Who contributed to .NET on July 12, 2026?

4 developers shipped this update, including Šimon Rozsíval, Andy Ayers, Max Charlamb, and Rolf Bjarne Kvinge.

What were the notable .NET updates?

[Android] Respect platform trust manager in SslStream, JIT: always home register params on wasm (#130446), and [runtime] Use SYSTEM_CORELIB_DIRECTORY to locate System.Private.CoreLib.dll (#26009).

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

ANDROID SSL VALIDATION BYPASS PATCHED; WASM JIT ALIGNMENT FIXES BLOCKER

By RepoJournal · Filed 06:59 UTC on July 12, 2026 · About .NET

4 people shipped this

Rolf Bjarne Kvinge @rolfbjarne 3 cited

Šimon Rozsíval @simonrozsival 1 cited

Andy Ayers @AndyAyersMS 1 cited

Max Charlamb @max-charlamb 1 cited

SslStream on Android was ignoring platform certificate pinning entirely, bypassing network_security_config.xml and allowing rejected certificates through.

SslStream bypassed Android's X509TrustManager completely [1], meaning certificate pinning and custom trust anchors were silently ignored while RemoteCertificateValidationCallback always reported success. This is a critical fix for any Xamarin.Android or .NET MAUI app relying on platform security configuration. On the JIT side, a Wasm register parameter fix [2] unblocks the caller-side this-drop issue that was stalling browser workloads, with minimal binary impact (28 bytes across affected contexts). The dotnet/macios team aligned with runtime's new SYSTEM_CORELIB_DIRECTORY property [3], fixing scenarios where coreclr and System.Private.CoreLib.dll aren't colocated. A teardown crash fix [4] resolved intermittent arm/arm64 segfaults in the cDAC GC stress framework that occurred after all verification completed. Separately, macios optimized assembly-preparer to skip preserve/mark steps when trimming is disabled [5], and fixed stale build failure comments lingering on PRs after successful re-runs [6].

Action items

→ If shipping Android: pull SslStream fix immediately and retest certificate pinning scenarios dotnet/runtime [immediate]
→ Monitor Wasm workload PRs for this-drop regressions; blocker is now cleared dotnet/runtime [monitor]
→ If building .NET on macOS/iOS: apply SYSTEM_CORELIB_DIRECTORY alignment to your host config dotnet/macios [plan]

References

[1] [Android] Respect platform trust manager in SslStream ↗ dotnet/runtime
[2] JIT: always home register params on wasm (#130446) dotnet/runtime
[3] [runtime] Use SYSTEM_CORELIB_DIRECTORY to locate System.Private.CoreLib.dll (#26009) dotnet/macios
[4] Fix intermittent teardown crash in the cDAC GC stress framework (#130526) dotnet/runtime
[5] [assembly-preparer] Don't run the preserve/optimize/mark steps when not trimming. (#26014) dotnet/macios
[6] [build] Hide stale build failure comment when a re-run succeeds (#26012) dotnet/macios

Quick answers

What shipped in .NET on July 12, 2026?: SslStream on Android was ignoring platform certificate pinning entirely, bypassing network_security_config.xml and allowing rejected certificates through. In total, 14 commits and 14 pull requests landed.
Who contributed to .NET on July 12, 2026?: 4 developers shipped this update, including Šimon Rozsíval, Andy Ayers, Max Charlamb, and Rolf Bjarne Kvinge.
What were the notable .NET updates?: [Android] Respect platform trust manager in SslStream, JIT: always home register params on wasm (#130446), and [runtime] Use SYSTEM_CORELIB_DIRECTORY to locate System.Private.CoreLib.dll (#26009).

OPERATOR SDK 13.0 BREAKS CONTROLLER ARCHITECTURE, ANDROID TESTS GO LOCAL

The dotnet-operator-sdk ships a major breaking change that fundamentally rewrites how multiple controllers target the same entity, while the Android team closes external test dependencies to fix certificate export failures on macOS.

dotnet 40 shipped 2-min read

@dotnet 2 days ago

MAC CERT STORE BREAKS PROVISIONING, MSBUILD FIXES RACE CONDITION, EFCORE TACKLES NULL MATERIALIZATION

dotnet/performance shipped a file-backed certificate abstraction that finally lets macOS queues rotate credentials without static PFX files, while msbuild Server on Linux just fixed an intermittent race that was silently dropping successful builds.

dotnet 59 shipped 2-min read

@dotnet 3 days ago

FSHARP FIXES MEMORY LEAK IN DEBUG BUILDS, DEVPROXY TIGHTENS THREADING

F# compiler eliminated a process-wide MeterListener accumulation bug that was degrading cache operation performance in DEBUG builds.

dotnet 18 shipped 1-min read

@dotnet 4 days ago

RUNTIME CUTS DEAD CODE, WINFORMS FIXES SENDKEYS PARSING, MAUI TIGHTENS RELEASE TRACKING

The runtime team removed years-old dead code paths while fixing a critical bug in WinForms keyboard input that broke sequential modifier sequences in migrated apps.

dotnet 103 shipped 2-min read

— or follow the whole beat:

Elsewhere on the wire

Elixir & Phoenix about 5 hours ago

ELIXIR CLOSES COMPLETION AND OPERATOR SIGNATURE GAPS

The Elixir team shipped fixes for two long-standing IDE friction points: cursor completion after operators and proper type signatures for the ++ concatenation operator.

elixir 2 shipped 1-min read

Mobile platforms about 5 hours ago

SWIFT TIGHTENS AVAILABILITY DIAGNOSTICS AS FLUTTER TRACKS SKIA UPDATES

Swift's compiler now correctly diagnoses uses of unavailable API members in universally unavailable extensions, closing a gap that let invalid code slip through.

mobile 8 shipped 1-min read

@spring-projects about 5 hours ago

SPRING-AI FIXES SILENT DATA LOSS IN BATCH EMBEDDING STRATEGY

A critical bug in TokenCountBatchingStrategy was dropping duplicate documents during batch processing, silently returning fewer embeddings than requested.

java 9 shipped 1-min read

@rust-lang about 5 hours ago

RUST COMPILER SHRINKS MIR, MIRI ADDS SYSCALL SHIMS

The compiler team landed a 14-PR rollup that cuts mir::Statement size to 40 bytes while the Miri interpreter gains critical Unix syscall coverage with gethostname, poll, and futimens support.

rust 110 shipped 1-min read