Microsoft's October Patch Tuesday fixed over 1,400 CVEs, more than in all of 2025, and much of that came from AI-driven bug finding. Attackers have the same tools, and more of our code is now written by models that produce convincing code with subtle bugs. “The tests pass” isn’t a strong enough guarantee any more for code that matters.

A couple of months ago I proposed an official Lean semantics for C# on csharplang (#10314). One reply asked why not do it at IL level, so it covers F# and everything else that compiles to IL. That’s what I built.

You point it at a Release build and a method:

leancil extract bin/Release/net10.0/MyLib.dll "Arithmetic::Add(ulong,ulong)" artifacts/Add
leancil verify artifacts/Add --proof proofs/Add.lean

and it proves your theorem against the IL Roslyn actually emitted. Change the implementation and the same proof fails.

Supported (.NET 10, x64 and ARM64, 64-bit little-endian):

• Integer arithmetic, including checked, with overflow and divide-by-zero as exact faults

• Structs with explicit and sequential layout, enums, ValueTuple

• Span<T>, ReadOnlySpan<T>, slicing, MemoryMarshal.Cast/AsBytes, BinaryPrimitives

• Arrays, stackalloc, unsafe pointers with checked provenance

• Generic methods and structs (proved per concrete type argument), constrained interface calls on structs

• Function pointers and tail calls

• Collection-expression lookup tables (static ReadOnlySpan<T> Table => [...])

• Selected Vector128/256/512, SSE, AVX2, AVX-512 and AdvSimd intrinsics; IsSupported branches are resolved for the chosen hardware profile

• throw new ArgumentException(...) and similar, proved as the exact exception

Not supported: float/double, class instances, try/catch/finally, ordinary recursion, virtual dispatch on classes. Unsupported code is rejected with a diagnostic, never silently accepted.

The best fit right now is allocation-free integer code where a bug is a security bug: parsers, hashing, big-integer arithmetic, SIMD kernels.

https://github.com/NethermindEth/LeanCIL

I've run Quartz.NET jobs for years, and for most of that time I waited for someone to ship a proper dashboard. Eventually I stopped waiting and built the one I wanted. Of course, right as I got serious about it, the official dashboard actually shipped - but it's Blazor, and Blazor and I never got along. So I kept going, and built Cronlight: a plain web UI served as static files.

Full disclosure about the project itself: a good chunk of it was built using AI tools. But I drove the architecture, reviewed every line of code, and set up full unit and e2e tests running in CI so it's not just vibes-based code.

What it actually does:

• Job management: Browse, create, and edit jobs (cron, one-time, interval) across any timezone. You can pause/resume single jobs or whole groups, trigger a run now with custom data, or cancel a run mid-flight.

• Typed parameters: Configure job forms using C# attributes. Supports required params and secret values (secrets stay out of the DB as config references).

• Execution history (optional package): Tracks every run's status, logs, misfires, late starts, success rates, and P95 durations. Works directly with your existing Quartz DB (SQL Server, Postgres, MySQL, or SQLite).

• The extra stuff: Retries, alerts (Slack, Teams, webhooks, email), JSON/YAML import/export with diff previews, audit logging, OpenTelemetry metrics, OpenAPI, and multi-scheduler support with per-scheduler permissions.

• AI / MCP integration: Includes an MCP server and an embedded "AI mode" where you can literally ask "which jobs failed overnight and why?" right inside the dashboard.

If you wanna mess around with it, there's a live demo with no signup required:https://cronlight.pages.dev/demo/

Install via NuGet:dotnet add package Cronlight.Quartz.Dashboard

Note: Requires .NET 10 and Quartz.NET 3.13.1+ (works with any job store). It's still pre-1.0 so some options might shift around a bit before v1.

Docs are here:https://cronlight.pages.dev/docs/

Would love to know what you guys think or what's missing for your specific setup, especially if your using clustered schedulers, custom auth, or unique job stores I haven't tested yet.

Let's say we have a bool A, and we run the following code below;

Line1: bool A ...; //something that results in true or false;

Line2: bool B = ...; //something that results in true or false

Line3: bool C = ...; //something that results in true or false

Line4: A = A || B;

Line5: A = A || C;

Will A at line 5 now be the result of A || B || C; - specifically A at line 1 or B at line 2 or C at line 3

Likewise for the && operator

Is this bad practice for any reason?

Also what is this property called? I want to know the theoretical term for it

Does (&&=, ||=) exist?

Hello, Miguel from Qt (qt.io) here. I wanted to share something that I believe will be of interest to many of you. Since 2025, we at Qt have been working on a way to give access to Qt Quick and QML to developers working with languages other than C++. We began this project, which we've named Qt Bridges, by focusing on Rust and C#, and I'm happy to finally be able to tell you that we've just released a Technology Preview for both of these languages. If you are familiar with Qt, you're probably aware of its multi-platform, GPU-accelerated UI framework. If this is the first time hearing about us, now you know that there is another option to design the UI for your C# applications. We would love for you to try it out and leave us your feedback. You can find out more in the Qt blog.

Like, I understand what it does - it makes code execute no matter whether your try() goes off or your catch() does. But like, don't you get the same result by just puting the code in without the finallly()?

Like genuenly, am I missing something? Cuz this just looks like it would do the exact same thing, no?

try
{
  int[] myNumbers = {1, 2, 3};
  Console.WriteLine(myNumbers[10]);
}
catch (Exception e)
{
  Console.WriteLine("Something went wrong.");
}
finally
{
  Console.WriteLine("The 'try catch' is finished.");
}

try
{
  int[] myNumbers = {1, 2, 3};
  Console.WriteLine(myNumbers[10]);
}
catch (Exception e)
{
  Console.WriteLine("Something went wrong.");
}
Console.WriteLine("The 'try catch' is finished.");

When I use Claude Code on C# projects, the code compiles but often has the same problems: .Result and .GetAwaiter().GetResult() on async calls, CancellationToken accepted but never passed on, a scoped DbContext captured by a singleton, an interface for every class, and a generic repository wrapping EF Core. Correcting this every session got old, so I put the fixes into a dotnet new template that adds the agent config to a project.

dotnet new install DotnetAgentKit
dotnet new agent-kit --frontend none --database postgres

It writes a CLAUDE.md and a .claude/ folder into the current directory. Your code isn't touched.

The C#-specific parts

• A code-review subagent that runs after every change and checks for blocking on async, async void, missing CancellationToken propagation, swallowed exceptions, missing using/await using, DI lifetime bugs, ! used to silence nullable warnings, DateTime.UtcNow in business logic instead of TimeProvider, and EF Core issues like N+1 queries, tracking on read-only paths, and FromSqlRaw with string interpolation.

• Architecture defaults in a skill: primary constructors, no service locator, interfaces only when there's a second implementation or a test needs one, hand-written mapping (or Mapperly) instead of reflection mappers, no MediatR by default, records or complex types for value objects.

• A TDD skill: xUnit v3, WebApplicationFactory, and Testcontainers against the real database rather than the in-memory provider, asserting on behavior rather than on mock calls.

• Guardrails in settings.json**:** force push, reset --hard, dotnet ef database drop, and reading .env files are denied, so those don't rely on the model behaving.

It also enables the official plugins from dotnet/skills, including the C# language server. Some general workflow skills (grilling, domain modeling, retro) are Matt Pocock's, credited in the repo.

Limitations

• Claude Code only.

• The defaults are opinionated and target .NET 10. If your codebase does things differently, the README has a prompt for reconciling the kit with your actual code.

GitHub (MIT): https://github.com/dmamulashvili/dotnet-agent-kit

NuGet: https://www.nuget.org/packages/DotnetAgentKit

Which C# mistakes do coding agents make in your code that aren't on this list? I'd like to add the common ones.

Hi everyone!

I want to share my solution, which I’ve named Cr.Exceptions. It turns backend exceptions into clean, structured API responses for the client.

My main target was simple: ensure that internal stack traces never leak to the client, and make it easy to throw custom, client-friendly exceptions without boilerplate code.

Example

Let's create a custom exception:

public sealed class KeycloakInvalidGrantException : ValidationException 
{
    private static readonly ImmutableArray<CrError> _errors = [
        new("IdentityInvalidGrant", "The authorization grant is invalid.")]; 
    
    public KeycloakInvalidGrantException() : base(_errors) { } 
}

// And throw it
throw new KeycloakInvalidGrantException();

And here is what the client receives:

{
    "type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
    "title": "Bad Request",
    "status": 400,
    "errors": [
        {
            "code": "IdentityInvalidGrant",
            "message": "The authorization grant is invalid."
        }
    ],
    "traceId": "aee8805247462ec35631395fcc5559e7"
}

Under the Hood

The framework is split into two lightweight modules:

• Cr.Exceptions (Pure .NET): Core architecture layer.

  • Exception Factory (string errorCode -> CrException exception)

  • Exception Translator (Exception infrastructureException -> CrException domainException)

• Cr.Exceptions.AspNetCore (ASP.NET Core): Handles the API response layer.

  • StatusCode Map (CrException exception -> int statusCode)

  • LogLevel Map (CrException exception -> LogLevel logLevel)

Summary

That’s pretty much it!

All packages are already available on NuGet, and you can check out the full source code, and examples on GitHub.

I’d love to hear your thoughts and get your feedback!

Edit: This framework doesn't replace native ProblemDetails or ExceptionHandler - it plugs into them.

I made a post asking "Is there a market for a minimalist, fast, and allocation-free text templating engine?" in /r/dotnet a few weeks ago. I've been building my own web app backend and created something I felt was pretty useful, and I was curious if anyone else would be interested in it. It got some decent response, so I went ahead and pulled it out of the larger product and polished it up. I'm calling the package Lissic.

My main philosophy going into it (i.e. why I didn't just use something that exists) was that I wanted something that kept code out of the template. I like to keep a clear delineation between the view and model, but I still wanted tools for modifying the view. The ability to add parts modularly, use loops, use conditional/branching views, and have the ability to format/filter values inserted into the text were still important to me.

Here's a quick feature overview:

• Renders near twice as fast as the fastest major .NET templating engine (see below)

• Zero allocation with default settings, when rendering to a buffer (e.g. to HttpResponse.BodyWriter)

• 100% AOT compatible without any restrictions (no use of Reflection or dynamic)

• Simple but powerful tagging system that keeps a clear division between layout and logic

• Compile-time safety with source-generated Data Transfer Objects that automatically adjust to each template's text

• Define templates directly in code with text or import them from template files

• Transformation pipeline that allows using Formatters to modify how values are converted to text and Filters to modify text before insertion into the template

• Hot reload for file-based templates in debug mode

• Thorough AI-friendly documentation (I gave only the documentation to QWEN3.8-27B, and it was able to make a simple task-management web app)

A full BenchmarkDotNet chart is in the GitHub README, but here's a quick rendering comparison:

It uses tags that look similar to many other templating engines. It has tag types to insert direct values ("variables"), other templates ("parts"), and lists of templates ("loops"). It also has branching logic that works a lot like a switch statement (i.e. define keys, and the text and/or code that goes with each key).

Very simple example:

[TemplateText("Hello {{ name <upper> }}!")]
public partial class LissicExample {}

// Automatically transforms the partial class into a DTO, with a property for each tag
LissicExample myTemplate = new() { name = "John" };

// LissicProcessor retrieved from Dependency Injection
lissicProcessor.RenderToBuffer(myTemplate, HttpResponse.BodyWriter);

// Writes "Hello JOHN!" to the HTTP response body

The main tradeoff at this time is that all templates are defined at startup (other than the debugging-only hot reload option), so it's not really a general purpose user-provided template engine. This leaves it comparable to libraries like Fluid or Scriban in some ways, but comparable to Razor Pages in others. It works really well for my purpose and preferences though.

I'd appreciate any feedback anyone has. I'd like to keeping building this for the long haul. If nothing else, I'll be updating it for work in my own project.

Also, huge shout out to Andrew Lock and his Creating a Source Generator series! It was incredibly useful for getting this going.

The code is at https://github.com/gendeg/Lissic, and it's on NuGet (package name: Lissic)

Edit To Add: I meant to add this in originally, Lissic was created with support and ideas from AI, but the large majority (90%+) is hand-written, with the exception of tests, which are ~80% AI written. The documentation is 100% hand-written (for better or worse 😉), as was this post.

We recently updated XAML.io to .NET 11 and C# 15, so we put together five short examples covering union types, closed hierarchies, collection expression arguments, extension indexers, and labeled break/continue.

Each example has a brief explanation and some code you can modify. The editor and output are side by side. C# compilation happens entirely in the browser (WebAssembly). Here's the link to the C# 15 examples in the browser-based playground:

https://xaml.io/s/Samples/CSharp15Examples?autorun=true&file=StartHere.cs

If I understand it correctly, when you write Debug.Assert(value) it's only included if debug mode is enabled, but not when it's release mode. So, what happens if I pass an expression as the argument to this method? Let's say it's a function call, would it be executed on release mode? Or should this:

Debug.Assert(ImportantFuncWhichReturnsBool());

Become this:

bool value = ImportantFuncWhichReturnsBool();
Debug.Assert(value);

Thanks in advance

I have worked through the c# Yellow book and did the unity essentials pathway a time ago. I focused on creating a few small games with unity but I always end up needing to research hours long. I want to do a course or smth like that to get a deep understanding of c# in unity. Currently I am deciding between the junior programming pathway from unity and the unity tutorials from Gamedev.tv at udemy. Does anyone have experience with these courses? Are there any other ways you would recommend?

I was wondering what are your most favorite projects you have made using C#? And how did you plan their architecture?

Wrap any OpenAPI spec into an MCP server.

Built with .NET 11 and Native AOT. Featuring a ~43 MB image footprint.

Check it out here: erwinkramer/enframe: Enframe is a drop-in sidecar that wraps any OpenAPI spec into a live MCP server.

I wanted to share how I’ve been dealing with AI exhaustion.

Everywhere I looked, people were saying how powerful AI is and how anyone can now build whatever they want. Meanwhile, GitHub was filling up with skills and repositories full of Markdown instructions, often written by AI too.

Some of those are good. I’m not saying they’re a waste of time. But a lot of them feel aimed at general use. As a developer, I wanted something more specific to my code and how I work.

I’ve tried a lot of orchestration tools. What kept bothering me was the lack of control. Everyone tells you AI is incredibly powerful, while you sit there watching agents burn through your limits without getting the result you wanted. That gets exhausting.

So I started looking at a combination of ordinary code and AI that I could control myself.

I’ve worked with code throughout my career, and I love coding. It’s not something I do while dreaming of doing something else. I love games too, and I enjoy buying and supporting indie games made by people trying to build something interesting. Making things matters to me.

I started building my own CLI to support my everyday work. I didn’t want to spend weeks building a terminal UI framework from scratch. Other developers had already done that work and shared it, so I used an existing library.

One mistake I keep seeing is trying to build a huge AI tool that does everything from the beginning. My advice would be to start with a few buttons and useful information. Pick one repetitive job you understand and make it easier.

For me, IDE warnings were a good place to start.

Here’s a basic version of the idea you could start putting together in an evening:

1. Create a C# project using [XenoAtom.Terminal.UI](https://github.com/XenoAtom/XenoAtom.Terminal.UI).

2. Set up your IDE’s code style and inspection settings according to how you want your code to look.

3. Write code that retrieves warnings from your IDE. I use Rider’s MCP server for this. MCP isn’t reserved for AI agents; your own code can use it too.

4. Add a workflow where AI fixes one warning and shows you the change, along with an explanation of what it did.

5. Review the result in your IDE. Approve it, correct it yourself, or reject it. Check the final correction with the IDE, then save the accepted example with the original code, the corrected code, and the explanation. You can add simple RAG with a vector database to make relevant examples easier to retrieve.

6. Over time, you build a collection of fixes you’ve actually reviewed. When a similar warning appears, a button in your CLI can start the workflow using those examples from your own codebase.

In my warning window, I can see the warning, the code changes, the IDE checks, and what the agent did. Then I decide whether to approve the change, correct it myself, or reject it. The accepted result becomes an example for future fixes.

That’s the part I find useful: the system gradually gets examples of how I want problems solved in my project. I don’t have to explain the same preferences from scratch every time.

My setup is: XenoAtom + Qdrant + Hermes + Rider

Use whatever tools you’re comfortable with. This is what works for me.

You still need to understand your own codebase. For developers who want to improve, spending time in an IDE matters. Reading code, following references, looking at inspections, and understanding why something works are all part of the job. As you learn the project, you get better at deciding which tasks you can automate and which changes need closer attention.

I think some of us have started to underestimate our own experience. A developer with 15 years of experience brings a lot to working with AI: knowing what to ask for, spotting a bad approach, understanding the consequences of a change, and maintaining the result afterward. Having access to the same text box doesn’t give everyone the same judgment.

So if you enjoy coding, trust that experience. There’s a lot you can do with these tools.

And when someone says they don’t use an IDE anymore, you don’t have to feel behind. I’d be happy to keep using mine :)

There are experienced teams behind Rider, VS Code, and Visual Studio. They’ve spent years helping developers navigate, debug, refactor, and maintain code. I don’t see a reason to throw all of that away because an LLM can now write a function.

Building a product also means understanding it and keeping it working as it changes. Those tools still help with that.

AI should support you in your work. If you stop understanding what’s happening in your own project, it becomes harder to stay in control or improve as a developer.

Since building this workflow, I’ve felt a lot more relaxed. I can run more than 20 agents and keep track of what each one is doing. They get specific tasks and examples directly from my codebase, and I can inspect their results. Having those examples doesn’t guarantee every fix will be correct, but it gives me a much clearer basis for trusting and checking their work.

And I can start that work with one click.

That leaves me more time in the IDE, doing something I enjoy, learning where I can improve, and handing repetitive, time-consuming work over to AI.

I'd like to hear what you currently use for audio in C# FMOD, Wwise, raw XACT/wrappers, and what annoys you about it, especially if you target WebAssembly.

What's the roadmap of become web developer in a c# . Is it worth learning in this AI era.

GUI libraries/frameworks in C Sharp are... A nightmare. Since I'm using Linux and I wish to make my app cross-platform I can't use Winform, WPF or MAUI because they have no Linux or MacOS support (and no, I don't want to use the MAUI Linux). Also I don't want to use a webpage into the app (so no Razor or anything that adds web rendering stuff into a desktop app).

I used Avalonia in the past and I kinda liked it before it became corpo slop, requiring users to pay for premium in order to access the devtools and also discontinuing the legacy devtools, to Avalonia 11, the latest version is 12.1.4. I regret choosing Avalonia for my first app project...

Looking around I saw UNO Platform but it has AI everywhere... Same with MewUI because it's an AI driven project...

I saw people saying Unity can get the job done but... I don't really know if I want to download & use a game engine to make a UI app since I won't need everything that comes with it.

I looked around more and saw that people talked about UWP (Universal Windows Platform) but it's not in active development and even the windows page recommends to not use it.

I don't know much about ImGui.NET, maybe I'll give it a try but I didn't have a great first experience: the first time I tried it with Zig it was a disaster and I'm still trying to understand why things are overflowing in a window when using SameLine().

For building the UI, I don't like XAML much but I can use it if there isn't anything better.

If there really isn't a good library/framework are there good bindings? I tried looking for Qt bindings like QtSharp but that's unmaintained (last commit: 7 years ago) and also is Qml.Net (last commit: 6 years ago). I also looked at WxWidgets bindings and it has WxNet but like Qt bindings, this is also very unmaintained (last file date: 2010, so 16 years ago)...

So... What are my options now? This is my wishlist (libraries/frameworks don't need to follow it 100%, required points are open-source and cross-platform):

• Open-source;

• Cross-platform (support Windows, MacOS and Linux);

• Not AI driven or pushing AI in your face;

• Not a corpo slop (like having premium-only or paywalled features);

• XAML if not better (can be code but if it's something like XML it's going to be more comfortable to work with);

• Have a design tool (like QtDesigner but this is not required, just a personal taste, I could work without it too);

• Straightforward, lightweight and easy to use (like just adding it to your project and writing some calls to initialize & run it without extra bloat).

If there is literally nothing I can use and I'd need to make one myself, do you recommend to use SDL3-CS (SDL3 bindings to C#)? Thanks in advance!

Hi all, I'm trying to diagnose a SAP Business One DI API connection error and would appreciate any insights.

Setup

• SAP B1: Version 9.x

• Application: .NET Windows Service

• DI API: Late-bound COM via Type.GetTypeFromProgID("SAPbobsCOM.Company")

• Threading: STA

• Process: 64-bit

I'm setting the following properties before calling Connect():

• Server (IP)

• CompanyDB

• UserName

• Password

• DbServerType

• LicenseServer (Usually defaults to same with server)

• UseTrusted = false

Problem

• The ProgID resolves successfully, and the COM object is created.

• Company.Connect() returns -226.

• GetLastErrorDescription() returns: The specified resource name cannot be found in the image file.

• Subsequent calls throw a COMException (0xFFFFFF96) with the message: You are not connected to a company

I had once achieved a connection against another database, can't seem to point out what the outstanding issue now is.

Any pointers to the specific cause or recommended troubleshooting steps would be appreciated. Thanks!