What's new this week: Avalonia, .NET, Visual Basic, and the Microsoft choices that hit developers

This is a weekly roundup of Avalonia, VB.NET, C#, and anything Microsoft does that I think has some validity to a working developer. This week I pulled some Xbox and Windows items in alongside the dev-tooling news because I think they signal a shift in the internal Microsoft thinking about how far they can push their customers.

Window for this edition: 2026-04-16 through 2026-04-30. The filter is simple. Would this change what a working developer does on Monday morning. Anything that fails that test got cut.

This week's triage

If you do nothing else this week, do these three things.

1. Install .NET 10.0.7 (or take Visual Studio 2026 18.5.2, which rolls in the same fix). CVE-2026-40372 in Microsoft.AspNetCore.DataProtection is an elevation-of-privilege bug in the cookie and auth-token crypto plumbing of every ASP.NET Core app. Non-optional if you ship anything public.
2. Audit Azure Pipelines builds for axios npm 1.14.1 and 0.30.4. The malicious versions were briefly published 2026-03-31; Microsoft released remediation guidance this week. Check your lockfiles and Defender for DevOps alerts.
3. If you run Copilot code review on private repos, set an Actions budget now. The June 1 cutover converts review minutes to billable Actions usage and the first weeks of June will catch unprepared shops with surprise bills.

Detail on each below.

Avalonia

The headline is a stability drop. Avalonia 12.0.2 shipped on 2026-04-28. Worth the upgrade if you are already on 12.0.0 or 12.0.1, because two of the fixes are real-world hits rather than typo cleanup. The macOS Metal renderer leaks memory until you patch, and the TabControl crashes when a user rapidly switches tabs during a transition animation. Android targets get the surface-destroy crash fixed and the back-press handler corrected for API 33 and up. Linux and ARM users get nothing platform-specific in this drop. If you are on 11.3.x the upgrade is not urgent.

Release notes: https://github.com/AvaloniaUI/Avalonia/releases/tag/12.0.2

The more interesting story is the third-party ecosystem catching up to 12.x. Two theme libraries shipped 12-compatible versions in the window. Material.Avalonia 3.16.0 on 2026-04-24 lights up the new WindowDrawnDecorations story on the Material chrome side, adds a GroupBox control, and fixes an Android PART_Indicator not found issue on the TextBox. Semi.Avalonia 12.0.1 on 2026-04-18 tracks Avalonia 12.0.1 with a ColorPicker refactor and TabbedPage layout fixes. Semi also shipped 11.3.14 the same day for shops still on the 11 line.

No FluentAvalonia release in the window. The repo had an AppWindow v3 PR merged and reverted on 2026-04-26, which is one to watch but does not need action yet.

The pace of 12.x stabilization and the speed of the third-party catch-up is downstream of the Devolutions sponsorship announced in 2025, when Devolutions committed roughly 3 million dollars to the open-source side of Avalonia. That money is now visibly buying release velocity.

No Avalonia blog post in the window. The most recent one was the 12.0 launch announcement on 2026-04-07. AvaloniaRider (the JetBrains plugin) is still on v1.11.0 from 2026-03-07. The Avalonia for VS Code Essentials extension hit GA on 2026-04-06, just outside the window, and is one to install if you missed it because it is the first time the VS Code path is plausible for non-trivial Avalonia work.

From where I sit: I am still on 11.x for my own Avalonia work and have not started into the 12.x changes yet. The line looks promising and the third-party catch-up is real, but I am not migrating live apps to 12.x without testing. If you are running 11.3.x in production, this week's drops do not change that calculus.

.NET

Two anchor items this week: a security patch you need to install today, and a Linux distribution story that quietly changes how .NET ships on the platform.

Security: .NET 10.0.7 out-of-band update

.NET 10.0.7 dropped on 2026-04-21 as an out-of-band security release fixing CVE-2026-40372. The bug is in Microsoft.AspNetCore.DataProtection. The managed authenticated encryptor was computing HMAC over the wrong bytes, which is an elevation-of-privilege vulnerability in the cookie and auth-token crypto plumbing of every ASP.NET Core app. In practice this means an attacker who can manipulate a Data Protection payload may be able to bypass the HMAC verification step and forge values that ASP.NET Core normally treats as tamper-evident: authentication cookies, anti-forgery tokens, OIDC state blobs, TempData, and any custom protected blobs in your own code. If you ship anything that hits the public internet, patch is non-optional. Visual Studio 2026 18.5.2 (released 2026-04-28) rolls in the same fix at the IDE level, so taking the VS update gets the runtime patch on the dev machine at the same time. Notice: https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/

Patch Tuesday on 2026-04-14, just outside the window, pushed 10.0.6, 9.0.15, and 8.0.26 servicing builds plus the monthly fixes for CVE-2026-26171, CVE-2026-32178, and CVE-2026-32203. Most shops are reconciling those at the same time as the 10.0.7 OOB.

Distribution: Ubuntu 26.04 LTS launches with .NET 10 in the archive

Ubuntu 26.04 LTS "Resolute Raccoon" launched on 2026-04-23 with .NET 10 built in. This is the day-one launch parity that previous Ubuntu LTS releases did not achieve. 22.04 and 24.04 each needed post-launch package work to get usable .NET in the archive; 26.04 ships with .NET 10 GA-ready on day one. Richard Lander's launch post calls it the deepest Microsoft and Canonical collaboration yet, and notes that the .NET runtime repo may be one of the largest users of Ubuntu 26.04 container images on the day the distribution went GA. apt install dotnet-sdk-10.0 against the standard Ubuntu archive now gets you a Microsoft-supported runtime. No PPA, no Microsoft package feed, no packages-microsoft-prod.deb ritual. .NET is one of Ubuntu's officially supported toolchains alongside Go, Rust, and the rest, and Microsoft validates every PR in dotnet/runtime against Ubuntu 26.04 in CI.

Container images use the resolute tag and slot into Dockerfiles by replacing noble. The Native AOT package (dotnet-sdk-aot-10.0) ships in the same archive: a hello-world AOT binary lands at 1.4 MB and starts in 3 ms, and a self-contained ASP.NET Core service with source-generated System.Text.Json comes in around 13 MB. .NET 8 and 9 are available via the dotnet-backports PPA on a best-effort basis, and .NET 11 will join it at GA. For shops shipping .NET on ARM Linux this is the cleanest distribution story Microsoft and Canonical have ever produced. Post: https://devblogs.microsoft.com/dotnet/whats-new-for-dotnet-in-ubuntu-2604/

Language: C# union types arrive in preview

The biggest C# language story of the year landed in .NET 11 Preview 3. C# is finally getting first-class discriminated unions with exhaustive pattern matching. The syntax, from the official "Explore union types in C# 15" devblog:

public record class Cat(string Name);
public record class Dog(string Name);
public record class Bird(string Name);

public union Pet(Cat, Dog, Bird);

string name = pet switch
{
    Dog d => d.Name,
    Cat c => c.Name,
    Bird b => b.Name,
};

The union keyword declares a closed type whose value is exactly one of the listed cases. The compiler lowers it to a record struct and treats the switch as exhaustive. No discard arm needed.

These are tagged unions, like F# discriminated unions or Rust enums, not TypeScript-style anonymous structural unions. The case is a known type tag and the compiler enforces exhaustiveness over the closed set. Microsoft explicitly calls out three prior workarounds the new syntax replaces: object (no constraint), marker interfaces or abstract base classes (not closed, anyone can extend), and forcing unrelated types under a shared ancestor. In community practice this is also where OneOf<T1,T2,T3> from NuGet and sealed-hierarchy + visitor patterns lived. Those become legacy.

Production-readiness signals: preview only. You opt in with <LangVersion>preview</LangVersion>. The base class library is incomplete, so UnionAttribute and IUnion must currently be hand-declared because the runtime types have not shipped. The devblog notes that "some features from the full proposal specification aren't yet implemented, including union member providers." Editor support landed in VS 2026 Insiders 11709.129. The spec is in dotnet/csharplang/proposals/unions.md and is still moving.

Why this matters: every C# codebase that models "one of these shapes" has been carrying a OneOf workaround or a sealed-hierarchy ceremony for a decade. This kills the workaround and makes the language honest about the pattern.

Devblog: https://devblogs.microsoft.com/dotnet/csharp-15-union-types/

The rest

.NET 11 Preview 3 dropped on 2026-04-14. Beyond the union-type work above, ASP.NET Core picks up Zstandard request and response compression alongside Brotli and gzip, HTTP/3 starts processing requests earlier in the pipeline, and Microsoft is signing container images. Announcement: https://devblogs.microsoft.com/dotnet/dotnet-11-preview-3/

Other items from the .NET blog cluster on 2026-04-28 and 2026-04-29: scan but skip the deep reads. SkiaSharp 4.0 Preview 1 is now co-maintained by Uno. VSTest is dropping its Newtonsoft.Json dependency in .NET 11 and Visual Studio 18.8, which matters if you own test infrastructure.

Quiet week from the working-developer .NET bloggers. Nothing verifiable in the window from Andrew Lock, Steve Gordon, or Khalid Abuhakmeh. Often a sign that everyone is heads-down on Build prep.

Visual Basic

We all know Microsoft wants VB to just go away, but the reality is there are still many of us who built lots of apps on the ecosystem, and we still love it. So this section will run every week, and most weeks the honest report is going to be that nothing happened. This is one of those weeks.

The dotnet/vblang repo had zero commits, zero new issues, and zero new PRs in the window. Two old issues got drive-by community comments on 2026-04-17, but nothing from a Microsoft employee. The most recent commit on main is still 2024-12-17, when Aleksey Tsingauz at Microsoft updated Language-Version-History.md to document VB recognising the C# Overload Resolution Priority attribute on consumed APIs. That is parity-with-C# behaviour for code VB is calling, not a new VB feature. It is consistent with the long-term-stability message Microsoft has been giving since 2020. Last meaningful activity baseline: https://github.com/dotnet/vblang/pull/629

The VB compiler bits inside dotnet/roslyn had one window-period touch on Microsoft.CodeAnalysis.VisualBasic.Workspaces. It was a dependency version bump in the codeflow PR that keeps the .NET monorepo aligned. Not a code change.

Nothing on VB in the .NET 10.0.7 OOB notes or in the wider .NET blog cluster. Nothing material on the VBA side from the Microsoft 365 dev blog. The VBScript-deprecation story from May 2024 is still rolling forward and remains on the watch list if you maintain Office VBA, but no fresh announcement this week.

That is the honest week. The interesting question is what "stability mode" means in practice when no commits land for four months. The compiler still gets servicing inside Roslyn, but the language repo is effectively in archive mode, and that is the news you can get only by checking the repo yourself. Now you do not have to.

The closest thing to in-window VB content is Robert Skibbe's "Is Visual Basic Dead?" post on robbelroot.de, originally published 2026-04-09 and revised 2026-04-17. Skibbe is a German freelance .NET developer with 17 years in VB.NET and C#, and his answer matches the data here: the language is in maintenance mode, Microsoft will not add new language features, the ecosystem (Blazor, MAUI, Minimal APIs, source generators) is C#-only, but real demand for VB.NET maintenance work still exists. He runs a pie chart of his own incoming project requests by language and VB.NET still pulls a meaningful share of his .NET work, almost entirely from companies with 10-to-15-year-old WinForms or WPF codebases that still generate revenue.

His blunt observation: "Most VB.NET developers I encounter are 50+ years old and many operate at a hobbyist skill level," which is not a dig at the language so much as a description of who the remaining users are. His advice for new learners is C# without question, but he is honest that VB.NET got him into the field at age 13 and the syntax-fluency transfer to C# is straightforward. Worth reading if you want a working developer's view that lines up with the empty-repo data above. https://robbelroot.de/blog/is-visual-basic-dead/

Microsoft choices that affect developers

Visual Studio 2026

The April Update (18.5.0) shipped on 2026-04-14, just outside the window, and the servicing children landed in scope.

• 18.5.1 (2026-04-21): F# code-quotation issue (FS045) fixed. Copilot model-thinking UI added.
• 18.5.2 (2026-04-28): the one to install. Top fix is keyboard input becoming unresponsive after Find in Files, the kind of paper-cut that costs an afternoon. Also fixes a 64-bit C++ codegen bug for switch(*optional) and rolls in the .NET 10.0.7 OOB so the ASP.NET Core EoP is patched at the IDE level.
• 18.4.4 (2026-04-14): if you are still pinned to the LTSC channel, this is the mandatory security roll-up. CVE-2026-26171 (.NET DoS), CVE-2026-32178 (.NET spoofing), CVE-2025-6965 (SQLite), CVE-2026-32631 (MinGit NTLM leak). 18.4.4 is the floor.

The April Update also flipped a longstanding completion-system conflict: IntelliSense now takes priority over Copilot inline completions, so when the IntelliSense list is open Copilot suppresses itself and you see one suggestion at a time. Default-on, no setting to flip. This is the kind of "stop fighting your tools" change that should have shipped two years ago.

Release notes: https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes

VS Code 1.118

VS Code 1.118 shipped on 2026-04-29. The release is overwhelmingly Copilot-shaped (agent experience, codebase search and context, token efficiency, chat history, sandboxing), but three non-Copilot items are worth flagging. TypeScript 7.0 beta support is now in the box, so you can opt a project into the next-major TS line before it ships. Dev Container lockfiles for Features are enabled by default, which fixes a class of "works on my machine" issues for anyone using devcontainers. And large local resources in webviews now load faster, which matters if you author or use VS Code extensions with heavy embedded UI. Nothing breaks for non-Copilot users. Safe upgrade.

Release notes: https://code.visualstudio.com/updates/v1_118

GitHub Copilot moves to usage-based billing

GitHub Copilot is moving to usage-based billing on 2026-06-01. This is the structural change of the week. Premium request units (PRUs) are being replaced by GitHub AI Credits, with credits consumed against per-token API rates that vary by model. Seat prices stay the same: Pro is $10/month, Pro+ is $39/month, Business is $19/user/month, Enterprise is $39/user/month. Each paid tier includes a monthly stipend of credits matching the seat price (Business $19, Pro+/Enterprise $39). Once the stipend is gone, the meter starts.

New signups for Pro, Pro+, and student plans were paused on 2026-04-20 ahead of the cutover. A preview-bill experience is launching in early May so admins can see projected costs before the meter actually turns on. The Anthropic comparison the developer press is making is fair: Microsoft has watched Anthropic ship usage-based billing on Claude, watched the margin model work, and is now copying the structure on Copilot. The community read is "you will get less but pay the same price." Announcement: https://github.blog/news-insights/company-news/github-copilot-is-moving-to-usage-based-billing/

The same shift touches code review. Copilot code review starts consuming Actions minutes on private repos on the same June 1 cutover. Public repos remain free. If you run a small shop with private repos and Copilot review enabled, set an Actions budget now. Changelog: https://github.blog/changelog/2026-04-27-github-copilot-code-review-will-start-consuming-github-actions-minutes-on-june-1-2026

Two smaller GitHub items in the window. A 2026-04-24 advance notice that GitHub App installation tokens are getting a new format, so audit any homegrown regex or length checks for App tokens. The 2026-04-23 Pull Requests dashboard moved to opt-out public preview, which means it becomes your default landing page across more than one repo unless you actively turn it off.

Windows tooling

Servicing drops in the window:

• WSL 2.8.4 (2026-04-24): devicehost DLL update for proper device support.
• WSL 2.8.3 (2026-04-24): reusable virtiofs shares, plan9 fix.
• WSL 2.7.3 (2026-04-25): LTS-channel servicing.
• winget 1.28.240 stable (2026-04-17): the one for production boxes.
• winget 1.29.140-preview (2026-04-16).
• Windows Terminal Preview 1.25.1171.0 (2026-04-28): bug-fix only, no matching Stable drop, which is unusual.
• PowerShell 7.6.1, 7.5.6, and 7.4.15 (2026-04-21): coordinated triple servicing drop.
• PowerShell 7.7.0-preview.1 (2026-04-28).

.NET MAUI

.NET MAUI shipped 10.0.60 SR6 and 10.0.50 S5 on 2026-04-29. Standard servicing.

Claude lands in Microsoft 365 Copilot

On 2026-04-16 Microsoft announced Claude Opus 4.7 is available today in M365 Copilot, specifically in the Copilot Cowork Frontier program, Copilot Studio early-release environments, and rolling out to Copilot in Excel. This is an extension of the original integration announced 2025-09-24, when Microsoft expanded M365 Copilot's model lineup to include Anthropic's Claude alongside OpenAI's. The Researcher agent and Copilot Studio were the first surfaces; the April 16 expansion adds Opus 4.7 as the latest model and adds Excel as a new surface. Anthropic models are hosted outside Microsoft-managed environments and are subject to Anthropic's Terms of Service, which the M365 admin needs to opt into.

For a working .NET developer this is the practical change buried inside this week's OpenAI-restructuring news. Claude is now reachable inside Microsoft's premier AI product line, so if you build Office automation, Copilot extensions, or Graph integrations, the model picker is no longer a single-vendor question.

Today's announcement: https://techcommunity.microsoft.com/blog/microsoft365copilotblog/available-today-anthropic-claude-opus-4-7-in-microsoft-365-copilot/4511666. Foundation post (Sept 2025): https://www.microsoft.com/en-us/microsoft-365/blog/2025/09/24/expanding-model-choice-in-microsoft-365-copilot/

Azure

Four items a working developer should know about in the window, found via the live azure.microsoft.com/blog/feed/ RSS and the per-product devblogs after the headline updates page proved JS-only.

• Axios npm supply-chain compromise, Pipelines guidance (2026-04-24). Microsoft published official Azure Pipelines remediation guidance for the malicious Axios 1.14.1 and 0.30.4 versions briefly published on 2026-03-31 (a hidden dependency contacted attacker C2 on install). Any Pipelines build doing npm install in that window may have hit the bad versions; this is the canonical reference for lockfile audits and Defender for DevOps alerts. https://devblogs.microsoft.com/devops/axios-npm-supply-chain-compromise-guidance-for-azure-pipelines-customers/
• Azure Data Studio is officially retired (2026-04-27). Microsoft published the ADS-to-VS-Code migration walkthrough for the MSSQL extension, marking ADS as fully retired. Anyone still launching ADS for Azure SQL queries is on a dead tool. https://devblogs.microsoft.com/azure-sql/azure-data-studio-is-retired-move-your-azure-sql-workflow-to-vs-code-in-10-minutes/
• Cosmos DB Dynamic Data Masking GA (2026-04-21). DDM for Cosmos DB for NoSQL hit GA, letting you mask sensitive fields at the API level so non-privileged callers see redacted values without app-side projection logic. A small-shop alternative to writing per-role projection code for PII fields in shared collections. https://devblogs.microsoft.com/cosmosdb/general-availability-dynamic-data-masking-for-azure-cosmos-db/
• Azure DevOps MCP Server April update (2026-04-21). April refresh of the public-preview Azure DevOps MCP server, adding tools for Boards and Repos workflows callable from Copilot or other agent clients. A one-person shop can now drive work-item triage and PR scaffolding from VS Code Copilot Chat against an ADO org without writing REST plumbing. https://devblogs.microsoft.com/devops/azure-devops-mcp-server-april-update/

The earlier "Azure feed is broken" complaint stands for the headline updates page, but the per-product devblog feeds and the main Azure blog feed are live and reliable. Lesson learned for the cadence: skip the headline feed, harvest per-product.

Microsoft Build 2026

Confirmed for June 2-3, 2026, San Francisco and online. Block the calendar.

The bigger picture

Three structural items landed in the window that are not strictly developer-tooling news but tell you something about where Microsoft's head is at. This is not an AI blog and the AI angle is not the whole post, but the items below all touch the same nerve.

Xbox

New Xbox CEO Asha Sharma, who took the role in February replacing Phil Spencer, made her first major public moves on 2026-04-21. Game Pass Ultimate dropped from $29.99 to $22.99 per month, PC Game Pass from $16.49 to $13.99, both effective immediately. The trade-off is that future Call of Duty titles will no longer join Game Pass at launch. New CoD entries arrive in the tier "during the following holiday season (about a year later)," while existing CoD titles already in the library stay available. Sharma's memo described Game Pass Ultimate as "too expensive for too many players," which is a remarkable thing to hear from the company that set the price. Two days later on 2026-04-23, in a memo titled "We Are Xbox," Microsoft retired the "Microsoft Gaming" branding and reverted to "Xbox," and pulled the "This is an Xbox" marketing campaign.

Game Pass announcement: https://news.xbox.com/en-us/2026/04/21/xbox-game-pass-update/. Rebrand memo: https://news.xbox.com/en-us/2026/04/23/we-are-xbox/.

Windows 11

Pavan Davuluri, EVP of Windows and Devices, published "Our commitment to Windows quality" on the Windows Insider blog on 2026-03-20, just outside this week's window but driving the in-window media cycle. Microsoft committed to three pillars: performance (lower memory and CPU usage, faster File Explorer, better gaming throughput), reliability (an overhauled update experience that lets users restart or shut down without being forced to install pending updates, plus longer pause windows), and "well-crafted experiences" (taskbar repositioning to left, right, or top is finally coming back). The first wave of changes is rolling through Insider builds across March and April, with deeper architectural work targeted for later in 2026.

Source: https://blogs.windows.com/windows-insider/2026/03/20/our-commitment-to-windows-quality/

OpenAI exclusivity ends

On 2026-04-27 Microsoft and OpenAI publicly restructured the partnership. Microsoft remains OpenAI's "primary cloud partner," but the exclusivity is gone. OpenAI can now ship to AWS, Google Cloud, and any other infrastructure their enterprise customers prefer. Microsoft's license to OpenAI models and products runs through 2032 but is now non-exclusive. The revenue share Microsoft has been collecting from OpenAI continues through 2030 but is now capped, and the AGI-milestone clauses that had been gumming up the legal architecture are gone. Sam Altman's announcement: https://twitter.com/sama/status/2048755148361707946.

This pairs with the M365-Copilot-with-Claude story above: the Anthropic integration is now visibly part of Microsoft's AI strategy, not a side experiment. For developers, the immediate practical change is small. The strategic change is large: the OpenAI-Azure axis that defined Microsoft's AI story since 2023 is no longer the only path.

The cynical read, which is also the accurate one: the profitability push has caught up with them. Microsoft has spent two decades operating like a company that did not need to win the consumer surface, because Azure and the enterprise side were paying the bills. The current investor pressure on AI-segment ROI has pulled the rug. Suddenly the consumer surfaces have to justify themselves on revenue, and the AI surface has to do it without a single-supplier dependency that regulators are circling. "We will lock you out of this so the strategic platform wins" is harder to sell when the strategic platform is also being asked to show a margin this quarter. Game Pass cannot keep climbing if subscribers leave. The Windows 10 migration only works as next year's revenue foundation if user trust comes back, and the trust deficit is what the quality push is trying to close. Copilot's flat-rate ceiling looks artificial when Anthropic's usage-based billing scales better. And the OpenAI exclusivity could not survive a regulatory environment that has been openly hostile to it. All four of these moves have the same pressure behind them.

For a working developer this matters because it is the same pressure that produces the strategy-football pattern on the dev side. Frameworks get launched and walked away from on the same logic. When the consumer and partnership surfaces start pivoting publicly, the developer surfaces are usually pivoting privately, six months ahead of the announcement. Watch Build 2026.

What I'm watching for next week

The 18.5.2 Find-in-Files fix unblocks anyone who installed 18.5.0 in the first week and immediately hit the keyboard hang. I want to know whether the regression hit common Copilot agent flows or only the classic Find dialog, because the bug report mentions "after Find in Files" rather than "during Find in Files."

I also want to find a working Azure feed before the next edition, because skipping a category is a worse signal than reporting that nothing changed. Suggestions welcome.