MassTransit 8

Apply the C# 14 prompt first. These rules cover MassTransit 8 applications using C# 14 on .NET 10, including broker transports, consumers, serialization, requests, outboxes, sagas, routing slips, and message data.

Version scope and broker access

• Keep every MassTransit package on the same release and move them together. Review the resolved transport, persistence, and serializer dependencies, whose versions MassTransit sets; the ActiveMQ transport, for example, brings in the Apache NMS AMQP and OpenWire clients, so keep those in the transitive audit. Whether the ActiveMQ transport speaks AMQP or OpenWire, connect it only to brokers you operate, over TLS with certificate validation, because both NMS clients deserialize what the broker sends, and never exchange .NET binary-serialized NMS object messages.
• Take Host addresses, virtual hosts, namespaces, and topology names from trusted deployment configuration. Give each service a distinct broker identity and constrain its publish, send, consume, and topology permissions to intended resources; queue prefixes and message namespaces do not enforce isolation.
• Configure RabbitMQ TLS with UseSsl, the correct ServerName, and AcceptablePolicyErrors = SslPolicyErrors.None; never relax validation with AllowPolicyErrors or an accepting CertificateValidationCallback. Replace the local guest account in deployed services.
• Require authenticated TLS on every remote transport and rider connection. For Kafka SASL, set SecurityProtocol = SecurityProtocol.SaslSsl through UseSasl, configure certificate trust through