.NET October 2024 Update - .NET 8.0.10, .NET 6.0.35

[rbhanda]

.NET October 2024 Update

Release Notes

• 8.0.10
• 6.0.35

Status

Asset Type	8.0.10	6.0.35	Notes
Installers/Binaries	✅	✅
Snaps	✅	✅
Linux Packages (Microsoft distribution)			The list below refers to the Microsoft-provisioned feeds (packages.microsoft.com) and does not in any way represent direct availability in distros (eg RHEL, Fedora).
Centos 7	NA
Centos 8
Debian 10
Debian 11
Debian 12
Fedora 37
Fedora 38
Fedora 39
Fedora 40
OpenSUSE 15
Ubuntu 20.04
Ubuntu 22.04
Ubuntu 23.04
Ubuntu 24.04

Issues

Please report any issues you find either by responding to this issue, creating a new issue or creating a new issue in one of the following repos:

• ASP.NET Core: dotnet/aspnetcore
• Entity Framework Core: dotnet/efcore
• .NET CLI/SDK dotnet/sdk
• .NET runtime dotnet/runtime
• Winforms: dotnet/winforms
• WPF: dotnet/wpf
• NuGet: nuget/home
• Containers: dotnet/dotnet-docker
• Winget: microsoft/winget-pkgs

Known Issues

• We are aware of wrong nuget versions being listed as vulnerable in our recently published dotnet/runtime advisories. We are actively working to resolve it. We are awaiting these [GHSA-8g4q-xg66-9fp4] Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability github/advisory-database#4882
  [GHSA-f32c-w444-8ppv] Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability github/advisory-database#4883
  [GHSA-qj66-m88j-hmgj] Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability github/advisory-database#4884
  PRs to be merged. Once they are merged, NuGet should have the correct versions updated. If you have dependabot PRs open due to this, we recommend ignoring them until the corrected advisories are published on GitHub

[MikeFarrington]

I can't download the SDK installers, I get like 0 byte files downloading the x64, or 255 byte files which clicking on a different one.

I'm guessing the files aren't yet cached on the CDNs or something, but perhaps it's something more.

[mairaw]

Are you getting the link from the .NET website or somewhere else @MikeFarrington?

I just tested with https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/sdk-8.0.403-windows-x64-installer and downloaded a 212 MB file.

[MikeFarrington]

Are you getting the link from the .NET website or somewhere else @MikeFarrington?

I just tested with https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/sdk-8.0.403-windows-x64-installer and downloaded a 212 MB file.

I tried both the .NET website, and from the github release page. I also tried the link in your comment.

All results are the same. CDNs are of course regional, so, maybe I need to wait for it to propagate fully or something.

Edit To Add: Sorry, it looks like my browser was acting up. Restarting Firefox cleared it up. Sorry, I've never had that happen before.

[JuergenAuer]

I have the same problem. Installed 8.0.0 - 8.0.8 + SDK, different machines, no problem.

Now: 0 Bytes, 128KB, 192KB, via Github 48KB. Tried to install the newest SDK.

PS: Looks like a FireFox-Problem. Chrome - no problem, 212 MB, installation works.

[jhancock-taxa]

Doesn't appear to have the MacOS fix that without it, means that any Mac with Sequoia on it is non-functional with .net and a major blocker and was promised for this release.

[timmkrause]

Doesn't appear to have the MacOS fix that without it, means that any Mac with Sequoia on it is non-functional with .net and a major blocker and was promised for this release.

Was also searching around. Just saw the PR that added it into the known issue doc.

1c3ac26

I just let a friend on 15.0.1 run dotnet dev-certs https which calls the faulty CertificateRequest.CreateSelfSigned and it executed successfully. So my guess would be that it is fixed. But I can't prove it or find evidence over here.

[jhancock-taxa]

8.0.403 was just released that does fix this.

But you need to run:

dotnet dev-certs https --clean
dotnet dev-certs https --trust

And then you should be back in business.

[IJUSTWANTCODESEARCH]

It appears the CVE for System.Text.Json was published incorrectly, the patched version is listed as 8.0.10 - it should be 8.0.5; unless there is another pending nuget push for that package.

[rbhanda]

It appears the CVE for System.Text.Json was published incorrectly, the patched version is listed as 8.0.10 - it should be 8.0.5; unless there is another pending nuget push for that package.

Thanks a lot for flagging this. I have updated our advisories with correct versions.

[Vincentp90]

Hey, I'm quite inexperienced with docker so this might be pebkac issue. I have this dockerfile and with SDK 8.0.402 docker build is working perfectly fine. (mcr.microsoft.com/dotnet/sdk:8.0.402)

However when using image mcr.microsoft.com/dotnet/sdk:8.0 (I assume this refers to current image so 8.0.403) then I get issue, somewhere in the build "dotnet devcerts https --export-path /root/.aspnet/https/something.client.pem --format Pem --no-password" is called. And this gives error that the path /root/.aspnet/https does not exist.

Is something changed here? Or is something changed with setting APPDATA or HOME env var (this is also used to set the --export-path in the build)?