[Breaking change]: Removal of inbox BinaryFormatter

[blowdart]

Description

The inbox implementation of BinaryFormatter will change in .NET 9 to throw exceptions on use.

A seperate, OOB package will be produced to allow for continued use of BinaryFormatter via direct call or configuration switches.

Version

.NET 9 Preview 6

Previous behavior

The inbox BinaryFormatter could be constructed and used to serialize and deserialize payloads.

Type of breaking change

• Binary incompatible: Existing binaries may encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
• Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code may require source changes to compile successfully.
• Behavioral change: Existing binaries may behave differently at run time.

Reason for change

BinaryFormatter is an insecure format and the cause of many security bugs. Removing it from the framework increases overall safety of .NET

Recommended action

Documentation needs to be written to show how to use the new OOB package once it is created, with warnings about its security.

Feature area

System.Runtime.Serialization

Affected APIs

BinaryFormatter

---

Associated WorkItem - 292109

[gewarren]

@blowdart @jeffhandley Just wanted to get clarification on which .NET 9 preview/RC/GA this will actually take hold?

[jeffhandley]

It was actually included in Preview 6, but we didn't complete the migration guide or the task of refreshing this issue with the appropriate content yet. We're actively working on both of those efforts this week. We will post a comment here with the content the engineering team can provide for the breaking change doc.