Bump net8/net9/net10 runtime package baselines to patched crypto servicing versions

[Copilot]

dotnet restore was failing with NU1901 because System.Security.Cryptography.Xml resolved to vulnerable versions across net8.0, net9.0, and net10.0, and warnings are treated as errors. This change moves the runtime-derived version baselines to patched servicing releases so vulnerable crypto packages are no longer selected.

• Runtime servicing alignment (net9/net10)

  • Updated Directory.Build.props:
    • NetNineRuntimeVersion → 9.0.15
    • AspNetCoreNineRuntimeVersion → 9.0.15
    • NetTenRuntimeVersion → 10.0.6
    • AspNetCoreTenRuntimeVersion → 10.0.6
  • This updates all runtime-derived package versions consistently for each TFM.

• Direct crypto package patch (net8)

  • Updated SystemSecurityCryptographyXmlVersion from 8.0.1 to 8.0.3 in the net8.0 property group.

• Dependency graph consistency fix

  • While applying the net8 XML patch, restore surfaced a downgrade (NU1605) because Xml 8.0.3 requires Pkcs >= 8.0.1.
  • Updated SystemSecurityCryptographyPkcsVersion from 8.0.0 to 8.0.1 in the net8.0 property group.

<PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
  <NetNineRuntimeVersion>9.0.15</NetNineRuntimeVersion>
  <AspNetCoreNineRuntimeVersion>9.0.15</AspNetCoreNineRuntimeVersion>
</PropertyGroup>

<PropertyGroup Condition="'$(TargetFramework)' == 'net10.0'">
  <NetTenRuntimeVersion>10.0.6</NetTenRuntimeVersion>
  <AspNetCoreTenRuntimeVersion>10.0.6</AspNetCoreTenRuntimeVersion>
</PropertyGroup>

<PropertyGroup Condition="'$(TargetFramework)' == 'net8.0'">
  <SystemSecurityCryptographyPkcsVersion>8.0.1</SystemSecurityCryptographyPkcsVersion>
  <SystemSecurityCryptographyXmlVersion>8.0.3</SystemSecurityCryptographyXmlVersion>
</PropertyGroup>

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• login.microsoftonline.com
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net10.0/Microsoft.Identity.Web.Test.runtimeconfig.json --depsfile /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net10.0/Microsoft.Identity.Web.Test.deps.json /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net10.0/testhost.dll --port 43459 --endpoint 127.0.0.1:043459 --role client --parentprocessid 5118 --telemetryoptedin false (dns block)
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net8.0/Microsoft.Identity.Web.Test.runtimeconfig.json --depsfile /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net8.0/Microsoft.Identity.Web.Test.deps.json /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net8.0/testhost.dll --port 35581 --endpoint 127.0.0.1:035581 --role client --parentprocessid 5125 --telemetryoptedin false (dns block)
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net9.0/Microsoft.Identity.Web.Test.runtimeconfig.json --depsfile /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net9.0/Microsoft.Identity.Web.Test.deps.json /home/REDACTED/work/microsoft-identity-web/microsoft-identity-web/tests/Microsoft.Identity.Web.Test/bin/Debug/net9.0/testhost.dll --port 37883 --endpoint 127.0.0.1:037883 --role client --parentprocessid 5117 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Problem

The build is failing with NU1901 errors because System.Security.Cryptography.Xml has known low-severity vulnerabilities (GHSA-37gx-xxp4-5rgx and GHSA-w3x6-4m5h-cxqf), and the repo has <TreatWarningsAsErrors>true</TreatWarningsAsErrors> in Directory.Build.props.

The affected projects include Microsoft.Identity.Web.csproj and Microsoft.Identity.Web.TokenCache.csproj, which fail NuGet restore for all three target frameworks (net8.0, net9.0, net10.0).

Root Cause

The runtime version variables and package versions in Directory.Build.props reference vulnerable versions of System.Security.Cryptography.Xml:

• net8.0: SystemSecurityCryptographyXmlVersion = 8.0.1 (vulnerable, patched in 8.0.3)
• net9.0: NetNineRuntimeVersion = 9.0.0 → all runtime packages including System.Security.Cryptography.Xml resolve to 9.0.0 (vulnerable, patched in 9.0.15)
• net10.0: NetTenRuntimeVersion = 10.0.0 → all runtime packages including System.Security.Cryptography.Xml resolve to 10.0.0 (vulnerable, patched in 10.0.6)

Required Fix

Update the following in Directory.Build.props:

1. Line 101 (NetNineRuntimeVersion): Change from 9.0.0 to 9.0.15
2. Line 102 (AspNetCoreNineRuntimeVersion): Update to the corresponding ASP.NET Core 9 servicing release that aligns with .NET 9.0.15 (should be 9.0.15 as well)
3. Line 118 (NetTenRuntimeVersion): Change from 10.0.0 to 10.0.6
4. Line 119 (AspNetCoreTenRuntimeVersion): Update to the corresponding ASP.NET Core 10 servicing release that aligns with .NET 10.0.6 (should be 10.0.6 as well)
5. Line 141 (SystemSecurityCryptographyXmlVersion under the net8.0 condition): Change from 8.0.1 to 8.0.3

This bumps the full runtime dependency set to patched servicing releases, ensuring consistency across all runtime-derived packages and not just silencing the one audit warning.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Restored D:\a\microsoft-identity-web\microsoft-identity-web\tests\PerformanceTests\PerformanceTestService\PerformanceTestService.csproj (in 6.8 sec).
Restored D:\a\microsoft-identity-web\microsoft-identity-web\tests\DevApps\AspireBlazorCallsWebApi\AspireBlazorCallsWebApi.Web\AspireBlazorCallsWebApi.Web.csproj (in 9.73 sec).
Restored D:\a\microsoft-identity-web\microsoft-identity-web\tests\DevApps\AspireBlazorCallsWebApi\AspireBlazorCallsWebApi.ServiceDefaults\AspireBlazorCallsWebApi.ServiceDefaults.csproj (in 8.11 sec).
Restored D:\a\microsoft-identity-web\microsoft-identity-web\tests\DevApps\AspireBlazorCallsWebApi\AspireBlazorCallsWebApi.ApiService\AspireBlazorCallsWebApi.ApiService.csproj (in 3.48 sec).
Restored D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web.UI\Microsoft.Identity.Web.UI.csproj (in 1.13 sec).
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml' 8.0.1 has a known low severity vulnerability, GHSA-37gx-xxp4-5rgx [D:\a\microsoft-identity-web\microsoft-identity-web\Microsoft.Identity.Web.sln]
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml' 8.0.1 has a known low severity vulnerability, GHSA-w3x6-4m5h-cxqf [D:\a\microsoft-identity-web\microsoft-identity-web\Microsoft.Identity.Web.sln]
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml' 9.0.0 has a known low severity vulnerability, GHSA-37gx-xxp4-5rgx [D:\a\microsoft-identity-web\microsoft-identity-web\Microsoft.Identity.Web.sln]
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml' 9.0.0 has a known low severity vulnerability, GHSA-w3x6-4m5h-cxqf [D:\a\microsoft-identity-web\microsoft-identity-web\Microsoft.Identity.Web.sln]
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml' 10.0.0 has a known low severity vulnerability, GHSA-37gx-xxp4-5rgx [D:\a\microsoft-identity-web\microsoft-identity-web\Microsoft.Identity.Web.sln]
D:\a\microsoft-identity-web\microsoft-identity-web\src\Microsoft.Identity.Web\Microsoft.Identity.Web.csproj : error NU1901: Warning As Error: Package 'System.Security.Cryptography.Xml'...

This pull request was created from Copilot chat.

[bgavrilMS]

Only the affected package needs to be bumped. Bumping Microsoft.Extensions.* packages can introduce breaking changes to consumers. We can do it if needed, but this doesn't seem to be the case.

[bgavrilMS]

Upgrade only the affected package. Don't mass upgrade Extensions etc. as it will cause breaking changes to users.