The .NET Insider – Issue 31

The .NET Insider – Issue 31

Copilot SDK with your own model, MAUI's Xcode 27 migration, October servicing updates, and safer workflows.

Hi everyone,

The past week brings .NET 11 RC2 and a new way to manage SDKs and runtimes with dotnetup. Today's additions also cover using your own model with the Copilot SDK and preparing MAUI apps for Xcode 27. The practical reads then look at workflow recovery, uncertain payment outcomes, and keeping agents within their assigned permissions.

One item needs action this month: October's servicing updates are available for .NET 8, 9, and 10. If you ship self-contained apps, update the bundled runtime and redeploy; updating the host alone won't patch them.

1. Announcing .NET 11 Release Candidate 2 · .NET Team
   RC2 is available with a go-live support license for production use. Highlights include incremental CBOR reading, configurable initial HTTP/2 concurrency, faster MSBuild wildcard matching and a CLI option for NuGet's minimum package publication age. Blazor's QuickGrid virtualization APIs are no longer experimental; use Visual Studio 2026 Insiders or VS Code with C# Dev Kit to try the release.

2. Introducing dotnetup: A toolchain manager for .NET · Chet Husk
   Microsoft's new public-preview tool installs and manages user-local SDKs and runtimes on macOS and Linux without administrator access. Stable, preview, and daily builds can sit side by side, while dotnetup update refreshes tracked channels and leaves exact-version requirements pinned. It also cleans up unneeded installations, and Windows system-install management is still on the roadmap.

3. .NET and .NET Framework October 2026 servicing updates · Rahul Bhandari and Tara Overfield
   October's releases bring security and non-security fixes in .NET 10.0.13, 9.0.21 and 8.0.32, alongside .NET Framework updates. The announcement links the CVE lists, release notes, and known issues for each supported version. Check the versions your applications actually deploy, including container images, not just the SDK installed on your development machine.

4. Bring Your Own Model to the GitHub Copilot SDK with C# · Bruno Capuano.
   Keep the Copilot agent runtime while routing model requests to your own provider through ProviderConfig. The .NET 10 sample uses a Foundry or Azure OpenAI deployment with Microsoft Entra ID or an API key. It deliberately turns off tools, skills, and host Git operations to isolate the setup; choose a deployment that supports the Responses API used by the example.

5. Announcing Blazorise 2.4 - Bura · Mladen Macanović
   Blazorise 2.4 adds a Ribbon component for command-heavy interfaces, vertical Steps and interactive SVG Chart data dragging. We rebuilt Tooltip and ColorPicker in Blazor, removing their external JavaScript dependencies, while FluentUI2 and Tailwind get styling improvements. Cached Fluent utilities also reduce repeated styling work. Update all Blazorise packages together to 2.4.0 and review the release notes for API changes.

6. Get Your .NET MAUI App Ready for Xcode 27 · Gerald Versluis.
   Existing apps built with Xcode 27 need UIKit's scene lifecycle; updating workloads alone won't change their platform files. The guide covers the scene delegate, plist configuration, and an experimental migration skill. For .NET 10 apps, use MAUI 10.0.110 or later and test authentication, deep links, and App Actions too, because fixing launch doesn't prove those flows still work.

7. Durable Task in the Real World: What Problems Does It Actually Solve? · Tamir Dresher
   Five examples cover approvals, Azure provisioning, subscription payments, out-of-order webhooks, and an incident-response agent. Durable Task coordinates waits and recovery, but it can't establish whether an external charge or command succeeded after a lost response. Use it when recovery logic is becoming a system of its own; your application still owns authoritative state, idempotency, and reconciliation.

8. Testing Payment Retries Without Charging Customers Twice · Vivek Kumar
   A C# walkthrough of stable idempotency keys, explicit payment states, and failure-focused testing. The important case is a completed charge followed by a lost response: keep the outcome unknown until it can be reconciled. The xUnit example checks key reuse, not actual gateway deduplication, so verify the provider's behavior and key-retention rules in its sandbox too.

9. Why AI Agents Overstep and How to Build Agents That Stay Within Their Boundaries · Mahesh Chand
   Clear instructions help, but tool permissions and application-side authorization determine what an agent can actually do. The article covers narrowly scoped tools, isolated workspaces, approval checks, and tests for unauthorized actions. For .NET tool integrations, check the user's identity, tenant, resource, and requested operation before execution, because an agent-generated approval flag isn't permission.

10. Stop waiting on a failed build · Mads Kristensen
    Visual Studio 2026 version 18.11 adds an opt-in setting under Tools → Options → Projects and Solutions → Build and Run to stop the solution build after its first project failure. The result remains failed, not canceled. Enable it when you usually fix the first error immediately, and leave it off when you want diagnostics from the remaining projects.

Closing

Thanks for reading. If one of these saved you time, forward this issue to a teammate, or share the link: https://dotnet.news

Have an article, tool, or video worth featuring? Reply to this email or write to [email protected].

© 2026 The .NET Insider

228 Park Ave S, #29976, New York, New York 10003, United States