Who contributed to .NET on July 18, 2026?

8 developers shipped this update, including Javier Calvarro Nelson, Copilot, MayaKirova, ilonatommy, Rolf Bjarne Kvinge, simonrozsival, Redth, and PureWeen.

What were the notable .NET updates?

Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765), Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere, and [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861).

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

By RepoJournal · Filed 07:01 UTC on July 18, 2026 · About .NET

8 people shipped this

Javier Calvarro Nelson @javiercn 2 cited

Rolf Bjarne Kvinge @rolfbjarne 2 cited

Copilot @Copilot 1 cited

simonrozsival @simonrozsival 1 cited

PureWeen @PureWeen 1 cited

MayaKirova @MayaKirova

ilonatommy @ilonatommy

Redth @Redth

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

In brief

ASP.NET Core now lets you attach AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere in your app, not just on endpoints. Cleaner declarative security across the board.
Blazor's deprecating UseWebAssemblyDebugging and ripping it out of the templates. The old bridge debugger's done. Browser dev tools handle it now.
macios fixed GC-safety issues in a handful of APIs. The kind of thing that rarely breaks in the field but absolutely matters if you're running with aggressive GC.
macios Runtime.Arch optimization is now a trimmer feature switch. Cleaner separation of concerns and faster trimming decisions at build time.

Authorization metadata handling finally converges across ASP.NET Core. Until now, only AuthorizationMiddleware honored all three kinds of authorization metadata - IAuthorizeData attributes, raw AuthorizationPolicy instances, and IAuthorizationRequirementData [1] [2]. MVC's AuthorizeFilter and other decision points ignored the latter two, creating silent gaps that let unauthorized code through. This patch unifies the model so custom authorization requirements work everywhere you'd expect them to work. On the Blazor side, UseWebAssemblyDebugging ships deprecated [3], with templates no longer emitting it by default. The tooling team flagged this as unnecessary friction for modern debugging workflows. Across the iOS bindings layer, GC-safety fixes land in macios after the HandleSafety test caught hand-written methods that freed objects before native calls completed [4]. The linker work converts Runtime.Arch optimizations to trimmer feature switches instead of IL rewrites [5], letting the trimmer fold dead branches naturally rather than through custom code. Android's trimmable typemap now emits XA4212 diagnostics for custom IJavaObject types that aren't properly rooted [6], closing a gap where the Cecil scanner missed them on the NativeAOT path. MAUI's infrastructure work hardens CI-fix automation and routes AI-agent labels more precisely [7].

Action items

→ Review ASP.NET Core authorization metadata behavior in custom filters and middleware - verify all three metadata types are honored dotnet/aspnetcore [plan]
→ Remove UseWebAssemblyDebugging calls from Blazor templates before next template baseline update dotnet/aspnetcore [plan]
→ Test GC.KeepAlive fixes in macios bindings if you maintain custom iOS interop code dotnet/macios [monitor]
→ Enable AndroidEnableAssemblyStoreDecompressionCache=true in Android release builds to benchmark assembly decompression caching gains dotnet/android [monitor]

References

[1] Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765) dotnet/aspnetcore
[2] Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere ↗ dotnet/aspnetcore
[3] [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861) dotnet/aspnetcore
[4] [src] Fix GC-safety issues in a number of APIs. (#26147) dotnet/macios
[5] [linker] Convert the Runtime.Arch optimization to a trimmer feature switch. Fixes #26106. ↗ dotnet/macios
[6] [TrimmableTypeMap] Emit XA4212 for custom IJavaObject types on the trimmable path ↗ dotnet/android
[7] Agentic-labeler: route AI-agent and platform labels correctly ↗ dotnet/maui

Quick answers

What shipped in .NET on July 18, 2026?: Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook. In total, 27 commits and 31 pull requests landed.
Who contributed to .NET on July 18, 2026?: 8 developers shipped this update, including Javier Calvarro Nelson, Copilot, MayaKirova, ilonatommy, Rolf Bjarne Kvinge, simonrozsival, Redth, and PureWeen.
What were the notable .NET updates?: Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765), Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere, and [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861).

CLANGSHARP CLOSES THE C++ AST GAP, MACIOS SHIPS XCODE 26.6 SUPPORT

ClangSharp landed the native bridges and managed API expansion needed to faithfully parse real-world C++ headers, while .NET for macOS is now Xcode 26.6 ready.

dotnet 85 shipped 2-min read

@dotnet 3 days ago

MATH.ROUND BUG CORRUPTS 5% OF INPUTS. EVENTPIPE LOSES HEAP DATA. SQLCLIENT GOES ASYNC

Runtime shipped a critical fix for Math.Round that was silently mangling roughly 5% of all rounding operations across the BCL, while EventPipe's data loss is finally getting a blocking mode to save your GC dumps.

dotnet 78 shipped 1-min read

@dotnet 4 days ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

@dotnet 5 days ago

ASPNETCORE VALIDATION GENERATOR FIXED, MSBUILD SYNCS ROSLYN AND NUGET

ASP.NET Core's validation source generator now correctly unwraps array types, closing a gap that could slip validation past your models.

dotnet 6 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 6 hours ago

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

infra 43 shipped 1-min read

Elixir & Phoenix about 6 hours ago

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

elixir 16 shipped 1-min read

@spring-projects about 6 hours ago

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.