Build Steeltoe against .NET 11 (preview)

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "jetbrains.resharper.globaltools": {
-      "version": "2026.2.1",
+      "version": "2026.3.0-eap01",
       "commands": [
         "jb"
       ],

.github/workflows/Steeltoe.All.yml

@@ -69,10 +69,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Turn off dev certificate (macOS only)
       if: ${{ matrix.os == 'macos-latest' }}

.github/workflows/component-shared-workflow.yml

@@ -59,10 +59,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Turn off dev certificate (macOS only)
       if: ${{ inputs.OS == 'macos' }}

.github/workflows/package.yml

@@ -34,10 +34,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Git checkout
       uses: actions/checkout@v6
@@ -151,6 +154,12 @@ jobs:
       with:
         dotnet-version: 10.0.*
 
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
+
     - name: Install code signing tool
       run: dotnet tool install --global sign --prerelease
 
@@ -214,6 +223,15 @@ jobs:
       env:
         NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
+        source-url: ${{ vars.AZURE_ARTIFACTS_FEED_URL }}
+      env:
+        NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
     - name: Install credential provider for Azure Artifacts
       run: sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"
 
@@ -244,6 +262,12 @@ jobs:
       with:
         dotnet-version: 10.0.*
 
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
+
     - name: Download signed packages
       uses: actions/download-artifact@v8
       with:

.github/workflows/scan-vulnerable-dependencies.yml

@@ -30,10 +30,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Git checkout
       uses: actions/checkout@v6

.github/workflows/sonarcube.yml

@@ -60,10 +60,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Install Sonar .NET Scanner
       run: dotnet tool install --global dotnet-sonarscanner

.github/workflows/verify-code-style.yml

@@ -29,10 +29,13 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: |
-          8.0.*
-          9.0.*
-          10.0.*
+        dotnet-version: 10.0.*
+
+    - name: Setup .NET 11 Preview
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 11.0.*
+        dotnet-quality: preview
 
     - name: Git checkout
       uses: actions/checkout@v6

AGENTS.md

@@ -21,9 +21,8 @@ This document provides essential guidelines for working with the Steeltoe codeba
 
 ## Prerequisites
 
-- **.NET SDK 10.0** (latest patch version)
-- **.NET Runtime 8.0** (latest patch version)
-- **.NET Runtime 9.0** (latest patch version)
+- **.NET SDK 11.0** (latest patch version)
+- **ASP.NET Core Runtime 10.0** (latest patch version)
 
 Verify your installation:
 ```bash
@@ -50,7 +49,7 @@ dotnet test src/Steeltoe.All.slnx --configuration Release
 For detailed test procedures including environment-specific filters, test categories, and coverage collection, see [`.github/workflows/Steeltoe.All.yml`](.github/workflows/Steeltoe.All.yml).
 
 **Important context for agents:**
-- Tests run on multiple frameworks: net8.0, net9.0, and net10.0
+- Tests run on multiple frameworks: net11.0 and net10.0
 - Tests use xUnit trait categories: `Integration` (requires Docker services), `MemoryDumps` (generates memory dumps)
 - Platform-specific test skipping uses attributes like `[FactSkippedOnPlatform]` and `[TheorySkippedOnPlatform]` instead of trait categories
 - Integration tests require Docker containers to be running (e.g., Config Server, Eureka Server) and are primarily designed for Linux CI environments

Directory.Build.props

@@ -0,0 +1,14 @@
+<!-- .NET 11 Preview -->
+
+<Project>
+  <PropertyGroup>
+    <SuppressNETCoreSdkPreviewMessage>true</SuppressNETCoreSdkPreviewMessage>
+
+    <!-- NU1608: Detected package version outside of dependency constraint (not all EF Core providers already offer compatible preview packages) -->
+    <NoWarn>$(NoWarn);NU1608</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(TargetFramework)' != 'net11.0' And '$(MSBuildProjectName)' != 'Steeltoe.Management.GitProperties.Build'">
+    <Using Include="System.Net.Http.Json" />
+  </ItemGroup>
+</Project>

README.md

@@ -31,7 +31,7 @@ In addition to the [feature documentation](https://steeltoe.io/api), we have bui
 
 | Steeltoe Branch | .NET Version | Status |
 | --- | --- | --- |
-| main | .NET 8 - 10 | Unstable |
+| main | .NET 10 - 11 | Unstable |
 | 4.x | .NET 8 - 10 | Stable |
 | 3.x | .NET 8 | Stable |
 | 2.x | .NET Framework 4.6.1+ | Out of Support |

shared.props

@@ -20,10 +20,8 @@
     <NoWarn>$(NoWarn);IDE0051;IDE0052</NoWarn>
   </PropertyGroup>
 
-  <PropertyGroup Condition="'$(TargetFramework)' != 'net8.0' And '$(TargetFramework)' != 'net9.0'">
-    <!--
-      Suppress new obsolete warnings for WebHostBuilder and WebHost on .NET 10 and higher.
-    -->
+  <PropertyGroup>
+    <!-- Suppress obsolete warnings for WebHostBuilder and WebHost. -->
     <NoWarn>$(NoWarn);ASPDEPR004;ASPDEPR008</NoWarn>
   </PropertyGroup>
 

src/Bootstrap/src/AutoConfiguration/Steeltoe.Bootstrap.AutoConfiguration.csproj

@@ -1,6 +1,6 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net10.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net11.0;net10.0</TargetFrameworks>
     <Description>Automatically configure Steeltoe packages that are referenced by a project. This is not a meta package, other packages must be added separately.</Description>
     <PackageTags>autoconfiguration;automatic;configuration;application;bootstrapping;starter</PackageTags>
     <IsPackable>true</IsPackable>

src/Bootstrap/test/AutoConfiguration.Test/Steeltoe.Bootstrap.AutoConfiguration.Test.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net10.0;net9.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net11.0;net10.0</TargetFrameworks>
   </PropertyGroup>
 
   <Import Project="..\..\..\..\shared.props" />
@@ -12,7 +12,7 @@
     <PackageReference Include="MongoDB.Driver" Version="$(MongoDbDriverVersion)" />
     <PackageReference Include="MySqlConnector" Version="$(MySqlConnectorVersion)" />
     <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
-    <PackageReference Include="Npgsql" Version="$(EntityFrameworkCoreTestVersion)" />
+    <PackageReference Include="Npgsql" Version="$(EntityFrameworkCorePossiblyDowngradedTestVersion)" />
     <PackageReference Include="RabbitMQ.Client" Version="$(RabbitClientTestVersion)" />
   </ItemGroup>
 

src/Bootstrap/test/EmptyAutoConfiguration.Test/Steeltoe.Bootstrap.EmptyAutoConfiguration.Test.csproj

@@ -1,6 +1,6 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net10.0;net9.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net11.0;net10.0</TargetFrameworks>
   </PropertyGroup>
 
   <Import Project="..\..\..\..\shared.props" />

src/Common/src/Certificates/ConfigureCertificateOptions.cs

@@ -70,16 +70,10 @@ public void Configure(string? name, CertificateOptions options)
 
     private static X509Certificate2 LoadCertificate(string certificateFilePath, bool isPkcs12)
     {
-#if NET9_0_OR_GREATER
         // LoadCertificateFromFile handles PEM and DER but not PKCS#12; .pfx/.p12 need a separate loader.
         return isPkcs12
             ? X509CertificateLoader.LoadPkcs12FromFile(certificateFilePath, null)
             : X509CertificateLoader.LoadCertificateFromFile(certificateFilePath);
-#else
-        // This code path does not need to know if the certificate is PKCS12.
-        _ = isPkcs12;
-        return new X509Certificate2(certificateFilePath);
-#endif
     }
 
     private static X509Certificate2 LoadCertificateWithKey(string certificateFilePath, string privateKeyFilePath)
@@ -91,11 +85,7 @@ private static X509Certificate2 LoadCertificateWithKey(string certificateFilePat
             // See https://learn.microsoft.com/dotnet/core/extensions/sslstream-troubleshooting
             using var certificate = X509Certificate2.CreateFromPemFile(certificateFilePath, privateKeyFilePath);
             byte[] pkcs12Bytes = certificate.Export(X509ContentType.Pkcs12);
-#if NET9_0_OR_GREATER
             return X509CertificateLoader.LoadPkcs12(pkcs12Bytes, null, X509KeyStorageFlags.UserKeySet);
-#else
-            return new X509Certificate2(pkcs12Bytes, (string?)null, X509KeyStorageFlags.UserKeySet);
-#endif
         }
 
         return X509Certificate2.CreateFromPemFile(certificateFilePath, privateKeyFilePath);
@@ -106,12 +96,8 @@ private static X509Certificate2Collection LoadIssuerChainFromPkcs12(string certi
         // PKCS#12 does not guarantee certificate ordering, so the leaf cannot be identified by position.
         // The leaf thumbprint is used to exclude it; all other certificates are chain members.
         var issuerChain = new X509Certificate2Collection();
-#if NET9_0_OR_GREATER
         X509Certificate2Collection fullCertificateChain = X509CertificateLoader.LoadPkcs12CollectionFromFile(certificateFilePath, null);
-#else
-        var fullCertificateChain = new X509Certificate2Collection();
-        fullCertificateChain.Import(certificateFilePath);
-#endif
+
         foreach (X509Certificate2 certificate in fullCertificateChain)
         {
             if (certificate.Thumbprint != skipThumbprint)

src/Common/src/Certificates/LocalCertificateWriter.cs

@@ -38,7 +38,7 @@ private static string GetAppBasePath()
     {
         if (AppContext.BaseDirectory.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}", StringComparison.Ordinal))
         {
-            // Traverse up to the project directory, if running from IDE. Strips off a sub-path like: \bin\Debug\net8.0\win-x64\
+            // Traverse up to the project directory, if running from IDE. Strips off a sub-path like: \bin\Debug\net10.0\win-x64\
             return AppContext.BaseDirectory[..AppContext.BaseDirectory.LastIndexOf($"{Path.DirectorySeparatorChar}bin", StringComparison.Ordinal)];
         }
 
@@ -69,11 +69,7 @@ public void Write(Guid orgId, Guid spaceId)
         }
         else
         {
-#if NET9_0_OR_GREATER
             caCertificate = X509CertificateLoader.LoadPkcs12FromFile(RootCaSigningPfxPath, null);
-#else
-            caCertificate = new X509Certificate2(RootCaSigningPfxPath);
-#endif
         }
 
         File.WriteAllText(RootCaCrtPath, caCertificate.ExportCertificatePem());
@@ -88,11 +84,7 @@ public void Write(Guid orgId, Guid spaceId)
         }
         else
         {
-#if NET9_0_OR_GREATER
             intermediateCertificate = X509CertificateLoader.LoadPkcs12FromFile(IntermediateSigningPfxPath, null);
-#else
-            intermediateCertificate = new X509Certificate2(IntermediateSigningPfxPath);
-#endif
         }
 
         File.WriteAllText(IntermediateCrtPath, intermediateCertificate.ExportCertificatePem());

src/Common/src/Certificates/Steeltoe.Common.Certificates.csproj

@@ -1,6 +1,6 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net10.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net11.0;net10.0</TargetFrameworks>
     <Description>Steeltoe shared library for working with certificates.</Description>
     <PackageTags>security;pem;certificate</PackageTags>
     <IsPackable>true</IsPackable>

src/Common/src/Common/Extensions/MaskedUri.cs

@@ -2,11 +2,9 @@
 // The .NET Foundation licenses this file to you under the Apache 2.0 License.
 // See the LICENSE file in the project root for more information.
 
+using System.Buffers;
 using System.Collections.Specialized;
 using System.Web;
-#if NET9_0_OR_GREATER
-using System.Buffers;
-#endif
 
 namespace Steeltoe.Common.Extensions;
 
@@ -33,11 +31,9 @@ internal readonly record struct MaskedUri
         "cert"
     ];
 
-#if NET9_0_OR_GREATER
     private static readonly SearchValues<string> SensitiveQueryStringParameterNameSearchValues =
         // Vectorized, case-insensitive multi-substring search: much faster than looping over SensitiveQueryStringParameterNameParts per parameter name.
         SearchValues.Create(SensitiveQueryStringParameterNameParts, StringComparison.OrdinalIgnoreCase);
-#endif
 
     private readonly Uri? _value;
 
@@ -116,19 +112,7 @@ internal static Uri Mask(Uri source)
 
     private static bool IsSensitiveParameterName(string parameterName)
     {
-#if NET9_0_OR_GREATER
         return parameterName.AsSpan().ContainsAny(SensitiveQueryStringParameterNameSearchValues);
-#else
-        foreach (string namePart in SensitiveQueryStringParameterNameParts)
-        {
-            if (parameterName.Contains(namePart, StringComparison.OrdinalIgnoreCase))
-            {
-                return true;
-            }
-        }
-
-        return false;
-#endif
     }
 
     public static implicit operator MaskedUri(Uri? uri)