dotnet

The October 25, 2026 out-of-band release (.NET 8.0.33, 9.0.22, 10.0.14, 11 RC3) fixes a Brotli buffer overflow, a Linux tarball ownership flaw, and two CVEs the October 13 patches did not fully close.

Pass --output-dir once per DbContext and EF Core keeps every later migration in that folder and namespace. Why the default layout is lopsided, the CS0111 collision you get from a shared folder, how to move existing migrations, and when to split the history table.

Add a second UseStaticFiles call with a PhysicalFileProvider and a RequestPath. Why MapStaticAssets can't do it, the absolute-path and content-root traps, dot files and unknown extensions, publishing the folder, and putting it behind authorization. Tested on ASP.NET Core 10.

outputTemplate is fixed per sink, so per-level formatting needs either an ExpressionTemplate with {#if @l ...} blocks or two Logger sub-loggers with ByIncludingOnly / ByExcluding filters. Both configured purely from appsettings.json, tested on Serilog 4.4, Serilog.Settings.Configuration 10.0.1 and Serilog.Expressions 5.0.

Aspire 13.6.4 stops a single timed-out or HTTP 504 DCP create call from sending a resource to FailedToStart, and exposes three DcpPublisher timeouts you can raise on slow CI runners.

Microsoft Agent Framework 1.26.0 makes MapAGUIServer resolve the keyed AIAgent, its AgentSessionStore, and the isolation key provider per request, and adds a selector overload that picks the agent from the HttpContext.

Microsoft.Playwright 1.64 adds Locator.Within() so you can write 'this button, within that dialog'. A quick probe shows it builds exactly the same locator as parent.Locator(child), including per-parent Nth() resolution.

Use Lazy<T> by default: it runs the factory once, caches exceptions, and its reads are too cheap to measure after initialization. Use LazyInitializer.EnsureInitialized when you lazily fill many fields or array slots and cannot afford an extra object per value. Hand-written double-checked locking is almost never worth it on .NET 10.

.NET MAUI 10.0.120 turns on AllowDrop for the Windows BlazorWebView and registers AndroidX DropDataContentProvider on Android, so Blazor Hybrid drop zones work without platform code. Here is what changed, the new MauiEnableAndroidWebViewDragDrop switch, and the MAUI1002 warning.

A peer sent RST_STREAM with PROTOCOL_ERROR for one request. HttpClient never retries it. Find which hop reset the stream, fix the request it rejected, retry only idempotent calls, or drop that hop to HTTP/1.1.