RepoJournal
.NET @dotnet
99 wires and counting

$ follow .NET

Keep up with .NET in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-09
stories 49
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CVE-2026-69304 opens in ASP.NET Core; caching and validation APIs shift

By RepoJournal · Filed · About .NET

Evangelink copilot-swe-agent oroztocil kotlarmilos bartelink Tomas Grosup matouskozak
11 people shipped this
Evangelink @Evangelink 2 cited copilot-swe-agent @copilot-swe-agent 1 cited oroztocil @oroztocil 1 cited kotlarmilos @kotlarmilos 1 cited bartelink @bartelink 1 cited Tomas Grosup @T-Gro 1 cited matouskozak @matouskozak 1 cited Copilot @Copilot dotnet-maestro @dotnet-maestro dotnet-maestro[bot] @dotnet-maestro[bot] dependabot @dependabot

Microsoft issued a security advisory for an ASP.NET Core denial of service vulnerability, while new PRs stop request reordering in output caching and replace the validation message formatter.

Microsoft published CVE-2026-69304, a denial of service vulnerability in ASP.NET Core. Apply the advisory's update before your next deploy. [1]

Output and response caching no longer sort headers and query parameters when calculating the cache key. A cache-entry lookup used to depend on sorted values, which reordered requests on a miss or collision. The change stops that sorting, preserving original order in the key. [2] Also, the minimal-API validation message formatter interface `IValidationMessageFormatter` is dropped in favor of the base class method `ValidationAttribute.FormatMessage` now in the BCL. The interface's purpose is superseded, so code using `IValidationMessageFormatter` must migrate to the new BCL API. [3]

In Blazor, `Microsoft.AspNetCore.Components.AI` now ships through the standard ASP.NET Core release cadence while retaining independent `0.x` versioning. Previously it was not part of the standard release process. [4]

On the F# side, `parallelLimit`, `parallelDoLimit`, `sequential`, `sequentialDo` are added to `Async` and `Task` modules, and `Task.startAsyncImmediate` is added. These implement proposed helpers that were missing for controlling concurrency in async and task workflows. [5] A compiler micro-optimization inlines free-variable type-parameter folds, removing per-call partial-application closures in one of the hottest traversals, which should reduce allocation during type checking. [6]

In `dotnet/skills`, the MSTest migration skill now covers NUnit 3/4, classifying all 48 attributes in NUnit's official index, and static source-to-test pairing expands to Kotlin, Swift, PowerShell, and C++. These changes keep test projects from silently changing framework behavior during migration and broaden generated-test coverage to those languages. [7] [8]

The MAUI performance harness now pins NuGet configs consistently across commit discovery and workload installation. Previously, after .NET 12 was added, discovery could use branch-HEAD configs while installation fell back to .NET 11 feeds, so installation was not pinned to the selected package versions. The fix shares manifest resolution and uses the working-directory NuGet.config. [9]

Action items

References

  1. [1] Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability dotnet/aspnetcore ↗
  2. [2] Stop output/response caching from reordering request values ↗ dotnet/aspnetcore
  3. [3] Replace IValidationMessageFormatter with ValidationAttribute.FormatMessage ↗ dotnet/aspnetcore
  4. [4] [Blazor] Ship Components.AI with the .NET release cadence ↗ dotnet/aspnetcore
  5. [5] feat(Task, Async): parallelLimit, sequential, startAsyncImmediate ↗ dotnet/fsharp
  6. [6] [MicroPerf] Inline the free-variable typar foldBacks (#20385) ↗ dotnet/fsharp
  7. [7] Add NUnit to MSTest migration skill ↗ dotnet/skills
  8. [8] Expand static test pairing to more languages ↗ dotnet/skills
  9. [9] Fix MAUI NuGet config pinning when workload feeds fall back ↗ dotnet/performance

$ ls dotnet/reviews/ # the step-back reads

the week in review Native AOT debug info overhaul the month in review F# interpolated strings and record spreads land as Orleans and runtime harden
Topics: .NET Full archive →

Quick answers

What shipped in .NET on September 9, 2026?
Microsoft issued a security advisory for an ASP.NET Core denial of service vulnerability, while new PRs stop request reordering in output caching and replace the validation message formatter. In total, 22 commits, 22 pull requests, 4 releases, and 1 security advisories landed.
Who contributed to .NET on September 9, 2026?
11 developers shipped this update, including copilot-swe-agent, oroztocil, kotlarmilos, Copilot, dotnet-maestro, bartelink, Tomas Grosup, and dotnet-maestro[bot], and 3 more.
What were the notable .NET updates?
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability, Stop output/response caching from reordering request values, and Replace IValidationMessageFormatter with ValidationAttribute.FormatMessage.
♥

$ log @dotnet --recent

dotnet/macios adds typed AppManifestEntry build items 42 shipped Spark 4.0 daemon workers and RDD execution land 19 shipped Orleans hardens grain directory and storage providers against null inputs 50 shipped WebAssembly runtime fixes narrow long-local reads; F# strips dead feature flags 97 shipped

$ log --all # elsewhere on the wire

@vuejs Compiler-SFC fix restores await scope in nested blocks @vercel Next.js fixes dev startup race as Turborepo layers telemetry and matcher speedups

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.