migrate-dotnet8-to-dotnet9 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited migrate-dotnet8-to-dotnet9 (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 7 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Migrate a .NET 8 project or solution to .NET 9, systematically resolving all breaking changes. The outcome is a project targeting net9.0 that builds cleanly, passes tests, and accounts for every behavioral, source-incompatible, and binary-incompatible change introduced in the .NET 9 release.
TargetFramework from net8.0 to net9.0BinaryFormatter usage (now always throws at runtime)net9.0 and builds cleanly — migration is done. If the goal is to reach net10.0, use the migrate-dotnet9-to-dotnet10 skill as the next step.| Input | Required | Description |
|---|---|---|
| Project or solution path | Yes | The .csproj, .sln, or .slnx entry point to migrate |
| Build command | No | How to build (e.g., dotnet build, a repo build script). Auto-detect if not provided |
| Test command | No | How to run tests (e.g., dotnet test). Auto-detect if not provided |
| Project type hints | No | Whether the project uses ASP.NET Core, EF Core, WinForms, WPF, containers, etc. Auto-detect from PackageReferences and SDK attributes if not provided |
Answer directly from the loaded reference documents. Do not search the filesystem or fetch web pages for breaking change information — the references contain the authoritative details. Focus on identifying which breaking changes apply and providing concrete fixes.
>
Commit strategy: Commit at each logical boundary — after updating the TFM (Step 2), after resolving build errors (Step 3), after addressing behavioral changes (Step 4), and after updating infrastructure (Step 5). This keeps each commit focused and reviewable.
.sln/.slnx files, or individual .csproj files.dotnet --version to confirm the .NET 9 SDK is installed. If it is not, stop and inform the user.Microsoft.NET.Sdk.Web → ASP.NET Core; Microsoft.NET.Sdk.WindowsDesktop with <UseWPF> or <UseWindowsForms> → WPF/WinFormsMicrosoft.EntityFrameworkCore.* → EF Core; Microsoft.Extensions.Http → HttpClientFactorydotnet build --no-incremental or delete bin/obj) on the current net8.0 target to establish a clean baseline. Record any pre-existing warnings..csproj (or Directory.Build.props if centralized), change: <TargetFramework>net8.0</TargetFramework>to:
<TargetFramework>net9.0</TargetFramework>For multi-targeted projects, add net9.0 to <TargetFrameworks> or replace net8.0.
Microsoft.Extensions.*, Microsoft.AspNetCore.*, Microsoft.EntityFrameworkCore.*, and other Microsoft package references to their 9.0.x versions. If using Central Package Management (Directory.Packages.props), update versions there.dotnet restore. Watch for:net9.0 (17.11 for net8.0 and earlier).Work through compilation errors and new warnings systematically. Load the appropriate reference documents based on the project type:
| If the project uses… | Load reference |
|---|---|
| Any .NET 9 project | references/csharp-compiler-dotnet8to9.md |
| Any .NET 9 project | references/core-libraries-dotnet8to9.md |
| Any .NET 9 project | references/sdk-msbuild-dotnet8to9.md |
| ASP.NET Core | references/aspnet-core-dotnet8to9.md |
| Entity Framework Core | references/efcore-dotnet8to9.md |
| Cryptography APIs | references/cryptography-dotnet8to9.md |
| System.Text.Json, HttpClient, networking | references/serialization-networking-dotnet8to9.md |
| Windows Forms or WPF | references/winforms-wpf-dotnet8to9.md |
| Docker containers, native interop | references/containers-interop-dotnet8to9.md |
| Runtime configuration, deployment | references/deployment-runtime-dotnet8to9.md |
Common source-incompatible changes to check for:
params ReadOnlySpan<T> overloads on String.Join, String.Concat, Path.Combine, Task.WhenAll, and many more now bind preferentially. Code calling these methods inside Expression lambdas will fail (CS8640/CS9226). See references/core-libraries-dotnet8to9.md.params Span<T> feature creates ambiguity with StringValues implicit operators on methods like String.Concat, String.Join, Path.Combine. Fix by explicitly casting arguments. See references/core-libraries-dotnet8to9.md.SYSLIB0054: Replace Thread.VolatileRead/VolatileWrite with Volatile.Read/Volatile.WriteSYSLIB0057: Replace X509Certificate2/X509Certificate binary/file constructors with X509CertificateLoader methodsSYSLIB0055 (ARM AdvSimd signed overloads) and SYSLIB0056 (Assembly.LoadFrom with hash algorithm) — see references/core-libraries-dotnet8to9.md[InlineArray] attribute on record struct types is now disallowed (CS9259). Change to a regular struct. See references/csharp-compiler-dotnet8to9.md.unsafe class will now error. Add unsafe modifier to the local function. See references/csharp-compiler-dotnet8to9.md.[]) no longer use span vs non-span to tiebreak overloads. Exact element type is now preferred. See references/csharp-compiler-dotnet8to9.md.ReadOnlySpan<char> to Trim/TrimStart/TrimEnd must rebuild; the overload was removed in GA. See references/core-libraries-dotnet8to9.md.BinaryFormatter, stop and inform the user — this is a major decision. See references/serialization-networking-dotnet8to9.md.string?. Add null checks. See references/serialization-networking-dotnet8to9.md.references/winforms-wpf-dotnet8to9.md.references/winforms-wpf-dotnet8to9.md.Build again after each batch of fixes. Repeat until the build is clean.
Behavioral changes do not cause build errors but may change runtime behavior. Review each applicable item and determine whether the previous behavior was relied upon.
High-impact behavioral changes (check first):
float/double to integer types now saturate instead of wrapping on x86/x64. See references/deployment-runtime-dotnet8to9.md.Migrate()/MigrateAsync() now throws if the model has pending changes. Search for `DateTime.Now`, `DateTime.UtcNow`, or `Guid.NewGuid()` in any `HasData` call — these must be replaced with fixed constants (e.g., new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc)). See references/efcore-dotnet8to9.md.Migrate() inside a user transaction now throws. See references/efcore-dotnet8to9.md.HttpClientHandler will get InvalidCastException. See references/serialization-networking-dotnet8to9.md.Trace-level logs are now redacted. See references/serialization-networking-dotnet8to9.md.runtimeconfig.json. See references/deployment-runtime-dotnet8to9.md.HostBuilder now enables DI validation in development by default. See references/aspnet-core-dotnet8to9.md.Other behavioral changes to review (may cause runtime exceptions ⚠️ or subtle behavioral differences):
FromKeyedServicesAttribute no longer injects non-keyed service fallback — throws InvalidOperationExceptionBigInteger now has a maximum length of (2^31) - 1 bitsJsonDocument deserialization of JSON null now returns non-null JsonDocument with JsonValueKind.Null instead of C# nullSystem.Text.Json metadata reader now unescapes metadata property namesZipArchiveEntry names/comments now respect the UTF-8 flagIncrementingPollingCounter initial callback is now asynchronousInMemoryDirectoryInfo prepends rootDir to filesRuntimeHelpers.GetSubArray returns a different typePictureBox raises HttpRequestException instead of WebExceptionStatusStrip uses a different default rendererIMsoComponent support is opt-inSafeEvpPKeyHandle.DuplicateHandle up-refs the handleHttpClient metrics report server.port unconditionallydotnet watch is incompatible with Hot Reload for old frameworksGetXmlNamespaceMaps returns Hashtable instead of StringRUN apt-get update && apt-get install -y zlib1g to your Dockerfile. # Before
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
FROM mcr.microsoft.com/dotnet/aspnet:8.0
# After
FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
FROM mcr.microsoft.com/dotnet/aspnet:9.0global.json, update: {
"sdk": {
"version": "9.0.100",
"rollForward": "latestFeature"
}
}Review the rollForward policy — if set to "disable" or "latestPatch", the SDK may not resolve correctly after upgrading. "latestFeature" (recommended) allows the SDK to roll forward to the latest 9.0.x feature band.
net9.0. VS 17.11 can only target net8.0 and earlier.dotnet build now uses Terminal Logger by default in interactive terminals. CI scripts that parse MSBuild console output may need --tl:off or MSBUILDTERMINALLOGGER=off.dotnet build --no-incrementaldotnet testThe references/ folder contains detailed breaking change information organized by technology area. Load only the references relevant to the project being migrated:
| Reference file | When to load |
|---|---|
references/csharp-compiler-dotnet8to9.md | Always (C# 13 compiler breaking changes — InlineArray on records, iterator safe context, collection expression overloads) |
references/core-libraries-dotnet8to9.md | Always (applies to all .NET 9 projects) |
references/sdk-msbuild-dotnet8to9.md | Always (SDK and build tooling changes) |
references/aspnet-core-dotnet8to9.md | Project uses ASP.NET Core |
references/efcore-dotnet8to9.md | Project uses Entity Framework Core |
references/cryptography-dotnet8to9.md | Project uses System.Security.Cryptography or X.509 certificates |
references/serialization-networking-dotnet8to9.md | Project uses BinaryFormatter, System.Text.Json, HttpClient, or networking APIs |
references/winforms-wpf-dotnet8to9.md | Project uses Windows Forms or WPF |
references/containers-interop-dotnet8to9.md | Project uses Docker containers or native interop (P/Invoke) |
references/deployment-runtime-dotnet8to9.md | Project uses runtime configuration, deployment, or has floating-point to integer conversions |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.