Auto Publish – main to live - 2026-10-14 12:00 UTC

.github/policies/label-prs.yml

@@ -47,18 +47,6 @@ configuration:
           - addLabel:
               label: ":octocat: auto-merge"
 
-      - description: Label PRs from dependabot/dependabot[bot]
-        if:
-          - payloadType: Pull_Request
-          - or:
-              - isActivitySender:
-                  user: dependabot
-              - isActivitySender:
-                  user: dependabot[bot]
-        then:
-          - addLabel:
-              label: ":octocat: auto-merge"
-
       - description: Label PRs with okr-quality
         if:
           - payloadType: Pull_Request

.github/workflows/dependabot-approve-merge.yml

@@ -0,0 +1,28 @@
+name: dependabot
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' && github.repository_owner == 'dotnet' && github.base_ref == 'main' }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Auto-approve PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Auto-merge PR
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

docs/csharp/language-reference/compiler-messages/feature-version-errors.md

@@ -153,15 +153,15 @@ helpviewer_keywords:
   - "CS9328"
   - "CS9346"
   - "CS9352"
-ms.date: 09/11/2026
+ms.date: 10/05/2026
 ai-usage: ai-assisted
 ---
 # Resolve errors and warnings for language features and versions
 
 This article covers the following compiler errors and warnings:
 
 <!-- The text in this list generates issues for Acrolinx, because they don't use contractions.
-That's by design. The text closely matches the text of the compiler error / warning for SEO purposes.
+That's by design. The text closely matches the text of the compiler error or warning for SEO purposes.
  -->
 - [**CS0171**](#breaking-changes-on-struct-initialization): *Field 'name' must be fully assigned before control is returned to the caller. Consider updating to language version 'version' to auto-default the field.*
 - [**CS0188**](#breaking-changes-on-struct-initialization): *The 'this' object cannot be used before all of its fields have been assigned. Consider updating to language version 'version' to auto-default the unassigned fields.*
@@ -379,16 +379,22 @@ Make custom calling convention types `public` (**CS8891**). If you define a cust
 - **CS9211**: *The diagnosticId argument to the 'Experimental' attribute must be a valid identifier.*
 - **CS9268**: *'type' is for evaluation purposes only and is subject to change or removal in future updates: 'message'. Suppress this diagnostic to proceed.*
 
-These diagnostics indicate that you're using a feature or type that's marked as experimental or is only available in the preview language version.
+These diagnostics indicate that you're using an experimental compiler feature, a preview language feature, or a symbol marked as experimental.
 
 > [!WARNING]
 > Experimental features are subject to change. The APIs might change, or they might be removed in future updates. Including experimental features is a way for library authors to get feedback on ideas and concepts for future development. Use extreme caution when using any feature marked as experimental.
 
 Set `<LangVersion>preview</LangVersion>` in your project file to use preview language features (**CS8652**). Preview features aren't yet finalized and might change in future releases.
 
-Suppress the specific diagnostic ID to acknowledge the experimental nature of the API (**CS8058**, **CS8305**, **CS9204**, **CS9268**). Library authors mark APIs with <xref:System.Diagnostics.CodeAnalysis.ExperimentalAttribute?displayProperty=fullName> to indicate they're subject to change. You can suppress the diagnostic by using `#pragma warning disable` or by adding the diagnostic ID to `<NoWarn>` in your project file.
+Enable the named experimental compiler feature with `/features:<feature>`, as directed in the **CS8058** message.
 
-Ensure the `diagnosticId` argument to `[Experimental]` is a valid C# identifier (**CS9211**). The identifier must follow standard naming rules. It can't contain spaces, special characters, or start with a digit. You can also declare your own experimental features by using the <xref:System.Diagnostics.CodeAnalysis.ExperimentalAttribute?displayProperty=fullName>.
+**CS8305** indicates that the symbol is marked with `Windows.Foundation.Metadata.ExperimentalAttribute`. Suppress **CS8305** only when you accept that the marked symbol can change or be removed.
+
+If you're consuming an API marked with <xref:System.Diagnostics.CodeAnalysis.ExperimentalAttribute?displayProperty=fullName>, suppress a valid reported diagnostic ID only when you accept that the API can change or be removed. Use `#pragma warning disable` or add the ID to `<NoWarn>` in your project file. Diagnostic IDs read from metadata aren't revalidated. An invalid ID, such as one that contains a space, can be reported but might not be suppressible with `#pragma`. In that case, contact the API author or update the dependency.
+
+If you're authoring an experimental API, the compiler reports the `diagnosticId` from <xref:System.Diagnostics.CodeAnalysis.ExperimentalAttribute?displayProperty=fullName> when it isn't null, empty, or composed only of whitespace. Otherwise, the compiler reports **CS9204** if `Message` is null or empty and **CS9268** otherwise.
+
+For an attribute declared in source, an invalid `diagnosticId` also produces **CS9211** at the attribute declaration. Ensure the ID is a valid C# identifier: It must start with an underscore or a Unicode letter. Each later character must be a Unicode letter, decimal digit, connecting character such as an underscore, combining character, or formatting character. Because metadata IDs aren't revalidated, API authors should always choose a valid ID. You can declare your own experimental APIs by using the <xref:System.Diagnostics.CodeAnalysis.ExperimentalAttribute?displayProperty=fullName>.
 
 ## Breaking changes on struct initialization
 

docs/csharp/language-reference/operators/snippets/shared/StackallocOperator.cs

@@ -38,7 +38,7 @@ private static void AsExpression()
     {
         // <SnippetAsExpression>
         int length = 1000;
-        Span<byte> buffer = length <= 1024 ? stackalloc byte[length] : new byte[length];
+        Span<byte> buffer = length >= 0 && length <= 1024 ? stackalloc byte[length] : new byte[length];
         // </SnippetAsExpression>
     }
 
@@ -72,7 +72,7 @@ private static void LimitStackAllocatedMemory(int inputLength)
     {
         // <SnippetLimitStackalloc>
         const int MaxStackLimit = 1024;
-        Span<byte> buffer = inputLength <= MaxStackLimit ? stackalloc byte[inputLength] : new byte[inputLength];
+        Span<byte> buffer = inputLength >= 0 && inputLength <= MaxStackLimit ? stackalloc byte[inputLength] : new byte[inputLength];
         // </SnippetLimitStackalloc>
     }
 }

docs/csharp/language-reference/operators/stackalloc.md

@@ -19,6 +19,9 @@ You can assign the result of a `stackalloc` expression to a variable of one of t
 
   :::code language="csharp" source="snippets/shared/StackallocOperator.cs" id="AssignToSpan":::
 
+  > [!CAUTION]
+  > This pattern applies a cap only to the `stackalloc` branch of the expression. If the application requires a cap on the `new T[...]` branch of the expression (e.g., to avoid unwanted creation of a one billion-element array), the caller must perform that length check separately.
+
   You don't need to use an [unsafe](../keywords/unsafe.md) context when you assign a stack-allocated memory block to a <xref:System.Span`1> or <xref:System.ReadOnlySpan`1> variable.
 
   When you work with those types, you can use a `stackalloc` expression in [conditional](conditional-operator.md) or assignment expressions, as the following example shows:
@@ -54,6 +57,8 @@ The amount of memory available on the stack is limited. If you allocate too much
 
 - Avoid using `stackalloc` inside loops. Allocate the memory block outside a loop and reuse it inside the loop.
 
+- Do not provide negative lengths to the `stackalloc` operator. If the length is derived from user input, ensure that the call site _both_ forbids negative values _and_ caps the maximum allowed value, as shown in the above examples. A negative length passed to `new T[...]` will result in a catchable <xref:System.OverflowException> rather than a fatal StackOverflowException.
+
 The content of the newly allocated memory is undefined. You should initialize it before it's used, either with a `stackalloc` initializer or a method like <xref:System.Span`1.Clear*?displayProperty=nameWithType>.
 
 > [!IMPORTANT]

docs/framework/release-notes/2026/08-11-august-cumulative-update.md

@@ -1,7 +1,7 @@
 ---
 title: August 2026 cumulative update
 description: Learn about the improvements in the .NET Framework August 2026 cumulative update.
-ms.date: 09/14/2026
+ms.date: 10/13/2026
 ai-usage: ai-generated
 ---
 # .NET Framework August 2026 cumulative update
@@ -10,6 +10,7 @@ _Released August 11, 2026_
 _Updated September 2, 2026, to include known issues._
 _Updated September 10, 2026, to include known issues resolution._
 _Updated September 14, 2026, to correct known issues resolution._
+_Updated October 13, 2026, to add known issues resolution._
 
 ## Summary of what's new in this release
 
@@ -92,7 +93,7 @@ This switch disables security protections introduced in the August 2026 update a
 
 #### Status
 
-Investigating.
+This issue is resolved in the October 2026 .NET Framework cumulative update and later updates. We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.
 
 ## Summary tables
 

docs/framework/release-notes/2026/10-13-october-cumulative-update.md

@@ -0,0 +1,155 @@
+---
+title: October 2026 cumulative update
+description: Learn about the improvements in the .NET Framework October 2026 cumulative update.
+ms.date: 10/13/2026
+ai-usage: ai-generated
+---
+# .NET Framework October 2026 cumulative update
+
+_Released October 13, 2026_
+
+## Summary of what's new in this release
+
+- [Security improvements](#security-improvements)
+- [Quality and reliability improvements](#quality-and-reliability-improvements)
+
+### Security improvements
+
+#### CVE-2026-58280 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-58280](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280).
+
+#### CVE-2026-69439 – Elevation of Privilege vulnerability
+
+This security update addresses an elevation of privilege vulnerability detailed in [CVE-2026-69439](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69439).
+
+#### CVE-2026-69651 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-69651](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69651).
+
+#### CVE-2026-70007 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-70007](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70007).
+
+#### CVE-2026-70035 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-70035](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035).
+
+#### CVE-2026-70174 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-70174](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70174).
+
+#### CVE-2026-83520 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-83520](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520).
+
+#### CVE-2026-84008 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-84008](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008).
+
+#### CVE-2026-85363 – Elevation of Privilege vulnerability
+
+This security update addresses an elevation of privilege vulnerability detailed in [CVE-2026-85363](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85363).
+
+#### CVE-2026-87697 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-87697](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697).
+
+#### CVE-2026-96222 – Spoofing vulnerability
+
+This security update addresses a spoofing vulnerability detailed in [CVE-2026-96222](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96222).
+
+#### CVE-2026-96224 – Remote Code Execution vulnerability
+
+This security update addresses a remote code execution vulnerability detailed in [CVE-2026-96224](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96224).
+
+#### CVE-2026-96233 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-96233](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96233).
+
+#### CVE-2026-96958 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-96958](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958).
+
+#### CVE-2026-96959 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-96959](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96959).
+
+#### CVE-2026-96960 – Denial of Service vulnerability
+
+This security update addresses a denial of service vulnerability detailed in [CVE-2026-96960](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960).
+
+#### CVE-2026-97788 – Information Disclosure vulnerability
+
+This security update addresses an information disclosure vulnerability detailed in [CVE-2026-97788](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97788).
+
+#### CVE-2026-97801 – Tampering vulnerability
+
+This security update addresses a tampering vulnerability detailed in [CVE-2026-97801](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97801).
+
+#### CVE-2026-108398 – Security Feature Bypass vulnerability
+
+This security update addresses a security feature bypass vulnerability detailed in [CVE-2026-108398](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398).
+
+### Quality and reliability improvements
+
+This release contains no new quality and reliability improvements.
+
+## Known issues in this release
+
+This release contains no known issues.
+
+## Summary tables
+
+The following table outlines the updates in this release.
+
+| Product version | Cumulative update |
+| --- | --- |
+| **Windows 11, version 26H2** | |
+| .NET Framework 3.5, 4.8.1 | [5127694](https://support.microsoft.com/kb/5127694) |
+| **Windows 11, version 26H1** | |
+| .NET Framework 4.8.1 | [5127691](https://support.microsoft.com/kb/5127691) |
+| **Windows 11, version 25H2** | |
+| .NET Framework 3.5, 4.8.1 | [5127690](https://support.microsoft.com/kb/5127690) |
+| **Windows 11, version 24H2** | |
+| .NET Framework 3.5, 4.8.1 | [5127690](https://support.microsoft.com/kb/5127690) |
+| **Windows 11, version 23H2** | |
+| .NET Framework 3.5, 4.8.1 | [5127692](https://support.microsoft.com/kb/5127692) |
+| **Windows Server 2025** | |
+| .NET Framework 3.5, 4.8.1 | [5127690](https://support.microsoft.com/kb/5127690) |
+| **Windows Server 2022** | |
+| .NET Framework 3.5, 4.8 | [5127687](https://support.microsoft.com/kb/5127687) |
+| .NET Framework 3.5, 4.8.1 | [5127693](https://support.microsoft.com/kb/5127693) |
+| **Windows 10, version 22H2** | |
+| .NET Framework 3.5, 4.8 | [5127683](https://support.microsoft.com/kb/5127683) |
+| .NET Framework 3.5, 4.8.1 | [5127689](https://support.microsoft.com/kb/5127689) |
+| **Windows 10, version 21H2** | |
+| .NET Framework 3.5, 4.8 | [5127683](https://support.microsoft.com/kb/5127683) |
+| .NET Framework 3.5, 4.8.1 | [5127689](https://support.microsoft.com/kb/5127689) |
+| **Windows 10 1809 and Windows Server 2019** | |
+| .NET Framework 3.5, 4.7.2 | [5127666](https://support.microsoft.com/kb/5127666) |
+| .NET Framework 3.5, 4.8 | [5127685](https://support.microsoft.com/kb/5127685) |
+| **Windows 10 1607 and Windows Server 2016** | |
+| .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2 | [5126868](https://support.microsoft.com/kb/5126868) (included in the LCU) |
+| .NET Framework 4.8 | [5127684](https://support.microsoft.com/kb/5127684) |
+
+The following table is for earlier Windows Server versions for Security and Quality Rollup updates.
+
+| Product version | Security and quality rollup |
+| --- | --- |
+| **Windows Server 2012 R2** | |
+| .NET Framework 3.5 | [5127664](https://support.microsoft.com/kb/5127664) |
+| .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 | [5127668](https://support.microsoft.com/kb/5127668) |
+| .NET Framework 4.8 | [5127688](https://support.microsoft.com/kb/5127688) |
+| **Windows Server 2012** | |
+| .NET Framework 3.5 | [5127660](https://support.microsoft.com/kb/5127660) |
+| .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 | [5127667](https://support.microsoft.com/kb/5127667) |
+| .NET Framework 4.8 | [5127686](https://support.microsoft.com/kb/5127686) |
+
+The operating system rows list a KB that's used for update-offering purposes. When the operating system KB is offered, the applicability logic determines the specific .NET Framework updates that will be installed. Updates for individual .NET Framework versions are installed based on the version of .NET Framework that's already present on the device. Because of this, the operating system KB is not expected to be listed as an installed update on the device. The expected updates to be installed are the .NET Framework specific version updates listed in the preceding table.
+
+This update installs the complete .NET Framework 3.5 product for Windows 11, version 26H1 (build version 28000) and newer. Unlike traditional cumulative updates that patch individual components, this update delivers the full .NET Framework 3.5 product as a standalone installer. It replaces any previously installed version.
+
+| Product version | .NET Framework 3.5 product update |
+| --- | --- |
+| .NET Framework 3.5 | [5127696](https://support.microsoft.com/kb/5127696) |

docs/framework/release-notes/release-notes.md

@@ -1,7 +1,7 @@
 ---
 title: .NET Framework release information
 description: Improvements in the .NET Framework servicing cumulative updates.
-ms.date: 08/27/2026
+ms.date: 10/13/2026
 ---
 # .NET Framework release notes
 
@@ -11,7 +11,8 @@ The .NET Framework updates include cumulative security and reliability improveme
 
 .NET Framework cumulative update releases are discussed in detail in the following individual release notes:
 
-* September 8, 2026 - [cumulative update](./2026/09-08-september-cumulative-update.md) **New Release**
+* October 13, 2026 - [cumulative update](./2026/10-13-october-cumulative-update.md) **New Release**
+* September 8, 2026 - [cumulative update](./2026/09-08-september-cumulative-update.md)
 * August 27, 2026 - [cumulative update preview](./2026/08-27-august-cumulative-update-preview.md)
 * August 11, 2026 - [cumulative update](./2026/08-11-august-cumulative-update.md)
 * July 14, 2026 - [cumulative update](./2026/07-14-july-cumulative-update.md)

docs/framework/toc.yml

@@ -679,6 +679,8 @@ items:
     items:
     - name: Overview and index
       href: release-notes/release-notes.md
+    - name: October 2026 cumulative update
+      href: release-notes/2026/10-13-october-cumulative-update.md
     - name: September 2026 cumulative update
       href: release-notes/2026/09-08-september-cumulative-update.md
     - name: August 2026 cumulative update preview