LoginSign Up
← Back to all sparks
A

ASP.NET Core

DEVOPS
Velocity5.0

Cross-platform framework for building modern cloud-based web applications

asp.net ↗

ASP.NET Core's October patch day hardens HTTP/2 on 8.0 and 9.0 while .NET 11 waits for GA.

dotnetserver-frameworkhttp2-hardeninglts-maintenancerelease-candidate
◆Current state
ASP.NET Core services the 8.0, 9.0 and 10.0 branches while .NET 11 sits at RC2. The October 13 patch day shipped 9.0.21 and 8.0.32 with the same fix set: HTTP/2 now rejects newline characters in trailers and the dynamic HPACK table, HTTP/3 abort locking is corrected, and the SignalR Java client no longer hangs when a response read fails. The last 11.0 tag removed DeviceBoundSessions rather than adding anything.
◆Where it's heading
Servicing work is now mostly protocol hardening and dependency hygiene, applied identically across branches on a shared patch day. The .NET 11 line is in scope-cutting mode, which points to a GA build with fewer features than the previews carried. MCP library bumps in 10.0 patch releases show agent tooling moving on a faster track than the major-version train.
◆Prediction
The next tags should be .NET 11 GA and a 10.0 patch carrying the same HTTP/2 hardening. The entries don't show whether DeviceBoundSessions returns after GA.

◆Recent moves

  1. 15d ago

    .NET 9.0.21

    9.0.21 hardens HTTP/2 against newline characters in trailers and the dynamic HPACK table, and fixes HTTP/3 abort locking and a SignalR Java client hang. It is the most substantive 9.0 patch in this window and follows the pattern of protocol hardening shipped in lockstep across branches.

    View source ↗
  2. 15d ago

    .NET 8.0.32

    8.0.32 brings the same HTTP/2 trailer and HPACK hardening and HTTP/3 locking fix to the LTS branch, tagged minutes after 9.0.21. Shipping an identical fix set to both lines keeps LTS users on the same security footing as 9.0.

    View source ↗
  3. 1mo ago

    .NET 11 RC2 removes DeviceBoundSessions

    The RC2 tag comes from a single commit that removes the DeviceBoundSessions implementation from the 11.0 line. Taking a feature out at RC2 shows the team cutting scope before GA rather than adding to it.

    View source ↗
  4. 1mo ago

    v11.0.0-rc.3.26522.148: Remove DeviceBoundSessions implementation (#69462) (#69479)

    View source ↗
  5. 1mo ago

    v10.0.14: Update MessagePack to 2.5.303 (#69368)

    View source ↗
  6. 1mo ago

    v10.0.13: Update MessagePack to 2.5.303 (#69368)

    10.0.13 bumps MessagePack from 2.5.302 to 2.5.303 and changes nothing else. It is the smallest kind of servicing release on the 10.0 branch.

    View source ↗