migrate-dotnet10-to-dotnet11 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited migrate-dotnet10-to-dotnet11 (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 7 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Migrate a .NET 10 project or solution to .NET 11, systematically resolving all breaking changes. The outcome is a project targeting net11.0 that builds cleanly, passes tests, and accounts for every behavioral, source-incompatible, and binary-incompatible change introduced in .NET 11.
Note: .NET 11 is currently in preview. This skill covers breaking changes documented through Preview 3.
TargetFramework from net10.0 to net11.0net11.0 and builds cleanly — migration is done| Input | Required | Description |
|---|---|---|
| Project or solution path | Yes | The .csproj, .sln, or .slnx entry point to migrate |
| Build command | No | How to build (e.g., dotnet build, a repo build script). Auto-detect if not provided |
| Test command | No | How to run tests (e.g., dotnet test). Auto-detect if not provided |
| Project type hints | No | Whether the project uses ASP.NET Core, EF Core, Cosmos DB, etc. Auto-detect from PackageReferences and SDK attributes if not provided |
Answer directly from the loaded reference documents for information about .NET 11 breaking changes. You may inspect the local repository (project/solution files, source code, configuration, build/test scripts) as needed to determine which changes apply. Do not fetch web pages or other external sources for breaking change information — the loaded references are the authoritative source. Focus on identifying which breaking changes apply and providing concrete fixes.
>
Commit strategy: Commit at each logical boundary — after updating the TFM (Step 2), after resolving build errors (Step 3), after addressing behavioral changes (Step 4), and after updating infrastructure (Step 5). This keeps each commit focused and reviewable.
.sln/.slnx files, or individual .csproj files.dotnet --version to confirm the .NET 11 SDK is installed. If it is not, stop and inform the user.Microsoft.NET.Sdk.Web → ASP.NET Core; Microsoft.NET.Sdk.WindowsDesktop with <UseWPF> or <UseWindowsForms> → WPF/WinFormsMicrosoft.EntityFrameworkCore.* → EF Core; Microsoft.EntityFrameworkCore.Cosmos → Cosmos DB providerdotnet build --no-incremental or delete bin/obj) on the current net10.0 target to establish a clean baseline. Record any pre-existing warnings..csproj (or Directory.Build.props if centralized), change: <TargetFramework>net10.0</TargetFramework>to:
<TargetFramework>net11.0</TargetFramework>For multi-targeted projects, add net11.0 to <TargetFrameworks> or replace net10.0.
Microsoft.Extensions.*, Microsoft.AspNetCore.*, Microsoft.EntityFrameworkCore.*, and other Microsoft package references to their 11.0.x versions. If using Central Package Management (Directory.Packages.props), update versions there.dotnet restore. Fix any restore errors before continuing.dotnet build. Capture all errors and warnings — these will be addressed in Step 3.Load reference documents based on the project's technology areas:
| Reference file | When to load |
|---|---|
references/csharp-compiler-dotnet10to11.md | Always (C# 15 compiler breaking changes) |
references/core-libraries-dotnet10to11.md | Always (applies to all .NET 11 projects) |
references/sdk-msbuild-dotnet10to11.md | Always (SDK and build tooling changes) |
references/aspnetcore-dotnet10to11.md | Project uses ASP.NET Core (OpenAPI, Blazor) |
references/efcore-dotnet10to11.md | Project uses Entity Framework Core |
references/cryptography-dotnet10to11.md | Project uses cryptography APIs, mTLS, or targets macOS |
references/runtime-jit-dotnet10to11.md | Deploying to older hardware, embedded devices, or using NativeAOT |
Work through each build error systematically. Common patterns:
Span<T>/ReadOnlySpan<T> type now have declaration-block safe-context. Code assigning span collection expressions to variables in outer scopes will error. Use array type or move the expression to the correct scope.ref readonly-returning methods or using ref readonly local functions, ensure System.Runtime.InteropServices.InAttribute is available.this. qualifier; use nameof(P) instead of nameof(this.P).with(...) is now treated as constructor arguments, not a method call. Use @with(...) to call a method named with.&&/|| with dynamic right operand now errors at compile time. Cast to concrete type or dynamic.ToList(), SaveChanges(), etc. on Cosmos provider always throw. Convert to async equivalents.bool isConnected is obsoleted. Remove the isConnected argument and use the new 3-parameter constructor. Projects with TreatWarningsAsErrors will fail to build.(X.Y) when is now parsed as a constant pattern with a when clause instead of a cast expression, which can cause existing code to fail to compile or change meaning. Review switch expressions using when and adjust syntax as needed.Microsoft.AspNetCore.OpenApi now depends on Microsoft.OpenApi 3.x. Code using Microsoft.OpenApi types directly (OpenApiDocument, OpenApiSchema, etc.) will have compile errors. Follow the v3 upgrade guide.Microsoft.EntityFrameworkCore.Tools and .Tasks no longer depend on .Design. Add an explicit PackageReference if needed.<EFScaffoldModelStage> and <EFPrecompileQueriesStage>.These changes compile successfully but alter runtime behavior. Review each one and determine impact:
ZipArchive.CreateAsync eagerly loads entries. May affect memory usage for large archives.x86-64-v2; Windows Arm64 requires LSE. Verify deployment targets meet requirements.ExecuteAsync() now propagate and crash the host. Add try/catch in background services that should not bring down the application.InvalidDataException.HardLink entries instead of duplicated data. Consumers of .NET-produced tar archives must handle HardLink entries.OverscanCount changed from 3 to 15. Set explicitly if performance-sensitive.Microsoft.Data.SqlClient.Extensions.Azure if using Entra ID auth.bundle_e_sqlcipher and other encryption bundle packages removed in SQLitePCLRaw 3.0.lib prefix on Linux/macOS (e.g., libMyLib.so). # Before
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
FROM mcr.microsoft.com/dotnet/aspnet:10.0
# After
FROM mcr.microsoft.com/dotnet/sdk:11.0 AS build
FROM mcr.microsoft.com/dotnet/aspnet:11.0global.json, update the sdk.version in your existing file while preserving other keys (such as rollForward and test configuration): {
"sdk": {
- "version": "10.0.100",
- "rollForward": "latestFeature"
+ "version": "11.0.100-preview.3",
+ "rollForward": "latestFeature"
},
"otherSettings": {
"...": "..."
}
}dotnet build --no-incrementaldotnet testThe references/ folder contains detailed breaking change information organized by technology area. Load only the references relevant to the project being migrated:
| Reference file | When to load |
|---|---|
references/csharp-compiler-dotnet10to11.md | Always (C# 15 compiler breaking changes) |
references/core-libraries-dotnet10to11.md | Always (applies to all .NET 11 projects) |
references/sdk-msbuild-dotnet10to11.md | Always (SDK and build tooling changes) |
references/aspnetcore-dotnet10to11.md | Project uses ASP.NET Core (OpenAPI, Blazor) |
references/efcore-dotnet10to11.md | Project uses Entity Framework Core |
references/cryptography-dotnet10to11.md | Project uses cryptography APIs, mTLS, or targets macOS |
references/runtime-jit-dotnet10to11.md | Deploying to older hardware, embedded devices, or using NativeAOT |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.