# What changed in @microsoft/signalr

> 7 changes in @microsoft/signalr 8 to 10 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@microsoft/signalr/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @microsoft/signalr 10

### Behavior and default changes

- Improves the Blazor reconnection experience after the server is restarted. (10.0.2) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v10.0.2)

### Fixes and other changes

- Methods are detached when disconnection is confirmed. (10.0.9) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v10.0.9)

## @microsoft/signalr 9

### Security

- An npm override requires lodash >=4.18.0 to address a CVE. (9.0.16) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v9.0.16)

### Fixes and other changes

- TestHost content root discovery now has a .slnx fallback. (9.0.13) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v9.0.13)

## @microsoft/signalr 8

### Breaking changes

- Cookie authentication now rejects return URLs containing ASCII control characters. (8.0.29) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v8.0.29)

### Fixes and other changes

- The log severity for an unknown proxy is reverted. (8.0.22) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v8.0.22)
- A WINDOWS_UPDATE received on a half-closed or closed stream is now lowered to stream abortion. (8.0.22) — [release notes](https://github.com/dotnet/aspnetcore/releases/tag/v8.0.22)