Add support for .NET 11 RC 2 (#13310)

.devcontainer/devcontainer.json

@@ -14,7 +14,7 @@
     },
     "ghcr.io/devcontainers/features/node:2": { "version": "24" }
   },
-  "image": "mcr.microsoft.com/dotnet/sdk:10.0.402",
+  "image": "mcr.microsoft.com/dotnet/sdk:11.0.100-rc.2",
   "postStartCommand": "dotnet workload install wasm-tools && dotnet dev-certs https --trust",
   "waitFor": "onCreateCommand",
   "customizations": {

.github/actions/submit-to-winget/action.yml

@@ -0,0 +1,61 @@
+name: Submit to WinGet
+description: Sends one version of a Windows app to the WinGet community repository, as a new package the first time and as an update after that.
+
+inputs:
+  id:
+    description: The WinGet package identifier, such as BitPlatform.Todo.
+    required: true
+  version:
+    description: The app's version.
+    required: true
+  installer:
+    description: Path of the installer the job built.
+    required: true
+  installer-url:
+    description: The URL of that installer, whose file must never change.
+    required: true
+  architecture:
+    description: x64 or x86.
+    required: true
+  product-code:
+    description: The key of the app's Add/Remove Programs entry.
+    required: true
+  name:
+    description: The package's name.
+    required: true
+  short-description:
+    description: One sentence about the app.
+    required: true
+  package-url:
+    description: The app's web page.
+    required: true
+  privacy-url:
+    description: The app's privacy policy.
+    default: ''
+  token:
+    description: A classic GitHub token with the public_repo scope. The pull request comes from its owner's fork of winget-pkgs.
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+
+    - name: Submit to WinGet
+      shell: pwsh
+      env:
+        WINGET_CREATE_GITHUB_TOKEN: ${{ inputs.token }}
+        DOTNET_ROLL_FORWARD: Major
+      run: >
+        & "${{ github.action_path }}/submit-to-winget.ps1"
+        -Id "${{ inputs.id }}"
+        -Version "${{ inputs.version }}"
+        -Installer "${{ inputs.installer }}"
+        -InstallerUrl "${{ inputs.installer-url }}"
+        -Architecture "${{ inputs.architecture }}"
+        -ProductCode "${{ inputs.product-code }}"
+        -Name "${{ inputs.name }}"
+        -ShortDescription "${{ inputs.short-description }}"
+        -PackageUrl "${{ inputs.package-url }}"
+        -PrivacyUrl "${{ inputs.privacy-url }}"
+        -WorkFolder "${{ runner.temp }}/winget"

.github/actions/submit-to-winget/submit-to-winget.ps1

@@ -0,0 +1,112 @@
+#Requires -Version 7.4
+param(
+    [Parameter(Mandatory)] [string] $Id,
+    [Parameter(Mandatory)] [string] $Version,
+    [Parameter(Mandatory)] [string] $Installer,
+    [Parameter(Mandatory)] [string] $InstallerUrl,
+    [Parameter(Mandatory)] [ValidateSet('x64', 'x86')] [string] $Architecture,
+    [Parameter(Mandatory)] [string] $ProductCode,
+    [Parameter(Mandatory)] [string] $Name,
+    [Parameter(Mandatory)] [string] $ShortDescription,
+    [Parameter(Mandatory)] [string] $PackageUrl,
+    [string] $PrivacyUrl,
+    [Parameter(Mandatory)] [string] $WorkFolder
+)
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+
+function ConvertTo-YamlString([string] $value) {
+    "'" + $value.Replace("'", "''") + "'"
+}
+
+function New-Manifests([string] $folder) {
+    New-Item -ItemType Directory -Force $folder | Out-Null
+    $sha256 = (Get-FileHash $Installer -Algorithm SHA256).Hash
+    $privacy = $PrivacyUrl ? "PrivacyUrl: $(ConvertTo-YamlString $PrivacyUrl)`n" : ''
+
+    Set-Content (Join-Path $folder "$Id.yaml") -Encoding utf8NoBOM -NoNewline -Value @"
+# yaml-language-server: `$schema=https://aka.ms/winget-manifest.version.1.10.0.schema.json
+PackageIdentifier: $Id
+PackageVersion: $Version
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.10.0
+
+"@
+
+    Set-Content (Join-Path $folder "$Id.installer.yaml") -Encoding utf8NoBOM -NoNewline -Value @"
+# yaml-language-server: `$schema=https://aka.ms/winget-manifest.installer.1.10.0.schema.json
+PackageIdentifier: $Id
+PackageVersion: $Version
+InstallerType: exe
+Scope: user
+InstallModes:
+- interactive
+- silent
+- silentWithProgress
+InstallerSwitches:
+  Silent: --silent
+  SilentWithProgress: --silent
+UpgradeBehavior: install
+RequireExplicitUpgrade: true
+ProductCode: $(ConvertTo-YamlString $ProductCode)
+Installers:
+- Architecture: $Architecture
+  InstallerUrl: $(ConvertTo-YamlString $InstallerUrl)
+  InstallerSha256: $sha256
+ManifestType: installer
+ManifestVersion: 1.10.0
+
+"@
+
+    Set-Content (Join-Path $folder "$Id.locale.en-US.yaml") -Encoding utf8NoBOM -NoNewline -Value @"
+# yaml-language-server: `$schema=https://aka.ms/winget-manifest.defaultLocale.1.10.0.schema.json
+PackageIdentifier: $Id
+PackageVersion: $Version
+PackageLocale: en-US
+Publisher: BitPlatform
+PublisherUrl: https://bitplatform.dev
+PublisherSupportUrl: https://github.com/bitfoundation/bitplatform/issues
+$($privacy)PackageName: $(ConvertTo-YamlString $Name)
+PackageUrl: $(ConvertTo-YamlString $PackageUrl)
+License: MIT
+LicenseUrl: https://github.com/bitfoundation/bitplatform/blob/develop/LICENSE
+ShortDescription: $(ConvertTo-YamlString $ShortDescription)
+ManifestType: defaultLocale
+ManifestVersion: 1.10.0
+
+"@
+}
+
+$publisher, $package = $Id -split '\.', 2
+$manifests = Join-Path $WorkFolder "manifests/$($publisher.Substring(0, 1).ToLowerInvariant())/$publisher/$package/$Version"
+
+$wingetcreate = Join-Path $WorkFolder 'wingetcreate.exe'
+New-Item -ItemType Directory -Force $WorkFolder | Out-Null
+Invoke-WebRequest https://github.com/microsoft/winget-create/releases/download/v1.12.13.0/wingetcreate.exe -OutFile $wingetcreate
+
+if ((Get-FileHash $wingetcreate -Algorithm SHA256).Hash -ne '24042BD37915805615E6CF969AC57C6439124C3FE85823327F5F3FB24BD9FFEA') {
+    throw 'wingetcreate.exe is not the build this script pins.'
+}
+
+$listed = $true
+
+try {
+    Invoke-RestMethod "https://api.github.com/repos/microsoft/winget-pkgs/contents/manifests/$($publisher.Substring(0, 1).ToLowerInvariant())/$publisher/$package" -Headers @{ Authorization = "Bearer $env:WINGET_CREATE_GITHUB_TOKEN" } | Out-Null
+}
+catch {
+    if ($_.Exception.Response.StatusCode -ne [Net.HttpStatusCode]::NotFound) {
+        throw
+    }
+
+    $listed = $false
+}
+
+if ($listed) {
+    & $wingetcreate update $Id --version $Version --urls "$InstallerUrl|$Architecture" --submit --no-open
+}
+else {
+    New-Manifests $manifests
+    & $wingetcreate submit $manifests --prtitle "New package: $Id version $Version" --no-open
+}

.github/agents/dependency-update.md

@@ -83,7 +83,7 @@ consumes a test project, so every band takes the newest patch of its own band. L
 
 **Version ranges stay.** `[8.0.0,9.0.0)` is a compatibility contract, not a pin.
 
-**`Bit.*` self-references track the in-development version**, currently `10.7.0-pre-02`. Never read
+**`Bit.*` self-references track the in-development version**, currently `11.0.0-pre-10`. Never read
 these off nuget.org — the published `latest` is behind the working tree by design, and unrelated
 higher-numbered lines exist there.
 
@@ -108,13 +108,24 @@ gh api "repos/<owner>/<repo>/git/trees/<sha>?recursive=1" --jq '[.tree[]|select(
 A non-zero count on a JavaScript action that vendors `node_modules` means it will not stage. This is
 worth checking for *any* action bump, not just this one — it is invisible in the release notes.
 
-**A MAUI bump needs one MAUI build.** MAUI's resizetizer bundles an `Svg.Skia`, and from 10.0.101 to
-10.0.110 that `Svg.Skia` called a SkiaSharp overload missing from the SkiaSharp next to it, so any SVG
-with a `<filter>` failed the build with `MAUIR0001` /
-`MissingMethodException: SKImageFilter.CreateMatrixConvolution`
-([dotnet/maui#38319](https://github.com/dotnet/maui/issues/38319)). The app icons of the Boilerplate
-and the BlazorUI demo have one, so before moving MAUI, build a MAUI app with the Boilerplate's
-`appicon.svg` as its icon, for any target.
+**MAUI's resizetizer breaks on SVG filters.** MAUI 10.0.101 to 10.0.110 and 11.0.0-rc.2 bundle an `Svg.Skia` that
+calls a SkiaSharp overload missing from the SkiaSharp next to it, so any SVG it resizes that has a `<filter>` fails
+the build with `MAUIR0001` / `MissingMethodException: SKImageFilter.CreateMatrixConvolution`
+([dotnet/maui#38319](https://github.com/dotnet/maui/issues/38319)). 10.0.120 fixed it for .NET 10, and a .NET 10
+Boilerplate project takes develop's MAUI. On this branch MAUI can't stay behind for .NET 11: a MAUI built for an
+older preview doesn't compile against the newer preview's Android workload (CS1705 on `Java.Interop`). So MAUI
+follows the SDK here, and the app icons of the Boilerplate and the BlazorUI demo carry no drop shadow (their
+`<filter>`) until a .NET 11 MAUI builds an app with the Boilerplate's `appicon.svg` as its icon.
+
+**bit Boilerplate builds for .NET 10 and .NET 11.** Its `framework` option picks one; the template's own tree is
+the .NET 11 project. In its `Directory.Packages.props`, a package whose 11.x build has no `net10.0` assets has a
+version in each of the two framework groups at the end of the file: the 11.x one, and a 10.x one that moves within
+10.x. So do the `Microsoft.Extensions.*` packages, although their 11.x builds have `net10.0` assets: they bring
+`Microsoft.Extensions.Logging.Abstractions` 11 into the .NET 10 server projects, whose targets file then overrides
+the one `Microsoft.Extensions.Telemetry.Abstractions` turns the framework's logging generator off with, depending
+on import order, and the build fails with CS0757. Every other package takes one version for both. The few literals that differ per framework are switch
+symbols in `template.json` (the SDK and its `rollForward`, the dev container image, the `dotnet-ef` version, the
+runner image), so they move together with the files they replace.
 
 **`Xamarin.Firebase.Messaging` is held at 125.1.1.** 125.1.2 pulls `Xamarin.AndroidX.Fragment` 1.9.0
 (through `GooglePlayServices.Base` 118.10.1), which absorbed the ktx classes, while the rest of the
@@ -124,10 +135,20 @@ the graph already brings `Fragment.Ktx` 1.9.0 (an empty stub), rather than pinni
 `Xamarin.GooglePlayServices.Auth.Api.Phone` is held at 118.3.1 for the same reason: 118.3.1.1 pulls
 `GooglePlayServices.Basement` 118.10.0.3, which brings Fragment 1.9.0.
 
-**Linux runners are held at `ubuntu-24.04`**, in the GitHub workflows and the Azure DevOps `vmImage`.
-`ubuntu-26.04` defaults to JDK 25 (`(default)` in the image readme's Java table), and .NET for Android
-10 accepts up to 21 (`LatestSupportedJavaVersion` 21.0.99), so every Android build there fails. .NET 11
-raises the limit to 25.0.99; move the runners together with the .NET 11 move.
+**EF Core in the Boilerplate follows its PostgreSQL provider.** A preview of
+`Npgsql.EntityFrameworkCore.PostgreSQL` asks for one exact EF Core version, and a provider built for another
+one fails at runtime ("Method not found"). So the Boilerplate's EF Core stays on the version the newest Npgsql
+names, together with every package that requires it (`Microsoft.EntityFrameworkCore.*`,
+`Microsoft.AspNetCore.Identity.EntityFrameworkCore`, `Microsoft.AspNetCore.DataProtection.EntityFrameworkCore`,
+`Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore`) and its `dnx dotnet-ef` calls, while the
+rest of ASP.NET Core moves on. A NU1608 on Npgsql in a restore means this was missed.
+
+**Linux runners are on `ubuntu-26.04`**, in the GitHub workflows and the Azure DevOps `vmImage`. It
+defaults to JDK 25 (`(default)` in the image readme's Java table), which .NET for Android accepts from .NET 11
+RC2 on (`LatestSupportedJavaVersion` 25.0.99 in `Xamarin.Android.Common.props.in`). develop stays on
+`ubuntu-24.04`, since .NET for Android 10 accepts up to 21, so a runner pin that comes over from develop moves
+to `ubuntu-26.04` here, except in the jobs that build a .NET 10 Boilerplate project (the Todo and Sales CDs), which
+keep develop's runners.
 
 When a held pin's rationale no longer holds — the oldest supported SDK moved, TS 7 was adopted
 repo-wide — say so in the report rather than acting on it.
@@ -245,14 +266,16 @@ There are no `.config/dotnet-tools.json` manifests any more: every tool is run w
 <package>@<version>`, so the pins live in the workflow and doc lines that call them (`grep -rn "dnx
 .*@"`). `vpk` must equal the `Velopack` PackageReference version in the same project — Velopack
 requires the CLI and the library to match, and this has drifted before. `dotnet-ef` should equal the
-EF Core package version. Likewise the `npx playwright@<version>` command in the Boilerplate's two
+EF Core package version of the project it runs on: the .NET 11 one in the template's files, the .NET 10 one in
+`template.json`'s `efToolVersion` and in the Todo CD. Likewise the `npx playwright@<version>` command in the Boilerplate's two
 `.runsettings` (`src/Tests` and `src/Internal/Boilerplate.Tests.E2E`) must equal
 `Microsoft.Playwright.MSTest.v4`: a remote Playwright server of any other version refuses the client, and
 every test that runs on it fails at connect.
 
-`src/global.json` is `rollForward: disable` and tracks the newest SDK. The two template
-`global.json` files are `10.0.100` + `latestFeature` deliberately — they must accept any 10.0.x on a
-consumer's machine. Do not "update" them.
+`src/global.json` is `rollForward: disable` and tracks the newest SDK. While .NET 11 is a release
+candidate, the two template `global.json` files pin the same RC SDK, also `rollForward: disable`, and
+move with it. Once .NET 11 ships they go back to `11.0.100` + `latestFeature`, so they accept any
+11.0.x on a consumer's machine. A .NET 10 project gets `10.0.100` + `latestFeature` from `template.json`.
 
 ### Container images
 

.github/agents/test-platform.md

@@ -106,8 +106,8 @@ websites - is checked. Every command prints what it checked and exits non-zero o
 | `windows [-Force]` | Opens each Windows app that is behind and taps its version, which updates it and restarts it. |
 | `e2e [-Stage <stages>] [-Filter <filter>] [-PrereleasePackages]` | Signs the global admin in once, then runs the E2E suite stage by stage like `RunTests.bat` - skipping the mac's stages when its Playwright server is down or on another version - keeping each stage's log and TRX. With `-PrereleasePackages`, it builds the suite with the Bit packages of the newest Prerelease nuget packages run. |
 | `mcp [-McpVersion <x.y.z>] [-Tool <name> -Arguments <json>]` | One `tools/list` or `tools/call` on `https://bitplatform.dev/mcp`. |
-| `devcontainer [-Sha <sha> [-PrereleasePackages]] [-Keep]` | Creates a project with `bit new`, brings its dev container up with the devcontainers CLI and runs `bit doctor` in it, with bit and the template from that commit or from nuget.org. Then removes the container, its volumes and its image, and keeps the logs. |
-| `aspire [-Sha <sha> [-PrereleasePackages]] [-Keep]` | Creates a project with `bit new` the same way and runs its Aspire app host three times with `dotnet run`: the second run must reuse the first one's containers, they must stop once the app host has sat idle for its idle time, and the third run must bring them back on the same volumes. Then removes the project, its containers and their volumes, and keeps the logs. |
+| `devcontainer [-Sha <sha> [-PrereleasePackages]] [-Framework <tfm>] [-Keep]` | Creates a project with `bit new`, for the template's default .NET or the one `-Framework` names, brings its dev container up with the devcontainers CLI and runs `bit doctor` in it, with bit and the template from that commit or from nuget.org. Then removes the container, its volumes and its image, and keeps the logs. |
+| `aspire [-Sha <sha> [-PrereleasePackages]] [-Framework <tfm>] [-Keep]` | Creates a project with `bit new` the same way and runs its Aspire app host three times with `dotnet run`: the second run must reuse the first one's containers, they must stop once the app host has sat idle for its idle time, and the third run must bring them back on the same volumes. Then removes the project, its containers and their volumes, and keeps the logs. |
 
 ## 1. The CI run
 
@@ -319,7 +319,8 @@ Triage every failure:
    tell flaky from broken. A stage's console log counts every failed attempt of a test that retries, its TRX only
    the last one: a test the TRX shows passed failed once and passed on its retry. Compare a failure only with earlier
    runs against a deployment from the same branch: the demos run whichever branch the last CD built, and the
-   branches differ in their .NET.
+   branches differ in their .NET. On one branch the demos can differ too: each demo's CD names the `--framework` it
+   builds with, so a failure in one app and not another may be the .NET version rather than the app.
 2. Read the server's side. The demo backends run on this machine and log to the Windows **Application** event log,
    source `.NET Runtime`. How much gets there is each site's own `Logging` section in its server-owned
    `appsettings.json` under `C:\inetpub\<site>`: the Boilerplate backends log from Information up, the platform
@@ -345,9 +346,9 @@ no `Content-Length`, was compressed again on the way. Compare the libraries' ass
 with a publish of the commit the expected sizes were measured on. The service worker's own scripts, its asset list
 included, report no size to Playwright, so the total leaves them out.
 
-Two failures on .NET 11 are known gaps of third-party libraries; report them as known and don't triage them: the
-template's MySQL provider doesn't work there (All CI keeps its MySQL job off), and CommunityToolkit.Datasync doesn't
-sync, so the offline Todo test that waits for an item added offline to reach the server fails every time. Check them
+Two gaps of third-party libraries on .NET 11 are known: the template's MySQL provider doesn't work there, and
+CommunityToolkit.Datasync doesn't sync. That is why All CI's MySQL job and the offline Todo demo build .NET 10
+projects. A .NET 11 project that uses either fails by design: report it as known and don't triage it. Check them
 again once those libraries support .NET 11.
 
 **A fix is proven only by the next CD.** The suite tests the deployed build, so a fix to the template or to a demo
@@ -475,8 +476,10 @@ alive for its idle time. `aspire` checks that the way a developer meets it:
 - `-Sha` and `-PrereleasePackages` work as for `devcontainer`. With `-PrereleasePackages` the project restores into a
   packages folder of its own, since this machine's cache may hold nuget.org's build of the same version; without it
   the Bit packages come from nuget.org at the version the template asks for. The project's `global.json` asks for
-  the repository's SDK, which needs the workloads the template's clients build with (`wasm-tools`): an SDK that
-  Visual Studio installed brings only its own.
+  the SDK of its .NET version, which needs the workloads the template's clients build with (`wasm-tools`): an SDK
+  that Visual Studio installed brings only its own.
+- Without `-Framework`, both `aspire` and `devcontainer` create a project for the template's default .NET. When a
+  change touches what differs between the .NET versions, run `aspire` once with each.
 - It takes about half an hour, most of it the idle wait, and a few GB of Docker's memory while the app runs.
   Start it in the background once the CD's deploy jobs are done, and never next to `devcontainer` or the Android
   stage. Its containers hold that memory, and Docker's VM keeps it for a while after they stop: IIS sites