Weekly .NET Roundup: Security Fixes, Copilot Agents, and MAUI

by TechHub

Welcome to this week's .NET roundup, led by out-of-band security fixes that require deployment action even for applications updated earlier in October. We cover GitHub Copilot's Visual Studio agent workflows and model configuration changes, then review the steps needed to prepare .NET MAUI apps for Xcode 27. Practical guides on .NET 11 validation localization and binary serialization with Compact Binary Object Notation (CBOR) round out the coverage, alongside community sessions on AI data ingestion and Blazor components.

This Week's Overview

Out-of-band .NET security fixes require deployment action

The October out-of-band updates deliver .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3. They complete fixes for CVE-2026-70197 and CVE-2026-102870 that the October 13, 2026 release did not fully address, so applications updated during that servicing release still need attention.

CVE-2026-111497 affects Brotli decompression on all platforms and may allow unauthenticated attackers to read or corrupt process memory. .NET Framework is unaffected by this vulnerability. CVE-2026-114148 affects Linux source-build tarballs in .NET 8-11 and ASP.NET Core runtime tarballs in .NET 8 and 9.

The deployment steps depend on how applications carry their runtime. Framework-dependent applications need the updated runtime installed and a restart, while self-contained applications need rebuilding and republishing. Container deployments require rebuilding and redeployment rather than only updating the host.

GitHub Copilot: agent workflows and model configuration

GitHub Copilot's Visual Studio update covers pull request investigation, model configuration, and dependency fixes across all Copilot plans. A separate C# sample shows how to retain the Copilot SDK runtime while routing inference to a user-controlled endpoint.

Pull request investigation

The Git agent explores attached pull requests and returns summaries with navigable links. It requires GitHub or Azure DevOps Model Context Protocol (MCP) server connections, making those connections a prerequisite for using the workflow.

Bring-your-own-model migration in Visual Studio

Bring your own model (BYOM) now requires Agent (Preview), which uses the GitHub Copilot SDK-powered harness. Previous Ask and Agent modes no longer support BYOM, so existing users need to change modes rather than expect their configuration to keep working unchanged. Users must also re-add previously configured Ollama models after updating.

Fixing vulnerable NuGet dependencies

NuGet Audit warnings now offer a fixer action that invokes Copilot agent mode through the NuGet MCP server. This gives developers a route from a vulnerability warning into an agent-assisted remediation workflow.

User-controlled inference from C#

The .NET 10 sample uses bring your own key (BYOK) to route inference to a user-controlled model endpoint while retaining the GitHub Copilot SDK runtime. It configures ProviderConfig for an OpenAI-compatible endpoint and the Responses API. Without an API key, AzureCliCredential reuses Azure CLI authentication and requires the Cognitive Services OpenAI User role.

The authentication callbacks are experimental, which matters when assessing the approach for application use. The sample disables tools, skills, configuration discovery, and Git operations to isolate the model request rather than demonstrate a fully configured agent.

Preparing .NET MAUI apps for Xcode 27

Existing .NET MAUI apps may crash after the splash screen on iOS 27 when built with Xcode 27 without UIKit scene lifecycle configuration. The migration guidance addresses that configuration, with .NET 10 apps needing .NET MAUI packages 10.0.110 or higher before enabling scenes.

Developers using the migration skill need .NET MAUI CLI 0.1.0-preview.13.26512.5 or later, and both the CLI and skill are experimental and unsupported. The released .NET 10 iOS and Mac Catalyst workloads 27.0.10722 require Xcode 27.0. The .NET for iOS and Mac Catalyst 27 SDKs also set minimum platform versions of iOS 15.0 and Mac Catalyst 17.0, so migration planning needs to account for supported devices alongside application configuration.

Resource-based validation localization in .NET 11

A sample targeting .NET 11 RC1 demonstrates built-in validation localization for Minimal APIs and Blazor without custom endpoint filters. AddLocalization and AddValidation enable resource-based messages, while UseRequestLocalization selects the culture for each request. Explicit ErrorMessage values act as resource keys, and convention-based lookups fall back to built-in English messages when no key resolves.

The sample uses WebApplicationFactory tests to verify responses across four cultures and default-culture fallback for unsupported requests. There are source-generation boundaries to account for: validation metadata is generated only in the assembly calling AddValidation, and models declared in .razor files are not visible to the generator. Those constraints matter when deciding where to declare validation models and register validation.

Working with CBOR's value-level serialization APIs

Compact Binary Object Notation (CBOR) is an IETF-standard binary serialization format defined by RFC 8949, with native binary data support and self-describing values. In .NET, CborWriter and CborReader operate on primitive values rather than automatically serializing strongly typed objects. Developers therefore work directly with the encoded structure.

CBOR supports indefinite-length strings, maps, and arrays for streaming when lengths are unknown, while canonical conformance mode sorts map keys by their encoding. On the reading side, ReadEncodedValue() lets decoders skip unrecognized values, and PeekState() inspects the next token without consuming it. These APIs provide control over both writing streamed data and navigating unfamiliar values.

Other .NET News

Bruno Capuano and Luis Quintanilla cover Microsoft.Extensions.AI, Microsoft.Extensions.DataIngestion, and Microsoft.Extensions.VectorData, connecting ingestion with embeddings and vector search. The session explains how these building blocks support context engineering and retrieval-augmented generation, which grounds responses in internal documents and business data.

Daniel Roth and Shriram Sankaran demonstrate the free, open-source Syncfusion Toolkit for Blazor. The session shows its components and how to use them in Blazor applications.

Visual Studio 2026 version 18.11 adds Ctrl + Shift + PgUp/PgDn to move active tabs and Ctrl + NumPad1 through Ctrl + NumPad9 to activate tabs by visible position, with preview tabs excluded from numbered slots. Movement respects pinned sections and vertical project groups, but alphabetical sorting prevents manual reordering and preview tabs cannot move. The movement shortcuts replace the default bindings for Edit.ViewTopExtend and Edit.ViewBottomExtend, which remain available for reassignment.

Also relevant this week