[ejsmith]

Upgrade the app to .NET 11 RC2 (SDK 11.0.100-rc.2.26504.105, runtime 11.0.0-rc.2.26504.105, released 2026-10-13) and refresh the other .NET dependencies that upgrade cleanly. All projects target net11.0. global.json, CI, the Dockerfile, the dev container, VS Code launch paths, the CI shard runner, and the email-template preview script all point at .NET 11. Public routes, persisted data, and config keys are unchanged.

Validation: Release build with warnings as errors, plus the full backend suite: 3,336 tests, 3,333 passed, 0 failed, 3 existing opt-in/performance skips. The job and api Docker targets build and run on the RC2 images. NuGet reports no vulnerable direct or transitive packages.

Changes, review notes, and verification

Package updates

Update	Notes
Microsoft.Extensions.*, System.IO.Hashing, System.DirectoryServices, System.Security.Cryptography.Pkcs, Microsoft.AspNetCore.OpenApi, Microsoft.AspNetCore.Mvc.Testing → 11.0.0-rc.2.26504.105	Framework-aligned packages. The Pkcs pin stays because MimeKit still allows the vulnerable 10.0.0.
Microsoft.Extensions.Logging.Abstractions (removed)	Now ships in the shared framework; NU1510 rejects the explicit reference.
Microsoft.OpenApi 2.12.2 → 3.10.2	Required by ASP.NET Core 11 OpenAPI ([3.10.2, 4.0.0)). Request body content now uses IOpenApiMediaType, so two transformers construct and mutate the concrete OpenApiMediaType (upgrade guide).
Microsoft.NET.Test.Sdk 18.11.0, Microsoft.Extensions.TimeProvider.Testing 10.11.0	vstest 18.11.0: TRX/MTP bridge fixes. TimeProvider.Testing is a servicing release.

These stay put: Aspire 13.6.1 and OpenTelemetry 1.19.x are already the latest. Foundatio.Repositories stays on its pinned preview build. Serilog, Riok.Mapperly, and Stripe have only prerelease updates.

OpenAPI contract

• ASP.NET Core 11 defaults the document to OpenAPI 3.2. The Svelte client generator (swagger-typescript-api) and third-party generators read this document, so OpenApiVersion is pinned to 3.1. Microsoft.OpenApi 3.x writes that as 3.1.2.
• openapi.json was regenerated. Ignoring the version, the server URL's dropped trailing slash, and the ordering of response codes and tags, it is semantically identical to the previous snapshot. No route, schema, or response changes.

Build workaround: static web assets in the test project

RC2 adds dotnet-watch browser-tools assets (_framework/Microsoft.NET.Sdk.BlazorWeb.DotNetWatch*) to every Web SDK project. The test project is a Web SDK project that references both Web and Job, so their identical assets collide. The Debug build then fails with "Conflicting assets with the same target path" or "scoped css bundles do not have matching endpoints".

The tests serve wwwroot from the Web content root, through UseSolutionRelativeContentRoot and UseStaticFiles, so the test project now sets StaticWebAssetsEnabled=false. This looks like an SDK regression and can be revisited at GA. EnableHotReloadInRuntimeConfigDevFile=false would also work, but it would turn off C# hot reload as well.

Runtime behavior changes reviewed

• Exact double→decimal conversion (details): (decimal)0.1 is now 0.1000000000000000055511151231. Session durations use this cast (PersistentEventExtensions.UpdateSessionStart). Elasticsearch already stores event values at double precision, and a round trip returns 230.131079, so stored data is unchanged. CloseInactiveSessionsJobTests was relying on the old 15-digit rounding and now compares at the stored double precision.
• Host failures: IHost.RunAsync now throws when a BackgroundService fails. The existing Program.Main catch blocks now log Fatal and exit with code 1 instead of 0.
• APM: ASP.NET Core adds OpenTelemetry semantic-convention HTTP tags. 5xx http.server.request.duration gains error.type, and Activity.StatusDescription is no longer set for unhandled exceptions. Dashboards or alerts keyed on those may need adjusting.
• Kestrel now enforces stricter protocol compliance for conflicting Content-Length/Transfer-Encoding and HTTP/2 connection headers. Low risk behind the ingress.
• Containers: the sdk:11.0.100-rc.2 and aspnet:11.0.0-rc.2 images are Ubuntu 26.04 and still run as root on port 8080. NodeSource setup_22.x works there. The all-in-one image installs the RC2 runtime on the Ubuntu 24.04 Elasticsearch base, where libicu74 is still correct and the x64/arm64 payloads resolve. .NET 11 requires x86-64-v2 on x64.

Verification

dotnet restore Exceptionless.slnx
dotnet build Exceptionless.slnx                      # Debug, exercises the static web assets workaround
dotnet build Exceptionless.slnx --configuration Release
dotnet test --project tests/Exceptionless.Tests -c Release --no-build
dotnet list Exceptionless.slnx package --vulnerable --include-transitive
dotnet build build/EmailTemplatePreviews.cs
docker build --target job .
docker build --target api .

The full app and all-in-one exceptionless Docker targets were not built locally. CI's Docker job covers them.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T02:06:03.746052Z	00a3508	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[niemyjski]

we should be able to get rid of this now

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.AppHost	23%	23%	128	❌
Exceptionless.Core	77%	69%	10895	✔
Exceptionless.Insulation	51%	43%	370	➖
Exceptionless.Web	86%	71%	9183	✔
Summary	80% (28152 / 35119)	69% (13905 / 20148)	20576	✔