RepoJournal
.NET @dotnet
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-09-12
stories 97
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Android NativeAOT runtime packs fixed, CoreCLR parser hardened, runtime JIT and GZipStream repairs land

By RepoJournal · Filed · About .NET · Composed from the cited sources · methodology

dotnet-maestro Jonathan Peppers Larry Ewing dotnet-docker-bot vs-mobiletools-engineering-service2 csigs simonrozsival
10 people shipped this
dotnet-maestro @dotnet-maestro 5 cited Jonathan Peppers @jonathanpeppers 2 cited Larry Ewing @lewing 2 cited dotnet-docker-bot @dotnet-docker-bot 1 cited vs-mobiletools-engineering-service2 @vs-mobiletools-engineering-service2 1 cited csigs @csigs 1 cited simonrozsival @simonrozsival 1 cited jakobbotsch @jakobbotsch 1 cited rzikm @rzikm 1 cited Noah Falk @noahfalk 1 cited

dotnet/android removed the workload rewrite that made dotnet publish -p:PublishAot=true request runtime-pack versions missing from NuGet.org, the highest-impact fix in a day otherwise dominated by automated codeflow.

The Android RC1 workload stamped its build-time MicrosoftNETCoreAppRefPackageVersion into customer projects and rewrote the .NET SDK's NativeAOT KnownRuntimePack metadata. When the workload was built against 11.0.0-rc.1.26428.117 but installed with the 11.0.100-rc.1.26425.128 SDK, publishing with AOT requested runtime packs that did not exist on NuGet.org [1]. The Android-side rewrite is now removed, leaving the SDK to advertise the packs itself [1].

The CoreCLR Debug environment override parser in dotnet/android could parse uninitialized bytes or read past its allocation after short reads, undersized payload accounting, malformed headers, zero widths, or unterminated fixed-width strings [2]. It now continues through normal short reads and EINTR and parses only the bytes actually read, bounds and validates both fixed-width hexadecimal header fields, and rejects zero or overflowing widths before arithmetic [2].

Two dotnet/runtime fixes address concrete misbehavior. AMD64 fast tailcall epilogs used R10 as the scratch register for GS cookie checks while SecretStubParam is also passed in R10, so the epilog could overwrite the argument before jumping to the target; the fix moves the GS cookie check to R11 when the tailcall carries SecretStubParam and passes the tailcall context through LSRA [3]. Separately, GZipStream consumed but never rewound a stray trailing 0x1F byte on seekable streams opened with leaveOpen: true, silently losing that byte for whoever read the base stream next [4].

The Windows x64 AllSubsets_Mono_Minijit_RuntimeTests leg has been removed from eng/pipelines/runtime.yml, suspending that leg for PR and rolling builds after repeated FAST_FAIL_SET_CONTEXT_DENIED failures across 46 process-level work items [5]. dotnet/runtime also removed functional cDAC fallbacks, keeping legacy DAC interfaces only for Debug comparison and lifetime management and returning E_NOTIMPL for unsupported cDAC operations [6]. In a different failure class, Wasm portable-entrypoint slow paths retained a PrestubMethodFrame while invoking a resolved R2R body, letting MethodBase.GetCurrentMethod accept its own prestub frame as the caller [7].

The remaining traffic is machine-generated. dotnet/dotnet took codeflow updates from dotnet/sdk, dotnet/wpf, dotnet/aspnetcore, nuget/nuget.client, and dotnet/efcore [8][9][10][11][12], dotnet/versions merged Docker image info [13], dotnet/android checked in localized files via OneLocBuild and a LEGO hand-back [14][15], and dotnet/android-api-docs imported 443 documentation channels across Android.Service.Autofill with support for String/CharSequence aliases and deprecation-first overload summaries [16].

Action items

References

  1. [1] [NativeAOT] Let the SDK select runtime packs (#12750) ↗ dotnet/android
  2. [2] [native] Harden CoreCLR environment override parsing ↗ dotnet/android
  3. [3] JIT: avoid GS cookie conflict with secret stub argument in non-standard register ↗ dotnet/runtime
  4. [4] Rewind trailing 0x1F byte in GZipStream on seekable leaveOpen streams ↗ dotnet/runtime
  5. [5] Temporarily disable Windows x64 Mono MiniJIT runtime tests (#133747) ↗ dotnet/runtime
  6. [6] Remove functional cDAC fallbacks (#132720) ↗ dotnet/runtime
  7. [7] [wasm] Fix caller identification across R2R prestub transitions (#133707) ↗ dotnet/runtime
  8. [8] [main] Source code updates from dotnet/sdk ↗ dotnet/dotnet
  9. [9] [main] Source code updates from dotnet/wpf ↗ dotnet/dotnet
  10. [10] [main] Source code updates from dotnet/aspnetcore ↗ dotnet/dotnet
  11. [11] [main] Source code updates from nuget/nuget.client ↗ dotnet/dotnet
  12. [12] [main] Source code updates from dotnet/efcore ↗ dotnet/dotnet
  13. [13] Merging Docker image info updates from build ↗ dotnet/versions
  14. [14] Localized file check-in by OneLocBuild Task: Build definition ID 17928: Build ID 15289853 ↗ dotnet/android
  15. [15] LEGO: Pull request from juno/hb_6dddf33b-c6da-43d8-ac04-14d2c339cb00_20260911093129150 to main ↗ dotnet/android
  16. [16] Add XML documentation for Android.Service.Autofill ↗ dotnet/android-api-docs

$ ls dotnet/reviews/ # the step-back reads

the week in review CVE-2026-69304 hits ASP.NET Core; Spark 4.0 support lands the month in review F# interpolated strings and record spreads land as Orleans and runtime harden
Full archive → Weekly reviews →

Quick answers

What shipped in .NET on September 12, 2026?
dotnet/android removed the workload rewrite that made dotnet publish -p:PublishAot=true request runtime-pack versions missing from NuGet.org, the highest-impact fix in a day otherwise dominated by automated codeflow. In total, 52 commits and 45 pull requests landed.
Who contributed to .NET on September 12, 2026?
10 developers shipped this update, including dotnet-maestro, dotnet-docker-bot, vs-mobiletools-engineering-service2, csigs, simonrozsival, Jonathan Peppers, Larry Ewing, and jakobbotsch, and 2 more.
What were the notable .NET updates?
[NativeAOT] Let the SDK select runtime packs (#12750), [native] Harden CoreCLR environment override parsing, and JIT: avoid GS cookie conflict with secret stub argument in non-standard register.
♥

$ log @dotnet --recent

Vector literals stop breaking under comma-decimal cultures, AIDL one-way proxies generate correctly 83 shipped Spark 4.0 lands in .NET bindings, arcade refreshes Entra tokens mid-job 23 shipped MSBuild TaskAnalyzer quiets three diagnostics, Terminal Logger stops corrupting shared log events 20 shipped MAUI backports iOS regression coverage, aspnetcore bumps extensions 6 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training GSM8K scoring parses answers as exact decimals AI Red Teaming PyRIT closes a judge-spoofing hole, promptfoo accepts Langfuse v6

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.