From 274fd29051ce5206896368e211df94eb1e125b99 Mon Sep 17 00:00:00 2001
From: Fred Silberberg <frsilb@microsoft.com>
Date: Tue, 18 Aug 2026 13:44:05 -0700
Subject: [PATCH 1/5] Update vulnerable NuGet and MessagePack dependencies

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 eng/Packages.props                                              | 2 +-
 .../Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj         | 2 +-
 src/Tools/Replay/Replay.csproj                                  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/eng/Packages.props b/eng/Packages.props
index 5bd8e79afa810..6d64bddf55ef6 100644
--- a/eng/Packages.props
+++ b/eng/Packages.props
@@ -150,7 +150,7 @@
       Language Server
     -->
     <PackageVersion Include="Microsoft.VisualStudio.LanguageServer.Client.Implementation" Version="17.10.72-preview" />
-    <PackageVersion Include="NuGet.ProjectModel" Version="6.14.0" />
+    <PackageVersion Include="NuGet.ProjectModel" Version="6.14.3" />
     <PackageVersion Include="Microsoft.TestPlatform.TranslationLayer" Version="$(MicrosoftNETTestSdkVersion)" />
     <PackageVersion Include="Microsoft.TestPlatform.ObjectModel" Version="$(MicrosoftNETTestSdkVersion)" />
 
diff --git a/src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj b/src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj
index 5675368467f2c..2a5c8a720d043 100644
--- a/src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj
+++ b/src/Compilers/Core/MSBuildTaskTests/Microsoft.Build.Tasks.CodeAnalysis.UnitTests.csproj
@@ -41,7 +41,7 @@
     <PackageReference Include="Microsoft.Build" />
     <PackageReference Include="Microsoft.Build.Tasks.Core" />
     <PackageReference Include="Basic.CompilerLog.Util" />
-    <PackageReference Include="MessagePack" VersionOverride="3.1.4" />
+    <PackageReference Include="MessagePack" VersionOverride="3.1.7" />
   </ItemGroup>
   <ItemGroup>
     <Service Include="{82A7F48D-3B50-4B1E-B82E-3ADA8210C358}" />
diff --git a/src/Tools/Replay/Replay.csproj b/src/Tools/Replay/Replay.csproj
index c14d7a3868612..364794a0016f7 100644
--- a/src/Tools/Replay/Replay.csproj
+++ b/src/Tools/Replay/Replay.csproj
@@ -36,7 +36,7 @@
     <PackageReference Include="Mono.Options" />
     <PackageReference Include="MSBuild.StructuredLogger" />
     <PackageReference Include="Basic.CompilerLog.Util" />
-    <PackageReference Include="MessagePack" VersionOverride="3.1.4" />
+    <PackageReference Include="MessagePack" VersionOverride="3.1.7" />
     <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Condition="'$(TargetFramework)' == 'net472'" />
   </ItemGroup>
 

From 578c5d4b9435a03ce40295a1b7793d7a85240a1a Mon Sep 17 00:00:00 2001
From: Fred Silberberg <frsilb@microsoft.com>
Date: Tue, 18 Aug 2026 13:48:58 -0700
Subject: [PATCH 2/5] Update ASP.NET Core test runtime packages

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/Razor/Directory.Packages.props | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Razor/Directory.Packages.props b/src/Razor/Directory.Packages.props
index 6097ff1e769de..2eb30af8b2b3c 100644
--- a/src/Razor/Directory.Packages.props
+++ b/src/Razor/Directory.Packages.props
@@ -12,8 +12,8 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="Basic.Reference.Assemblies.AspNet80" Version="$(_BasicReferenceAssembliesVersion)" />
-    <PackageVersion Include="Microsoft.AspNetCore.App.Ref" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.App.Runtime.$(NetCoreSDKRuntimeIdentifier)" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.App.Ref" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.App.Runtime.$(NetCoreSDKRuntimeIdentifier)" Version="10.0.11" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzer.Testing" Version="$(MicrosoftCodeAnalysisTestingVersion)" />
     <PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="$(_MicrosoftExtensionsPackageVersion)" />
     <PackageVersion Include="Microsoft.NET.Sdk.Razor" Version="11.0.100-preview.4.26215.114" />

From 7c31ea1250d66b3071a0431a9842c900836a5446 Mon Sep 17 00:00:00 2001
From: Fred Silberberg <frsilb@microsoft.com>
Date: Tue, 18 Aug 2026 14:15:01 -0700
Subject: [PATCH 3/5] Update Visual Studio app-local runtime packages

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 eng/Packages.props | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/eng/Packages.props b/eng/Packages.props
index 6d64bddf55ef6..09822617d2c42 100644
--- a/eng/Packages.props
+++ b/eng/Packages.props
@@ -14,8 +14,8 @@
 
       We should try to keep this version in sync with the version of app-local runtime in VS.
     -->
-    <MicrosoftNetCoreAppRuntimePackagesVersion>10.0.1</MicrosoftNetCoreAppRuntimePackagesVersion>
-    <MicrosoftWindowsDesktopAppRuntimePackagesVersion>10.0.1</MicrosoftWindowsDesktopAppRuntimePackagesVersion>
+    <MicrosoftNetCoreAppRuntimePackagesVersion>10.0.11</MicrosoftNetCoreAppRuntimePackagesVersion>
+    <MicrosoftWindowsDesktopAppRuntimePackagesVersion>10.0.11</MicrosoftWindowsDesktopAppRuntimePackagesVersion>
     <_xunitVersion>2.9.2</_xunitVersion>
     <SqliteVersion>2.1.6</SqliteVersion>
     <!-- HumanizerVersion is referenced from the Text.Analyzers.Package.csproj -->

From dde0ee077b974dbacc227f1c4acb65a79a09ac97 Mon Sep 17 00:00:00 2001
From: Fred Silberberg <frsilb@microsoft.com>
Date: Tue, 18 Aug 2026 14:49:10 -0700
Subject: [PATCH 4/5] Pin Nerdbank.MessagePack to patched version

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: bd4ef3d1-3635-4dcb-8f10-d125f3fe3147
---
 eng/Packages.props | 1 +
 1 file changed, 1 insertion(+)

diff --git a/eng/Packages.props b/eng/Packages.props
index 09822617d2c42..59355c461f142 100644
--- a/eng/Packages.props
+++ b/eng/Packages.props
@@ -123,6 +123,7 @@
     <PackageVersion Include="Microsoft.VisualStudio.Utilities" Version="18.9.918" />
     <PackageVersion Include="Microsoft.VisualStudio.Utilities.Internal" Version="16.3.90" />
     <PackageVersion Include="Nerdbank.Streams" Version="2.13.16" />
+    <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.34" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="StreamJsonRpc" Version="2.26.10" />
     <PackageVersion Include="MessagePack" Version="2.5.302" />

From 525b805ad0f158cf61f7fb48283309a47b91d246 Mon Sep 17 00:00:00 2001
From: Fredric Silberberg <frsilb@microsoft.com>
Date: Mon, 24 Aug 2026 13:47:02 -0700
Subject: [PATCH 5/5] Pin crossgen to 10.0.1

---
 eng/Packages.props | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/eng/Packages.props b/eng/Packages.props
index cc1c5178bf15e..d9f527355c06c 100644
--- a/eng/Packages.props
+++ b/eng/Packages.props
@@ -154,7 +154,9 @@
 
     <PackageVersion Include="Microsoft.NETCore.App.Runtime.win-arm64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
     <PackageVersion Include="Microsoft.NETCore.App.Runtime.win-x64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
-    <PackageVersion Include="Microsoft.NETCore.App.crossgen2.win-x64" Version="$(MicrosoftNetCoreAppRuntimePackagesVersion)" />
+    <!-- Pin to 10.0.1 because versions 10.0.2 and later remove READYTORUN_FLAG_SKIP_TYPE_VALIDATION
+         from our binaries, causing additional JIT compilation in VS. -->
+    <PackageVersion Include="Microsoft.NETCore.App.crossgen2.win-x64" Version="10.0.1" />
     <PackageVersion Include="Microsoft.WindowsDesktop.App.Runtime.win-arm64" Version="$(MicrosoftWindowsDesktopAppRuntimePackagesVersion)" />
     <PackageVersion Include="Microsoft.WindowsDesktop.App.Runtime.win-x64" Version="$(MicrosoftWindowsDesktopAppRuntimePackagesVersion)" />