Who contributed to .NET on May 26, 2026?

3 developers shipped this update, including barosiak, dotnet-maestro[bot], and davidwengier.

What were the notable .NET updates?

Fix GCHandle leak in OSX SafeDeleteSslContext (#128325), [cDAC] Implement IsExceptionObject for cDAC, and Make Async Profiler tests compatible with single threaded runtime. (#127762).

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

MEMORY LEAK IN MACOS SSL CONTEXT THREATENS PRODUCTION DEPLOYMENTS

By RepoJournal · Filed 06:04 UTC on May 26, 2026 · About .NET

3 people shipped this

dotnet-maestro[bot] @dotnet-maestro[bot] 3 cited

barosiak @barosiak 1 cited

davidwengier @davidwengier 1 cited

A critical GCHandle leak in SafeDeleteSslContext on macOS has been silently draining handle table slots on every SSL connection, and the fix races with native callbacks in ways that demand immediate attention.

The runtime team shipped an emergency fix [1] for a GCHandle allocation that was never freed in the legacy macOS SecureTransport path, leaking one handle slot per SSL context. This is not theoretical: the team reproduced it as a reliable crash in SslStream tests. The fix itself carries risk because it races with in-flight Read/Write native callbacks, which means you need to test thoroughly before shipping to production. In parallel, the cDAC work continues to mature [2], with IsExceptionObject now properly walking method table hierarchies and validating against the legacy DAC. The async profiler test suite got hardened [3] to work on single-threaded WASM platforms by splitting multithreaded tests from basic ones and fixing Native AOT missing native IP issues. Across the dotnet ecosystem, codeflow PRs continue rolling in from aspnetcore [4], sourcelink [5], and efcore [6], keeping main synchronized. The Roslyn team tackled Razor integration test failures [7] by fixing DartLab deployment to use main VS installation instead of RoslynDev hive, eliminating file clashes and simplifying hive checks.

Action items

→ Test the macOS SafeDeleteSslContext fix [ref:1] against your SSL workloads before production deploy dotnet/runtime [immediate]
→ Review async profiler test changes [ref:5] if you run WASM or Native AOT builds dotnet/runtime [plan]
→ Monitor codeflow PRs from main [ref:6] [ref:7] [ref:10] for breaking changes in your dependencies dotnet/dotnet [monitor]

References

[1] Fix GCHandle leak in OSX SafeDeleteSslContext (#128325) dotnet/runtime
[2] [cDAC] Implement IsExceptionObject for cDAC ↗ dotnet/runtime
[3] Make Async Profiler tests compatible with single threaded runtime. (#127762) dotnet/runtime
[4] [main] Source code updates from dotnet/aspnetcore ↗ dotnet/dotnet
[5] [main] Source code updates from dotnet/sourcelink ↗ dotnet/dotnet
[6] [main] Source code updates from dotnet/efcore ↗ dotnet/dotnet
[7] Fix Razor integration tests in DartLab ↗ dotnet/roslyn

Quick answers

What shipped in .NET on May 26, 2026?: A critical GCHandle leak in SafeDeleteSslContext on macOS has been silently draining handle table slots on every SSL connection, and the fix races with native callbacks in ways that demand immediate attention. In total, 23 commits and 20 pull requests landed.
Who contributed to .NET on May 26, 2026?: 3 developers shipped this update, including barosiak, dotnet-maestro[bot], and davidwengier.
What were the notable .NET updates?: Fix GCHandle leak in OSX SafeDeleteSslContext (#128325), [cDAC] Implement IsExceptionObject for cDAC, and Make Async Profiler tests compatible with single threaded runtime. (#127762).

RUNTIME FIXES KERBEROS FALLBACK ON UNIX, APPHOST CONVERTS TO C

The managed SPNEGO implementation now falls back to NTLM when Kerberos credentials go missing on Linux, closing a critical auth gap that broke enterprise deployments [ref:1].

dotnet 120 shipped 1-min read

@dotnet 1 day ago

MACIOS DOCS OVERHAUL SPANS 31 TYPES, ASPNETCORE VALIDATION MOVES TO SOURCE GENERATION

Rolf Bjarne shipped 31 types with proper XML documentation across macios while aspnetcore refactors validation classes out of the public API entirely.

dotnet 25 shipped 1-min read

@dotnet 2 days ago

SQLCLIENT KILLS PLATFORM-SPECIFIC BUILDS, ASPNETCORE HARDENS SIGNALR

SqlClient unified its Windows and Unix code paths without restructuring the NuGet package, collapsing build complexity across the entire SNI layer.

dotnet 97 shipped 2-min read

@dotnet 3 days ago

COMPLEX NUMBERS NOW IEEE 754 COMPLIANT, SKILLS EVALS GO VALLY-ONLY, UNSAFE EVOLVES

Complex<T> just shipped conformance to C23 Annex G special values, dotnet/skills completed its migration to the Vally eval harness, and the language is tightening unsafe semantics ahead of C# 13.

dotnet 141 shipped 2-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.