## dotnet/aspnetcore — v11.0.0-preview.5.26302.115…v11.0.0-preview.6.26359.118

_193+ commits._

### Features
- **Add SignalR Auth Refresh support to server and .NET client (#67111) (#67400)** (0c6d0f4)
- **Add support for cancelling regular hub invocations from client (#64098)** (26881cc)
- **Add `ConfigureHostApplicationBuilder` virtual method on WebApplicationFactory to allow early configuration of the host application builder (#66527)** (2049006)
- **Add test case for two leading dots (#67266)** (9b1fd5f)
- **Implement async validation support for Microsoft.Extensions.Validation (#66487)** (b546278)
- **Add short circuit attribute (#67249)** (a6a61f8)
- **[Blazor] Add E2E telemetry tests for Blazor WASM standalone with gateway (#67267)** (108d6b5)
- **Add QUERY to known HTTP methods in HostingTelemetryHelpers (#63276)** (e65aaa9)
- **Add missing types to NullableConverter's supported type allowlist (#66625)** (f376145)
- **Verify SignalR union support as hub method parameters and return types (#67125)** (fc4c046)
- **ApiExplorer and OpenAPI unions support (#67001)** (bd9f3b7)
- **Add fuzzing infrastructure for ASP.NET Core (#67022)** (01c7cc4)
- **Verify MVC / Razor Pages support for unions (#67005)** (f097397)
- **Verify Minimal API unions support in RDF and RDG as endpoint parameters and return types (#66951)** (a6319ae)
- **feat: adds support for additional operations emission in OpenAPI 3.2.0 (#67007)** (8eaa2b5)
- **Add dotnet-user-jwts --file support for file-based apps (#66919)** (775c077)
- **Add PR triggers for components-e2e-internal (#66985)** (3277e83)
- **Add InitialIndex parameter and ScrollToIndexAsync API to `Virtualize<TItem>` (#66753)** (d494c24)

### Fixes
- **[release/11.0-preview6] Fix Blazor WASM Standalone HTTPS failure with Gateway (#67565)** (4316d23)
- **[release/11.0-preview6] [Blazor] Fix WebView blazor.modules.json publish crash via conditional fallback (#67374) (#67401)** (6bd759a)
- **Fix test-quarantine unquarantine matching and re-quarantine detection (#67356)** (1ca52e4)
- **Fix test-quarantine activation crash from oversized part1_data env var (#67338)** (4ecc19f)
- **Fix RouteHandlerAnalyzer to avoid exception when generic type parameter is used in a handler (#63641)** (6f66df5)
- **Fully dedupe aspnetcoretools build to fix NativeAOT sourcelink race (#67327)** (4f7ac6b)
- **Fix NativeAOT tool build race in NativeAot.Tests (#67320)** (cb29c66)
- **Verify Blazor union support; fix prerendering of unions with a null active case (#67296)** (2bd9124)
- **Fix public/unofficial CI NativeAOT cross-build for ARM/ARM64/musl legs (#67252)** (db6ba68)
- **Fix TempData and SupplyParameterFromSession persistence for streaming SSR case (#66832)** (fb7deb6)
- **Fix trailing comma handling for chunked. (#67006)** (a70804f)
- **OpenAPI: Fix duplicate xml documentation ids for Generic properties and references (#64404)** (ee88c83)
- **fix docs issues (#67165)** (7e5dc0c)
- **Fix internal CI NativeAOT cross-build for ARM/ARM64/musl legs (#67158)** (a0b18f6)
- **fix(s390x/ppc64le): set RuntimeIdentifier for BasicLinkedApp in DotNetBuild mode (#66867)** (e7e059b)
- **Fix: add KeySubDelimiter between multi-value Vary header values in ResponseCaching and OutputCaching (#66936)** (1125148)
- **Merged PR 60124: [release/9.0] fix http2/3 path header ASCII symbols validation (#67109)** (0fdad03)
- **Fix ValidationsGenerator CS8785 when AddValidation is called from multiple sites (#66675)** (9af09bb)
- **Revert "Fixes Problem Details casing bug (#59396)" (#67011)** (ecc223b)
- **Fix possible deadlock in UnixCertificateManager and MacOSCertificateManager (#66727)** (27a6a87)
- **Fix BlazorGateway VS F5 launch (#66836) and E2E manifest task path (#66617) (#66849)** (00cf101)
- **Fix System.Diagnostics.Metrics.Meter.IsSupported default (#66846)** (d3e55d1)

### Backend
- **[Hot reload]: scope ShouldRender bypass to first render per component to prevent unbounded re-render loop (OOM) (#67372)** (cd6a156)
- **Rename SupportsNullableProperty to DoesNotSupportNullValue (#67386)** (01c1e4f)
- **Defer implicit middlewares to run after Routing (#67307)** (ca1634b)
- **Reject ASCII control characters in cookie auth return URLs (#66876)** (7c9c01b)
- **Improve CRLF / LF line terminators observability in HTTP/1.x request (#66807)** (e4a1751)
- **[Blazor] Rename EnvironmentBoundary component to EnvironmentView (#67369)** (2a0f0e0)
- **[Blazor] Rename API to NavigationManager.GetUriWithFragment (#67368)** (5b47094)
- **Allow OpenAPI registration to resolve document names upon request (#66692)** (914065b)
- **Use globalized type names in validations gen (#67363)** (579a905)
- **Harden host filtering middleware matching leading dot when using wildcard. (#67265)** (51a99f3)
- **[Blazor] Reshape BrowserConfiguration API per review (BrowserOptions) while preserving the JS wire format (#67337)** (d5a6efd)
- **Re-quarantine Http3RequestTests.GET_GracefulServerShutdown_AbortRequestsAfterHostTimeout (#67339)** (661f449)
- **Quarantine TestServerTests.LongPollingWorks (#67349)** (00e352a)
- **Quarantine VirtualizationCspTest.Virtualize_WithItems_DoesNotViolate_StrictStyleCspPolicy (#67353)** (6d7b5de)
- **[test-quarantine] Quarantine RealServerUsingMinimalBackedIntegrationTests.CanResolveServices (#67341)** (71f1f6b)
- **Update dependencies from build 319511 (#67334)** (c96e311)
- **[main] (deps): Bump src/submodules/MessagePack-CSharp (#67315)** (82accf1)
- **[main] (deps): Bump src/submodules/googletest (#67316)** (d72b73a)
- **Use StringSyntaxAttribute in analyzer test helpers (#63642)** (df726df)
- **[main] Source code updates from dotnet/dotnet (#67309)** (afca1bd)
- **Opt pooled async methods out of runtime async (#67190)** (fb525db)
- **WebAssembly Out-of-Process Renderer (#66442)** (d38389e)
- **Scrub leaked tokens from test-quarantine Part 1 output (#67322)** (3d18de5)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/backport-base.yml (#67319)** (c4090a1)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/inter-branch-merge-base.yml (#67318)** (880d6e2)
- **[main] (deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#67317)** (1a72384)
- **[blazor][wasm] use dotnet.download() for InteractiveAuto (#66656)** (e80ed94)
- **[Blazor] Separate media components into Microsoft.AspNetCore.Components.Media package (#67130)** (79b198b)
- **[Blazor] Catch and discard JSDisconnectedException in IJSObjectReference.DisposeAsync for WebView (#66259)** (4a97713)
- **Batch small Helix work items to reduce per-item overhead (-53% compute) (#66808)** (a097744)
- **[main] Source code updates from dotnet/dotnet (#67290)** (7393d18)
- **[breaking] Defer antiforgery/CSRF rejection to form consumers via `IAntiforgeryValidationFeature` (#67082)** (d54f274)
- **Update dependencies from build 318994 (#67253)** (80b29b3)
- **Updated npm packages 2026-06-17 (#67282)** (d5a18c1)
- **Unquarantine BlazorWebJsInitializersTest.InitializersRunsModernCallbacksByDefaultWhenPresent (#67263)** (edd7e2b)
- **Unquarantine ServerVirtualizationTest.DynamicContent_PrependItemsWhileScrolledToMiddle_VisibleItemsStayInPlace (#67262)** (e4f3c65)
- **Update CI pipeline to use Windows 2022 image (#67286)** (3a91a68)
- **Unquarantine TestServerTests.WebSocketsWorks (#67261)** (25ae7e4)
- **Unquarantine AbortedStream_ResetsAndDrainsRequest_RefusesFramesAfterClientReset (#67260)** (46316b9)
- **Quarantine only flaky tests, not consistent regressions (#67278)** (d033283)
- **Revert "Skip .NET SDK first-run experience in Helix work items (#66916)" (#67241)** (8deda82)
- **[Blazor] Override ResolveComponentForRenderMode in WebViewRenderer to treat all render modes as no-ops (#65876)** (fb6e5b8)
- **Update dependencies from build 318763 (#67232)** (9b86daf)
- **Remove misplaced `pure` annotations (#66778)** (0217526)
- **Split IValidatableInfo to multiple interfaces (#67183)** (becbe4b)
- **[Blazor] Align gateway and templates with Aspire implementation (#67048)** (8854c58)
- **Make Virtualize component CSP-compliant (#66680)** (ede0ab9)
- **Update default OpenApi version to 3.2 (#67097)** (423e407)
- **Delete dead code in MEV (#67214)** (ad2f14f)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/backport-base.yml (#67220)** (aa54935)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/inter-branch-merge-base.yml (#67221)** (7a50ac5)
- **[main] Source code updates from dotnet/dotnet (#67194)** (f3bbfec)
- **Rename argument in DisplayNameInfo.GetDisplayName (#67159)** (90a61e3)
- **Recompile gh-aw workflows with matching CLI v0.79.7 (#67215)** (6d86210)
- **Reduce algorithmic complexity for parsing If-Match and If-None-Match. (#66796)** (ac7fe7d)
- **Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-optimization build 20260609.1 (#67208)** (4241326)
- **Throw HttpSysException with HttpInitialize status details (#66859)** (ef9ce6f)
- **[main] (deps): Bump actions/checkout from 6.0.2 to 6.0.3 (#67182)** (6e5e013)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/backport-base.yml (#67181)** (af70f7a)
- **[main] (deps): Bump github/gh-aw-actions from 0.77.5 to 0.79.7 (#67179)** (bb9e3bf)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/inter-branch-merge-base.yml (#67180)** (8bb3231)
- **[main] Source code updates from dotnet/dotnet (#67114)** (0e14788)
- **Unquarantine ServerVirtualizationTest.CanRenderHtmlTable (#67169)** (bb68f14)
- **Unquarantine Http3RequestTests.GET_GracefulServerShutdown_AbortRequestsAfterHostTimeout (#67171)** (2235227)
- **Update ID.Web packages (#67161)** (dcd10d6)
- **Raise test-quarantine ET budget to 50M, halve run frequency (#67168)** (f7ea67b)
- **Precompute test-quarantine Part 1 gathering in pre-activation (#67167)** (cddc35c)
- **Replace VS2026 Pre Scout Helix queue names (#67141)** (d20a436)
- **Updated npm packages 2026-06-10 (#67140)** (928300a)
- **Enable control flow guard for native AOT tools (#67106)** (da04fcb)
- **Run tests on MacOS 26 (#63531)** (7c9d1fe)
- **Update MessagePack (#67107)** (81f91ea)
- **Move Source B PR selection into a pre-activation step (#67129)** (fae66ea)
- **Verify test-quarantine Source B PRs via batched GraphQL (#67115)** (016ea32)
- **Merged PR 60873: Avoid caching responses for authenticated users (#67110)** (1a638c9)
- **Merged PR 60176: [release/9.0] gRPC transcoding: respecting json-name aliases (#67108)** (b0fe49c)
- **Capture gradle stderr and stacktrace in SignalR Java client builds (#67009)** (4b9edc7)
- **Handle `DescriptionAttribute` for nullable value types in OpenAPI generation (#65245)** (6309245)
- **Revert Node pin to 24.14.1 in default-build.yml (#66979)** (672741d)
- **Batch test-quarantine data collection to reduce token usage (#67085)** (568488b)
- **Improve default Identity email wording for recipients who didn't initiate the action (#66747)** (cbdd640)
- **Apply API changes for Label and DisplayName** (dc731b1)
- **VirtuazlieAnchorMode docs improvement (#67063)** (12db528)
- **[main] Source code updates from dotnet/dotnet (#67024)** (7f0d5e9)
- **[main] (deps): Bump src/submodules/googletest (#67038)** (21ad7ab)
- **Cap helix log extraction in test-quarantine workflow (#67047)** (c390cce)
- **Remove auto-milestoning from policybot (#67046)** (d1df4c8)
- **[main] (deps): Bump actions/checkout from 6.0.2 to 6.0.3 (#67040)** (f2895a4)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/backport-base.yml (#67042)** (b8f35c2)
- **[main] (deps): Bump dotnet/arcade/.github/workflows/inter-branch-merge-base.yml (#67041)** (31015cb)
- **[main] (deps): Bump github/gh-aw-actions from 0.77.5 to 0.78.1 (#67039)** (fda1bb2)
- **Implement Cross-Site Request Forgery Algorithm based on Fetch Metadata headers (#66585)** (1a6684c)
- **[main] Source code updates from dotnet/dotnet (#66981)** (af9b6d1)
- **Address file-based app user secrets feedback (#67010)** (6865ecc)
- **Propagate JsonSerializerOptions correctly during OpenAPI generation (#66847)** (33c8c07)
- **Document antiforgery HTTP method limitations and HttpMethodOverride interaction (#66772)** (bbb57bb)
- **Update Microsoft.OpenApi to 3.6.0 (#66998)** (a57571e)
- **Update dependencies from https://dev.azure.com/dnceng/internal/_git/dotnet-optimization build 20260526.2 (#66948)** (dd5915b)
- **Stabilize flaky VirtualizationTest AnchorMode tests (#66893)** (2ae863d)
- **Update SkipIfNotAdminAttribute.cs (#64179)** (f8ce524)
- **Localized file check-in by OneLocBuild Task: Build definition ID 1159: Build ID 2990348 (#66962)** (9d73636)
- **[test-quarantine] Quarantine flaky E2E tests: RedirectionTest streaming get and ServerVirtualizationTest anchor mode (#66971)** (107e3e0)
- **Update Milestones for July (#66987)** (2dc6fbf)
- **Harden test-quarantine prompt against wrong issue links (#66986)** (73224b3)
- **Produce hang dumps in HELIX_WORKITEM_UPLOAD_ROOT (#66935)** (12ae318)
- **Split issue triage agent into orchestrator + reviewer (#66873)** (8019b47)
- **Update Microsoft.Windows.CsWin32 from 0.3.269 to 0.3.275 (#66944)** (3d3e43a)
- **Update Selenium and Playwright browser-testing dependencies (#66945)** (423a8c2)
- **Enable long-path checkout in runtime sync workflow (#66898)** (6258d70)
- **updated remark for MaximumParallelInvocationsPerClient property. (#66897)** (b901529)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/dotnet/aspnetcore?utm_source=github-action)._