.NET 11 security changes target the software supply chain
Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support. .NET 10 is still the Long Term Support (LTS) option. The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development. Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle.
.NET 8 and .NET 9 are out of support
The most urgent item for defenders isn’t a new feature. .NET 8 and .NET 9 reached end of support on November 10, 2026, the same day .NET 11 shipped, and they will get no more fixes. Microsoft advises organizations to move to .NET 11, or to .NET 10 if they need a longer support lifecycle. Teams running release candidates of .NET 11 are told to move to the final build.
Supply chain controls
NuGet source configuration has a new minimum package publication age setting. Teams can use it to wait a set time before newly published package versions can be selected. In effect, this works as a “cooldown” period, which can help defend against malicious or compromised package releases that would otherwise get pulled into builds. Microsoft notes that it adds to vulnerability checks and dependency review but doesn’t replace them.
Container publishing now produces reproducible image digests through SOURCE_DATE_EPOCH, so teams can check that an image matches what a given source should produce. In System.IO.Compression, reading ZIP entries now includes CRC32 validation, and Zstandard compression is newly supported.
Authentication and application security
SignalR connections can now refresh authentication without reconnecting. Blazor Interactive Server components receive the updated identity and can react when claims change. This helps long-lived connections that might otherwise run on stale credentials. Asynchronous validation lets validators await database lookups or remote calls without blocking threads. Blazor Interactive Server apps can also pause inactive circuits after a set delay, which frees the server memory and SignalR connections held by idle users. The feature requires an additional package and explicit configuration, so upgrading doesn’t change circuit behavior on its own.
The expanded Process API gives developers control over the handles a child process inherits, as well as suspended process starts and process signaling.
“The libraries also expand numeric types, DNS resolution, cryptography, and tracing configuration,” the .NET team said.
Diagnostics and memory safety
In-process crash report logging can now capture a managed stack trace, module information, and runtime state before a process exits. It was previously available on mobile platforms and now also works on Linux and macOS, which could help with incident investigation. Microsoft’s separate C# memory safety work is still in preview.
AI and agentic tooling
The SDK now includes an MCP server template built on the official MCP C# SDK. New Blazor AI components support streaming chat, tool rendering, and approval flows for agent actions. The components are experimental and will stay prerelease throughout .NET 11, and the AG-UI hosting integration is also prerelease. Organizations should treat these as non-production features.
