Merge pull request #47944 from dotnet/main

Merge main into live

Author: dotnet-policy-service[bot]

docs/azure/includes/dotnet-all.md

@@ -24,6 +24,7 @@ If you're migrating an app to .NET 10, the breaking changes listed here might af
 | [Exception diagnostics suppressed when TryHandleAsync returns true](aspnet-core/10/exception-handler-diagnostics-suppressed.md) | Behavioral change | Preview 7 |
 | [IActionContextAccessor and ActionContextAccessor are obsolete](aspnet-core/10/iactioncontextaccessor-obsolete.md) | Source incompatible/behavioral change | Preview 7 |
 | [IncludeOpenAPIAnalyzers property and MVC API analyzers are deprecated](aspnet-core/10/openapi-analyzers-deprecated.md) | Source incompatible | Preview 7 |
+| [IPNetwork and ForwardedHeadersOptions.KnownNetworks are obsolete](aspnet-core/10/ipnetwork-knownnetworks-obsolete.md) | Source incompatible | Preview 7 |
 | [Microsoft.Extensions.ApiDescription.Client package deprecated](aspnet-core/10/apidescription-client-deprecated.md) | Source incompatible | Preview 7 |
 | [Razor run-time compilation is obsolete](aspnet-core/10/razor-runtime-compilation-obsolete.md) | Source incompatible | Preview 7 |
 
@@ -42,13 +43,18 @@ If you're migrating an app to .NET 10, the breaking changes listed here might af
 | [Consistent shift behavior in generic math](core-libraries/10.0/generic-math.md) | Behavioral change | Preview 1 |
 | [Default trace context propagator updated to W3C standard](core-libraries/10.0/default-trace-context-propagator.md) | Behavioral change | Preview 4 |
 | [DriveInfo.DriveFormat returns Linux filesystem types](core-libraries/10.0/driveinfo-driveformat-linux.md) | Behavioral change | Preview 6 |
+| [DynamicallyAccessedMembers annotation removed from DefaultValueAttribute ctor](core-libraries/10.0/defaultvalueattribute-dynamically-accessed-members.md) | Binary/source incompatible | Preview 7 |
 | [GnuTarEntry and PaxTarEntry no longer includes atime and ctime by default](core-libraries/10.0/tar-atime-ctime-default.md) | Behavioral change   | Preview 5          |
 | [LDAP DirectoryControl parsing is now more stringent](core-libraries/10.0/ldap-directorycontrol-parsing.md) | Behavioral change | Preview 1 |
 | [MacCatalyst version normalization](core-libraries/10.0/maccatalyst-version-normalization.md) | Behavioral change | Preview 1 |
 | [.NET runtime no longer provides default SIGTERM signal handler](core-libraries/10.0/sigterm-signal-handler.md) | Behavioral change | Preview 5 |
 | [System.Linq.AsyncEnumerable included in core libraries](core-libraries/10.0/asyncenumerable.md) | Source incompatible | Preview 1 |
 | [YMM embedded rounding removed from AVX10.2](core-libraries/10.0/ymm-embedded-rounding.md) | Behavioral change | Preview 5 |
 
+## Entity Framework Core
+
+[Breaking changes in EF Core 10](/ef/core/what-is-new/ef-core-10.0/breaking-changes)
+
 ## Extensions
 
 | Title | Type of change      | Introduced version |
@@ -98,10 +104,12 @@ If you're migrating an app to .NET 10, the breaking changes listed here might af
 | [Default workload configuration from 'loose manifests' to 'workload sets' mode](sdk/10.0/default-workload-config.md) | Behavioral change | Preview 2 |
 | [`dotnet package list` performs restore](sdk/10.0/dotnet-package-list-restore.md) | Behavioral change | Preview 4 |
 | [`dotnet restore` audits transitive packages](sdk/10.0/nugetaudit-transitive-packages.md) | Behavioral change | Preview 3 |
+| [SHA-1 fingerprint support deprecated in `dotnet nuget sign`](sdk/10.0/dotnet-nuget-sign-sha1-deprecated.md) | Behavioral change | Preview 1 |
 | [MSBUILDCUSTOMBUILDEVENTWARNING escape hatch removed](sdk/10.0/custom-build-event-warning.md) | Behavioral change | Preview 1 |
 | [MSBuild custom culture resource handling](sdk/10.0/msbuild-custom-culture.md) | Behavioral change | Preview 1 |
 | [NU1510 is raised for direct references pruned by NuGet](sdk/10.0/nu1510-pruned-references.md) | Source incompatible | Preview 1 |
 | [PackageReference without a version raises an error](sdk/10.0/nu1015-packagereference-version.md) | Behavioral change | Preview 6 |
+| [PrunePackageReference marks direct prunable references with PrivateAssets=all and IncludeAssets=none](sdk/10.0/prune-packagereference-privateassets.md) | Behavioral change | Preview 7 |
 | [HTTP warnings promoted to errors in `dotnet package list` and `dotnet package search`](sdk/10.0/http-warnings-to-errors.md) | Behavioral/source incompatible change | Preview 4 |
 | [NUGET_ENABLE_ENHANCED_HTTP_RETRY environment variable removed](sdk/10.0/nuget-enhanced-http-retry-removed.md) | Behavioral change | Preview 6 |
 

docs/azure/includes/dotnet-new.md

@@ -68,6 +68,10 @@ If you're migrating an app to .NET 9, the breaking changes listed here might aff
 |-----------------------------------------------------------------------------------------------------|---------------------|--------------------|
 | [Deprecated desktop Windows/macOS/Linux MonoVM runtime packages](deployment/9.0/monovm-packages.md) | Source incompatible | Preview 7          |
 
+## Entity Framework Core
+
+[Breaking changes in EF Core 9](/ef/core/what-is-new/ef-core-9.0/breaking-changes)
+
 ## Interop
 
 | Title                                                  | Type of change      | Introduced version |

docs/core/compatibility/10.0.md

@@ -0,0 +1,50 @@
+---
+title: "Breaking change: IPNetwork and ForwardedHeadersOptions.KnownNetworks are obsolete"
+description: Learn about the breaking change in ASP.NET Core 10.0 where IPNetwork and ForwardedHeadersOptions.KnownNetworks have been obsoleted in favor of System.Net.IPNetwork and KnownIPNetworks.
+ms.date: 08/08/2025
+ai-usage: ai-assisted
+ms.custom: https://github.com/aspnet/Announcements/issues/523
+---
+# IPNetwork and ForwardedHeadersOptions.KnownNetworks are obsolete
+
+<xref:Microsoft.AspNetCore.HttpOverrides.IPNetwork?displayProperty=fullName> and <xref:Microsoft.AspNetCore.Builder.ForwardedHeadersOptions.KnownNetworks> have been marked as obsolete in favor of using <xref:System.Net.IPNetwork?displayProperty=fullName> and `KnownIPNetworks`.
+
+## Version introduced
+
+.NET 10 Preview 7
+
+## Previous behavior
+
+Previously, you could use <xref:Microsoft.AspNetCore.HttpOverrides.IPNetwork?displayProperty=fullName> and <xref:Microsoft.AspNetCore.Builder.ForwardedHeadersOptions.KnownNetworks> to configure known networks for the forwarded headers middleware:
+
+```csharp
+app.UseForwardedHeaders(new ForwardedHeadersOptions
+{
+    KnownNetworks.Add(new(IPAddress.Loopback, 8))
+});
+```
+
+## New behavior
+
+Starting in .NET 10, if you use [the obsolete APIs](#affected-apis) in your code, you'll get warning `ASPDEPR005` at compile time:
+
+> warning ASPDEPR005: Please use KnownIPNetworks instead. For more information, visit <https://aka.ms/aspnet/deprecate/005>.
+
+Use the <xref:System.Net.IPNetwork?displayProperty=fullName> type and `KnownIPNetworks` property instead.
+
+## Type of breaking change
+
+This change can affect [source compatibility](../../categories.md#source-compatibility).
+
+## Reason for change
+
+<xref:System.Net.IPNetwork?displayProperty=fullName> has replaced the <xref:Microsoft.AspNetCore.HttpOverrides.IPNetwork?displayProperty=fullName> type that was implemented for <xref:Microsoft.AspNetCore.HttpOverrides.ForwardedHeadersMiddleware>.
+
+## Recommended action
+
+Change to using <xref:System.Net.IPNetwork?displayProperty=fullName> and `KnownIPNetworks`.
+
+## Affected APIs
+
+- <xref:Microsoft.AspNetCore.HttpOverrides.IPNetwork?displayProperty=fullName>
+- <xref:Microsoft.AspNetCore.Builder.ForwardedHeadersOptions.KnownNetworks?displayProperty=fullName>

docs/core/compatibility/9.0.md

@@ -24,23 +24,37 @@ The <xref:System.Linq.AsyncEnumerable> class in .NET 10, and in the [`System.Lin
 
 ## Type of breaking change
 
-This is a [source incompatible](../../categories.md#source-compatibility) change.
+This change can affect [source compatibility](../../categories.md#source-compatibility).
 
 ## Reason for change
 
 <xref:System.Collections.Generic.IAsyncEnumerable`1> is a commonly used interface, so the platform itself should provide LINQ support for the type. Maintainers of `System.Linq.Async` and other community members petitioned for inclusion directly in the platform.
 
 ## Recommended action
 
-If upgrading to .NET 10 and the code includes a direct package reference to `System.Linq.Async`, remove that package reference. For multitargeting both .NET 10 and previous versions, add a package reference to `System.Linq.AsyncEnumerable` instead.
+If you're upgrading to .NET 10 and your code includes a direct package reference to `System.Linq.Async`, remove that package reference. For multitargeting both .NET 10 and a previous version, add a package reference to `System.Linq.AsyncEnumerable` instead.
 
-If `System.Linq.Async` is consumed indirectly via another package, avoid ambiguity errors by including this in the project:
+If `System.Linq.Async` is consumed indirectly via another package, avoid ambiguity errors by adding `<ExcludeAssets>` metadata with a value of `compile` or `all`:
 
-```xml
-<PackageReference Include="System.Linq.Async" Version="6.0.1">
-  <ExcludeAssets>all</ExcludeAssets>
-</PackageReference>
-```
+- To allow transitive use of `System.Linq.Async`, set `<ExcludeAssets>` to `compile`:
+
+  ```xml
+  <PackageReference Include="System.Linq.Async" Version="6.0.1">
+    <ExcludeAssets>compile</ExcludeAssets> 
+  </PackageReference>
+  ```
+
+  This configuration prevents direct usage in your code while allowing other packages to continue using System.Linq.Async internally.
+
+- For complete exclusion, set `<ExcludeAssets>` to `all`:
+
+  ```xml
+  <PackageReference Include="System.Linq.Async" Version="6.0.1">
+    <ExcludeAssets>all</ExcludeAssets>
+  </PackageReference>
+  ```
+
+  Use this configuration only if you're certain no dependencies require System.Linq.Async at run time.
 
 Most consuming code should be compatible without changes, but some call sites might need updates to refer to newer names and signatures. For example, a `Select` call like `e.Select(i => i * 2)` will work the same before and after. However, the call `e.SelectAwait(async (int i, CancellationToken ct) => i * 2)` will need to be changed to use `Select` instead of `SelectAwait`, as in `e.Select(async (int i, CancellationToken ct) => i * 2)`.
 

docs/core/compatibility/aspnet-core/10/ipnetwork-knownnetworks-obsolete.md

@@ -0,0 +1,38 @@
+---
+title: "Breaking change: 'DynamicallyAccessedMembers' annotation removed from 'DefaultValueAttribute' ctor"
+description: "Learn about the breaking change in .NET 10 where a 'DefaultValueAttribute' constructor is no longer annotated with 'DynamicallyAccessedMembers'."
+ms.date: 08/11/2025
+ai-usage: ai-assisted
+---
+
+# `DynamicallyAccessedMembers` annotation removed from `DefaultValueAttribute` ctor
+
+The <xref:System.ComponentModel.DefaultValueAttribute.%23ctor(System.Type,System.String)?displayProperty=nameWithType> constructor is no longer annotated with <xref:System.Diagnostics.CodeAnalysis.DynamicallyAccessedMembersAttribute>. This constructor is not supported with trimming and throws an exception if reached at run time in a trimmed app.
+
+## Version introduced
+
+.NET 10 Preview 7
+
+## Previous behavior
+
+Previously, if the constructor was used in a trimmed app and the feature switch to disable exception throwing was used, publishing the app generated a trimming warning, and there was a chance the code worked at run time.
+
+## New behavior
+
+Starting in .NET 10, if the constructor is used in a trimmed app and the feature switch to disable exception throwing is used, publishing the app still generates a trimming warning. But there's a smaller chance the code will work at run time.
+
+## Type of breaking change
+
+This change can affect [binary compatibility](../../categories.md#binary-compatibility) and [source compatibility](../../categories.md#source-compatibility).
+
+## Reason for change
+
+This attribute should not be used in trimmed apps because it doesn't reliably work. Trimming should be free to remove type members mentioned in the attribute.
+
+## Recommended action
+
+Don't enable the feature switch that attempts to make <xref:System.Diagnostics.CodeAnalysis.DynamicallyAccessedMembersAttribute> (unreliably) work in trimmed apps.
+
+## Affected APIs
+
+- <xref:System.ComponentModel.DefaultValueAttribute.%23ctor(System.Type,System.String)>

docs/core/compatibility/core-libraries/10.0/asyncenumerable.md

@@ -0,0 +1,48 @@
+---
+title: "Breaking change - SHA-1 fingerprint support deprecated in dotnet nuget sign"
+description: "Learn about the breaking change in .NET 10 where SHA-1 fingerprint support is deprecated in dotnet nuget sign command, promoting NU3043 warning to error."
+ms.date: 08/11/2025
+ai-usage: ai-assisted
+ms.custom: https://github.com/dotnet/docs/issues/47449
+---
+
+# SHA-1 fingerprint support deprecated in `dotnet nuget sign`
+
+Starting in .NET 10, the [NU3043](/nuget/reference/errors-and-warnings/nu3043) warning is promoted to an error when using SHA-1 fingerprints with the [`dotnet nuget sign` command](../../../tools/dotnet-nuget-sign.md). This change enforces the use of only strong, approved hash algorithms (SHA-2 family) for signing operations.
+
+## Version introduced
+
+.NET 10 Preview 1
+
+## Previous behavior
+
+In .NET 9 SDK, the `dotnet nuget sign` command accepted certificate fingerprints using SHA-1 and SHA-2 family algorithms (SHA256, SHA384, SHA512). If a SHA-1 fingerprint was used, a warning (NU3043) was issued, indicating the use of an insecure hashing algorithm, but the operation continued successfully.
+
+## New behavior
+
+Starting in .NET 10, the NU3043 warning is elevated to an error. This change blocks the use of SHA-1 fingerprints with the `--certificate-fingerprint` option in the `dotnet nuget sign` command, improving overall signing security.
+
+## Type of breaking change
+
+This is a [behavioral change](../../categories.md#behavioral-change).
+
+## Reason for change
+
+This change was made to enforce stronger security standards by disallowing the use of SHA-1 for certificate fingerprinting. SHA-1 is considered cryptographically weak and vulnerable to collision attacks.
+
+## Recommended action
+
+Update the usage of `dotnet nuget sign` to use fingerprints from the SHA-2 family only:
+
+- SHA256 (recommended)
+- SHA384
+- SHA512
+
+## Affected APIs
+
+None.
+
+## See also
+
+- [dotnet nuget sign](../../../tools/dotnet-nuget-sign.md)
+- [NuGet warning NU3043](/nuget/reference/errors-and-warnings/nu3043)

docs/core/compatibility/core-libraries/10.0/defaultvalueattribute-dynamically-accessed-members.md

@@ -1,14 +1,14 @@
 ---
 title: "Breaking change - NU1510 is raised for direct references pruned by NuGet"
-description: "Learn about the breaking change in .NET 10 where NU1510 is raised for unnecessary direct package references."
-ms.date: 3/25/2025
+description: "Learn about the breaking change in the .NET 10 SDK where NU1510 is raised for unnecessary direct package references."
+ms.date: 08/11/2025
 ai-usage: ai-assisted
 ms.custom: https://github.com/dotnet/docs/issues/45462
 ---
 
 # NU1510 is raised for direct references pruned by NuGet
 
-Starting in .NET 10, NuGet raises a [`NU1510` warning](/nuget/reference/errors-and-warnings/nu1510) when a project includes a direct package reference that overlaps with a framework-provided library and is not required.
+Starting in .NET 10, NuGet raises a [`NU1510` warning](/nuget/reference/errors-and-warnings/nu1510) when a project includes a direct package reference that overlaps with a framework-provided library and isn't required.
 
 ## Version introduced
 
@@ -20,11 +20,14 @@ Previously, the .NET SDK ignored the contents of a package if it overlapped with
 
 ## New behavior
 
-NuGet now removes unnecessary package references entirely and raises a `NU1510` warning to notify you of the issue.
+Starting in .NET 10, NuGet handles any unnecessary package references by raising a `NU1510` warning to notify you of the issue.
+
+> [!NOTE]
+> In a later .NET 10 preview, this behavior changed again such that direct prunable package references are automatically excluded from the `.nuspec` file. For more information, see [PrunePackageReference marks direct prunable references with PrivateAssets=all and IncludeAssets=none](prune-packagereference-privateassets.md).
 
 ## Type of breaking change
 
-This is a [source-incompatible change](../../categories.md#source-compatibility).
+This change can affect [source compatibility](../../categories.md#source-compatibility).
 
 ## Reason for change
 
@@ -50,3 +53,7 @@ If your project targets only frameworks where the package is pruned, remove the
 ## Affected APIs
 
 None.
+
+## See also
+
+- [PrunePackageReference marks direct prunable references with PrivateAssets=all and IncludeAssets=none](prune-packagereference-privateassets.md)

docs/core/compatibility/sdk/10.0/dotnet-nuget-sign-sha1-deprecated.md

@@ -0,0 +1,82 @@
+---
+title: "Breaking change - PrunePackageReference marks direct prunable references with PrivateAssets=all and IncludeAssets=none"
+description: "Learn about the breaking change in the .NET 10 SDK where PrunePackageReference automatically marks directly prunable PackageReference with PrivateAssets=all and IncludeAssets=none."
+ms.date: 01/03/2025
+ai-usage: ai-assisted
+---
+
+# PrunePackageReference marks direct prunable references with PrivateAssets=all and IncludeAssets=none
+
+The [PrunePackageReference](/nuget/consume-packages/package-references-in-project-files#prunepackagereference) feature automatically removes *transitive* packages that are provided by the target platform. With this change, the feature also marks *directly* prunable `PackageReference` items with `PrivateAssets=all` and `IncludeAssets=none` attributes. These attributes prevent the packages from appearing in generated dependency lists for packages.
+
+## Version introduced
+
+.NET 10 Preview 7
+
+## Previous behavior
+
+In earlier .NET 10 previews, directly prunable `PackageReference` items might have generated an [`NU1510` warning](/nuget/reference/errors-and-warnings/nu1510) but still appeared in the generated *.nuspec* dependencies for all target frameworks, even those where the package is provided by the platform.
+
+For example, consider a multi-targeting project with the following configuration:
+
+```xml
+<PropertyGroup>
+  <TargetFramework>net9.0;net472</TargetFramework>
+</PropertyGroup>
+
+<ItemGroup>
+  <PackageReference Include="System.Text.Json" Version="9.0.4" />
+</ItemGroup>
+```
+
+Such a project file generated a *.nuspec* file with dependencies for both target frameworks:
+
+```xml
+<dependencies>
+  <group targetFramework=".NETFramework4.7.2">
+    <dependency id="System.Text.Json" version="9.0.4" />
+  </group>
+  <group targetFramework="net9.0">
+    <dependency id="System.Text.Json" version="9.0.4" />
+  </group>
+</dependencies>
+```
+
+## New behavior
+
+Starting in .NET 10 Preview 7, directly prunable `PackageReference` items are automatically marked with `PrivateAssets=all` and `IncludeAssets=none`, which excludes them from the generated dependencies for target frameworks where they're provided by the platform.
+
+The same project configuration now generates a *.nuspec* file with the prunable dependency removed from the target framework that provides it (.NET 9):
+
+```xml
+<dependencies>
+  <group targetFramework=".NETFramework4.7.2">
+    <dependency id="System.Text.Json" version="9.0.4" />
+  </group>
+  <group targetFramework="net9.0">
+  </group>
+</dependencies>
+```
+
+## Type of breaking change
+
+This is a [behavioral change](../../categories.md#behavioral-change).
+
+## Reason for change
+
+This change ensures that package dependencies accurately reflect the actual requirements for each target framework. It prevents unnecessary package references from appearing in generated packages when those APIs are already provided by the target framework.
+
+## Recommended action
+
+- If you create a package and get a [`NU1510` warning](/nuget/reference/errors-and-warnings/nu1510), follow the instructions there.
+- If you create a package and the generated *.nuspec* dependencies don't contain a referenced package for *any* target framework, remove the reference from the project file as it's not needed.
+- If the referenced package appears in the *.nuspec* file, no action is needed.
+
+## Affected APIs
+
+None.
+
+## See also
+
+- [PrunePackageReference](/nuget/consume-packages/package-references-in-project-files#prunepackagereference)
+- [NU1510 is raised for direct references pruned by NuGet](nu1510-pruned-references.md)