[SENESO]

Fixes #66434 (also closes #69061 as a duplicate).

RateLimitingMiddleware creates its own PartitionedRateLimiter<HttpContext> (_endpointLimiter) in CreateEndpointLimiter() but never disposes it. The limiter's internal timer infrastructure keeps the host rooted, so every WebApplicationFactory-based test class leaks roughly one host (~100MB). Verified with a WeakReference repro: the host is not collectable with UseRateLimiter before this change, and collectable after.

The fix registers the middleware-owned limiter for disposal on IHostApplicationLifetime.ApplicationStopped. Design notes:

• Only _endpointLimiter is disposed — it is created inside the middleware, so the middleware is its sole owner. _globalLimiter comes from RateLimiterOptions.GlobalLimiter (user-provided) and is deliberately left alone: the user may share it across hosts or dispose it themselves.
• GetService (not GetRequiredService) keeps this null-safe for non-host scenarios; the callback is a static lambda so the registration can't root the middleware instance.

Tests:

• EndpointLimiterIsDisposedWhenApplicationStops — fails without the fix, passes with it.
• GlobalLimiterIsNotDisposedWhenApplicationStops — documents the ownership decision.

Note: I couldn't execute the repo's own test suite in my environment (it needs the source-built targeting pack from a near-full repo build), so CI is the real gate here. The change is minimal, additive, and null-safe.

[dotnet-policy-service]

Thanks for your PR, @SENESO. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[SENESO]

@dotnet-policy-service agree

[MohamedAliTera]

Any update on this? 👀

[SENESO]

Hi @MohamedAliTera, thanks for checking in. The fix is complete and all CI checks are green — it's currently waiting on a maintainer review. Hopefully it gets picked up soon.

[dotnet-policy-service]

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.