.NET 11 Released, Critical Vite Dev Server Bug, Gemini 4 Carbon: Developer News for November 11, 2026

Submitted by jaypabs on Wednesday, November 11, 2026 - 11:32.

Wednesday's news is a big one for C# developers: .NET 11 is officially out. Also in this roundup: a critical Vite dev server bug that can lead to remote code execution, a record-sized Microsoft Patch Tuesday, Google's Gemini 4 Carbon arriving for developers and in GitHub Copilot, a cross-browser "web guidance" package for coding agents, and a Dependabot change that may quietly switch off alerts on your old repositories. Here is the plain-English version for November 11, 2026 (Manila time), with a link to every original source.

Version numbers, counts and dates below come from the linked announcements. Where two sources count things differently, both numbers are shown.

1. .NET 11 and C# 15 Are Released

Microsoft announced the release of .NET 11 on November 10 at the start of .NET Conf 2026. It is a Standard Term Support (STS) release with two years of support, while .NET 10 remains the current Long Term Support option. Highlights from the announcement:

C# 15 adds union types and closed hierarchies, so you can describe all the possible states of a value and let the compiler check that your pattern matching handles every case.
A Native AOT CLI host and a warm MSBuild server to make everyday dotnet commands feel faster.
ASP.NET Core gets asynchronous validation, OpenAPI 3.2, and new features for Blazor and SignalR.
.NET MAUI now uses CoreCLR as its default runtime.
The base libraries add built-in Zstandard compression, simpler process execution and richer JSON support.
For AI work, Microsoft points to Microsoft.Extensions.AI, MCP support and the Microsoft Agent Framework.

JetBrains shipped Rider 2026.3 the same day with day-one .NET 11 and C# 15 support, including support for debugging the new runtime async feature.

Should you upgrade? If you are learning C# or building a school project, either .NET 10 (LTS) or .NET 11 is fine. For a system you will maintain for years, many teams stay on the LTS release. If you want to brush up on the basics first, our C# async and await tutorial works on .NET 6 and newer.

2. Critical Vite Bug: Do Not Expose Your Dev Server to the Network

The Vite team published a critical advisory (GHSA-p4f5-76q4-ffq7) on November 10. By sending an HTTP request to the Vite dev server, an attacker could get arbitrary code executed, because two internal virtual modules embedded part of the URL without escaping it.

Only apps that explicitly expose the dev server to the network are affected, for example with vite --host or the server.host option. That is common when testing a site on your phone over Wi-Fi, or when running Vite inside a container. Patched versions are 8.3.7, 8.2.5, 8.1.7, 7.3.8 and 6.4.6 (and vite-plus 1.5.1). Affected ranges go all the way back to Vite 4.0.0.

What to do: run npm ls vite in each front-end project, update to a patched version, and avoid using --host on public or shared networks. Remember that Vite comes bundled inside many starters for React, Vue and Svelte, so check even if you never installed it by name.

3. November Patch Tuesday: Microsoft, Adobe and More

This month's Patch Tuesday is enormous. BleepingComputer counts 1,235 flaws fixed by Microsoft, including 66 rated Critical and one actively exploited Outlook spoofing zero-day that was used to steal NTLM account hashes: opening a crafted message file could make Outlook connect to an attacker's server without the usual external-content warning. The Zero Day Initiative's review counts about 1,090 new CVEs, a reminder that totals depend on how you count. Either way, the release covers Windows, Office, Exchange, Azure, and also .NET and Visual Studio.

Adobe fixed about 110 vulnerabilities across nine products, with critical issues in Adobe Connect and Experience Manager; Adobe says it is not aware of attacks using them.

What to do: run Windows Update on your development machine, update Visual Studio through the Visual Studio Installer, and restart. If you manage computer labs, schedule the updates before the next class day.

4. Gemini 4 Carbon Is Available for Developers and in Copilot

Google made Gemini 4 Carbon available to developers on November 10, describing it as its strongest model for long, multi-step agent work and cybersecurity tasks. It is available on the paid tier of the Gemini API in Google AI Studio and in Android Studio, and Google AI Ultra subscribers can try it in AI Studio and Google Antigravity.

On the same day GitHub said Gemini 4 Carbon is generally available in GitHub Copilot for Copilot Pro+, Max, Business and Enterprise users, selectable in the model picker in VS Code, Visual Studio, JetBrains IDEs, Xcode, Eclipse, Copilot CLI, github.com and GitHub Mobile. The rollout is gradual, so it may not appear for everyone yet.

5. Chrome's Modern Web Guidance 1.0 Teaches Coding Agents Better Web Code

The Chrome team released Modern Web Guidance version 1.0, a set of "skills" you install into your project so AI coding agents follow current web best practices for performance, accessibility, security and browser compatibility. Version 1.0 adds a modernization workflow that scans existing HTML, CSS, JavaScript and package.json for safe upgrade opportunities, and every guide now gets human expert review. Importantly, it is becoming a cross-browser project, with Firefox and Edge joining Chrome. You can install it with:

npx modern-web-guidance@latest install

It is worth a look if you use an AI assistant for front-end work and keep getting outdated patterns back.

6. Dependabot Alerts Will Pause on Inactive Repositories from December 8

GitHub announced that starting December 8, 2026, it will turn off Dependabot alerts on most repositories with no activity in the past year. Existing alerts are archived, not deleted. Any push to any branch or tag turns alerts back on automatically, and you can also re-enable them in the repository settings. Repositories with an enforced security configuration that enables Dependabot alerts are not affected.

Why it matters: an old capstone project or portfolio site that is still deployed somewhere can still have vulnerable dependencies. If a repository powers something live, push a small update or turn alerts on manually so you keep getting warnings.

7. Releases to Watch This Week

Node.js security releases for the 26.x, 24.x and 22.x lines are scheduled for "on or shortly after" Wednesday, November 11, each with at least one HIGH severity fix. End-of-life lines such as 20.x and 25.x will not get fixes.
Python 3.16.0 alpha 2 is now available for testing, with more expressive regular expressions (nested character sets and set operations), faster startup, and C implementations of uuid4() and uuid7(). It is a preview, not for production.
PHP 8.6.0 is still planned for 19 November 2026. Linuxcompatible reports that a small RC6 with four fixes was tagged on November 10.
Rust 1.100.0 is in pre-release testing, with the stable release scheduled for November 12.

Quick Checklist

Update Vite in every front-end project and stop exposing the dev server with --host on shared networks.
Install this month's Windows, Office and Visual Studio updates.
Plan your Node.js update once the new 26.x, 24.x and 22.x releases are published.
Check which of your live projects sit in repositories with no pushes in the past year, before December 8.
Try .NET 11 on a side project, but keep long-lived systems on the LTS release if you prefer stability.

That is the roundup for today. Most items are quick to act on, so pick the one that affects your projects most and finish it today.

Search