Repository navigation
Merging internal commits for release/8.0 - #69178
Merged
Merged
Conversation
…otnet-runtime build 20260803.5 On relative base path root Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 8.0.30-servicing.26367.20 -> To Version 8.0.30-servicing.26403.5
…otnet-efcore build 20260804.2 On relative base path root dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 8.0.30 -> To Version 8.0.30
…otnet-efcore build 20260805.2 On relative base path root dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 8.0.30 -> To Version 8.0.31
…and cap cache of pathDescriptors Fixing 2 problems: 1) A query-string parameter written with a mixed or shortened field-name spelling (e.g. `?tenantScope.tenant_id=…` or a parent like `?timestamp_value=…`) could bypass the existing name check and overwrite a value already bound from the URL path. This change compares the resolved field identities instead of raw name strings, so query parameters can no longer clobber route-bound fields regardless of how they're spelled. 2) A transcoded method whose request has a self-referential message field allows an unbounded set of valid dotted paths, so the per-endpoint path descriptor cache could grow without limit from repeated requests. Cap the cache size (default 1000, overridable via AppContext) to prevent it.
… IIS out-of-process (MaxRequestBodySize) ## Description On IIS out-of-process hosting, IISMiddleware cleared the request body size limit (MaxRequestBodySize = null). RequestDecompressionMiddleware consumed that as an unbounded decompressed-body budget, allowing an anonymous decompression-bomb DoS (temporary, with amplification). ## Fix Gate the null-assignment behind the Microsoft.AspNetCore.Server.IISIntegration.ClearMaxRequestBodySize AppContext switch (default off). By default the server request body size limit is preserved; apps needing the legacy defer-to-IIS behavior can opt in. ## Customer Impact Prevents unbounded request-body decompression on IIS out-of-process. Opt-out switch provided for compatibility. ## Regression No. Long-standing behavior since 2.0; exposed via RequestDecompression (7.0+). ## Risk Low. Minimal, gated change with opt-out. Product change validated identically on main; unit tests added. Local full build blocked by internal feed provisioning; relying on PR CI. ## Testing Unit tests: default preserves limit, switch clears it, read-only untouched, absent feature. Verified end-to-end on main via real IIS Express out-of-process deploy. ---- #### AI description (iteration 1) #### PR Classification Bug fix to address unbounded request decompression on IIS out-of-process by changing the default behavior of MaxRequestBodySize handling. #### PR Summary This PR fixes a security issue where IIS out-of-process servers had unbounded request decompression by changing the default behavior to no longer clear the MaxRequestBodySize. An opt-in AppContext switch is introduced to preserve the legacy behavior for backward compatibility. - `IISMiddleware.cs`: Changed default behavior to preserve MaxRequestBodySize instead of clearing it, and added `ClearMaxRequestBodySizeSwitch` AppContext switch to enable legacy behavior - `IISMiddlewareTests.cs`: Added comprehensive tests covering the new default behavior, the opt-in switch, read-only feature handling, and missing feature scenarios <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Updates identity redirect handling. ---- #### AI description (iteration 1) #### PR Classification Security bug fix to prevent protocol-relative URL open redirect vulnerabilities in the Blazor identity redirect handling. #### PR Summary Enhances redirect URI validation in the identity redirect manager to block protocol-relative URLs (starting with "//") which could be exploited for open redirect attacks. - `IdentityRedirectManager.cs`: Added additional check to reject URIs starting with "//" as they are treated as protocol-relative URLs and pose a security risk, preventing potential open redirect vulnerabilities. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Restricts parameter updates and removal to roots created by JavaScript. ---- #### AI description (iteration 1) #### PR Classification Security enhancement to restrict JavaScript root component operations by validating that only components originally added by JavaScript can be updated or removed via JavaScript interop. #### PR Summary Adds validation to prevent JavaScript from modifying or removing Blazor root components that were not originally created by JavaScript, closing a potential security vulnerability. - `JSComponentInterop.cs`: Added `_jsComponentIds` HashSet to track JS-added components and `EnsureValidJSComponentId()` method to validate component operations in `SetRootComponentParameters()` and `RemoveRootComponent()` - `JSComponentInteropTest.cs`: New test file with tests verifying that parameter updates and removal operations are rejected for server-rendered components and allowed for JS-added components - `JSRootComponentsTest.cs` and `JavaScriptRootComponents.razor`: Added E2E test validating error handling when attempting to update parameters on non-JS root components - Test infrastructure files (`_ServerHost.cshtml`, `index.html`, `jsRootComponentInitializers.js`): Added `captureRendererInterop()` to intercept renderer interop methods and enable parameter update testing <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…otnet-efcore build 20260811.6 On relative base path root dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 8.0.30 -> To Version 8.0.31
…otnet-runtime build 20260810.18 On relative base path root Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 8.0.30-servicing.26367.20 -> To Version 8.0.31-servicing.26410.18 Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 From Version 8.0.30 -> To Version 8.0.31
…otnet-runtime build 20260812.28 On relative base path root Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 8.0.30-servicing.26367.20 -> To Version 8.0.31-servicing.26412.28 Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 From Version 8.0.30 -> To Version 8.0.31
…otnet-runtime build 20260813.7 On relative base path root Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 8.0.30-servicing.26367.20 -> To Version 8.0.31-servicing.26413.7 Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 From Version 8.0.30 -> To Version 8.0.31
…ng/internal/dotnet-efcore, dnceng/internal/dotnet-runtime This pull request updates the following dependencies [marker]: <> (Begin:83131e87-e80d-4d5b-f426-08dbd53b3319) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - **Subscription**: [83131e87-e80d-4d5b-f426-08dbd53b3319](https://maestro.dot.net/subscriptions?search=83131e87-e80d-4d5b-f426-08dbd53b3319) - **Build**: [20260813.7](https://dev.azure.com/dnceng/internal/_build/results?buildId=3047123) ([327049](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-runtime/build/327049)) - **Date Produced**: August 13, 2026 7:01:13 PM UTC - **Commit**: [2a19dd15d054021e9cb1d97fe3ceb6df910e4bcc](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GC2a19dd15d054021e9cb1d97fe3ceb6df910e4bcc) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.30-servicing.26367.20 to 8.0.31-servicing.26413.7][7] - Microsoft.Extensions.HostFactoryResolver.Sources - Microsoft.Internal.Runtime.AspNetCore.Transport - Microsoft.NETCore.BrowserDebugHost.Transport - Microsoft.NETCore.Platforms - Microsoft.SourceBuild.Intermediate.runtime.linux-x64 - From [8.0.30 to 8.0.31][7] - Microsoft.NET.Runtime.MonoAOTCompiler.Task - Microsoft.NET.Runtime.WebAssembly.Sdk - Microsoft.NETCore.App.Ref - Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm - Microsoft.NETCore.App.Runtime.win-x64 [7]: https://dev.azure.com/dnceng/internal/_git/dotnet-runtime/branches?baseVersion=GCa83db3e0eb2defb6220e15dae2f1a0462fdbf99f&targetVersion=GC2a19dd15d054021e9cb1d97fe3ceb6df910e4bcc&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:83131e87-e80d-4d5b-f426-08dbd53b3319) [marker]: <> (Begin:e179a2a7-bc5d-4498-2467-08dbd53ba9ce) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - **Subscription**: [e179a2a7-bc5d-4498-2467-08dbd53ba9ce](https://maestro.dot.net/subscriptions?search=e179a2a7-bc5d-4498-2467-08dbd53ba9ce) - **Build**: [20260811.6](https://dev.azure.com/dnceng/internal/_build/results?buildId=3045302) ([326672](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-efcore/build/326672)) - **Date Produced**: August 11, 2026 11:25:38 PM UTC - **Commit**: [75200b3923b6a4fa05a6e640b0e0634bedbdc14b](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?_a=history&version=GC75200b3923b6a4fa05a6e640b0e0634bedbdc14b) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.30 to 8.0.31][4] - dotnet-ef - Microsoft.EntityFrameworkCore - Microsoft.EntityFrameworkCore.Design - Microsoft.EntityFrameworkCore.InMemory - Microsoft.EntityFrameworkCore.Relational - Microsoft.EntityFrameworkCore.Sqlite ...
…otnet-efcore build 20260813.3 On relative base path root dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 8.0.31 -> To Version 8.0.31
…ng/internal/dotnet-efcore This pull request updates the following dependencies [marker]: <> (Begin:e179a2a7-bc5d-4498-2467-08dbd53ba9ce) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - **Subscription**: [e179a2a7-bc5d-4498-2467-08dbd53ba9ce](https://maestro.dot.net/subscriptions?search=e179a2a7-bc5d-4498-2467-08dbd53ba9ce) - **Build**: [20260813.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=3047413) ([327071](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-efcore/build/327071)) - **Date Produced**: August 13, 2026 8:32:57 PM UTC - **Commit**: [c8edbfbb24da8dc0c9e6687a6f0006a134ad7c2d](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?_a=history&version=GCc8edbfbb24da8dc0c9e6687a6f0006a134ad7c2d) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.31 to 8.0.31][1] - dotnet-ef - Microsoft.EntityFrameworkCore - Microsoft.EntityFrameworkCore.Design - Microsoft.EntityFrameworkCore.InMemory - Microsoft.EntityFrameworkCore.Relational - Microsoft.EntityFrameworkCore.Sqlite - Microsoft.EntityFrameworkCore.SqlServer - Microsoft.EntityFrameworkCore.Tools [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-efcore/branches?baseVersion=GC75200b3923b6a4fa05a6e640b0e0634bedbdc14b&targetVersion=GCc8edbfbb24da8dc0c9e6687a6f0006a134ad7c2d&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:e179a2a7-bc5d-4498-2467-08dbd53ba9ce)
…otnet-runtime build 20260820.15 On relative base path root Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 8.0.31-servicing.26413.7 -> To Version 8.0.31-servicing.26420.15 Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 From Version 8.0.31 -> To Version 8.0.31
…ng/internal/dotnet-runtime This pull request updates the following dependencies [marker]: <> (Begin:83131e87-e80d-4d5b-f426-08dbd53b3319) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - **Subscription**: [83131e87-e80d-4d5b-f426-08dbd53b3319](https://maestro.dot.net/subscriptions?search=83131e87-e80d-4d5b-f426-08dbd53b3319) - **Build**: [20260820.15](https://dev.azure.com/dnceng/internal/_build/results?buildId=3053243) ([328114](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-runtime/build/328114)) - **Date Produced**: August 21, 2026 9:03:55 PM UTC - **Commit**: [1219a42122cf5190c7f512850557e38c422430dc](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GC1219a42122cf5190c7f512850557e38c422430dc) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.31-servicing.26413.7 to 8.0.31-servicing.26420.15][1] - Microsoft.Extensions.HostFactoryResolver.Sources - Microsoft.Internal.Runtime.AspNetCore.Transport - Microsoft.NETCore.BrowserDebugHost.Transport - Microsoft.NETCore.Platforms - Microsoft.SourceBuild.Intermediate.runtime.linux-x64 - From [8.0.31 to 8.0.31][1] - Microsoft.NET.Runtime.MonoAOTCompiler.Task - Microsoft.NET.Runtime.WebAssembly.Sdk - Microsoft.NETCore.App.Ref - Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm - Microsoft.NETCore.App.Runtime.win-x64 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-runtime/branches?baseVersion=GC2a19dd15d054021e9cb1d97fe3ceb6df910e4bcc&targetVersion=GC1219a42122cf5190c7f512850557e38c422430dc&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:83131e87-e80d-4d5b-f426-08dbd53b3319)
…otnet-efcore build 20260821.8 On relative base path root dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 8.0.31 -> To Version 8.0.31
…ng/internal/dotnet-efcore This pull request updates the following dependencies [marker]: <> (Begin:e179a2a7-bc5d-4498-2467-08dbd53ba9ce) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - **Subscription**: [e179a2a7-bc5d-4498-2467-08dbd53ba9ce](https://maestro.dot.net/subscriptions?search=e179a2a7-bc5d-4498-2467-08dbd53ba9ce) - **Build**: [20260821.8](https://dev.azure.com/dnceng/internal/_build/results?buildId=3054252) ([328140](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-efcore/build/328140)) - **Date Produced**: August 21, 2026 11:07:43 PM UTC - **Commit**: [4caf9eeca38ab8bbc8857b975a8f0ad29ad2ea7f](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?_a=history&version=GC4caf9eeca38ab8bbc8857b975a8f0ad29ad2ea7f) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.31 to 8.0.31][1] - dotnet-ef - Microsoft.EntityFrameworkCore - Microsoft.EntityFrameworkCore.Design - Microsoft.EntityFrameworkCore.InMemory - Microsoft.EntityFrameworkCore.Relational - Microsoft.EntityFrameworkCore.Sqlite - Microsoft.EntityFrameworkCore.SqlServer - Microsoft.EntityFrameworkCore.Tools [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-efcore/branches?baseVersion=GCc8edbfbb24da8dc0c9e6687a6f0006a134ad7c2d&targetVersion=GC4caf9eeca38ab8bbc8857b975a8f0ad29ad2ea7f&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:e179a2a7-bc5d-4498-2467-08dbd53ba9ce)
…-merge-8.0-2026-09-09-1723
This was referenced Oct 15, 2026
Open
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.