Daily notes on .NET, C#, EF Core, MAUI, Blazor, and Flutter - for developers who ship.

Starting December 2, 2026, GitHub Actions blocks pull_request_target events in all public repositories unless an Actions event policy allows them. Brownouts hit on November 9 and 16. Here is how to find affected workflows and either migrate to pull_request or opt back in.

MXC is Microsoft's MIT-licensed SDK for running untrusted code, including model output, plugins and tools, under one deny-by-default policy that it maps to Seatbelt on macOS, bubblewrap on Linux and ProcessContainer on Windows. Here is what MXC SDK 1.0.1 and schema 1.0.0 actually define, how Copilot CLI hands it a policy per process, and what stays outside the box.

ChainedPartitionedRateLimiter walks each limiter once, but the ASP.NET Core rate limiting middleware calls the chain twice when the first pass fails: AttemptAcquire, then AcquireAsync. With fixed window or token bucket limiters a rejected request burns two permits from the first limiter, and a queued request does too. Reproduced on ASP.NET Core 10.0.10 and 11.0 RC3, with a wrapper that makes the middleware walk the chain once.

On November 3, 2026 the .NET team showed agent skills shipping inside NuGet packages as skills/<name>/SKILL.md. Here is the layout, how restore exposes it through project.assets.json, the two tools that read it today, and what is still missing.

Starting a thread inside a finalizer works, but the new thread is a normal-priority foreground thread that resurrects the object, outlives GC.WaitForPendingFinalizers, can crash the process, and may touch objects that were already finalized. Blocking on it hangs shutdown. Eight cases reproduced on .NET 10 with real output, plus the safe handoff pattern.

AsyncLocal<T> stores a value in the ExecutionContext, which flows down into awaits, Task.Run and continuations but never back up: every async method restores the caller's context when it returns. Verified on .NET 10: eleven cases with real output, the runtime code that does the restore, and three patterns that do get a value back to the caller.

On .NET Core and .NET 5+ Stopwatch.IsHighResolution is a hard-coded true and never false. Frequency is whatever QueryPerformanceFrequency says on Windows (usually 10 MHz) and a fixed 1,000,000,000 on Linux, macOS, iOS, Android and WASM, which is a unit, not a resolution. Only .NET Framework can fall back to DateTime. Source walkthrough plus a measured run on .NET 10 / Apple M4 showing 1 ns nominal ticks but 41.67 ns real steps.

The MCP Tasks extension (io.modelcontextprotocol/tasks, spec 2026-07-28, SEP-2663) lets a server answer tools/call with a durable task handle instead of a result. The client polls tasks/get, answers mid-flight questions with tasks/update, and can cancel or reconnect. Here is the wire protocol, what changed from the experimental 2025-11-25 version, when a task is worth it, and a working server and client checked against @modelcontextprotocol/ext-tasks 0.2.2.

On October 29, 2026 Microsoft announced Syncfusion as a Blazor contributor. The headline is Syncfusion.Blazor.Toolkit 2.0.1: 17 MIT-licensed components for net8.0, net9.0 and net10.0, free for commercial use with no license key. Here is what is in it, how to wire it up, and where the commercial line is drawn.

[CallerArgumentExpression] makes the C# compiler pass the source text of an argument as a string. Verified on .NET 10 and C# 14: what exactly gets captured (whitespace, comments, parentheses, line breaks), when you get null instead, how to write NotNull, Positive and That guards, and the overload trap that silently disables it.