Document breaking change: AsnEncodedData.RawData setter obsoleted (SYSLIB0065) in .NET 11

docs/core/compatibility/11.md

@@ -39,6 +39,7 @@ See [Breaking changes in ASP.NET Core 11](/aspnet/core/breaking-changes/11/overv
 
 | Title                                                          | Type of change    |
 |----------------------------------------------------------------|-------------------|
+| [AsnEncodedData.RawData setter is obsolete](cryptography/11/asnencodeddata-rawdata-setter-obsolete.md) | Source incompatible |
 | [DSA removed from macOS](cryptography/11/dsa-removed-macos.md) | Behavioral change |
 
 <!--

docs/core/compatibility/cryptography/11/asnencodeddata-rawdata-setter-obsolete.md

@@ -0,0 +1,77 @@
+---
+title: "Breaking change: AsnEncodedData.RawData setter is obsolete"
+description: "Learn about the breaking change in .NET 11 where the AsnEncodedData.RawData property setter is marked obsolete."
+ms.date: 07/05/2026
+ai-usage: ai-assisted
+---
+
+# AsnEncodedData.RawData setter is obsolete
+
+Starting in .NET 11 Preview 6, the `set` accessor of <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=nameWithType> is marked obsolete. Using the setter generates compiler warning `SYSLIB0065`.
+
+## Version introduced
+
+.NET 11 Preview 6
+
+## Previous behavior
+
+Previously, you could set the <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=nameWithType> property without a compilation warning. For example:
+
+```csharp
+X509BasicConstraintsExtension decoded = new();
+decoded.RawData = extension.RawData;
+Console.WriteLine(decoded.CertificateAuthority); // Unexpectedly prints False
+```
+
+## New behavior
+
+Starting in .NET 11, setting the <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=nameWithType> property generates compiler warning `SYSLIB0065`.
+
+## Type of breaking change
+
+This change can affect [source compatibility](../../categories.md#source-compatibility).
+
+## Reason for change
+
+<xref:System.Security.Cryptography.AsnEncodedData> represents an ASN.1-encoded object. Many types derive from it, such as <xref:System.Security.Cryptography.X509Certificates.X509BasicConstraintsExtension>, and these derived types accept the ASN.1 encoding as constructor arguments and decode it. The decoded representation is cached so that property access doesn't repeatedly decode the ASN.1.
+
+Because `RawData` has a setter and is not `virtual`, setting it on a derived instance causes a discrepancy between the decoded state and the underlying data. The derived type can't detect that the raw data changed, so it continues to return stale decoded values. For example:
+
+```csharp
+X509BasicConstraintsExtension extension = new(
+    certificateAuthority: true,
+    hasPathLengthConstraint: true,
+    pathLengthConstraint: 3,
+    critical: true);
+
+X509BasicConstraintsExtension decoded = new();
+decoded.RawData = extension.RawData;
+Console.WriteLine(decoded.CertificateAuthority);      // Unexpectedly prints False
+Console.WriteLine(decoded.HasPathLengthConstraint);   // Unexpectedly prints False
+Console.WriteLine(decoded.PathLengthConstraint);      // Unexpectedly prints 0
+```
+
+## Recommended action
+
+To maintain coherency between the decoded state and the underlying data, use the constructor of the appropriate type to decode data. Treat instances as read-only—construct a new instance instead of reusing an existing one.
+
+```csharp
+// Instead of setting RawData, construct a new instance.
+X509BasicConstraintsExtension decoded = new(extension, extension.Critical);
+```
+
+If you need mutable behavior, use <xref:System.Security.Cryptography.AsnEncodedData.CopyFrom(System.Security.Cryptography.AsnEncodedData)?displayProperty=nameWithType>. The `CopyFrom` method is `virtual`, so derived types can invalidate their decoded state when the raw data changes.
+
+To suppress the `SYSLIB0065` warning if you need to keep using the setter, add a suppression in code:
+
+```csharp
+#pragma warning disable SYSLIB0065
+decoded.RawData = extension.RawData;
+#pragma warning restore SYSLIB0065
+```
+
+For more information, see [SYSLIB0065](../../../../fundamentals/syslib-diagnostics/syslib0065.md).
+
+## Affected APIs
+
+- `set` accessor of <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=fullName>

docs/core/compatibility/toc.yml

@@ -36,6 +36,8 @@ items:
                 href: core-libraries/11/ziparchive-createasync-eager-load.md
           - name: Cryptography
             items:
+              - name: AsnEncodedData.RawData setter is obsolete
+                href: cryptography/11/asnencodeddata-rawdata-setter-obsolete.md
               - name: DSA removed from macOS
                 href: cryptography/11/dsa-removed-macos.md
           - name: Extensions

docs/fundamentals/syslib-diagnostics/obsoletions-overview.md

@@ -88,6 +88,7 @@ The following table lists the `SYSLIB0XXX` obsoletions in .NET 5+.
 | [SYSLIB0061](syslib0061.md) | Warning | The `Queryable` <xref:System.Linq.Queryable.MaxBy``2(System.Linq.IQueryable{``0},System.Linq.Expressions.Expression{System.Func{``0,``1}},System.Collections.Generic.IComparer{``0})?displayProperty=nameWithType> and <xref:System.Linq.Queryable.MinBy``2(System.Linq.IQueryable{``0},System.Linq.Expressions.Expression{System.Func{``0,``1}},System.Collections.Generic.IComparer{``0})?displayProperty=nameWithType> taking an `IComparer<TSource>` are obsolete. Use the new ones that take an `IComparer<TKey>`. |
 | [SYSLIB0062](syslib0062.md) | Warning | <xref:System.Xml.Xsl.XsltSettings.EnableScript?displayProperty=nameWithType> is obsolete. |
 | [SYSLIB0064](syslib0064.md) | Warning | <xref:System.Security.Cryptography.RSACryptoServiceProvider.Encrypt(System.Byte[],System.Boolean)?displayProperty=nameWithType> and <xref:System.Security.Cryptography.RSACryptoServiceProvider.Decrypt(System.Byte[],System.Boolean)?displayProperty=nameWithType> are obsolete. Use the overloads that accept an <xref:System.Security.Cryptography.RSAEncryptionPadding> instead. |
+| [SYSLIB0065](syslib0065.md) | Warning | The `set` accessor of <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=nameWithType> is obsolete. Use the constructor of the appropriate type to decode data, or use <xref:System.Security.Cryptography.AsnEncodedData.CopyFrom(System.Security.Cryptography.AsnEncodedData)?displayProperty=nameWithType> for mutable scenarios. |
 
 ## EXTOBS obsoletions
 

docs/fundamentals/syslib-diagnostics/syslib0065.md

@@ -0,0 +1,73 @@
+---
+title: SYSLIB0065 warning - AsnEncodedData.RawData setter is obsolete
+description: Learn about the obsoletion of the AsnEncodedData.RawData property setter. Use of this setter generates compile-time warning SYSLIB0065.
+ms.date: 07/05/2026
+ai-usage: ai-assisted
+f1_keywords:
+  - SYSLIB0065
+---
+
+# SYSLIB0065: AsnEncodedData.RawData setter is obsolete
+
+Starting in .NET 11, the `set` accessor of <xref:System.Security.Cryptography.AsnEncodedData.RawData?displayProperty=nameWithType> is obsolete. Setting this property in code generates warning `SYSLIB0065` at compile time.
+
+## Reason for obsoletion
+
+<xref:System.Security.Cryptography.AsnEncodedData> represents an ASN.1-encoded object. Many types derive from it, such as <xref:System.Security.Cryptography.X509Certificates.X509BasicConstraintsExtension>, and cache their decoded representation so that property access doesn't repeatedly decode the ASN.1.
+
+Because `RawData` is not `virtual`, setting it on a derived instance causes a discrepancy between the cached decoded state and the new raw data. The derived type can't detect that the raw data changed, so it continues to return stale decoded values. For example:
+
+```csharp
+X509BasicConstraintsExtension extension = new(
+    certificateAuthority: true,
+    hasPathLengthConstraint: true,
+    pathLengthConstraint: 3,
+    critical: true);
+
+X509BasicConstraintsExtension decoded = new();
+decoded.RawData = extension.RawData;
+Console.WriteLine(decoded.CertificateAuthority);      // Unexpectedly prints False
+Console.WriteLine(decoded.HasPathLengthConstraint);   // Unexpectedly prints False
+Console.WriteLine(decoded.PathLengthConstraint);      // Unexpectedly prints 0
+```
+
+## Workaround
+
+To maintain coherency between the decoded state and the underlying data, use the constructor of the appropriate type to decode data. Treat instances as read-only—construct a new instance instead of reusing an existing one.
+
+```csharp
+// Instead of setting RawData, use the constructor.
+X509BasicConstraintsExtension decoded = new(extension, extension.Critical);
+```
+
+If you need mutable behavior, use <xref:System.Security.Cryptography.AsnEncodedData.CopyFrom(System.Security.Cryptography.AsnEncodedData)?displayProperty=nameWithType>. The `CopyFrom` method is `virtual`, so derived types can invalidate their decoded state when the raw data changes.
+
+## Suppress a warning
+
+If you must use the obsolete setter, you can suppress the warning in code or in your project file.
+
+To suppress only a single violation, add preprocessor directives to your source file to disable and then re-enable the warning.
+
+```csharp
+// Disable the warning.
+#pragma warning disable SYSLIB0065
+
+// Code that uses obsolete API.
+// ...
+
+// Re-enable the warning.
+#pragma warning restore SYSLIB0065
+```
+
+To suppress all `SYSLIB0065` warnings in your project, add a `<NoWarn>` property to your project file.
+
+```xml
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+   ...
+   <NoWarn>$(NoWarn);SYSLIB0065</NoWarn>
+  </PropertyGroup>
+</Project>
+```
+
+For more information, see [Suppress warnings](obsoletions-overview.md#suppress-warnings).

docs/navigate/tools-diagnostics/toc.yml

@@ -4093,6 +4093,8 @@ items:
             href: ../../fundamentals/syslib-diagnostics/syslib0062.md
           - name: SYSLIB0064
             href: ../../fundamentals/syslib-diagnostics/syslib0064.md
+          - name: SYSLIB0065
+            href: ../../fundamentals/syslib-diagnostics/syslib0065.md
       - name: Experimental features
         items:
           - name: Overview