[release-notes] ASP.NET Core in .NET 11 Preview 6

[danroth27]

Draft ASP.NET Core release notes for .NET 11 Preview 6. This PR targets the milestone base branch release-notes/11.0-preview6 (see #10455).

Please review the AI-authored content for accuracy, including any code samples and <!-- TODO --> / <!-- Filtered features --> notes, then mark ready for review. 🤖 Generated with the release-notes skill.

[Copilot]

Pull request overview

Adds the draft ASP.NET Core component release notes for .NET 11 Preview 6 to the release-notes repository, documenting new features, breaking changes, bug fixes, and community contributors for the milestone branch (release-notes/11.0-preview6).

Changes:

• Introduces feature writeups for Minimal API async validation, Blazor Virtualize scrolling, OpenAPI updates, [ShortCircuit], and SignalR authentication refresh.
• Captures notable breaking changes and a short bug-fix roundup.
• Adds a milestone-scoped community contributor list.

[danroth27]

Verified every feature in these notes by building and running samples against the locally installed .NET 11 Preview 6 SDK (build 26325.125). Samples live in c:\github\danroth27\aspnetcore11samples. Corrections pushed in the latest commit:

Async validation (ran a minimal API; valid → 200, async rules → 400):

• IAsyncValidatableObject extends IValidatableObject, so the model must also implement the synchronous Validate method — the original sample didn't compile without it.
• AsyncValidationAttribute is overridden via the protected IsValidAsync (the doc said GetValidationResultAsync, which is the public method the framework calls and isn't overridable).

Blazor Virtualize (verified in a headless browser: InitialIndex=500 opened at items 485–515; "Back to top" → ScrollToIndexAsync(0) scrolled to Product 0):

• Virtualize.Items requires ICollection<T>, so the sample now uses List<Product> (IReadOnlyList<Product> does not compile).

[ShortCircuit] (verified middleware is skipped):

• Changed the robots.txt example from [ShortCircuit(404)] to [ShortCircuit]. [ShortCircuit(404)] returns the body with a 404 status, which is wrong for robots.txt; [ShortCircuit] returns 200. Added a minimal-API example.

Verified accurate as written (no change):

• OpenAPI: document version is 3.2.0 by default; a union return type produces anyOf: [Kitten, Puppy] with bare-named case components.
• SignalR auth refresh: EnableAuthenticationRefresh, OnAuthenticationRefresh, and Hub.OnAuthenticationRefreshedAsync compile, and the /refresh endpoint is mapped alongside /negotiate.
• Breaking changes: the IValidatableInfo split into IValidatableTypeInfo/IValidatableParameterInfo/IValidatablePropertyInfo is present in the build.

Note: the local build is 26325.125; the notes target 26328.106. I confirmed the corrected APIs are identical across both builds.

[danroth27]

Pushed an update addressing the review feedback. Summary:

Restructure

• Renamed Async validation for minimal APIs (+ cross-link to the libraries notes; the sync Validate now throws for async-only types).
• Split the OpenAPI section into OpenAPI 3.2 by default (kept as a feature) and a broader Unions in ASP.NET Core section (Minimal APIs, MVC/Razor Pages, SignalR, Blazor + gaps + cross-refs).
• SignalR: added the client-side WithAuthenticationRefresh API, and a new Cancel hub invocations from the client section (#64098).

Re-verified on the final Preview 6 build (11.0.100-preview.6.26359.118) — every feature was rebuilt/run in danroth27/aspnetcore11samples: async validation (incl. the throw change), OpenAPI 3.2 + union anyOf, [ShortCircuit], Virtualize (browser-tested InitialIndex/ScrollToIndexAsync), SignalR auth refresh (client compiles), and hub-invocation cancellation (round-trip: client cancel → server token fires).

Community contributors — vetted all 12 for Microsoft/.NET-team affiliation and removed two:

• @jesuszarate — company @microsoft (ANCM signing work). Microsoft employee.
• @Alex-Sob — Akvelon, Inc. (a firm that staffs contractors on the .NET/ASP.NET Core team); the merged PRs are internal analyzer work. Removed as a judgment call — let me know if you'd prefer to keep them.

The other 10 (Xebia, Syncfusion, IBM, Cloudflare, and independents) are external and were kept. @desjoerd and @sheiksyedm are public members of the dotnet org but work for Xebia/Syncfusion (not Microsoft), so I kept them.

[danroth27]

Reframed the Blazor preview API changes per the guidance that preview-to-preview renames aren''t breaking changes (we haven''t shipped these APIs in a stable release yet).

New Preview API changes section (migration notes for upgrading from an earlier .NET 11 preview) replaces the old Breaking changes section:

• EnvironmentBoundary → EnvironmentView — this component was documented back in Preview 1, so this is a rename ([Blazor] Rename EnvironmentBoundary component to EnvironmentView aspnetcore#67369)
• NavigationManager.GetUriWithHash → GetUriWithFragment ([Blazor] Rename API to NavigationManager.GetUriWithFragment aspnetcore#67368)
• Browser options reshape: WithBrowserConfiguration→WithBrowserOptions, BrowserConfiguration→BrowserOptions, ServerBrowserOptions→InteractiveServerBrowserOptions, DisableDomPreservation→PreserveDom, CircuitInactivityTimeoutMs→CircuitInactivityTimeout (Reshape BrowserConfiguration API per review (BrowserOptions) while preserving the JS wire format aspnetcore#67337)
• Media components moved out of Components.Web to a new Components.Media package (Separate media components into Microsoft.AspNetCore.Components.Media package aspnetcore#67130)
• Minimal API validation resolver split (IValidatableInfo → three interfaces; Split IValidatableInfo to multiple interfaces aspnetcore#67183) — experimental API, grouped here rather than as a break

Removed the two Blazor feature sections that re-documented the renamed APIs — we don''t need to re-document a renamed feature, just note the rename.

Automatic cross-origin (CSRF) protection is now documented purely as new functionality; I folded the shared-verdict detail (dotnet/aspnetcore#67082) into that feature section instead of listing it as a breaking change.

Net result: there is no Breaking changes section this preview — nothing here breaks a shipped-stable API.

⚠️ Media move caveat (dotnet/aspnetcore#67130): the components are removed from Microsoft.AspNetCore.Components.Web in the Preview 6 build (26359.118), but the new Microsoft.AspNetCore.Components.Media package''s earliest published build is 11.0.0-preview.7.26360.111 — there is no matching preview.6 package. I documented it as "removed from Web, moving to a new package" without pointing to a specific PackageReference. Happy to adjust if you''d prefer different handling.

[danroth27]

Reviewed the Automatic cross-origin (CSRF) protection section against the new draft docs (reference, migration) and improved it. Every claim is verified against the Preview 6 source (release/11.0.1xx-preview6: DefaultCsrfProtection, CsrfProtectionMiddleware, WebApplicationBuilder) and the running 26359.118 build.

What changed:

• Added the primary upgrade action — allow a trusted cross-origin caller by declaring its origin in a CORS policy. The middleware reuses the endpoint''s CORS policy; AllowAnyOrigin is intentionally not trusted for writes.
• Added opt-outs — .DisableAntiforgery() / [IgnoreAntiforgeryToken] per endpoint, and the DisableCsrfProtection global config key.
• Clarified deferred enforcement — endpoints that never read a form (e.g. JSON APIs) aren''t rejected.
• Corrected ordering — "after authentication and authorization" (was "after routing and authentication").
• Linked the new conceptual + migration docs.

Runtime check against the installed P6 build (curl, Sec-Fetch-Site set manually):

Scenario	Result
same-origin form POST	200
cross-site untrusted origin, minimal API [FromForm]	400
cross-site origin trusted via CORS default policy	200
non-browser (no Sec-Fetch-Site/Origin)	200
cross-site untrusted, JSON body (no form read)	200

One nuance worth knowing: reading HttpContext.Request.Form directly is a backstop that throws InvalidOperationException rather than returning a clean 400. The clean 400 comes from framework form consumers (minimal API [FromForm], MVC, Blazor SSR), which is exactly what the note describes.

[Youssef1313]

I'm having a hard time understanding what "Documents continue to generate as before" means

[guardrex]

Pinging @tdykstra for an 👁️ on this suggestion because we're mirroring this language in the PR for ASP.NET Core What's New coverage (dotnet/AspNetCore.Docs #37334).

[danroth27]

Reworded to make clear only the default document version changes; your generation code and configuration are unchanged. Since the docs (dotnet/AspNetCore.Docs#37334) mirror this language, I'll leave this thread open to align with whatever final wording you and @tdykstra land on. cc @guardrex

[Youssef1313]

LGTM for the parts in my areas. Only left few comments.

Also are we intentionally missing dotnet/aspnetcore#66527 ?

[guardrex]

Let me jump in to mention that if you want to cross-link to the two Blazor node article sections, use the following two links. The Blazor node articles (and changes on the Blazor Pre6 PR) cover the AntiforgeryToken component, the [RequireAntiforgeryToken] attribute, and the AntiforgeryStateProvider.GetAntiforgeryToken method. Let's take up the Pre6 updates on the Blazor Pre6 PR. For this PR if you want to include the links, here they are, and this PR won't break because these are existing sections ........

• <xref:blazor/forms/index#antiforgery-support>
• <xref:blazor/security/index#antiforgery-support>

UPDATE: I added those links to the Blazor section of ASP.NET Core What's New that pertains to the BWA template change (dropping the antiforgery middleware setup), along with the general links to CSRF middleware.