$ cat dotnet/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
CVE-2026-69304 hits ASP.NET Core; Spark 4.0 support lands
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The ASP.NET Core denial-of-service advisory is the breaking item; dotnet/spark lands daemon and RDD execution for Spark 4.0.
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability dotnet/aspnetcore
Microsoft's security advisory carries the CVE-2026-69304 denial-of-service vulnerability and arrives alongside shifting caching and validation APIs in ASP.NET Core, so this is the item to schedule first. Pin your patch against the affected service before the week's other work.
Add Spark 4.0 daemon worker lifecycle and reuse support dotnet/spark
The daemon implementation launches separate .NET 8 worker processes with real OS PIDs and supports worker reuse, which removes the requirement to set `spark.python.use.daemon=false` on Linux. Spark 4.0 on .NET no longer forces workers back into the legacy path.
Enable Spark 4.0 RDD NON_UDF execution dotnet/spark
RDD `NON_UDF` (`PythonEvalType = 0`) commands now reach .NET workers under Spark 4.0, while `SQL_BATCHED_UDF` stays supported and 2.x/3.x command routing is preserved. Code that already used RDD execution on older Spark can move to 4.0 without a rewrite.
Add Spark 4.0 DataFrame row retrieval support dotnet/spark
`DataFrame.Tail(int)` and parameterless `ToLocalIterator()` gain Spark 4.0 support, and early-terminated local iteration now cleans up through a non-finalizer path. The row-retrieval surface moves closest to finished among the Spark 4.0 work.
Add CoreCLR WASM R2R performance lane dotnet/performance
A dedicated CoreCLR browser-WASM R2R microbenchmark lane runs on V8, propagating the R2R selection through Helix and the microbenchmark harness and publishing per-assembly results under a distinct `R2RType=r2r` dimension. For Wasm-adjacent work, this is the first lane that scores the CoreCLR browser path.
[msbuild] Add AppManifestEntry build items. Fixes #12788 dotnet/macios
macios gains typed `AppManifestEntry` MSBuild items for adding, overriding, and removing Info.plist entries, with boolean, string, string-array, and removal operations; entry metadata joins incremental build fingerprints through collision-safe hashing. Manifest edits from .NET code no longer need a project file escape hatch.
Implement wasm JumpStubNode with signature-matched argument forwarding dotnet/runtime
Wasm address-taken method stubs no longer throw `NotImplementedException` during emission: the new `JumpStubNode` preserves the target's lowered Wasm signature, forwards all arguments, and transfers control. The wasm emission path loses a hard failure.
Delete msbuild-server skill dotnet/skills
The dotnet/skills team deletes the msbuild-server skill because msbuild-server is now on by default since .NET 11 Preview 7 and recommending it in other scenarios risks missing critical fixes. If your tooling still relies on that skill, the recommendation is gone.
$ ls dotnet/week/ # the briefings behind this review