This Week in .NET — Week 22, 2026
A loaded week: the .NET 11 preview train keeps rolling, the runtime quietly changed how async works under the hood, the C# team poked a hornet's nest, and there's a critical ASP.NET Core security fix you should not sit on. Here's what mattered.
Platform & Runtime
.NET 11 Preview 4 is here. The 2026 release cycle marches on, with Preview 4 landing this month on the road to a November general availability. Remember the shape of the year: .NET 11 is an STS release on the new 24-month support window, not an LTS — plan your adoption accordingly.
Runtime Async goes mainstream. The big architectural story of .NET 11 is runtime-native async: the runtime now understands asynchronous code paths directly, producing cleaner stack traces and lower overhead. For projects targeting net11.0 it no longer hides behind a preview feature flag — the libraries themselves are compiled with it on. If you debug async-heavy services for a living, this is the change to watch.
CoreCLR becomes the default for Android. What was experimental in .NET 10 is now the default in .NET 11: Android Release builds run on CoreCLR, improving compatibility with the rest of .NET and trimming startup time. It's another step in the long, mostly invisible project of reducing Mono usage across the platform.
Fresh BCL goodies. The preview brought a grab-bag of base-library additions worth a skim: Zstandard compression support, a BFloat16 floating-point type, collection-expression support for FrozenDictionary, HMAC and KMAC verification APIs, plus TimeZone and Rune improvements. Small things, but the kind that quietly delete code from your projects.
C# & Language
C# 15 ships collection expression arguments. The new syntax lets you customize a collection as it's created — for example, presetting capacity or a comparer: List<string> names = [with(capacity: values.Count * 2), .. values];. Handy in hot paths where you'd otherwise reach for an explicit constructor.
…and the community isn't sold. Early reaction to .NET 11 has skewed skeptical, and with(...) is exhibit A: a vocal slice of developers question how much it really saves versus the complexity it adds, and grumble more broadly about the pace of major releases. Whether you read that as healthy pushback or familiar internet grumbling, it's the conversation of the week — and a good prompt to ask which new language features your team will actually adopt.
ASP.NET Core & Blazor
Patch now: critical Data Protection CVE. A critical elevation-of-privilege vulnerability (CVSS 9.1) was disclosed in the ASP.NET Core Data Protection cryptographic APIs, with a fix rolling into the latest updates. This is a "stop and patch" item, not a "next sprint" item — if you use Data Protection anywhere in your stack, prioritize it.
Blazor gets an EnvironmentBoundary component. A new component renders content conditionally based on the hosting environment, the same idea as the MVC environment tag helper but consistent across Server and WebAssembly hosting. A small ergonomics win for anyone juggling per-environment markup.
Tools & Cloud
Aspire leans into agent observability. Tracing for AI agents is becoming a first-class concern in .NET Aspire — a sign of where the platform's center of gravity is moving as more teams bolt LLM-driven features onto their services. Worth a look if you're building anything agentic and tired of flying blind.
NuGet pruning in .NET 10. A reminder doing the rounds this week: .NET 10 can prune transitive packages that already ship as part of the framework, slimming your dependency graph and cutting noise from restore. Cheap hygiene with real payoff in build clarity.
HttpClient connection pooling, again. The perennial topic resurfaced — getting pooling right (and not exhausting sockets) remains one of the most common ways otherwise-solid .NET services fall over under load. If "a connection attempt failed" sounds familiar, it's a good week to revisit how you create and reuse your clients.
Looking ahead
Build 2026 is almost here. Microsoft Build runs June 2–3 in San Francisco, and it's the obvious place to expect the next wave of .NET, C#, and AI-tooling announcements. We'll have a reaction piece up once the keynotes land — if there's a session you want us to dig into, tell us in the comments.
