.NET 10 & C# 14 LTS

Everything today is generally available, supported until November 2028, and safe to put into production. The only real question is sequencing.

How today runs

Five modules. The middle three carry the most change for server-side teams, so they get the time.

Why this deck measures things

Release notes describe intent. They are written before the code ships, and they are not always right about what you'll actually observe.

While preparing this workshop, a number of widely repeated claims failed when compiled and run — including claims from documentation, from conference talks, and from an earlier version of these slides. So every risky statement today was checked on a real machine.

The cadence, and why it decides your upgrade plan

.NET ships every November, alternating between long-term and standard-term support. That alternation — not the feature list — is what drives most upgrade decisions.

What has to move together

"Upgrade to .NET 10" is not one decision. These versions are coupled, and getting one wrong produces confusing failures later.

Getting to .NET 10

Retargeting is usually a one-line change. The work is in what surfaces afterwards.

<PropertyGroup>
  <TargetFramework>net10.0</TargetFramework>
  <!-- C# 14 is the default for net10.0; you do not need to set LangVersion. -->
</PropertyGroup>

A pragmatic order that keeps each step independently revertible:

1. Retarget and build. Fix only what breaks compilation.
2. Run your test suite before adopting a single new language feature. Keep the "did the runtime change break us?" question separate from "did our refactor break us?"
3. Update packages — especially EF Core, which must match the major version.
4. Then adopt C# 14 features, where they earn their place.

Tooling that helps

• GitHub Copilot upgrade — the agent that replaced Upgrade Assistant. Assesses the solution, proposes a plan, applies fixes and commits each step so you can review or roll back. Available in Visual Studio, VS Code, the Copilot CLI and GitHub.com.
• dotnet list package --outdated — the fastest way to find package drift.
• dotnet list package --vulnerable --include-transitive — run this anyway; upgrades are a good moment to clear known CVEs.

Triaging the breaking changes

Microsoft publishes a per-release breaking-change list. It is long, and most of it will not apply to you. Triage it by how the break reaches you rather than reading top to bottom.

File-based apps: C# without a project

.NET 10 lets you run a single .cs file directly. No .csproj, no obj/, no scaffolding.

dotnet run hello.cs

Dependencies and settings come from #: directives at the top of the file:

#!/usr/bin/env dotnet
#:package Humanizer@2.14.1

using Humanizer;

var when = DateTime.UtcNow.AddHours(-30);
Console.WriteLine($"no csproj, one file: {when.Humanize()}");

Run it with no project file present at all:

no csproj, one file: yesterday

When a script outgrows itself

dotnet project convert promotes a file-based app to a normal project. What it actually produces is worth seeing before you rely on it.

dotnet project convert app.cs

app.cs
app\app.cs
app\app.csproj

<PropertyGroup>
  <OutputType>Exe</OutputType>
  <TargetFramework>net10.0</TargetFramework>
  <ImplicitUsings>enable</ImplicitUsings>
  <Nullable>enable</Nullable>
  <PublishAot>true</PublishAot>
  <PackAsTool>true</PackAsTool>
</PropertyGroup>
<ItemGroup>
  <PackageReference Include="Humanizer" Version="2.14.1" />
</ItemGroup>

The CLI grew some useful verbs

The command line is drifting towards a noun-first shape, and picked up a couple of things worth putting in your muscle memory.

dnx dotnetsay "Hello from dnx" --yes     # the tool runs

dotnet tool list --global
Package Id      Version      Commands     # still empty

The runtime change you can actually see

.NET 10's JIT can prove that a small array never leaves its method, and then not allocate it on the heap at all.

The test method builds a local int[4], fills it, sums it, and returns an int. The array never escapes. A sibling method returns the array instead, so it must escape. Both were called two million times, measuring GC.GetAllocatedBytesForCurrentThread(), on three runtimes with the same source.

runtime 8.0.31
  local array  : 40.00 bytes/call
  escaping     : 40.00 bytes/call

runtime 9.0.20
  local array  : 40.00 bytes/call
  escaping     : 40.00 bytes/call

runtime 10.0.12
  local array  : 0.00 bytes/call
  escaping     : 40.00 bytes/call

The catch, and why it's the more useful finding

The same binary, run three times in a row on the same machine, with nothing changed:

--- run 1 ---
  local array : 0.00 bytes/call
--- run 2 ---
  local array : 40.00 bytes/call
--- run 3 ---
  local array : 0.00 bytes/call

Measuring this yourself, cheaply

Every measurement in today's deck came from one of three tools. None of them needs a profiler licence or a spare afternoon.

GC.Collect();
long before = GC.GetAllocatedBytesForCurrentThread();
for (int i = 0; i < 2_000_000; i++) acc += Work(i);
long after = GC.GetAllocatedBytesForCurrentThread();
Console.WriteLine($"{(after - before) / 2_000_000.0:F2} bytes/call");

C# 14: not just nicer syntax C# 14

C# 14 ships with .NET 10. The headline is extension members; the upgrade risk is overload resolution around spans.

Extension members are the main event C# 14

Classic extension methods let you add methods. Extension blocks let you add a small, coherent member surface.

public static class OrderExtensions
{
    public static bool IsEmpty(
        this IReadOnlyCollection<OrderLine> lines)
        => lines.Count == 0;

    public static decimal Total(
        this IEnumerable<OrderLine> lines)
        => lines.Sum(line => line.Price);
}

public static class OrderExtensions
{
    extension(IReadOnlyCollection<OrderLine> lines)
    {
        public bool IsEmpty => lines.Count == 0;
    }

    extension(IEnumerable<OrderLine> lines)
    {
        public decimal Total =>
            lines.Sum(line => line.Price);
    }
}

The extension block is declared inside a top-level, non-generic, non-nested static class. The receiver is named once, then used by every instance member in the block.

Get the extension syntax exactly right C# 14

There are two receiver forms. Use a named receiver for instance members; use a type-only receiver when the block contains only static members.

public static class CustomerExtensions
{
    extension(Customer customer)
    {
        public bool HasEmail =>
            !string.IsNullOrWhiteSpace(customer.Email);

        public string DisplayLabel() =>
            $"{customer.Id}: {customer.Name}";
    }
}

public static class CustomerExtensions
{
    extension(Customer)
    {
        public static Customer Anonymous =>
            new("anonymous");
    }
}

Extension properties: powerful, but easy to overuse

The new capability is not shorter method syntax. It is the ability to make calculated facts read like facts.

public static class UriExtensions
{
    extension(Uri uri)
    {
        public bool IsHttps =>
            string.Equals(uri.Scheme, Uri.UriSchemeHttps,
                StringComparison.OrdinalIgnoreCase);

        public string Origin =>
            uri.IsDefaultPort
                ? $"{uri.Scheme}://{uri.Host}"
                : $"{uri.Scheme}://{uri.Host}:{uri.Port}";
    }
}

Static extension members move factories closer to the type

Static extensions appear as static members of the receiver type. That can make neutral values, factories, and operators discoverable without owning the original type.

public static class MoneyExtensions
{
    extension(Money)
    {
        public static Money Zero => new(0m, "EUR");

        public static Money FromEuros(decimal amount) =>
            new(amount, "EUR");
    }
}

Money invoiceMinimum = Money.Zero;
Money deposit = Money.FromEuros(250m);

What extension members do not change

Extension members improve expression. They do not change ownership, encapsulation, or binding priority.

public sealed class Customer
{
    public string Label => "real member";
}

public static class CustomerExtensions
{
    extension(Customer customer)
    {
        public string Label => "extension member";
    }
}

Console.WriteLine(new Customer().Label); // real member wins

The field keyword C# 14

The new contextual keyword gives an accessor direct access to the compiler-synthesised backing field. It replaces the most repetitive full-property pattern.

private string _name = string.Empty;

public string Name
{
    get => _name;
    set => _name = value.Trim();
}

public string Name
{
    get;
    set => field = value.Trim();
}

You can mix an auto accessor with a full accessor. The backing field is still generated by the compiler, but the custom accessor can validate, normalise, lazy-initialise, or raise notifications.

public string Email
{
    get;
    set => field = value.Trim().ToLowerInvariant();
}

public Report Summary
{
    get => field ??= BuildReport();
}

field can shadow a real member Audit

This is rare, but it is the kind of rare that ships: the compiler reports only a warning.

private int field = 100;

public int Value
{
    get => field;
    set => field = value;
}

public int RawField => field;

100, 100, then 7, 7
0, 0, then 7, 0

First-class spans: the feature is overload resolution

C# 14 treats span conversions as standard implicit conversions in more places. Arrays, strings, Span<T>, and ReadOnlySpan<T> compose more naturally.

void Parse(ReadOnlySpan<char> text) { }
void Process(ReadOnlySpan<int> values) { }

string name = "Ada";
int[] numbers = [1, 2, 3];
Span<int> writable = numbers;

Parse(name);       // string -> ReadOnlySpan<char>
Process(numbers);  // int[] -> ReadOnlySpan<int>
Process(writable); // Span<int> -> ReadOnlySpan<int>

The real span break: calls silently move Behaviour

This is the most dangerous C# 14 item in the release because correct existing code can bind to a different overload with no diagnostic.

static void M(IEnumerable<int> values) =>
    Console.WriteLine("IEnumerable");

static void M(ReadOnlySpan<int> values) =>
    Console.WriteLine("ReadOnlySpan");

int[] numbers = [1, 2, 3];
M(numbers);

Null arrays can become empty spans Audit

The behavioural break is clearest when callers pass a null array to an overload set containing IEnumerable<T> and ReadOnlySpan<T>.

static void Validate(IEnumerable<int> values)
{
    ArgumentNullException.ThrowIfNull(values);
}

static void Validate(ReadOnlySpan<int> values)
{
    if (values.IsEmpty)
        return;
}

int[]? numbers = null;
Validate(numbers);

Two reassurances: the audit is narrower than it sounds

Do not turn this into "all arrays are dangerous". Two common fears did not reproduce.

The shortcut that silently reverses your arrays

Someone will ask it within ten minutes of the retargeting slide: "can we just set LangVersion to 14 and keep net8.0?" It compiles. Do not do it.

Target framework and language version are separate dials, and the SDK will let you turn one without the other. Every C# 14 feature we have seen so far builds and runs on net8.0 with <LangVersion>14.0</LangVersion> — extension members, field, null-conditional assignment, unbound nameof. Zero errors, zero warnings.

Then you write this, which is ordinary, discard-the-result LINQ:

int[] nums = [3, 1, 2];

nums.Reverse();   // a bare statement

Console.WriteLine(string.Join(",", nums));

net8.0 + LangVersion 13.0  ->  [3,1,2]
net8.0 + LangVersion 14.0  ->  [2,1,3]

  0 Warning(s)
  0 Error(s)

Null-conditional assignment: the whole write short-circuits

?. and ?[] can now appear on the left-hand side of assignment and compound assignment.

if (holder is not null)
{
    holder.Name = Loud();
}

holder?.Name = Loud();

customer?.Orders += 1;
array?[index] = value;

nameof now accepts unbound generics

When you want the generic type name rather than a constructed type, you no longer need a representative type argument.

Console.WriteLine(nameof(List<>));
Console.WriteLine(nameof(Dictionary<,>));

string metric = $"cache.miss.{nameof(Dictionary<,>)}";

List
Dictionary

Lambda parameter modifiers no longer force full types

Before C# 14, adding out, ref, in, ref readonly, or scoped meant spelling out parameter types. Now the compiler can infer them in simple lambda parameter lists.

delegate bool TryParse<T>(string text, out T result);

// Before
TryParse<int> parse1 =
    (string text, out int result) =>
        int.TryParse(text, out result);

// C# 14
TryParse<int> parse2 =
    (text, out result) =>
        int.TryParse(text, out result);

Partial properties and events close generator gaps

Partial members let one file declare the public shape and another file, often generated, supply the implementation.

public partial class CustomerViewModel
{
    public partial string DisplayName { get; set; }

    public partial event EventHandler? Saved;
}

public partial class CustomerViewModel
{
          private EventHandler? _saved;

          public partial string DisplayName
          {
              get => field;
        set => field = value.Trim();
    }

    public partial event EventHandler? Saved
    {
        add { _saved += value; }
        remove { _saved -= value; }
    }
}

User-defined compound assignment is for mutation hot paths

C# 14 lets a type customise compound assignment directly, instead of relying only on x = x + y expansion.

public struct Accumulator
{
    private long _total;

    public void operator +=(long amount)
    {
        _total += amount;
    }

    public override string ToString() => _total.ToString();
}

What this means for your upgrade

Most C# 14 features are opt-in. Two are not: default language version and overload resolution.

1. Inventory overload sets. Search shared APIs for pairs of IEnumerable<T> and ReadOnlySpan<T>. Add tests for null arrays and arrays with values.
2. Promote CS9258. Treat the field shadowing warning as an error before adopting field-backed properties.
3. Pin if you need sequencing. Retarget to net10.0 with <LangVersion>13.0</LangVersion>, validate runtime changes, then remove the pin.
4. Adopt extension members where they improve API shape. Prefer domain vocabulary over helper-class churn.
5. Keep convenience features boring. nameof(List<>), null-conditional assignment, and lambda modifier inference should make code easier to read, not cleverer.

Lab 01 — C# 14 in anger 30 min

Take a deliberately old-fashioned type and modernise it.

cd labs/Day1/01-CSharp14/start
dotnet run

You are given a small order-processing library written in C# 7 style. Your tasks:

1. Replace every manual backing field with the field keyword.
2. Convert the OrderHelpers static class into an extension block, turning at least two of its methods into extension properties.
3. Add a static extension member that returns an empty order.
4. Find the three places that can use null-conditional assignment.
5. Make the Money struct support in-place +=.

The solution is in labs/Day1/01-CSharp14/solution. Tests in the start project must keep passing throughout — that's the point.

.NET 10 libraries .NET 10

The library story is defensive modernisation: stronger cryptography choices, stricter JSON boundaries, and a few everyday APIs that remove local plumbing.

Post-quantum crypto: why application teams care now

The near-term risk is not that a quantum computer breaks your service today. It is harvest now, decrypt later.

Do not conflate the PQC algorithms

.NET 10 exposes several post-quantum families. They solve different problems and should not appear in the same sentence as if they are interchangeable.

ML-KEM gives you a symmetric secret, not ciphertext for your message

The recipient owns a key pair. The sender imports the public key, encapsulates, and sends the encapsulation ciphertext. Both sides end with the same 32-byte secret.

using System.Security.Cryptography;

if (!MLKem.IsSupported)
{
    throw new PlatformNotSupportedException("ML-KEM is not available here.");
}

using MLKem recipient = MLKem.GenerateKey(MLKemAlgorithm.MLKem768);

#pragma warning disable SYSLIB5006 // Key serialisation is still experimental.
byte[] spki = recipient.ExportSubjectPublicKeyInfo();
using MLKem sender = MLKem.ImportSubjectPublicKeyInfo(spki);
#pragma warning restore SYSLIB5006

sender.Encapsulate(out byte[] ciphertext, out byte[] senderSecret);

byte[] recipientSecret = recipient.Decapsulate(ciphertext);
// Feed senderSecret / recipientSecret into symmetric cryptography.

The cost is bigger keys and signatures

PQC is not just a new enum value. The byte counts affect certificates, handshakes, tokens, QR codes, headers and storage schemas.

IsSupported is real control flow

The BCL type existing does not mean the current machine can run the algorithm. .NET delegates support to the underlying cryptographic provider, such as Windows CNG with PQC support or OpenSSL 3.5 or later.

MLKem.IsSupported -> True
MLDsa.IsSupported -> True
CompositeMLDsa.IsSupported -> True
SlhDsa.IsSupported -> False

SlhDsa.GenerateKey(...) throws:
PlatformNotSupportedException: Algorithm 'SlhDsa' is not supported on this platform.

if (!SlhDsa.IsSupported)
{
    // Hide the feature, choose a different algorithm, or fail startup clearly.
    return;
}

"PQC is experimental" is too coarse

The boundary does not run around the types. It runs through them. On MLKem and MLDsa, SYSLIB5006 is applied per member — so the same class gives you members that compile silently and members that stop the build.

MLKem.GenerateKey(...);
key.Encapsulate(out ct, out secret);
key.Decapsulate(ct);
key.ExportEncapsulationKey();

MLDsa.GenerateKey(...);
signer.SignData(data);
signer.VerifyData(data, sig);

key.ExportSubjectPublicKeyInfo();
MLKem.ImportSubjectPublicKeyInfo(spki);
// ...and the PEM / PKCS#8 / X.509 paths

bool ok = SlhDsa.IsSupported;   // whole type
CompositeMLDsa.GenerateKey(...); // whole type

error SYSLIB5006: 'MLKem.ExportSubjectPublicKeyInfo()' is for evaluation
purposes only and is subject to change or removal in future updates.
error SYSLIB5006: 'MLKem.ImportSubjectPublicKeyInfo(byte[])' is for evaluation
purposes only and is subject to change or removal in future updates.

  0 Warning(s)
  2 Error(s)

System.Text.Json becomes stricter at the boundary

The serializer is increasingly a boundary component, not just a convenience API for turning objects into text.

Item item = JsonSerializer.Deserialize<Item>(
    json,
    JsonSerializerOptions.Strict)!;

JsonSerializerDefaults.Strict changes four things

Microsoft documents the intent. The workshop measurement diffed the actual options objects so you can teach the precise behaviour.

JsonSerializerOptions shared = JsonSerializerOptions.Strict;
JsonSerializerOptions local = new(JsonSerializerDefaults.Strict);

Duplicate JSON properties are a security problem

Duplicate names create parser differentials: one component may log or authorise one value while another component executes a different value.

{"A":1,"A":2}

public sealed record Item(int A);

Strict mode makes DTO contracts executable

The other three strict switches move common review comments from convention into runtime behaviour.

var options = new JsonSerializerOptions(JsonSerializerDefaults.Strict)
{
    TypeInfoResolver = MyJsonContext.Default
};

Source-generated JSON can preserve references

.NET 10 lets source-generated contexts specify reference handling through JsonSourceGenerationOptionsAttribute, instead of falling back to runtime options for cyclic graphs.

[JsonSourceGenerationOptions(
    ReferenceHandler = JsonKnownReferenceHandler.Preserve)]
[JsonSerializable(typeof(Node))]
internal partial class GraphJsonContext : JsonSerializerContext
{
}

internal sealed class Node
{
    public Node? Parent { get; set; }
    public List<Node> Children { get; } = [];
}

JSON now reads directly from PipeReader

JsonSerializer.DeserializeAsync and async-enumerable deserialisation can consume a PipeReader directly, matching the existing PipeWriter serialisation direction.

using System.IO.Pipelines;
using System.Text.Json;

PipeReader reader = connection.Input;
Order? order = await JsonSerializer.DeserializeAsync<Order>(
    reader,
    JsonSerializerOptions.Strict,
    cancellationToken);

Crypto improvements beyond PQC

Several smaller cryptography changes remove old assumptions that have lingered in platform code.

The library changes most teams will actually touch

These are not headline features, but they replace common helper code and performance workarounds.

What to actually do after this module

Treat .NET 10 libraries as an adoption backlog, not as a feature checklist.

1. Inventory long-lived confidentiality. Identify data and protocols where harvest-now-decrypt-later is credible.
2. Probe PQC support in every target environment. Put IsSupported in code paths and deployment checks, not just demos.
3. Separate stable and experimental PQC usage. Keep SYSLIB5006 suppressions narrow and reviewed.
4. Harden JSON boundaries first. Start with duplicate-property rejection and strict options on public or partner-facing inputs.
5. Retire local helpers. Replace custom archive, ordering, PEM, thumbprint and WebSocket plumbing where the BCL now owns the behaviour.

Lab 02 — PQC and JSON hardening 30 min

Use the new APIs as boundary code: capability-gated crypto first, then a stricter JSON input path.

cd labs/Day1/02-Libraries-Pqc-Json/start
dotnet run

1. Gate PQC features with IsSupported and print the local support matrix.
2. Generate an ML-KEM key pair, encapsulate a shared secret and decapsulate it.
3. Sign and verify a payload with ML-DSA, then prove a tampered payload fails.
4. Harden a JSON deserializer with strict options and duplicate-property rejection.

OpenAPI 3.1 is now the default .NET 10

The most visible ASP.NET Core 10 change is not an endpoint API. It is the contract your tools read.

{
  "note": { "type": ["null", "string"] }
}

Pin the family, not the patch digit

The option is straightforward, but the emitted patch version is selected by the framework.

using Microsoft.OpenApi;

builder.Services.AddOpenApi(options =>
{
    options.OpenApiVersion = OpenApiSpecVersion.OpenApi3_0;
});

The real schema diff: nullability and integers

This is the before/after to show generator owners. It came from the same record emitted as 3.1.1 and pinned 3.0.4.

public record Order(
    int Id,
    string? Note,
    int? Quantity,
    Priority Priority,
    DateTimeOffset Placed);

"id":       { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": ["integer","string"], "format": "int32" }
"note":     { "type": ["null","string"] }
"quantity": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": ["null","integer","string"], "format": "int32" }
"placed":   { "type": "string", "format": "date-time" }

"id":       { "pattern": "^-?(?:0|[1-9]\\d*)$", "anyOf": [ {"type":"integer"}, {"type":"string"} ], "format": "int32" }
"note":     { "type": "string", "nullable": true }
"quantity": { "pattern": "^-?(?:0|[1-9]\\d*)$",
              "anyOf": [ {"type":"integer"}, {"type":"string"}, {"enum":[null],"nullable":true} ],
              "format": "int32", "nullable": true }

The integer schema is really a JSON option story

The OpenAPI 3.1 output reflects ASP.NET Core's runtime JSON behaviour: numbers may be read from strings by default.

using System.Text.Json.Serialization;

builder.Services.ConfigureHttpJsonOptions(options =>
{
    options.SerializerOptions.NumberHandling = JsonNumberHandling.Strict;
});

Enums silently degrade unless JSON options say otherwise

The contract does not infer friendly enum values from your C# enum by itself.

{ "type": "integer" }

{ "enum": ["Low", "High"] }

using System.Text.Json.Serialization;

builder.Services.ConfigureHttpJsonOptions(options =>
{
    options.SerializerOptions.Converters.Add(new JsonStringEnumConverter());
});

Microsoft.OpenApi 2.0 rewrites your transformers

Pinning the document back to OpenAPI 3.0 does not pin the object model your code compiles against.

schema.Example = new JsonObject
{
    ["temperatureC"] = 0,
    ["summary"] = "Bracing",
};

Three transformer kinds, one execution pipeline

Use the smallest transformer that has the context you need.

app.MapGet("/old", () => "This endpoint is old")
   .AddOpenApiOperationTransformer((operation, context, cancellationToken) =>
   {
       operation.Deprecated = true;
       return Task.CompletedTask;
   });

XML comments now feed the OpenAPI document

A source generator turns existing XML documentation into contract metadata for the current assembly and project references.

<PropertyGroup>
  <GenerateDocumentationFile>true</GenerateDocumentationFile>
</PropertyGroup>

app.MapGet("/hello", Hello);

/// <summary>Sends a greeting.</summary>
/// <param name="name">The person to greet.</param>
static string Hello(string name) => $"Hello, {name}!";

Generate the document at build time

Build-time generation turns the contract into an artefact you can diff, lint and publish from CI.

<PropertyGroup>
  <OpenApiGenerateDocumentsOnBuild>true</OpenApiGenerateDocumentsOnBuild>
  <OpenApiDocumentsDirectory>$(MSBuildProjectDirectory)</OpenApiDocumentsDirectory>
  <OpenApiGenerateDocumentsOptions>--file-name orders --document-name v1 --openapi-version OpenApi3_1</OpenApiGenerateDocumentsOptions>
</PropertyGroup>

using System.Reflection;

if (Assembly.GetEntryAssembly()?.GetName().Name != "GetDocument.Insider")
{
    builder.AddServiceDefaults();
}

• Add the Microsoft.Extensions.ApiDescription.Server package for design-time generation.
• YAML generation is runtime-only in .NET 10.
• Use build output as input to OpenAPI linting and client generation.

Minimal APIs get built-in validation

DataAnnotations validation is now a framework feature for Minimal API parameters instead of a per-team endpoint filter.

using Microsoft.Extensions.DependencyInjection;
using System.ComponentModel.DataAnnotations;

builder.Services.AddValidation();

app.MapPost("/products", (Product product) => TypedResults.Ok(product));

public record Product(
    [Required] string Name,
    [Range(1, 1000)] int Quantity);

app.MapPost("/products", ([Required] string name) => TypedResults.Ok(name))
   .DisableValidation();

Two upgrade changes that show up as production outages

These are good changes for APIs and security, but they change runtime behaviour under real infrastructure.

options.Events.OnRedirectToLogin = context =>
{
    context.Response.Redirect(context.RedirectUri);
    return Task.CompletedTask;
};

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
    KnownProxies = { IPAddress.Parse("10.0.0.7") },
    KnownIPNetworks = { new IPNetwork(IPAddress.Parse("10.0.0.0"), 8) }
});

The Swashbuckle question is strategic, not rhetorical

Microsoft's default path changed. Your team's decision should be explicit.

Server-Sent Events get a first-party result

Use SSE when the server needs to push a one-way stream and WebSockets would be more machinery than value.

using System.Runtime.CompilerServices;
using System.Net.ServerSentEvents;

app.MapGet("/events", (CancellationToken cancellationToken) =>
{
    async IAsyncEnumerable<SseItem<string>> Stream(
        [EnumeratorCancellation] CancellationToken ct)
    {
        while (!ct.IsCancellationRequested)
        {
            yield return new SseItem<string>($"tick {DateTimeOffset.UtcNow}");
            await Task.Delay(TimeSpan.FromSeconds(1), ct);
        }
    }

    return TypedResults.ServerSentEvents(Stream(cancellationToken));
});

JSON Patch moves to System.Text.Json

The new package removes a common Newtonsoft dependency, but the behaviour is not a byte-for-byte clone.

using Microsoft.AspNetCore.JsonPatch.SystemTextJson;

var patchDoc = JsonSerializer.Deserialize<JsonPatchDocument<Person>>(jsonPatch);
patchDoc!.ApplyTo(person, error =>
{
    // error.AffectedObject and error.ErrorMessage are available here.
});

Wiring JSON Patch into an endpoint

The package is only half the story. The shape teams actually ship is a PATCH endpoint that binds JsonPatchDocument<T> straight from the body.

[HttpPatch("{id}")]
public Results<Ok<Person>, ValidationProblem, NotFound<ProblemDetails>> Patch(
    int id, JsonPatchDocument<Person> patchDoc)
{
    var person = _repo.Get(id);
    if (person is null) return TypedResults.NotFound(new ProblemDetails());

    var errors = new Dictionary<string, string[]>();
    patchDoc.ApplyTo(person, e =>
        errors[e.AffectedObject.GetType().Name] = [e.ErrorMessage]);

    return errors.Count > 0
        ? TypedResults.ValidationProblem(errors)
        : TypedResults.Ok(person);
}

PATCH /person/123   [{"op":"replace","path":"/address/city","value":"Munich"}]
200   {"firstName":"Holger", ... "address":{ ... "city":"Munich" ... }}

PATCH /person/123   [{"op":"replace","path":"/nope","value":"X"}]
400   {"errors":{"Person#1":["The target location specified by path
        segment 'nope' was not found."]}}

Content-Type: application/json-patch+json  ->  200
Content-Type: application/json             ->  415 Unsupported Media Type

JSON Patch rules out Native AOT

It publishes, it starts, and it fails on the first request. If an API is heading for Native AOT, JSON Patch is a design decision, not a detail.

warning IL3053: Assembly 'Microsoft.AspNetCore.JsonPatch.SystemTextJson'
                produced AOT analysis warnings.

System.NotSupportedException: JsonTypeInfo metadata for type
'JsonPatchDocument`1[Person]' was not provided by TypeInfoResolver of type '[]'.

warning SYSLIB1030: Did not generate serialization metadata for type
                    'JsonPatchDocument<Person>'
warning SYSLIB1220: The 'JsonConverterAttribute' type
                    'JsonPatchDocumentConverterFactory' is not a converter type
                    or does not contain an accessible parameterless constructor

Identity adds passkey APIs, not a general WebAuthn library

ASP.NET Core Identity now has first-party WebAuthn/FIDO2 passkey support for authentication scenarios.

builder.Services.Configure<IdentityPasskeyOptions>(options =>
{
    options.ServerDomain = "contoso.com";
});

The ASPDEPR wall is an upgrade planning tool

Retargeting a legacy ASP.NET Core app to net10.0 can light up source warnings before behaviour breaks at runtime.

What did not change in ASP.NET Core 10

Saying this out loud prevents the room from filling gaps with rumours.

Lab 03 — OpenAPI-first Minimal APIs 40 min

Build the API contract you will deliberately break and migrate tomorrow.

cd labs/Day1/03-AspNetCore-OpenApi/start
dotnet run

1. Generate and inspect the default OpenAPI 3.1 document.
2. Serve the OpenAPI document as YAML as well as JSON.
3. Add XML comments and response descriptions that appear in the contract.
4. Add Minimal API validation and return problem details for invalid requests.
5. Add a small SSE endpoint so the contract includes a streaming shape.

Complex types are the EF Core 10 headline EF Core 10

EF Core 10 turns complex types from a niche modelling feature into the default choice for value objects.

public sealed class Customer
{
    public int Id { get; set; }
    public required Address BillingAddress { get; set; }
    public required Address ShippingAddress { get; set; }
}

public readonly record struct Address(
    string Line1,
    string City,
    string Country);

What EF Core 10 adds to complex types

EF 8 introduced complex types. EF Core 10 adds the missing pieces that make them usable in real models.

public class Customer
{
    public int Id { get; set; }
    public required Address Address { get; set; }
    public Address? SecondaryAddress { get; set; }
}

modelBuilder.Entity<Customer>(b =>
{
    b.ComplexProperty(c => c.Address, a => a.ToJson());
    b.ComplexProperty(c => c.SecondaryAddress, a => a.ToJson());
});

Complex type gotchas that belong in the design review

Most mistakes come from treating complex types as owned types with a new method name.

modelBuilder.Entity<Place>()
    .ComplexProperty(p => p.Location, b => b.HasDiscriminator());

customer.Address = customer.Address with { Line1 = "Peacock Lodge" };

Owned → complex migration: a decision framework

Do not bulk-rewrite every OwnsOne. Classify each type by the behaviour your domain needs.

Named query filters fix the soft-delete plus tenant trap

EF Core 10 lets you attach multiple named global filters to one entity and disable only the one you mean.

modelBuilder.Entity<Blog>()
    .HasQueryFilter(b => !b.IsDeleted && b.TenantId == tenantId);

var supportView = await context.Blogs
    .IgnoreQueryFilters()
    .ToListAsync();

modelBuilder.Entity<Blog>()
    .HasQueryFilter("SoftDeletionFilter", b => !b.IsDeleted)
    .HasQueryFilter("TenantFilter", b => b.TenantId == tenantId);

var supportView = await context.Blogs
    .IgnoreQueryFilters(["SoftDeletionFilter"])
    .ToListAsync();

Parameterized collections are the sleeper upgrade risk

EF Core 10 changes the default SQL shape for collection.Contains(x) on SQL Server.

int[] ids = [1, 2, 3];
var blogs = await context.Blogs
    .Where(b => ids.Contains(b.Id))
    .ToListAsync();

@__ids_0='[1,2,3]'

WHERE [b].[Id] IN (
    SELECT [i].[value]
    FROM OPENJSON(@__ids_0) WITH ([value] int '$') AS [i]
)

WHERE [b].[Id] IN (@ids1, @ids2, @ids3)

SQL Server native json is useful, and it can surprise your migrations

On Azure SQL and SQL Server 2025 compatibility level 170 or later, EF Core 10 maps JSON columns to the native json type by default.

CREATE TABLE [Blogs] (
    [Tags] nvarchar(max),
    [Details] nvarchar(max)
);

CREATE TABLE [Blogs] (
    [Tags] json NOT NULL,
    [Details] json NOT NULL
);

WHERE JSON_VALUE([b].[Details], '$.Viewers' RETURNING int) > 3

ExecuteUpdateAsync accepts regular C# now

The setters callback is a normal delegate in EF Core 10, so conditional updates no longer require expression-tree construction.

Expression<Func<SetPropertyCalls<Blog>, SetPropertyCalls<Blog>>> setters =
    s => s.SetProperty(b => b.Rating, 5);

await context.Blogs.ExecuteUpdateAsync(setters);

await context.Blogs.ExecuteUpdateAsync(s =>
{
    s.SetProperty(b => b.Rating, 5);

    if (rename)
    {
        s.SetProperty(b => b.Name, newName);
    }
});

ExecuteUpdate can update inside JSON documents

When a JSON document is mapped as a complex type, EF Core 10 can update a member in one database statement.

var blogs = await context.Blogs.ToListAsync();

foreach (var blog in blogs)
{
    blog.Details.Views++;
}

await context.SaveChangesAsync();

modelBuilder.Entity<Blog>()
    .ComplexProperty(b => b.Details, d => d.ToJson());

await context.Blogs.ExecuteUpdateAsync(s =>
    s.SetProperty(
        b => b.Details.Views,
        b => b.Details.Views + 1));

UPDATE [b]
SET [Details].modify(
    '$.Views',
    JSON_VALUE([b].[Details], '$.Views' RETURNING int) + 1)
FROM [Blogs] AS [b]

LeftJoin and RightJoin make outer joins readable

.NET 10 adds first-class LINQ operators, and EF Core 10 translates them to SQL joins.

var query = context.Students
    .GroupJoin(
        context.Departments,
        s => s.DepartmentId,
        d => d.Id,
        (s, departments) => new { s, departments })
    .SelectMany(
        x => x.departments.DefaultIfEmpty(),
        (x, d) => new { x.s.Name, Department = d.Name ?? "[NONE]" });

var query = context.Students
    .LeftJoin(
        context.Departments,
        student => student.DepartmentId,
        department => department.Id,
        (student, department) => new
        {
            student.Name,
            Department = department.Name ?? "[NONE]"
        });

EF Core 10 vector search is exact search, not indexed search

SQL Server vector support is built into EF Core 10, but the scope matters for architecture decisions.

public class Blog
{
    [Column(TypeName = "vector(1536)")]
    public SqlVector<float> Embedding { get; set; }
}

var nearest = await context.Blogs
    .OrderBy(b => EF.Functions.VectorDistance(
        "cosine", b.Embedding, queryVector))
    .Take(3)
    .ToListAsync();

Split-query ordering gets a correctness fix

EF Core 10 makes the ordering inside split-query subqueries match the outer query, including the key.

var blogs = await context.Blogs
    .AsSplitQuery()
    .Include(b => b.Posts)
    .OrderBy(b => b.Name)
    .Take(2)
    .ToListAsync();

-- Subquery ordered by name only
ORDER BY [b].[Name]

-- Subquery matches the outer ordering
ORDER BY [b].[Name], [b].[Id]

EF Core 10 logs less sensitive data and warns on raw-SQL concatenation

Two small defaults reduce common production risks without changing the SQL that executes.

-- Logged text in EF Core 10
WHERE [u].[Role] IN (?, ?)

var users = context.Users.FromSqlRaw(
    "SELECT * FROM Users WHERE [" + fieldName + "] IS NULL");

Breaking changes part 1: defaults that change generated artefacts

Microsoft rates most of these low impact, but they still affect migrations, snapshots, diagnostics and deployment behaviour.

Breaking changes part 2: SQLite date/time and tooling are the loud ones

The only high-impact EF Core 10 breaking changes in the digest are Microsoft.Data.Sqlite date/time behaviours.

AppContext.SetSwitch(
    "Microsoft.Data.Sqlite.Pre10TimeZoneHandling",
    isEnabled: true);

And also: useful EF Core 10 footnotes

These are not the headline, but they are worth knowing before you close the upgrade plan.

Lab 04 — EF Core 10 value objects and filters 30 min

Use SQLite for the hands-on pieces, then keep the same model for the EF Core 11 migration tomorrow.

cd labs/Day1/04-EfCore10/start
dotnet test

1. Model an address-style value object as a complex type.
2. Add two named query filters to the same entity.
3. Disable one named filter in a support-style query while keeping the other active.
4. Use ExecuteUpdateAsync with a statement lambda.

The .NET 10 adoption checklist

Everything today, reduced to the order you should actually do it in.

The four changes that won't announce themselves

Compilation errors find themselves. These four compile, run, and behave differently.

What tomorrow does with today's work

Day 2 is not a second feature tour. It reuses what you built today.