signalr

CVE-2026-92707: nested MessagePack array headers could reuse the same trailing bytes to pass the length check, so deserializing into object allocated thousands of times the payload size. The fix, a before/after probe, and why SignalR apps on .NET 8 through 11 RC 1 need a direct package pin.

The ASP.NET Core team mapped out where C# 15 union types flow through .NET 11: minimal API and MVC bodies, SignalR's JsonHubProtocol, Blazor, and OpenAPI anyOf schemas. Route, query, header, and form binding are not supported yet.

The SignalR authentication refresh APIs are finalized in .NET 11 RC 1, with renamed callbacks on HubConnection, a TypeScript client, and Blazor Server circuits that pick up the refreshed ClaimsPrincipal automatically.

.NET 11 Preview 7 adds an opt-in package that pauses interactive Server circuits when the browser tab is hidden, freeing memory and SignalR connections held by users who are not actually there.

The reconnect modal means the SignalR circuit dropped, not that your app crashed. Decide whether the retry ended in failed or rejected, then fix sticky sessions, the 3-minute retention window, the 32 KB message limit, or persist circuit state with [PersistentState].

For internal service-to-service calls in .NET 11, default to gRPC when you own both ends of the contract and the call is point-to-point. Use REST with JSON when anything you do not control has to call the service. SignalR is not an RPC transport between services: reach for it only when one producer has to fan a message out to many long-lived consumers.

Cancelling the CancellationToken you pass to InvokeAsync now reaches the server and cancels the hub method. This closes a SignalR request open since 2019.

Build a cross-platform real-time chat app in under 5 minutes using Xamarin Forms for the client and ASP.NET Core SignalR for the backend.

Use ngrok to publicly expose your local SignalR service so mobile clients can connect without network configuration or SSL workarounds.