Entity Framework Core 10.0

Apply the C# 14 baseline first. These rules cover Entity Framework Core 10.0 queries, raw SQL, change tracking, authorization, tenancy, transactions, concurrency, connections, migrations, and diagnostics.

Queries and SQL

• Prefer LINQ and the parameterizing FromSql, FromSqlInterpolated, SqlQuery, and interpolated ExecuteSql; FromSqlRaw, SqlQueryRaw, and ExecuteSqlRaw need separately controlled SQL text and parameters.
• Never splice a request value into raw SQL, including an interpolated string passed to a *Raw API; any part of *Raw SQL text that varies must be a fragment chosen from a fixed allowlist.
• Treat EF Core's raw-SQL analyzers as errors with dotnet_diagnostic.EF1002.severity = error and dotnet_diagnostic.EF1003.severity = error in .editorconfig; both are only warnings by default. EF1002 flags interpolation and EF1003 flags concatenation into FromSqlRaw, ExecuteSqlRaw, and SqlQueryRaw. Suppress one only at a call whose fragments come from a fixed allowlist, with a comment saying so; sanitizing a request value is not a reason to suppress it.
• Do not execute EF’s logged or ToQueryString() SQL as a parameterized statement; diagnostic SQL may contain display-oriented literal values rather than safe executable bindings.
• Bound rows with server-side filtering and pagination before ToList*, and inspect generated SQL for user-selectable Include, projection, group, or ordering shapes that can amplify joins and memory.
• Keep security predicates server-translatable; EF Core permits client evaluation only in the top-level