What to do when .NET 10 warns about packages you never installed

On net10.0, NuGet Audit checks the packages your packages pulled in, so a build that was clean on net9.0 can warn about Newtonsoft.Json 12.0.1 you never added. Find the parent with dotnet nuget why and update it, or pin a fixed version directly. dotnet package update --vulnerable does the pin, not the parent bump. Delete the references NU1510 points at, and fail CI on high and critical advisories.

Stop System.Text.Json from accepting the same JSON property twice

Send the same property twice in one JSON body and System.Text.Json keeps the last copy, with a 200 and no warning. Anything that read the body first and kept a different copy is now acting on a different value. .NET 10 added AllowDuplicateProperties, which defaults to true, and one line turns the rejection on.

Angular's HttpClient only sends the XSRF header to its own origin

Angular copies the XSRF-TOKEN cookie into an X-XSRF-TOKEN header for every request to the page's own origin except GET and HEAD, and for nothing else. An app on app.example.com calling api.example.com sends no header at all, so the antiforgery check answers 400 — and renaming the cookie does not help.

ASP.NET Core does not block HTML in a form post, and Quill sends plenty

ASP.NET MVC 5 answered a form post containing markup with a 'potentially dangerous value' error, and a generation of .NET developers learned to expect the framework to be watching. ASP.NET Core dropped that check on purpose. The markup binds, gets stored, and comes back out on the next reader's page the moment a view renders it raw — unless something on the server cleans it against an allowlist first, which is a line you write yourself.

Why your API still redirects to login in .NET 10

In .NET 10 a cookie-authenticated app answers an anonymous API request with 401 instead of redirecting to the login page — but only for the endpoints ASP.NET Core recognises as API endpoints, and that recognition comes from metadata it adds automatically for some shapes and not others. TypedResults.Ok answers 401. Results.Ok, behind the same policy with the same JSON body, still answers 302.