Weekly .NET Roundup: Security Fixes, Agent Skills and C# 15

by TechHub

Azure DevOps security guidance warns that patching Azure Pipelines requires checking embedded Node.js runners, cached versions, containers and deployed applications separately, and identifies .NET runtime fixes for the Brotli advisory. Microsoft added Agent Framework builder skills for .NET and Python, while NuGet-delivered skills let package authors bundle coding-agent instructions with dependencies, introducing package Markdown as another security consideration. C# 15 previews introduce closed hierarchies and union types, and Logic Apps Standard custom code now supports .NET 10, with existing .NET 8 projects requiring explicit configuration migration. Across these developments, installing an update or agent skill is only part of adoption: teams still need to verify deployed runtimes, assess instructions and test application behavior.

This Week's Overview

Azure Pipelines security updates require more than a Node.js version change

Azure DevOps security guidance explains how to apply the Node.js fixes released on October 21, 2026, for 10 vulnerabilities in versions 22.23.4, 24.22.1 and 26.12.1. Azure Pipelines agent v5.281.1 includes Node24 version 24.22.1, but that runner is not present in every platform package. Teams need to check the package they deploy rather than treating the agent version alone as confirmation that the patched runner is available.

Pipeline configuration introduces another potential gap: UseNode@1 and NodeTool@0 default checkLatest to false, so broad version ranges can resolve to older cached patches. Selecting Node.js in a pipeline updates PATH, not the agent's embedded task runners, and containers and deployed applications require separate servicing. For the Brotli advisory, the fixed .NET runtime baselines are 8.0.33, 9.0.22 and 10.0.14, while .NET Framework is unaffected.

Distributing framework guidance to coding agents

Installable skills give coding agents framework-specific instructions during development. This week's coverage describes both dedicated Agent Framework skills and a way to distribute guidance alongside NuGet packages.

Agent Framework builder skills

Microsoft added Agent Framework builder skills for .NET and Python, providing development-time guidance rather than application runtime capabilities. The .NET skill covers AIAgent, Microsoft.Extensions.AI, NuGet, dependency injection, and ASP.NET Core hosting. Developers can install the skills through GitHub CLI or the cross-agent skills CLI and pin tags or commits to keep guidance snapshots reproducible.

Microsoft Learn's Model Context Protocol (MCP) server provides access to complete Agent Framework documentation and code examples through a Streamable HTTP endpoint. These resources do not replace application setup: projects still need SDK packages and model credentials. Optional Azure operations also require the appropriate credentials and permissions.

Skills packaged with NuGet dependencies

NuGet-delivered skills use the standard SKILL.md format, combining Markdown instructions with a YAML header. Running dotnet restore downloads bundled skills alongside package binaries, and project.assets.json lists the available skill files. This gives package authors a way to ship agent guidance with the dependency it describes.

For discovery and persistent repository access, dotnet-inspect finds package skills and dotnet-package-skills copies them into repositories. NuGet MCP does not yet support skills, though the team intends to add support. The team recommends evaluating skills with frontier models and warns that agents consuming package Markdown introduce a new threat vector, making the instructions part of what teams need to assess.

C# 15 previews closed hierarchies and union types

Nick Chapsas examines closed hierarchies and union types in separate videos about C# 15. Both focus on the problems the language features are intended to solve.

Closed hierarchies and inheritance

The closed-hierarchies video introduces the feature in C# 15 and .NET 11. Chapsas discusses it as a way to address inheritance problems and support safer code, giving developers context for evaluating its role in their designs.

Union types and agent guidance

The union-types video demonstrates the feature coming to C# 15 and explains the problem it solves. It also covers how to inform AI coding agents about using the feature, connecting language adoption with the guidance developers give their coding tools.

Logic Apps Standard custom code moves to .NET 10

Azure Logic Apps Standard custom code now supports .NET 10 with Azure Logic Apps Standard extension version 5.1013.2 and extension bundle 1.194.31. New custom-code projects target only .NET 10, while existing .NET 8 projects require an explicit configuration migration. Deployed application settings must include LOGIC_APPS_CUSTOMCODE_DOTNETVERSION=net10.0 and FUNCTIONS_INPROC_NET8_ENABLED=1, with FUNCTIONS_WORKER_RUNTIME remaining dotnet.

Verification goes beyond a successful build: teams should check publication under lib\custom\net10.0, execute the workflow, and verify a function breakpoint. An optional migration skill requires GitHub CLI 2.90.0 or later. Installing that skill for GitHub Copilot supplies guidance but does not execute the migration.

Other .NET News

Choosing a lazy-initialization mode means choosing exception behavior as well as concurrency behavior: None provides no thread safety and caches supplied-factory exceptions, PublicationOnly permits concurrent factories and publishes one successful result without caching exceptions, and ExecutionAndPublication runs the factory once while blocking competing callers and caching factory exceptions. The demonstrated LazyInitializer overloads avoid allocating a Lazy object and do not cache exceptions, while an approved proposal to separate exception caching from thread safety remains unimplemented and uncertain for .NET 12.

Blazor Web Apps have supported per-page or per-component render-mode selection since .NET 8: Interactive Server executes components on the server using SignalR circuits for browser interactions, while Interactive WebAssembly downloads the .NET runtime and application bundle to run C# in the browser. Interactive Auto starts with server rendering and uses cached WebAssembly on subsequent visits without switching an active component mid-session, whereas Blazor Hybrid hosts Razor components in a native .NET MAUI application through BlazorWebView, without WebAssembly or SignalR circuits.

Many Azure SQL reconfiguration events finish in less than 60 seconds, but application recovery can take longer, and sys.database_connection_stats reports in five-minute intervals with complete information potentially taking up to 24 hours to appear. Microsoft.Data.SqlClient supports configurable connection and command retries from version 3.0 onward, but when a transient failure invalidates an active transaction, Microsoft's guidance is to retry the entire transaction rather than only the failed statement.

Bartolesi describes a product-delivery workflow that stores requirements in the repository, uses Copilot CLI for implementation, and keeps a final human pull-request review after Claude Code review, with reusable .NET, Blazor, and MudBlazor guidance packaged in the dotcraft plugin. Concrete release safeguards include Brainy's Playwright continuous-integration tests against a real SQL Server database with failure traces and screenshots, DayPulse's pull-request preview environments, and a shared SaaS release workflow that deploys versioned packages to Azure App Service using OpenID Connect (OIDC), with the caveat that application rollback does not reverse database migrations.

The GitHub Copilot upgrade agent supports moving .NET projects from Windows x64 or x86 to Windows Arm64 by assessing dependencies and architecture assumptions, creating a migration plan, and helping update code and configuration. It can build components and run tests when matching Arm64 hardware or continuous-integration runners are available, but a successful build does not replace runtime testing, and the migration focuses on portability and correctness rather than Arm64-specific performance tuning.

Also relevant this week