.NET 11: where a package waiting period actually applies
A configured waiting period needs a known enforcement point. Connect dependencies, exceptions, and the delivered artifact before using the setting as a trust indicator.
Portekizce okuBy Pentesty
The decision starts before the upgrade
A team delivering billing software through containers may have three different owners: one chooses libraries, another builds the image, and another authorizes publication. Treat those as connected decisions. During an urgent change, the business should know which review was shortened and who accepted responsibility for that decision.
Microsoft currently lists .NET 11 as STS with two years of support and .NET 10 as LTS. .NET 8 and 9 reached end of support on November 10, 2026. A business decision should account for maintenance capacity, dependencies, and the ability to keep up with servicing.
The waiting period has an enforcement boundary
NuGet minimum age filters automatic version selection in supported commands. Explicit version requests take a different path. Ordinary restore does not enforce that age, including for transitive dependencies; floating references can fail with NU1020. This setting therefore does not close every route by which a recent package enters a build.
Before adopting a waiting period, list how each repository receives updates: a human decision, an update tool, or a direct file change. Assign review evidence and an owner to each route. A tool that only restored dependencies should not receive credit in an internal report for an approval nobody examined.
Effective configuration can change too
nuget.config can assign minPublishAgeHours to each source. A higher-priority source definition resets the age to zero if it omits that attribute. Package exceptions cover every version and every source, while a nearer exception list replaces an inherited one. Review the effective result, including exceptions.
Separate a temporary release authorization from a permanent policy change. Record the package, version, business reason, and next review. If a team needs an urgent fix, request a traceable decision for that delivery. Avoid turning one project’s urgency into an indefinite waiver across the organization.
Compare the artifact that will be distributed
For containers, SDK documentation describes fixing SOURCE_DATE_EPOCH so independent publishes with the same inputs produce the same digest. That supports a build comparison. Matching digests establish equality of the compared result; the business still needs a reason to trust the inputs it selected.
Deterministic package guidance addresses nupkg files separately: file timestamps can change the result, and DeterministicTimestamp can fix them. Keep that value with the source and reference package. Package and image comparisons should each identify the artifact that was actually examined.
Define a delivery another team can reconstruct
For a pilot, choose a service with an available owner and a dependency that can be changed in an authorized environment. Give another engineer the approved inputs, configuration, and expected artifact. Ask them to explain differences before expanding the process. The objective is a trust decision that colleagues can challenge using concrete evidence.
The .NET 11 announcement distinguishes stable functionality from experimental Blazor AI components and prerelease AG-UI integration. A final SDK release should not automatically authorize those components for production. Give their evaluation a separate scope and an explicit owner.
For delivery reporting, choose measures that describe decisions: dependency changes with an identified reviewer, exceptions with an expiry date, and completed artifact comparisons. Keep the route used by each change visible. If an urgent delivery did not follow the usual route, show the alternative review for that service and the person who will answer for it during the next maintenance window.
Frequently asked questions
Does minimum age govern every restore?
No. Ordinary restore does not apply this check, including to transitive dependencies; floating references have separately documented behavior.
Does a matching digest prove a package is trustworthy?
The comparison checks the observed artifacts. Provenance, review, and authorized-use decisions still require their own justification.
Should every service migrate immediately?
Plan the transition around dependencies and support. Inventory services, assign owners, and choose a window that permits investigation of operational differences.
How should an urgent exception be handled?
Identify the delivery and reviewer, explain the reason, and schedule reassessment. A temporary business need should have a defined end.
Sources and references
- Microsoft: runtime support
- NuGet: waiting-period limits
- NuGet: sources and exceptions
- Microsoft: container publishing
- NuGet: reproducible packages
- Microsoft: .NET 11 release
Original Pentesty analysis, published November 12, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.