a Controller, the structure lives in a template variable that gets replaced during processing. The feature works in both Razor and Standard syntax and supports nested, multi-stage resolution.

C# Collections
Order is not workflow

Queue and Stack in C#: FIFO, LIFO and Empty-State Behavior

Dev Leader walks through Queue<T> and Stack<T> not just as ordering rules but as contracts with sharp edges: empty-state handling, peek versus consume, copies and enumeration. The guide makes clear that FIFO and LIFO describe removal order only, not workflow guarantees — useful for anyone reviewing consumption loops in existing code.

Security
Security
DOAzure DevOps Blog Josef Sin 13 h ago

October 2026 Node.js vulnerabilities: patch guidance for Azure DevOps and .NET

Node.js released fixes for 10 vulnerabilities on October 21, 2026 in 22.23.4, 24.22.1 and 26.12.1. The Azure DevOps team points out that every layer — agent task runners, pipeline-selected Node.js and container images — has its own update path. The same Brotli memory-corruption flaw (CVE-2026-111497) also affects modern .NET, with fixed runtime baselines 8.0.33, 9.0.22 and 10.0.14.

AutoMapper 16.3.0
Stack overflow patched
JBJimmy Bogard Jimmy Bogard 13 h ago

AutoMapper 16.3.0 and 15.1.4 Close MaxDepth Gaps Behind DoS Bugs

Jimmy Bogard shipped AutoMapper 16.3.0 and 15.1.4, both fixing two security issues, so anyone on 16.x or 15.x should upgrade. The default MaxDepth limit added in March turned out to be bypassable through constructor-built destinations and several other recursion paths, letting deeply nested self-referential graphs crash the process with an uncatchable StackOverflowException.

ASP.NET Core
ASP.NET Core
HBHabr C# (ru) gandjustas 18 h ago

Modular monolith in ASP.NET out of the box with HostingStartup

The hosting startup assemblies mechanism that has shipped with ASP.NET Core since 2.0 turns out to be enough to build a modular monolith without a NuGet package or a custom plugin system. Modules are ordinary class libraries carrying `[assembly: HostingStartup]`, and the `HOSTINGSTARTUPASSEMBLIES` environment variable decides which ones load. One Docker image can then run as a monolith or as a set of services depending on that value.

EF Core 11
Team-friendly migrations

EF Core 11: migrations get friendlier for teams

EF Core 11 brings a set of small changes that remove daily friction from migrations work. You can keep a relationship in the model without a foreign key constraint in the database, the model snapshot now surfaces diverged migrations at merge time, a single command can scaffold and apply a migration, and dotnet ef gets a configuration file. Any .NET team working on a shared codebase will feel the difference.

Polly / .NET 10
Resilience without Polly
CWMukesh Murugan (codewithmukesh) Mukesh Murugan 1 d ago

HTTP resilience in .NET 10 without Polly: three options

Polly's Open Source Maintenance Fee, starting 16 November 2026, will not affect most teams, but the article maps three ways to keep Polly out of your dependency graph entirely. Mukesh Murugan runs Microsoft.Extensions.Http.Resilience, Kevlar and a hand-written DelegatingHandler stack against the same flaky API and compares the results.

Security
Security
ABASI Backbone Learning Christopher D. Cavell 1 d ago

Your Security Check Passed. Then the World Changed.

An approval records what was true when it was given; it says nothing about whether the operation may run now. Using an ASP.NET Core and EF Core example, the article explains how to bind each decision to exactly what it approved, re-read preconditions at the point of use, and close the gap between check and write with a conditional update.

WPF
WPF
IGInfragistics Blog Ivaylo Barakov 1 d ago

Infragistics WPF MCP Server: Build WPF Apps with AI

Infragistics released a free, read-only MCP server that hands AI assistants the real Ultimate UI for WPF API: 189 Xam* controls, 5,300+ public classes, 2,600+ documentation topics and both theming systems. The walkthrough covers installing it as a .NET tool, wiring it into GitHub Copilot or Claude Code, and producing a RoyalDark-themed XamDataGrid dashboard from a single prompt.

PactNet 5
Contract testing
DEDevelopersVoice Sudhir Mangla 2 d ago

Consumer-driven contract testing in .NET: catch API breaks before deploy

In a microservice architecture a provider can pass all of its own tests and still break another service by reshaping its JSON. This guide walks through consumer-driven contract testing on .NET 10 with PactNet 5.0.1: generating contracts from real consumer clients, verifying them against the provider, publishing to a Pact Broker, and gating deployments in CI.

Feedback

Found a bug or have an idea? Your message lands straight in my inbox.

Type of message