Daily notes on .NET, C#, EF Core, MAUI, Blazor, and Flutter - for developers who ship.

.NET MAUI 10.0.120 turns on AllowDrop for the Windows BlazorWebView and registers AndroidX DropDataContentProvider on Android, so Blazor Hybrid drop zones work without platform code. Here is what changed, the new MauiEnableAndroidWebViewDragDrop switch, and the MAUI1002 warning.

A dependency was built with a Kotlin at least two minor versions newer than your build's compiler. Raise the org.jetbrains.kotlin.android version in settings.gradle.kts to X minus one or later, or pin the dependency back.

A peer sent RST_STREAM with PROTOCOL_ERROR for one request. HttpClient never retries it. Find which hop reset the stream, fix the request it rejected, retry only idempotent calls, or drop that hop to HTTP/1.1.

Turn on GitHub Copilot computer use in Copilot CLI and the Copilot app on macOS and Windows, grant the macOS Accessibility and Screen Recording permissions, approve apps per session or always, write prompts that keep the agent read-only, and lock it down with deny rules and the features.computerUse managed setting.

ModelContextProtocol 2.3.0, released October 20, 2026, changes McpClient.ServerInfo from Implementation to Implementation? because 2026-07-28 servers may omit their identity from server/discover. Here is why, what breaks under warnings-as-errors, and the one-line fix.

An expired MemoryCache entry is not removed on a timer. It stays in the dictionary until a read touches it, a throttled background scan runs, or compaction kicks in. Here is exactly when each happens, and how to get eager eviction.

A single-subscription stream accepts exactly one listen() for its whole life. Create the stream once and give it to one listener, or share it with asBroadcastStream or Stream.multi.

ApiException: 10 is DEVELOPER_ERROR: Google does not recognize the package name plus signing certificate SHA-1 of the installed APK. Register the SHA-1 of the key that actually signed the build, and pass the Web client ID as serverClientId.

On container protocol 2.0.0, Foundry hosted agents isolate conversations and sessions per Entra caller by default. When your own backend fronts many end users, you delegate with x-ms-user-identity, grant a custom impersonation role, and key everything your container stores by session ID plus user ID. Here is the C# for each layer and the traps that leak data between users.

Microsoft.AspNetCore.OpenApi only marks a response nullable when the action returns a bare T? (and, on .NET 10, not even Task<T?>). ActionResult<T?> and IActionResult lose the annotation on both .NET 10 and .NET 11 RC2. Here is why, a tested operation transformer that fixes it, and the 204 No Content trap that makes the spec lie unless you also change MVC's formatter.