By Microsoft shipped .NET 11 Release Candidate 2 on October 13 with a go-live support license — meaning you can deploy it to production today, not just test it in staging. The headline feature is experimental post-quantum cryptography: composite ML-KEM and HPKE APIs that let you start building harvest-now-decrypt-later protection into your apps before the November GA. Here is what the release actually changes and what to do with it.
The Go-Live License Is Not a Footnote
Microsoft reserves go-live licenses for release candidates they are prepared to stand behind in production. RC2 has it. That is a deliberate signal: if your team has been waiting to test .NET 11 in a real environment, the wait is over. This is also the last RC before GA, so any issues surfacing now feed directly into the November release.
Who should deploy RC2 to production now: greenfield projects, internal tools, and teams actively testing .NET 11 migration paths. Who should still wait for GA: financial transaction systems, anything in a heavily regulated environment, or any codebase where a mid-cycle upgrade requires a formal change management process. For everyone else, RC2 is essentially .NET 11 with a pre-release label.
Post-Quantum Cryptography: The Problem Is Not the Future
Most developers hear “quantum computing” and think 2040. The threat in the post-quantum conversation is not that a quantum computer will crack your TLS session today — it is that adversaries are harvesting your encrypted traffic right now to decrypt it once quantum computing becomes feasible, likely in the mid-2030s. The 2026 Thales Quantum & AI Threat Report found 61 percent of security teams name harvest-now-decrypt-later as their top quantum concern. A White House executive order signed June 2026 gives federal systems until December 31, 2030 to migrate.
.NET 11 RC2 adds two experimental APIs for this:
- Composite ML-KEM — Combines the NIST-standardized ML-KEM key encapsulation (FIPS 203) with classical ECDH in a hybrid. If ML-KEM is broken, classical crypto still protects you. This is the right first move: layer it on, do not rip out RSA overnight.
- HPKE (Hybrid Public Key Encryption) — The emerging standard for hybrid encryption. .NET 11 adds the experimental APIs; the recommendation is X25519MLKEM768 for TLS integration.
These APIs are marked experimental, which means they may change before GA. They are not production-hardened cryptographic building blocks yet — they are the testing ground. Build familiarity with the patterns. The migration window is roughly 5–8 years, but the key exchange layer (where harvest-now-decrypt-later attacks operate) is where you want to move first.
Runtime Async V2: The Improvement You Will Actually Feel
Post-quantum gets the headlines. Runtime Async V2 is what will make you better at your job every day.
The original async/await implementation in .NET compiled async methods into state-machine classes. That produced useful code but ugly stack traces — a three-method async chain could generate 13 frames, most of them state-machine noise. In RC2, the runtime manages async suspension and resumption directly. The same chain produces 5 frames. You see your actual methods, not the machinery behind them.
Beyond debuggability: the runtime now knows which variables are actually live at a suspension point, so it only spills to the heap when necessary. Lower allocations, less GC pressure, better throughput under high concurrency. For microservices handling thousands of requests per second, this is a meaningful baseline improvement, not a micro-optimization.
The Rest of RC2 Worth Knowing
NuGet package-age controls let you set a minimum age before packages can be installed — blocking packages published in the last N days. It is a quiet but effective supply-chain defense against freshly-compromised package versions.
MSBuild wildcard matching is faster, which matters at scale. If your build scans thousands of files on every change, you will notice.
.NET MAUI gets C# UI templates — a first-class alternative to XAML for developers who find XAML’s indirection annoying. Windows Forms adds KioskModeManager for full-screen applications without custom window-management code.
What to Do Now
Three things worth doing this week:
- Install RC2 and test your build — grab it from the official .NET 11 RC2 announcement. The go-live license means this is not a risky experiment.
- Review your key exchange surface — identify where your application does key agreement (TLS handshake configuration, token encryption, API secrets transport). That is where post-quantum migration starts, per the Microsoft post-quantum cryptography guide.
- Do not migrate crypto in production yet — ML-KEM and HPKE are experimental. Use them in test environments. Build the patterns now, ship them at GA.
November is close. RC2 is the dress rehearsal. The teams that run it now will have a much easier November upgrade than those waiting for the GA announcement.
