Update dependency versions by 333fred · Pull Request #84952 · dotnet/roslyn

333fred · 2026-08-18T22:01:14Z

Addresses audit warnings for various packages that we depend on but don't directly ship. Unresolved are the sqlite warnings, which are being worked on separately.

Addresses most of #84885, except for the sqlite warnings.

Microsoft Reviewers: Open in CodeFlow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bd4ef3d1-3635-4dcb-8f10-d125f3fe3147

azure-pipelines · 2026-08-18T22:01:34Z

Azure Pipelines: Successfully started running 2 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run.

333fred · 2026-08-18T22:02:30Z

    <PackageVersion Include="Microsoft.VisualStudio.Utilities" Version="18.9.918" />
    <PackageVersion Include="Microsoft.VisualStudio.Utilities.Internal" Version="16.3.90" />
    <PackageVersion Include="Nerdbank.Streams" Version="2.13.16" />
+    <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.34" />


Note: this comes from Microsoft.VisualStudio.Composition, which isn't updated until 18.9.39. VS 18.9.1 does not ship with 18.9.39 of that package, so I opted for a transitive pin instead, as VS itself appears to do.

Consider adding a comment next to the entry to make that clear. Ideally nuget would help us highlight transitive only pins which could then later be removed again.

333fred · 2026-08-18T22:02:39Z

/pr-val

github-actions · 2026-08-18T22:03:10Z

View PR Validation Run triggered by @333fred

Parameters

Validation Type: pr-val
Pipeline ID: 8972
Pipeline Version: main
PR Number: 84952
Commit SHA: dde0ee077b974dbacc227f1c4acb65a79a09ac97
Source Branch: update-deps
Target Branch: main
Build ID: 15012178

Copilot

Pull request overview

This PR updates centrally managed dependency versions to address audit warnings for packages used in the repo (but not directly shipped), aligning several .NET runtime/ASP.NET Core package pins and bumping a few specific library versions.

Changes:

Bump MessagePack to 3.1.7 for the Replay tool and MSBuild task unit tests (via VersionOverride).
Update VS app-local runtime package version properties from 10.0.1 to 10.0.11 and bump NuGet.ProjectModel to 6.14.3.
Update Razor’s pinned Microsoft.AspNetCore.App.Ref and runtime packages from 10.0.1 to 10.0.11 and add a central pin for Nerdbank.MessagePack.

Show a summary per file

File	Description
src/Tools/Replay/Replay.csproj	Updates `MessagePack` override version used by the Replay tool.
src/Razor/Directory.Packages.props	Updates Razor’s pinned ASP.NET Core reference/runtime package versions.
src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj	Updates `MessagePack` override version used by MSBuild task unit tests.
eng/Packages.props	Updates VS runtime package version properties, bumps `NuGet.ProjectModel`, and adds a transitive pin for `Nerdbank.MessagePack`.

Review details

Files reviewed: 4/4 changed files
Comments generated: 0
Review effort level: Lite

jasonmalinowski · 2026-08-18T22:17:17Z

    <PackageReference Include="Microsoft.Build.Tasks.Core" />
    <PackageReference Include="Basic.CompilerLog.Util" />
-    <PackageReference Include="MessagePack" VersionOverride="3.1.4" />
+    <PackageReference Include="MessagePack" VersionOverride="3.1.7" />


Why do we have a VersionOverride here?

Packages.props has <PackageVersion Include="MessagePack" Version="2.5.302" /> which seems to get updated as part of the VS SDK updates

And Basic.CompilerLog.Util comes with 3.1.4.

333fred · 2026-08-19T00:54:57Z

/pr-val

github-actions · 2026-08-19T00:55:24Z

View PR Validation Run triggered by @333fred

Parameters

Validation Type: pr-val
Pipeline ID: 8972
Pipeline Version: main
PR Number: 84952
Commit SHA: 9a60e5d5fb4aad603baf70d333f3b8907d832c57
Source Branch: update-deps
Target Branch: main
Build ID: 15015263

Copilot

Review details

Files reviewed: 4/4 changed files
Comments generated: 1
Review effort level: Lite

333fred · 2026-08-19T22:24:49Z

/pr-val

github-actions · 2026-08-19T22:25:20Z

View PR Validation Run triggered by @333fred
Test Insertion

Parameters

Validation Type: pr-val
Pipeline ID: 8972
Pipeline Version: main
PR Number: 84952
Commit SHA: 612ea363d8722c6abdf83e558fd9fa0e831fedbd
Source Branch: update-deps
Target Branch: main
Build ID: 15027866

Copilot

Review details

Files reviewed: 4/4 changed files
Comments generated: 0 new
Review effort level: Lite

333fred · 2026-08-21T17:53:20Z

/pr-val

github-actions · 2026-08-21T17:53:48Z

View PR Validation Run triggered by @333fred

Parameters

Validation Type: pr-val
Pipeline ID: 8972
Pipeline Version: main
PR Number: 84952
Commit SHA: ec0d67659270dfcfd61703d80e0541ceaa94b6e3
Source Branch: update-deps
Target Branch: main
Build ID: 15052173

Copilot

Review details

Files reviewed: 4/4 changed files
Comments generated: 0 new
Review effort level: Lite

333fred · 2026-08-24T20:47:37Z

/pr-val

github-actions · 2026-08-24T20:48:10Z

View PR Validation Run triggered by @333fred

Parameters

Validation Type: pr-val
Pipeline ID: 8972
Pipeline Version: main
PR Number: 84952
Commit SHA: 525b805ad0f158cf61f7fb48283309a47b91d246
Source Branch: update-deps
Target Branch: main
Build ID: 15078163

Copilot

Review details

Files reviewed: 4/4 changed files
Comments generated: 0 new
Review effort level: Lite

333fred · 2026-08-26T17:09:47Z

Temporary exception for the methods jitted regressions in the insertion was approved, merging.

333fred and others added 4 commits August 18, 2026 13:44

Update vulnerable NuGet and MessagePack dependencies

274fd29

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update ASP.NET Core test runtime packages

578c5d4

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update Visual Studio app-local runtime packages

7c31ea1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pin Nerdbank.MessagePack to patched version

dde0ee0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bd4ef3d1-3635-4dcb-8f10-d125f3fe3147

Copilot AI lite review requested due to automatic review settings August 18, 2026 22:01

333fred requested review from a team as code owners August 18, 2026 22:01

Copilot started reviewing on behalf of 333fred August 18, 2026 22:01 View session

dotnet-policy-service Bot added the Area-Razor label Aug 18, 2026

333fred commented Aug 18, 2026

View reviewed changes

Copilot AI reviewed Aug 18, 2026

View reviewed changes

jasonmalinowski reviewed Aug 18, 2026

View reviewed changes

jasonmalinowski approved these changes Aug 18, 2026

View reviewed changes

JoeRobich approved these changes Aug 18, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 19, 2026 00:54

Copilot started reviewing on behalf of 333fred August 19, 2026 00:55 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Comment thread eng/Packages.props

RyanToth3 approved these changes Aug 19, 2026

View reviewed changes

333fred added Area-Infrastructure and removed Area-Razor labels Aug 19, 2026

Copilot AI review requested due to automatic review settings August 19, 2026 17:33

333fred force-pushed the update-deps branch from 9a60e5d to dde0ee0 Compare August 19, 2026 17:33

dotnet-policy-service Bot added the Area-Razor label Aug 19, 2026

Copilot started reviewing on behalf of 333fred August 19, 2026 17:34 View session

Copilot started reviewing on behalf of 333fred August 19, 2026 22:25 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

akhera99 approved these changes Aug 20, 2026

View reviewed changes

Merge branch 'main' into update-deps

ec0d676

Copilot AI review requested due to automatic review settings August 21, 2026 17:53

Copilot started reviewing on behalf of 333fred August 21, 2026 17:53 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Pin crossgen to 10.0.1

525b805

Copilot AI review requested due to automatic review settings August 24, 2026 20:47

Copilot started reviewing on behalf of 333fred August 24, 2026 20:47 View session

Copilot AI reviewed Aug 24, 2026

View reviewed changes

This was referenced Aug 24, 2026

Crossgen2 10.0.2+ reports false generic variance error and clears SkipTypeValidation dotnet/runtime#132724

Closed

Update SQLite Dependencies for nuget audit warnings #85015

Merged

jjonescz approved these changes Aug 26, 2026

View reviewed changes

333fred merged commit d641f24 into dotnet:main Aug 26, 2026
25 checks passed

333fred deleted the update-deps branch August 26, 2026 17:08

dotnet-policy-service Bot added this to the Next milestone Aug 26, 2026

dibarbet mentioned this pull request Aug 28, 2026

Update roslyn to 5.12.0-1.26428.1 dotnet/vscode-csharp#9712

Merged

dotnet-bot mentioned this pull request Sep 3, 2026

[Automated] PRs inserted in VS build main-12202.72 #85140

Closed

Uh oh!

Conversation

333fred commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Microsoft Reviewers: Open in CodeFlow

Uh oh!

azure-pipelines Bot commented Aug 18, 2026

Uh oh!

333fred Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

ViktorHofer Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

333fred commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

jasonmalinowski Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

JoeRobich Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

333fred Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

333fred commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

333fred commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026 • edited by JoeRobich Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

333fred commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

333fred commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

Uh oh!

333fred commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

333fred commented Aug 18, 2026 •

edited

Loading

JoeRobich Aug 18, 2026 •

edited

Loading

github-actions Bot commented Aug 19, 2026 •

edited by JoeRobich

Loading