[release-notes] ASP.NET Core in .NET 11 Preview 6

[danroth27]

Draft ASP.NET Core release notes for .NET 11 Preview 6. This PR targets the milestone base branch release-notes/11.0-preview6 (see #10455).

Please review the AI-authored content for accuracy, including any code samples and <!-- TODO --> / <!-- Filtered features --> notes, then mark ready for review. 🤖 Generated with the release-notes skill.

[Copilot]

Pull request overview

Adds the draft ASP.NET Core component release notes for .NET 11 Preview 6 to the release-notes repository, documenting new features, breaking changes, bug fixes, and community contributors for the milestone branch (release-notes/11.0-preview6).

Changes:

• Introduces feature writeups for Minimal API async validation, Blazor Virtualize scrolling, OpenAPI updates, [ShortCircuit], and SignalR authentication refresh.
• Captures notable breaking changes and a short bug-fix roundup.
• Adds a milestone-scoped community contributor list.

[danroth27]

Verified every feature in these notes by building and running samples against the locally installed .NET 11 Preview 6 SDK (build 26325.125). Samples live in c:\github\danroth27\aspnetcore11samples. Corrections pushed in the latest commit:

Async validation (ran a minimal API; valid → 200, async rules → 400):

• IAsyncValidatableObject extends IValidatableObject, so the model must also implement the synchronous Validate method — the original sample didn't compile without it.
• AsyncValidationAttribute is overridden via the protected IsValidAsync (the doc said GetValidationResultAsync, which is the public method the framework calls and isn't overridable).

Blazor Virtualize (verified in a headless browser: InitialIndex=500 opened at items 485–515; "Back to top" → ScrollToIndexAsync(0) scrolled to Product 0):

• Virtualize.Items requires ICollection<T>, so the sample now uses List<Product> (IReadOnlyList<Product> does not compile).

[ShortCircuit] (verified middleware is skipped):

• Changed the robots.txt example from [ShortCircuit(404)] to [ShortCircuit]. [ShortCircuit(404)] returns the body with a 404 status, which is wrong for robots.txt; [ShortCircuit] returns 200. Added a minimal-API example.

Verified accurate as written (no change):

• OpenAPI: document version is 3.2.0 by default; a union return type produces anyOf: [Kitten, Puppy] with bare-named case components.
• SignalR auth refresh: EnableAuthenticationRefresh, OnAuthenticationRefresh, and Hub.OnAuthenticationRefreshedAsync compile, and the /refresh endpoint is mapped alongside /negotiate.
• Breaking changes: the IValidatableInfo split into IValidatableTypeInfo/IValidatableParameterInfo/IValidatablePropertyInfo is present in the build.

Note: the local build is 26325.125; the notes target 26328.106. I confirmed the corrected APIs are identical across both builds.

[danroth27]

Pushed an update addressing the review feedback. Summary:

Restructure

• Renamed Async validation for minimal APIs (+ cross-link to the libraries notes; the sync Validate now throws for async-only types).
• Split the OpenAPI section into OpenAPI 3.2 by default (kept as a feature) and a broader Unions in ASP.NET Core section (Minimal APIs, MVC/Razor Pages, SignalR, Blazor + gaps + cross-refs).
• SignalR: added the client-side WithAuthenticationRefresh API, and a new Cancel hub invocations from the client section (#64098).

Re-verified on the final Preview 6 build (11.0.100-preview.6.26359.118) — every feature was rebuilt/run in danroth27/aspnetcore11samples: async validation (incl. the throw change), OpenAPI 3.2 + union anyOf, [ShortCircuit], Virtualize (browser-tested InitialIndex/ScrollToIndexAsync), SignalR auth refresh (client compiles), and hub-invocation cancellation (round-trip: client cancel → server token fires).

Community contributors — vetted all 12 for Microsoft/.NET-team affiliation and removed two:

• @jesuszarate — company @microsoft (ANCM signing work). Microsoft employee.
• @Alex-Sob — Akvelon, Inc. (a firm that staffs contractors on the .NET/ASP.NET Core team); the merged PRs are internal analyzer work. Removed as a judgment call — let me know if you'd prefer to keep them.

The other 10 (Xebia, Syncfusion, IBM, Cloudflare, and independents) are external and were kept. @desjoerd and @sheiksyedm are public members of the dotnet org but work for Xebia/Syncfusion (not Microsoft), so I kept them.

[danroth27]

Evaluated the 12 PRs against the final Preview 6 build (11.0.100-preview.6.26359.118), building a sample for each candidate in aspnetcore11samples.

Added (verified in the build):

PR	What	Added as
#66585	Auto-enabled cross-origin (CSRF) protection via Sec-Fetch-Site/Origin	Feature section (this is the feature behind the existing #67082 breaking-change note)
#67337	Configure browser behavior from the server (WithBrowserOptions)	Feature section
#67369	EnvironmentView component (env-conditional content)	Feature section
#67368	NavigationManager.GetUriWithFragment	Folded into the EnvironmentView section
#66919	dotnet user-jwts --file for file-based apps	Feature section
#65876	Blazor Hybrid @rendermode no longer throws in WebView	Bug fixes
#63276	QUERY added to hosting metrics known methods	Bug fixes

Already documented: #66753 (Virtualize), #64098 (hub-invocation cancellation).

Excluded (with reason):

• #67130 (media components → Microsoft.AspNetCore.Components.Media) — the package only publishes up to 26324; there's no build matching 26359, so it's not cleanly shipping. Recommend holding until the packaging settles.
• #67037 (Blazor Label/DisplayName) — narrow form helpers, still actively in API review.
• #66527 (WebApplicationFactory.ConfigureHostApplicationBuilder) — niche integration-testing API.

Two API-shape notes worth flagging (found by building samples, not from PR bodies): CsrfProtectionResult ships as a class with Allowed()/Denied() factory methods (not an enum), and ICsrfProtection exposes ValidateAsync returning ValueTask<CsrfProtectionResult>.

[danroth27]

Reframed the Blazor preview API changes per the guidance that preview-to-preview renames aren''t breaking changes (we haven''t shipped these APIs in a stable release yet).

New Preview API changes section (migration notes for upgrading from an earlier .NET 11 preview) replaces the old Breaking changes section:

• EnvironmentBoundary → EnvironmentView — this component was documented back in Preview 1, so this is a rename ([Blazor] Rename EnvironmentBoundary component to EnvironmentView aspnetcore#67369)
• NavigationManager.GetUriWithHash → GetUriWithFragment ([Blazor] Rename API to NavigationManager.GetUriWithFragment aspnetcore#67368)
• Browser options reshape: WithBrowserConfiguration→WithBrowserOptions, BrowserConfiguration→BrowserOptions, ServerBrowserOptions→InteractiveServerBrowserOptions, DisableDomPreservation→PreserveDom, CircuitInactivityTimeoutMs→CircuitInactivityTimeout (Reshape BrowserConfiguration API per review (BrowserOptions) while preserving the JS wire format aspnetcore#67337)
• Media components moved out of Components.Web to a new Components.Media package (Separate media components into Microsoft.AspNetCore.Components.Media package aspnetcore#67130)
• Minimal API validation resolver split (IValidatableInfo → three interfaces; Split IValidatableInfo to multiple interfaces aspnetcore#67183) — experimental API, grouped here rather than as a break

Removed the two Blazor feature sections that re-documented the renamed APIs — we don''t need to re-document a renamed feature, just note the rename.

Automatic cross-origin (CSRF) protection is now documented purely as new functionality; I folded the shared-verdict detail (dotnet/aspnetcore#67082) into that feature section instead of listing it as a breaking change.

Net result: there is no Breaking changes section this preview — nothing here breaks a shipped-stable API.

⚠️ Media move caveat (dotnet/aspnetcore#67130): the components are removed from Microsoft.AspNetCore.Components.Web in the Preview 6 build (26359.118), but the new Microsoft.AspNetCore.Components.Media package''s earliest published build is 11.0.0-preview.7.26360.111 — there is no matching preview.6 package. I documented it as "removed from Web, moving to a new package" without pointing to a specific PackageReference. Happy to adjust if you''d prefer different handling.

[danroth27]

Reviewed the Automatic cross-origin (CSRF) protection section against the new draft docs (reference, migration) and improved it. Every claim is verified against the Preview 6 source (release/11.0.1xx-preview6: DefaultCsrfProtection, CsrfProtectionMiddleware, WebApplicationBuilder) and the running 26359.118 build.

What changed:

• Added the primary upgrade action — allow a trusted cross-origin caller by declaring its origin in a CORS policy. The middleware reuses the endpoint''s CORS policy; AllowAnyOrigin is intentionally not trusted for writes.
• Added opt-outs — .DisableAntiforgery() / [IgnoreAntiforgeryToken] per endpoint, and the DisableCsrfProtection global config key.
• Clarified deferred enforcement — endpoints that never read a form (e.g. JSON APIs) aren''t rejected.
• Corrected ordering — "after authentication and authorization" (was "after routing and authentication").
• Linked the new conceptual + migration docs.

Runtime check against the installed P6 build (curl, Sec-Fetch-Site set manually):

Scenario	Result
same-origin form POST	200
cross-site untrusted origin, minimal API [FromForm]	400
cross-site origin trusted via CORS default policy	200
non-browser (no Sec-Fetch-Site/Origin)	200
cross-site untrusted, JSON body (no form read)	200

One nuance worth knowing: reading HttpContext.Request.Form directly is a backstop that throws InvalidOperationException rather than returning a clean 400. The clean 400 comes from framework form consumers (minimal API [FromForm], MVC, Blazor SSR), which is exactly what the note describes.

[Youssef1313]

fwiw, Validator class isn't used by Microsoft.Extensions.Validation at all. It's only used by Blazor when Microsoft.Extensions.Validation isn't wired up.

[Youssef1313]

Should this say "isn't silently skipped"?

[Youssef1313]

The docs suggest InvalidOperationException instead of NotSupportedException.

[Youssef1313]

I'm having a hard time understanding what "Documents continue to generate as before" means

[guardrex]

Pinging @tdykstra for an 👁️ on this suggestion because we're mirroring this language in the PR for ASP.NET Core What's New coverage (dotnet/AspNetCore.Docs #37334).

[Youssef1313]

LGTM for the parts in my areas. Only left few comments.

Also are we intentionally missing dotnet/aspnetcore#66527 ?