Merging internal commits for release/8.0

[vseanreesermsft]

No description provided.

[Copilot]

Pull request overview

This PR aggregates internal servicing changes for the release/8.0 line, primarily focused on security hardening (MessagePack, Kestrel path validation, gRPC JSON transcoding query binding, output caching behavior) and updating dependency versions. It also introduces a build-time patching mechanism for the MessagePack-CSharp submodule to pull in upstream/security fixes without directly committing submodule source changes.

Changes:

• Apply MessagePack-CSharp security fixes via build-time git apply patches, plus supporting LF enforcement for patch files.
• Harden request parsing/caching behaviors (Kestrel path validation for HTTP/2+HTTP/3, OutputCaching authenticated handling, gRPC JSON transcoding query binding cache behavior).
• Update runtime/EFCore/MessagePack dependency versions and internal NuGet feed sources.

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/submodules/msgpack-fix-full.diff	Adds a large patch to be applied to the MessagePack-CSharp submodule (security + robustness fixes + tests + API baselines).
eng/build.sh	Applies MessagePack submodule patches during build when not yet applied.
eng/build.ps1	Applies MessagePack submodule patches during build on Windows.
.gitattributes	Forces LF for *.diff/*.patch to keep git apply reliable under core.autocrlf=true.
eng/scripts/CodeCheck.ps1	Attempts to exclude the patched submodule from “generated code up-to-date” checks.
eng/Versions.props	Bumps runtime/EFCore versions and MessagePack package version.
eng/Version.Details.xml	Updates dependency versions/SHAs for runtime + EFCore.
NuGet.config	Adds internal dependency-flow package sources and enables them in disabled sources list.
src/Servers/Kestrel/Core/src/Internal/Http3/Http3Stream.cs	Aborts on non-byte path chars to prevent truncation during path normalization.
src/Servers/Kestrel/Core/src/Internal/Http2/Http2Stream.cs	Resets/aborts on non-byte path chars to prevent truncation during path normalization.
src/Servers/Kestrel/test/InMemory.FunctionalTests/Http3/Http3StreamTests.cs	Adds test coverage for non-ASCII path handling in HTTP/3 header decoding.
src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2StreamTests.cs	Adds test coverage for non-ASCII path handling in HTTP/2 header decoding.
src/Middleware/OutputCaching/src/Policies/DefaultPolicy.cs	Prevents storing cached responses when User is authenticated (covers auth middleware after caching).
src/Middleware/OutputCaching/test/OutputCacheTests.cs	Adds tests covering authenticated requests not being cached + negative test for auth-after-cache ordering.
src/Grpc/JsonTranscoding/src/Microsoft.AspNetCore.Grpc.JsonTranscoding/Internal/JsonRequestHelpers.cs	Avoids caching unresolved query paths; blocks query binding from overwriting route/body fields via JSON-name aliases.
src/Grpc/JsonTranscoding/src/Microsoft.AspNetCore.Grpc.JsonTranscoding/Internal/CallHandlers/CallHandlerDescriptorInfo.cs	Makes path descriptor cache non-nullable and precomputes route JSON paths set.
src/Grpc/JsonTranscoding/test/Microsoft.AspNetCore.Grpc.JsonTranscoding.Tests/UnaryServerCallHandlerTests.cs	Adds tests for query path caching behavior and route/body overwrite protections.
src/Grpc/JsonTranscoding/test/Microsoft.AspNetCore.Grpc.JsonTranscoding.Tests/Proto/transcoding.proto	Adds a sub_data field to support new overwrite-protection tests.
src/Grpc/JsonTranscoding/test/Microsoft.AspNetCore.Grpc.JsonTranscoding.IntegrationTests/RouteTests.cs	Adds integration test for nested JSON-name query params not overwriting route-bound values.
src/SignalR/common/SignalR.Common/test/Internal/Protocol/MessagePackHubProtocolTestBase.cs	Adds a regression test to ensure deeply nested skipped results don’t overflow the stack.

Comments suppressed due to low confidence (1)

eng/scripts/CodeCheck.ps1:222

• The generated-code diff check only excludes exact file paths. Adding "src/submodules/MessagePack-CSharp" to $changedFilesExclusions won’t exclude any files under that directory (git diff lists file paths), so CodeCheck will still fail after the build scripts apply patches to the submodule. Add an explicit prefix/wildcard check for files under the submodule directory.

    # Temporary: Disable check for blazor js file and nuget.config (updated automatically for
    # internal builds)
    $changedFilesExclusions = @("src/Components/Web.JS/dist/Release/blazor.server.js", "src/Components/Web.JS/dist/Release/blazor.web.js", "NuGet.config", "src/submodules/MessagePack-CSharp")

    if ($changedFiles) {
        foreach ($file in $changedFiles) {
            if ($changedFilesExclusions -contains $file) {continue}
            $filePath = Resolve-Path "${repoRoot}/${file}"
            LogError  -filepath $filePath `

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.