Who contributed to .NET on July 18, 2026?

8 developers shipped this update, including Javier Calvarro Nelson, Copilot, MayaKirova, ilonatommy, Rolf Bjarne Kvinge, simonrozsival, Redth, and PureWeen.

What were the notable .NET updates?

Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765), Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere, and [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861).

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

By RepoJournal · Filed 07:01 UTC on July 18, 2026 · About .NET

8 people shipped this

Javier Calvarro Nelson @javiercn 2 cited

Rolf Bjarne Kvinge @rolfbjarne 2 cited

Copilot @Copilot 1 cited

simonrozsival @simonrozsival 1 cited

PureWeen @PureWeen 1 cited

MayaKirova @MayaKirova

ilonatommy @ilonatommy

Redth @Redth

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

In brief

ASP.NET Core now lets you attach AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere in your app, not just on endpoints. Cleaner declarative security across the board.
Blazor's deprecating UseWebAssemblyDebugging and ripping it out of the templates. The old bridge debugger's done. Browser dev tools handle it now.
macios fixed GC-safety issues in a handful of APIs. The kind of thing that rarely breaks in the field but absolutely matters if you're running with aggressive GC.
macios Runtime.Arch optimization is now a trimmer feature switch. Cleaner separation of concerns and faster trimming decisions at build time.

Authorization metadata handling finally converges across ASP.NET Core. Until now, only AuthorizationMiddleware honored all three kinds of authorization metadata - IAuthorizeData attributes, raw AuthorizationPolicy instances, and IAuthorizationRequirementData [1] [2]. MVC's AuthorizeFilter and other decision points ignored the latter two, creating silent gaps that let unauthorized code through. This patch unifies the model so custom authorization requirements work everywhere you'd expect them to work. On the Blazor side, UseWebAssemblyDebugging ships deprecated [3], with templates no longer emitting it by default. The tooling team flagged this as unnecessary friction for modern debugging workflows. Across the iOS bindings layer, GC-safety fixes land in macios after the HandleSafety test caught hand-written methods that freed objects before native calls completed [4]. The linker work converts Runtime.Arch optimizations to trimmer feature switches instead of IL rewrites [5], letting the trimmer fold dead branches naturally rather than through custom code. Android's trimmable typemap now emits XA4212 diagnostics for custom IJavaObject types that aren't properly rooted [6], closing a gap where the Cecil scanner missed them on the NativeAOT path. MAUI's infrastructure work hardens CI-fix automation and routes AI-agent labels more precisely [7].

Action items

→ Review ASP.NET Core authorization metadata behavior in custom filters and middleware - verify all three metadata types are honored dotnet/aspnetcore [plan]
→ Remove UseWebAssemblyDebugging calls from Blazor templates before next template baseline update dotnet/aspnetcore [plan]
→ Test GC.KeepAlive fixes in macios bindings if you maintain custom iOS interop code dotnet/macios [monitor]
→ Enable AndroidEnableAssemblyStoreDecompressionCache=true in Android release builds to benchmark assembly decompression caching gains dotnet/android [monitor]

References

[1] Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765) dotnet/aspnetcore
[2] Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere ↗ dotnet/aspnetcore
[3] [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861) dotnet/aspnetcore
[4] [src] Fix GC-safety issues in a number of APIs. (#26147) dotnet/macios
[5] [linker] Convert the Runtime.Arch optimization to a trimmer feature switch. Fixes #26106. ↗ dotnet/macios
[6] [TrimmableTypeMap] Emit XA4212 for custom IJavaObject types on the trimmable path ↗ dotnet/android
[7] Agentic-labeler: route AI-agent and platform labels correctly ↗ dotnet/maui

Quick answers

What shipped in .NET on July 18, 2026?: Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook. In total, 27 commits and 31 pull requests landed.
Who contributed to .NET on July 18, 2026?: 8 developers shipped this update, including Javier Calvarro Nelson, Copilot, MayaKirova, ilonatommy, Rolf Bjarne Kvinge, simonrozsival, Redth, and PureWeen.
What were the notable .NET updates?: Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere (#67765), Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere, and [Blazor] Deprecate UseWebAssemblyDebugging and remove it from Blazor templates (#67861).

WASM RUNTIME SHRINKS 3.6% AS DOTNET HARDENS DEBUGGER EXPORTS

The JIT compiler just cut 815 kilobytes from WebAssembly Core Library by folding address constants into load instructions, while the runtime fixed a silent failure in WASI debugging that would strip metadata from stripped binaries.

dotnet 13 shipped 1-min read

@dotnet 3 days ago

RUNTIME FIXES KERBEROS FALLBACK ON UNIX, APPHOST CONVERTS TO C

The managed SPNEGO implementation now falls back to NTLM when Kerberos credentials go missing on Linux, closing a critical auth gap that broke enterprise deployments [ref:1].

dotnet 120 shipped 1-min read

@dotnet 4 days ago

MACIOS DOCS OVERHAUL SPANS 31 TYPES, ASPNETCORE VALIDATION MOVES TO SOURCE GENERATION

Rolf Bjarne shipped 31 types with proper XML documentation across macios while aspnetcore refactors validation classes out of the public API entirely.

dotnet 25 shipped 1-min read

@dotnet 5 days ago

SQLCLIENT KILLS PLATFORM-SPECIFIC BUILDS, ASPNETCORE HARDENS SIGNALR

SqlClient unified its Windows and Unix code paths without restructuring the NuGet package, collapsing build complexity across the entire SNI layer.

dotnet 97 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.