Merge main into live

.github/workflows/generate-preview-links.yml

@@ -13,6 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       statuses: read
+      checks: write
       pull-requests: write
     steps:
       - name: Harden Runner
@@ -23,3 +24,4 @@ jobs:
       - uses: dotnet/docs-tools/actions/preview-link-generator@main
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
+          annotate_file_warnings: true

docs/ai/evaluation/snippets/evaluate-ai-responses/TestAI.csproj

@@ -11,13 +11,13 @@
   <ItemGroup>
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
-    <PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.8.3" />
-    <PackageReference Include="Microsoft.Extensions.AI.Evaluation" Version="10.8.0" />
-    <PackageReference Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.8.0" />
-    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.8.3" />
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.Evaluation" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.Evaluation.Quality" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.11" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageReference Include="MSTest" Version="4.3.3" />
   </ItemGroup>
 

docs/ai/evaluation/snippets/evaluate-safety/EvaluateResponseSafety.csproj

@@ -11,14 +11,14 @@
   <ItemGroup>
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
-    <PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.8.3" />
-    <PackageReference Include="Microsoft.Extensions.AI.Evaluation" Version="10.8.0" />
-    <PackageReference Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.Evaluation" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.Evaluation.Reporting" Version="10.9.0" />
     <PackageReference Include="Microsoft.Extensions.AI.Evaluation.Safety" Version="10.3.0-preview.1.26109.11" />
-    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.8.3" />
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.11" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageReference Include="MSTest" Version="4.3.3" />
   </ItemGroup>
 

docs/ai/how-to/snippets/handle-invalid-tool-input/csharp/HandleInvalidToolInput.csproj

@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.AI" Version="10.8.1" />
-    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.8.1" />
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.AI" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.11" />
   </ItemGroup>
 
 </Project>

docs/ai/quickstarts/snippets/assistants/AIAssistants.csproj

@@ -10,7 +10,7 @@
   <ItemGroup>
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
-    <PackageReference Include="OpenAI" Version="2.12.0" />
+    <PackageReference Include="OpenAI" Version="2.13.0" />
   </ItemGroup>
 
 </Project>

docs/ai/quickstarts/snippets/mcp-server/SampleMcpServer.csproj

@@ -33,8 +33,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
-    <PackageReference Include="ModelContextProtocol" Version="2.1.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
+    <PackageReference Include="ModelContextProtocol" Version="2.2.0" />
   </ItemGroup>
 
 </Project>

docs/ai/snippets/microsoft-extensions-ai/ConsoleAI.CustomClientMiddle/ConsoleAI.CustomClientMiddle.csproj

@@ -8,8 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="OllamaSharp" Version="5.4.27" />
-    <PackageReference Include="System.Threading.RateLimiting" Version="10.0.10" />
+    <PackageReference Include="OllamaSharp" Version="5.4.30" />
+    <PackageReference Include="System.Threading.RateLimiting" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>

docs/ai/snippets/microsoft-extensions-ai/ConsoleAI.FunctionalityPipelines/ConsoleAI.FunctionalityPipelines.csproj

@@ -8,8 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="OllamaSharp" Version="5.4.27" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.11" />
+    <PackageReference Include="OllamaSharp" Version="5.4.30" />
     <PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.17.0" />
   </ItemGroup>
 

docs/ai/snippets/prompt-engineering/multi-turn-chat.csproj

@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <PackageReference Include="Azure.AI.OpenAI" Version="2.8.0-beta.1" />
-    <PackageReference Include="Microsoft.Agents.AI.OpenAI" Version="1.17.0" />
+    <PackageReference Include="Microsoft.Agents.AI.OpenAI" Version="1.18.0" />
     <!--
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.2" />
     <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.2" />

docs/ai/vector-stores/snippets/chat-with-data/openai/VectorDataAI.csproj

@@ -9,10 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.8.3" />
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.10" />
-    <PackageReference Include="CommunityToolkit.VectorData.InMemory" Version="1.0.0" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.11" />
+    <PackageReference Include="CommunityToolkit.VectorData.InMemory" Version="1.0.1" />
   </ItemGroup>
 
 </Project>

docs/azure/sdk/snippets/aspnetcore-guidance/MinApiSample/MinApiSample.csproj

@@ -7,11 +7,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
 	  <PackageReference Include="Azure.Messaging.ServiceBus" Version="7.20.2" />
 	  <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.11.0" />
 	  <PackageReference Include="Azure.Storage.Blobs" Version="12.29.1" />
-	  <PackageReference Include="Microsoft.Extensions.Azure" Version="1.14.0" />
+	  <PackageReference Include="Microsoft.Extensions.Azure" Version="1.14.1" />
   </ItemGroup>
 
 </Project>

docs/azure/sdk/snippets/logging/LoggingSampleApp.csproj

@@ -7,10 +7,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.3" />
-    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.3" />
+    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.5.4" />
+    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.4" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
-    <PackageReference Include="Microsoft.Extensions.Azure" Version="1.14.0" />
+    <PackageReference Include="Microsoft.Extensions.Azure" Version="1.14.1" />
   </ItemGroup>
 
 </Project>

docs/core/diagnostics/ambient-metadata/snippets/buildmetadata-msbuild-azure/buildmetadata-msbuild-azure.csproj

@@ -13,8 +13,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.AmbientMetadata.Build" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.AmbientMetadata.Build" Version="10.9.0" />
   </ItemGroup>
 
 </Project>

docs/core/diagnostics/snippets/resource-monitoring/resource-monitoring.csproj

@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Diagnostics.ResourceMonitoring" Version="10.8.0" />
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Diagnostics.ResourceMonitoring" Version="10.9.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
     <PackageReference Include="Spectre.Console" Version="0.57.2" />
   </ItemGroup>
 

docs/core/enrichment/snippets/enrichment/Enrichment.csproj

@@ -8,10 +8,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Telemetry" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Telemetry" Version="10.9.0" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/dependency-injection/snippets/basics/di-basics.csproj

@@ -8,7 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/dependency-injection/snippets/console/console-di.csproj

@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/snippets/async-state/csharp/AspNetCoreIntegration/AspNetCoreIntegration.csproj

@@ -6,7 +6,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.AsyncState" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.AsyncState" Version="10.9.0" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/snippets/configuration/binding-scenarios/DictionaryBinding/DictionaryBinding.csproj

@@ -8,8 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.11" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/snippets/http/latency/latency.csproj

@@ -18,7 +18,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Http.Diagnostics" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.Http.Diagnostics" Version="10.9.0" />
   </ItemGroup>
 
 </Project>

docs/core/extensions/sslstream-best-practices.md

@@ -3,7 +3,8 @@ title: TLS/SSL best practices
 description: Learn the best practices when using SslStream in .NET.
 author: rzikm
 ms.author: radekzikmund
-ms.date: 03/13/2023
+ms.date: 08/26/2026
+ai-usage: ai-assisted
 ---
 
 # TLS/SSL best practices
@@ -25,19 +26,52 @@ Deferring the decision to the OS automatically uses the most recent version of T
 > [!NOTE]
 > <xref:System.Net.Security.CipherSuitesPolicy> is not supported on Windows and attempts to instantiate it will cause <xref:System.NotSupportedException> to be thrown.
 
-## Specify a server certificate
+## Specify a local certificate
 
-When authenticating as a server, <xref:System.Net.Security.SslStream> requires an <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> instance. It is recommended to always use an <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> instance which also contains the private key.
+When authenticating as a server, <xref:System.Net.Security.SslStream> always requires a certificate. When authenticating as a client, you also provide a certificate if the server requests one for mutual TLS (mTLS). In both roles, the certificate must be an <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> instance that contains the private key.
 
-There are multiple ways that a server certificate can be passed to <xref:System.Net.Security.SslStream>:
+Recent .NET versions handle the server and client sides symmetrically, so the following guidance applies whether the application authenticates as a server, a client, or both.
 
-- Directly as a parameter to <xref:System.Net.Security.SslStream.AuthenticateAsServerAsync*?displayProperty=nameWithType> or via <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificate?displayProperty=nameWithType> property
-- From a selection callback in <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateSelectionCallback?displayProperty=nameWithType> property
-- By passing a <xref:System.Net.Security.SslStreamCertificateContext> in the <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateContext?displayProperty=nameWithType> property
+You can provide the certificate to <xref:System.Net.Security.SslStream> in several ways.
 
-The recommended approach is to use the <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateContext?displayProperty=nameWithType> property. When the certificate is obtained by one of the other two ways, a <xref:System.Net.Security.SslStreamCertificateContext> instance is created internally by the <xref:System.Net.Security.SslStream> implementation. Creating a <xref:System.Net.Security.SslStreamCertificateContext> involves building an <xref:System.Security.Cryptography.X509Certificates.X509Chain> which is a CPU intensive operation. It is more efficient to create a <xref:System.Net.Security.SslStreamCertificateContext> once and reuse it for multiple <xref:System.Net.Security.SslStream> instances.
+When you authenticate as a server:
 
-Reusing <xref:System.Net.Security.SslStreamCertificateContext> instances also enables additional features such us [TLS session resumption](https://datatracker.ietf.org/doc/html/rfc5077) on Linux servers.
+- Set the <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificate?displayProperty=nameWithType> property, or pass the certificate to <xref:System.Net.Security.SslStream.AuthenticateAsServerAsync*?displayProperty=nameWithType>.
+- Return the certificate from the <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateSelectionCallback?displayProperty=nameWithType> callback.
+- Set a <xref:System.Net.Security.SslStreamCertificateContext> on the <xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateContext?displayProperty=nameWithType> property.
+
+When you authenticate as a client:
+
+- Add the certificate to the <xref:System.Net.Security.SslClientAuthenticationOptions.ClientCertificates?displayProperty=nameWithType> collection, or pass a collection that contains it to <xref:System.Net.Security.SslStream.AuthenticateAsClientAsync*?displayProperty=nameWithType>.
+- Return the certificate from the <xref:System.Net.Security.SslClientAuthenticationOptions.LocalCertificateSelectionCallback?displayProperty=nameWithType> callback.
+- Set a <xref:System.Net.Security.SslStreamCertificateContext> on the <xref:System.Net.Security.SslClientAuthenticationOptions.ClientCertificateContext?displayProperty=nameWithType> property.
+
+> [!NOTE]
+> The <xref:System.Net.Security.SslClientAuthenticationOptions.ClientCertificateContext> property is available starting in .NET 8.
+
+For better performance, use the certificate context property (<xref:System.Net.Security.SslServerAuthenticationOptions.ServerCertificateContext> or <xref:System.Net.Security.SslClientAuthenticationOptions.ClientCertificateContext>). When you provide the certificate in one of the other ways, <xref:System.Net.Security.SslStream> creates a <xref:System.Net.Security.SslStreamCertificateContext> internally. Creating the context builds an <xref:System.Security.Cryptography.X509Certificates.X509Chain>, which is a CPU-intensive operation, so it's more efficient to create the context once and reuse it across multiple <xref:System.Net.Security.SslStream> instances.
+
+Reusing a <xref:System.Net.Security.SslStreamCertificateContext> instance also enables extra features such as [TLS session resumption](https://datatracker.ietf.org/doc/html/rfc5077) on Linux servers.
+
+### Send intermediate certificates to the peer
+
+When an intermediate certificate authority issues the local certificate, the peer might not be able to build the full certificate chain unless the handshake includes the intermediate certificates. To send these intermediates, create a <xref:System.Net.Security.SslStreamCertificateContext> with the <xref:System.Net.Security.SslStreamCertificateContext.Create*> method and pass the intermediate certificates in the `additionalCertificates` parameter:
+
+```csharp
+X509Certificate2 leafCertificate = GetLeafCertificate();
+X509Certificate2Collection intermediates = GetIntermediateCertificates();
+
+SslStreamCertificateContext certificateContext =
+    SslStreamCertificateContext.Create(leafCertificate, intermediates);
+
+// When you authenticate as a server.
+serverOptions.ServerCertificateContext = certificateContext;
+
+// When you authenticate as a client for mutual TLS.
+clientOptions.ClientCertificateContext = certificateContext;
+```
+
+The context works the same way for both roles. On the client side, the certificate context is the recommended way to send intermediates, because the alternative—adding the intermediates to the machine or user certificate store—affects every application on the system.
 
 ## Custom `X509Certificate` validation