Who contributed to .NET on August 4, 2026?

11 developers shipped this update, including Egor Bogatov, Copilot, copilot-swe-agent, rosebyte, dotnet-maestro[bot], NatElkins, dotnet-maestro, and abonie, and 3 more.

What were the notable .NET updates?

Restore stress guards on process-isolated IL tests (#131769), Remove ClassSupportsIClassX which always returns true (#131683), and Remove calli target tagging from CoreCLR interop stubs (#131642).

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

RUNTIME STRIPS DEAD CODE, FIXES TRIMMER DATAFLOW BUGS ACROSS CODEPATH

By RepoJournal · Filed 07:01 UTC on August 4, 2026 · About .NET

11 people shipped this

Copilot @Copilot 2 cited

Egor Bogatov @EgorBo 1 cited

copilot-swe-agent @copilot-swe-agent 1 cited

rosebyte @rosebyte 1 cited

William Godbe @wtgodbe 1 cited

timcassell @timcassell 1 cited

dotnet-maestro[bot] @dotnet-maestro[bot]

NatElkins @NatElkins

dotnet-maestro @dotnet-maestro

abonie @abonie

Ilona Tomkowicz @ilonatommy

CoreCLR interop stubs lose obsolete target tagging while trimmer gains null-safety guards in generic-attribute processing, unblocking three years of accumulated simplification work.

The runtime shed technical debt across three fronts overnight. First, EgorBo restored stress guards on process-isolated IL tests [1], surfacing a regression where test-skip attributes silently dropped when isolation was enabled. Second, Copilot's agent removed ClassSupportsIClassX [2], a stub that unconditionally returned true and made all its call sites dead code or no-ops. Third, the same agent eliminated calli target tagging from interop stubs [3], simplifying MethodDesc and unmanaged target handling to use actual storage semantics instead of low-bit encoding tricks. On the configuration side, a generic-attribute dataflow fix [4] guards ProcessGenericArgumentDataFlow with RequiresGenericArgumentDataFlow and adds null-safety checks to prevent NREs while emitting IL2091, while a separate fix [5] restores dropped collection items when binding configuration to positional records with null constructor parameters. This was a regression in .NET 10 where PR #116677 changed JSON null handling and exposed a latent issue in BindParameter. ASP.NET forced brace-expansion to 5.0.8 [6] to fix DoS vulnerabilities affecting unbounded expansion output and exponential CPU consumption on crafted patterns, cascading through npm's dependency graph via minimatch, glob, and rimraf. BenchmarkDotNet's error mapper now converts missing references into user-actionable messages [7] and memoizes IInProcessDiagnoser.GetHandlerData per BenchmarkCase to reduce redundant calls.

Action items

→ Review process-isolated IL tests in your suite for stress-guard coverage dotnet/runtime [plan]
→ Upgrade ASP.NET projects with npm dependencies; brace-expansion DoS fix requires major version bump dotnet/aspnetcore [plan]
→ Test configuration binding with null constructor parameters in positional records before next release dotnet/runtime [monitor]

References

[1] Restore stress guards on process-isolated IL tests (#131769) dotnet/runtime
[2] Remove ClassSupportsIClassX which always returns true (#131683) dotnet/runtime
[3] Remove calli target tagging from CoreCLR interop stubs (#131642) dotnet/runtime
[4] Fix custom-attribute generic argument dataflow in the trimmer ↗ dotnet/runtime
[5] Fix configuration binder dropping collection items with null constructor parameters ↗ dotnet/runtime
[6] [Infrastructure] Updated npm packages 2026-07-29 ↗ dotnet/aspnetcore
[7] Update `MsBuildErrorMapper` ↗ dotnet/BenchmarkDotNet

Quick answers

What shipped in .NET on August 4, 2026?: CoreCLR interop stubs lose obsolete target tagging while trimmer gains null-safety guards in generic-attribute processing, unblocking three years of accumulated simplification work. In total, 39 commits and 45 pull requests landed.
Who contributed to .NET on August 4, 2026?: 11 developers shipped this update, including Egor Bogatov, Copilot, copilot-swe-agent, rosebyte, dotnet-maestro[bot], NatElkins, dotnet-maestro, and abonie, and 3 more.
What were the notable .NET updates?: Restore stress guards on process-isolated IL tests (#131769), Remove ClassSupportsIClassX which always returns true (#131683), and Remove calli target tagging from CoreCLR interop stubs (#131642).

DOTNET FOUNDATION PULLS iOS METRICS INTO FOCUS AS RUNTIME HARDENS HTTP PARSING

Performance team fixed iOS size reporting to measure only distributable packages, while runtime clamped down on RFC 9112 compliance for chunked encoding.

dotnet 72 shipped

@dotnet Aug 5

HELIX MACHINE CORRUPTION DETECTION ROLLS OUT; RUNTIME MUTUAL AUTH TIGHTENS

Performance's new dpkg detection takes broken test machines offline automatically, while runtime enforces Negotiate mutual authentication and SDK extends binary log sessions across device builds.

dotnet 133 shipped

@dotnet Aug 3

ROSLYN FIXES EDITOR SYNC, WPF TIGHTENS SECURITY

Roslyn patched a critical textDocument notification handler that was dropping range information, breaking editor sync across the IDE.

dotnet 8 shipped

@dotnet Aug 2

RUNTIME HARDENS UNSAFE CALLS WHILE MAUI FIXES MERGE PIPELINE

The CLR just shipped tooling to migrate LibraryImport toward unsafe-v2, plus allocation cuts in COM interop, while MAUI plugs gaps in its bot-driven merge policy.

dotnet 12 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.