What shipped in .NET on August 24, 2026?

The dotnet ecosystem is drowning in dependency bumps, and MSBuild is leading the charge. In total, 4 commits and 13 pull requests landed.

Who contributed to .NET on August 24, 2026?

3 developers shipped this update, including dependabot, dotnet-maestro, and dotnet-maestro[bot].

What were the notable .NET updates?

Bump github/gh-aw-actions/setup from 0.86.2 to 0.87.2, [main] Update dependencies from dotnet/roslyn, and Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt.

@dotnet

The .NET runtime, ASP.NET, and the C# tooling

github ↗

Pick a date

Topics: .NET Full archive →

The Wire · Showcase

DOTNET PIPELINES SWARM: 14 PRS, ONE MESSAGE

By RepoJournal · Filed 06:59 UTC on August 24, 2026 · About .NET

3 people shipped this

dependabot @dependabot 3 cited

dotnet-maestro @dotnet-maestro 3 cited

dotnet-maestro[bot] @dotnet-maestro[bot]

The dotnet ecosystem is drowning in dependency bumps, and MSBuild is leading the charge.

Fourteen pull requests across three repos, all from bots, all automated. The real signal is in MSBuild: it's chasing roslyn's latest build [2] and syncing gh-aw-actions to v0.87.2 [1]. dev-proxy is quietly upgrading its auth stack, pulling Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.19.2 to 8.22.0 [3], and hardening its CI with CodeQL 4.37.7 [4]. Arcade is syncing xharness [6] and arcade-services [5] to keep the build infrastructure humming. The release notes for gh-aw-actions say "Sync of actions from gh-aw at v0.87.2" [1]. Nothing here is a security emergency, but the churn is relentless: 4 commits and 13 PRs in 24 hours. This is the cost of staying current, and dotnet is paying it.

Action items

→ Merge the roslyn dependency bump in MSBuild [ref:3] to keep the compiler in sync dotnet/msbuild [plan]
→ Update dev-proxy's auth packages [ref:6] to 8.22.0 to avoid lagging on identity fixes dotnet/dev-proxy [plan]
→ Watch the arcade multi-dependency PR [ref:11] for potential build breakage dotnet/arcade [monitor]

References

[1] Bump github/gh-aw-actions/setup from 0.86.2 to 0.87.2 ↗ dotnet/msbuild
[2] [main] Update dependencies from dotnet/roslyn ↗ dotnet/msbuild
[3] Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt ↗ dotnet/dev-proxy
[4] Bump github/codeql-action/analyze from 4.37.1 to 4.37.7 ↗ dotnet/dev-proxy
[5] [main] Update dependencies from dotnet/arcade, dotnet/arcade-services, dotnet/dnceng ↗ dotnet/arcade
[6] [main] Update dependencies from dotnet/xharness ↗ dotnet/arcade

Quick answers

What shipped in .NET on August 24, 2026?: The dotnet ecosystem is drowning in dependency bumps, and MSBuild is leading the charge. In total, 4 commits and 13 pull requests landed.
Who contributed to .NET on August 24, 2026?: 3 developers shipped this update, including dependabot, dotnet-maestro, and dotnet-maestro[bot].
What were the notable .NET updates?: Bump github/gh-aw-actions/setup from 0.86.2 to 0.87.2, [main] Update dependencies from dotnet/roslyn, and Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt.

ORLEANS HARDENS SILO FAILURE DETECTION

Orleans now ignores failed probes triggered by long GC pauses, a fix that could save your cluster from false member faults.

dotnet 47 shipped

@dotnet Aug 22

Android CI tightens the net

The .NET Android team is hardening the deployment pipeline, and skipping unchanged framework assemblies could be the biggest win you're not expecting.

dotnet 36 shipped

@dotnet Aug 21

Kestrel blocks malformed SNI hostnames

Kestrel now rejects malformed SNI server names, closing a DNS-label-boundary hole in the TLS handshake.

dotnet 80 shipped

@dotnet Aug 20

SIGNALR CLOSES DUPLICATE STREAM HOLE

A protocol-invalid duplicate stream ID could leave the displaced hub argument permanently unreachable, and now it's rejected immediately.

dotnet 131 shipped

Elsewhere on the wire

AI Agents Aug 24

CLINE SHIPS V4.1.15 AS TELEMETRY BUGS SURFACE ACROSS THE AGENT STACK

Cline's long-awaited auto-approve fix landed overnight, but it's the telemetry drop in 4.1.11 that should have you checking your session metrics.

ai-agents 44 shipped

Local LLMs Aug 24

VLLM'S P2P WEIGHT SYNC CUTS RL MOE TRANSFER COSTS

Forget all-gathering experts during RL rollout: vLLM's new sharded_rdt backend lets each worker pull only the slice it needs, turning a total_bytes transfer into a total_bytes divided by num_workers one.