[automated] Merge branch 'release/10.0.3xx' => 'main'

Directory.Build.props

@@ -73,10 +73,20 @@
     <GenerateProgramFile>false</GenerateProgramFile>
   </PropertyGroup>
 
+  <!-- TODO: Re-enable NuGet Audit and fix alerts: https://github.com/dotnet/sdk/issues/51465 -->
+  <PropertyGroup>
+    <NuGetAudit>false</NuGetAudit>
+  </PropertyGroup>
+
   <PropertyGroup>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
 
+  <!-- TODO: Re-enable NuGet Audit and fix alerts: https://github.com/dotnet/sdk/issues/51466 -->
+  <PropertyGroup>
+    <NuGetAudit>false</NuGetAudit>
+  </PropertyGroup>
+
   <!-- Global usings -->
   <!-- See: https://learn.microsoft.com/dotnet/core/project-sdk/msbuild-props#using -->
   <ItemGroup>

build-duty-report-2026-01-26.md

@@ -0,0 +1,145 @@
+# SDK Build Duty Triage Report
+
+**Generated:** January 26, 2026  
+**Repos Monitored:** dotnet/sdk, dotnet/templating, dotnet/dotnet (VMR - SDK-owned only)
+
+---
+
+## Summary
+
+| Category | Count |
+|----------|-------|
+| 🟢 Ready to Merge | 1 |
+| ⏳ Waiting/On Hold | 1 |
+| 🔴 Failing/Blocked | 13 |
+| 🟡 Branch Lockdown | 10 |
+| 🟠 New/Pending Validation | 2 |
+
+---
+
+## 🟢 Ready to Merge PRs (1)
+
+These PRs have all checks passing and are ready for merge.
+
+### dotnet/dotnet VMR
+
+| PR | Title | Target Branch | Age |
+|----|-------|---------------|-----|
+| [#4419](https://github.com/dotnet/dotnet/pull/4419) | [release/10.0.1xx] Source code updates from dotnet/source-build-reference-packages | release/10.0.1xx | 0d |
+
+---
+
+## 🟠 New/Pending Validation PRs (2)
+
+These PRs were just created and are awaiting initial CI validation.
+
+### dotnet/sdk
+
+| PR | Title | Target Branch | Age |
+|----|-------|---------------|-----|
+| [#52673](https://github.com/dotnet/sdk/pull/52673) | [release/10.0.1xx] Source code updates from dotnet/dotnet | release/10.0.1xx | 0d |
+
+### dotnet/templating
+
+| PR | Title | Target Branch | Age |
+|----|-------|---------------|-----|
+| [#9757](https://github.com/dotnet/templating/pull/9757) | [release/10.0.1xx] Source code updates from dotnet/dotnet | release/10.0.1xx | 3d |
+
+---
+
+## ⏳ Waiting/On Hold PRs (1)
+
+These PRs have passing checks but have comments indicating they should wait before merging.
+
+### dotnet/templating
+
+| PR | Title | Target Branch | Age | Reason |
+|----|-------|-----------------|-----|--------|
+| [#9754](https://github.com/dotnet/templating/pull/9754) | [release/10.0.3xx] Source code updates from dotnet/dotnet | release/10.0.3xx | 4d | **Will break build** - Arcade version flow issue. Waiting for Arcade 10 to flow through VMR. CC @MichaelSimons. Also linked to [Issue #51574](https://github.com/dotnet/sdk/issues/51574). |
+
+---
+
+## 🟡 Branch Lockdown PRs (10)
+
+These PRs are in branches with lockdown labels and require approval to merge.
+
+### dotnet/sdk (8)
+
+| PR | Title | Target Branch | Age |
+|----|-------|---------------|-----|
+| [#52667](https://github.com/dotnet/sdk/pull/52667) | [release/9.0.1xx] Update dependencies from dotnet/roslyn-analyzers | release/9.0.1xx | 1d |
+| [#52624](https://github.com/dotnet/sdk/pull/52624) | [release/9.0.3xx] Update dependencies from dotnet/scenario-tests | release/9.0.3xx | 4d |
+| [#52606](https://github.com/dotnet/sdk/pull/52606) | [release/9.0.1xx] Update dependencies from dotnet/scenario-tests | release/9.0.1xx | 5d |
+| [#52594](https://github.com/dotnet/sdk/pull/52594) | [release/9.0.3xx] Update dependencies from dotnet/msbuild | release/9.0.3xx | 5d |
+| [#52592](https://github.com/dotnet/sdk/pull/52592) | [release/9.0.3xx] Update dependencies from dotnet/arcade | release/9.0.3xx | 5d |
+| [#52591](https://github.com/dotnet/sdk/pull/52591) | [release/9.0.1xx] Update dependencies from dotnet/source-build-reference-packages | release/9.0.1xx | 5d |
+| [#52590](https://github.com/dotnet/sdk/pull/52590) | [release/9.0.1xx] Update dependencies from dotnet/arcade | release/9.0.1xx | 5d |
+| [#52530](https://github.com/dotnet/sdk/pull/52530) | Merge branch 'release/8.0.1xx' => 'release/8.0.4xx' | release/8.0.4xx | 8d |
+
+### dotnet/templating (2)
+
+| PR | Title | Target Branch | Age |
+|----|-------|---------------|-----|
+| [#9746](https://github.com/dotnet/templating/pull/9746) | [release/9.0.1xx] Update dependencies from dotnet/arcade | release/9.0.1xx | 5d |
+| [#9744](https://github.com/dotnet/templating/pull/9744) | [release/9.0.3xx] Update dependencies from dotnet/arcade | release/9.0.3xx | 5d |
+
+---
+
+## 🔴 Failing/Blocked PRs (13)
+
+PRs with pending or failing status checks.
+
+### dotnet/sdk (11)
+
+| PR | Title | Target Branch | Age | Issue |
+|----|-------|---------------|-----|-------|
+| [#52662](https://github.com/dotnet/sdk/pull/52662) | [release/10.0.2xx] Source code updates from dotnet/dotnet | release/10.0.2xx | 3d | ⚠️ Opposite codeflow merged - needs decision (merge/close/force) |
+| [#52657](https://github.com/dotnet/sdk/pull/52657) | Merge branch 'release/10.0.1xx' => 'release/10.0.2xx' | release/10.0.2xx | 3d | ⏳ Checks pending |
+| [#52653](https://github.com/dotnet/sdk/pull/52653) | [release/10.0.2xx] Update dependencies from microsoft/testfx | release/10.0.2xx | 3d | ⏳ Checks pending |
+| [#52652](https://github.com/dotnet/sdk/pull/52652) | [release/10.0.1xx] Update dependencies from microsoft/testfx | release/10.0.1xx | 3d | ⏳ Checks pending |
+| [#52651](https://github.com/dotnet/sdk/pull/52651) | [main] Update dependencies from microsoft/testfx | main | 3d | ⏳ Checks pending |
+| [#52596](https://github.com/dotnet/sdk/pull/52596) | [main] Source code updates from dotnet/dotnet | main | 5d | ❌ ILLink analyzer error: `System.MissingMethodException` - [Issue #52599](https://github.com/dotnet/sdk/issues/52599) |
+| [#52588](https://github.com/dotnet/sdk/pull/52588) | Merge branch 'release/10.0.2xx' => 'release/10.0.3xx' | release/10.0.3xx | 5d | ❌ Build error: `TagHelperCollection` not found in RazorSdk - @dotnet/razor-tooling investigating |
+| [#52585](https://github.com/dotnet/sdk/pull/52585) | [release/10.0.3xx] Source code updates from dotnet/dotnet | release/10.0.3xx | 5d | ⏳ Checks pending |
+| [#52523](https://github.com/dotnet/sdk/pull/52523) | [release/10.0.2xx] Source code updates from dotnet/dotnet | release/10.0.2xx | 9d | ❌ Restore error NU1603: `Microsoft.Deployment.DotNet.Releases` version mismatch |
+| [#52519](https://github.com/dotnet/sdk/pull/52519) | Merge branch 'release/10.0.3xx' => 'main' | main | 9d | ❌ Test failures: `XunitMultiTFM`, `RunWithSolutionFilterAsFirstUnmatchedToken` - fix pushed, awaiting green |
+
+### github-actions[bot] Merge PRs (2)
+
+*Note: These are cross-branch merge PRs that require manual attention.*
+
+| Repo | PR | Title | Target Branch | Age | Issue |
+|------|-----|-------|---------------|-----|-------|
+| dotnet/sdk | [#52530](https://github.com/dotnet/sdk/pull/52530) | Merge 'release/8.0.1xx' => 'release/8.0.4xx' | release/8.0.4xx | 8d | Branch Lockdown |
+| dotnet/sdk | [#52529](https://github.com/dotnet/sdk/pull/52529) | Merge 'release/8.0.4xx' => 'release/9.0.1xx' | release/9.0.1xx | 8d | Branch Lockdown |
+
+---
+
+## Notes
+
+- **Status API shows pending for all PRs** - These repos use Azure Pipelines/GitHub Checks API which doesn't populate the Status API. Actual check status determined from comments and PR state.
+- All PRs checked against authors: `dotnet-maestro[bot]`, `github-actions[bot]` (Merge PRs only)
+- dotnet/dotnet VMR PRs filtered to SDK-owned: `dotnet/sdk`, `dotnet/templating`, `dotnet/deployment-tools`, `dotnet/source-build-reference-packages`
+
+### Total PR Count by Repo
+
+| Repo | Count |
+|------|-------|
+| dotnet/sdk | 19 |
+| dotnet/templating | 4 |
+| dotnet/dotnet (VMR) | 1 |
+| **Total** | **24** |
+
+### Key Issues Blocking Multiple PRs
+
+| Issue | Affected PRs | Status |
+|-------|--------------|--------|
+| [#52599](https://github.com/dotnet/sdk/issues/52599) - ILLink analyzer MissingMethodException | #52596 | Open, @MiYanni investigating |
+| [#51574](https://github.com/dotnet/sdk/issues/51574) - Arcade version flow | templating #9754 | On hold |
+| RazorSdk TagHelperCollection missing | #52588 | @dotnet/razor-tooling investigating |
+| Opposite codeflow merged | #52662, #52596, #52523 | Needs decision: merge/close/force |
+| Branch Lockdown (9.0.x branches) | 8 SDK PRs, 2 templating PRs | Requires approval |
+
+---
+
+*Report generated by SDK Build Duty skill*

sdk.slnx

@@ -66,6 +66,8 @@
   <Folder Name="/src/Cli/">
     <Project Path="src/Cli/dotnet/dotnet.csproj" />
     <Project Path="src/Cli/Microsoft.DotNet.Cli.CommandLine/Microsoft.DotNet.Cli.CommandLine.csproj" />
+    <Project Path="src/Cli/Microsoft.DotNet.Cli.CoreUtils/Microsoft.DotNet.Cli.CoreUtils.csproj" />
+    <Project Path="src/Cli/Microsoft.DotNet.Cli.Definitions/Microsoft.DotNet.Cli.Definitions.csproj" />
     <Project Path="src/Cli/Microsoft.DotNet.Cli.Utils/Microsoft.DotNet.Cli.Utils.csproj" />
     <Project Path="src/Cli/Microsoft.DotNet.Configurer/Microsoft.DotNet.Configurer.csproj" />
     <Project Path="src/Cli/Microsoft.DotNet.FileBasedPrograms/Microsoft.DotNet.FileBasedPrograms.Package.csproj" />

src/BuiltInTools/HotReloadAgent.Host/StartupHook.cs

@@ -26,6 +26,7 @@ internal sealed class StartupHook
                                                        && !OperatingSystem.IsIOS()
                                                        && !OperatingSystem.IsTvOS()
                                                        && !OperatingSystem.IsBrowser();
+    private static readonly bool s_supportsPosixSignals = s_supportsConsoleColor;
 
 #if NET10_0_OR_GREATER
     private static PosixSignalRegistration? s_signalRegistration;
@@ -125,7 +126,7 @@ private static void RegisterSignalHandlers()
             [DllImport("kernel32.dll", SetLastError = true)]
             static extern bool SetConsoleCtrlHandler(Delegate? handler, bool add);
         }
-        else
+        else if (s_supportsPosixSignals)
         {
 #if NET10_0_OR_GREATER
             // Register a handler for SIGTERM to allow graceful shutdown of the application on Unix.

src/BuiltInTools/HotReloadClient/HotReloadClients.cs

@@ -187,39 +187,28 @@ public async ValueTask InitialUpdatesAppliedAsync(CancellationToken cancellation
     }
 
     /// <param name="cancellationToken">Cancellation token. The cancellation should trigger on process terminatation.</param>
-    public async Task ApplyStaticAssetUpdatesAsync(IEnumerable<(string filePath, string relativeUrl, string assemblyName, bool isApplicationProject)> assets, CancellationToken cancellationToken)
+    public async Task ApplyStaticAssetUpdatesAsync(IEnumerable<StaticWebAsset> assets, CancellationToken cancellationToken)
     {
         if (browserRefreshServer != null)
         {
-            await browserRefreshServer.UpdateStaticAssetsAsync(assets.Select(static a => a.relativeUrl), cancellationToken);
+            await browserRefreshServer.UpdateStaticAssetsAsync(assets.Select(static a => a.RelativeUrl), cancellationToken);
         }
         else
         {
             var updates = new List<HotReloadStaticAssetUpdate>();
 
-            foreach (var (filePath, relativeUrl, assemblyName, isApplicationProject) in assets)
+            foreach (var asset in assets)
             {
-                ImmutableArray<byte> content;
                 try
                 {
-#if NET
-                    var blob = await File.ReadAllBytesAsync(filePath, cancellationToken);
-#else
-                    var blob = File.ReadAllBytes(filePath);
-#endif
-                    content = ImmutableCollectionsMarshal.AsImmutableArray(blob);
+                    ClientLogger.LogDebug("Loading asset '{Url}' from '{Path}'.", asset.RelativeUrl, asset.FilePath);
+                    updates.Add(await HotReloadStaticAssetUpdate.CreateAsync(asset, cancellationToken));
                 }
                 catch (Exception e) when (e is not OperationCanceledException)
                 {
-                    ClientLogger.LogError("Failed to read file {FilePath}: {Message}", filePath, e.Message);
+                    ClientLogger.LogError("Failed to read file {FilePath}: {Message}", asset.FilePath, e.Message);
                     continue;
                 }
-
-                updates.Add(new HotReloadStaticAssetUpdate(
-                    assemblyName: assemblyName,
-                    relativePath: relativeUrl,
-                    content: content,
-                    isApplicationProject));
             }
 
             await ApplyStaticAssetUpdatesAsync([.. updates], isProcessSuspended: false, cancellationToken);

src/BuiltInTools/HotReloadClient/HotReloadStaticAssetUpdate.cs

@@ -4,6 +4,10 @@
 #nullable enable
 
 using System.Collections.Immutable;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Threading;
+using System.Threading.Tasks;
 
 namespace Microsoft.DotNet.HotReload;
 
@@ -13,4 +17,18 @@ internal readonly struct HotReloadStaticAssetUpdate(string assemblyName, string
     public string AssemblyName { get; } = assemblyName;
     public ImmutableArray<byte> Content { get; } = content;
     public bool IsApplicationProject { get; } = isApplicationProject;
+
+    public static async ValueTask<HotReloadStaticAssetUpdate> CreateAsync(StaticWebAsset asset, CancellationToken cancellationToken)
+    {
+#if NET
+        var blob = await File.ReadAllBytesAsync(asset.FilePath, cancellationToken);
+#else
+        var blob = File.ReadAllBytes(asset.FilePath);
+#endif
+        return new HotReloadStaticAssetUpdate(
+            assemblyName: asset.AssemblyName,
+            relativePath: asset.RelativeUrl,
+            content: ImmutableCollectionsMarshal.AsImmutableArray(blob),
+            asset.IsApplicationProject);
+    }
 }

src/BuiltInTools/HotReloadClient/Utilities/PathExtensions.cs

@@ -0,0 +1,114 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+#nullable enable
+
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Text;
+
+namespace System.IO;
+
+internal static partial class PathExtensions
+{
+#if NET // binary compatibility
+    public static bool IsPathFullyQualified(string path)
+        => Path.IsPathFullyQualified(path);
+
+    public static string Join(string? path1, string? path2)
+        => Path.Join(path1, path2);
+#else
+    extension(Path)
+    {
+        public static bool IsPathFullyQualified(string path)
+           => Path.DirectorySeparatorChar == '\\'
+            ? !IsPartiallyQualified(path.AsSpan())
+            : Path.IsPathRooted(path);
+    }
+
+    // Copied from https://github.com/dotnet/runtime/blob/a6c5ba30aab998555e36aec7c04311935e1797ab/src/libraries/Common/src/System/IO/PathInternal.Windows.cs#L250
+
+    /// <summary>
+    /// Returns true if the path specified is relative to the current drive or working directory.
+    /// Returns false if the path is fixed to a specific drive or UNC path.  This method does no
+    /// validation of the path (URIs will be returned as relative as a result).
+    /// </summary>
+    /// <remarks>
+    /// Handles paths that use the alternate directory separator.  It is a frequent mistake to
+    /// assume that rooted paths (Path.IsPathRooted) are not relative.  This isn't the case.
+    /// "C:a" is drive relative- meaning that it will be resolved against the current directory
+    /// for C: (rooted, but relative). "C:\a" is rooted and not relative (the current directory
+    /// will not be used to modify the path).
+    /// </remarks>
+    private static bool IsPartiallyQualified(ReadOnlySpan<char> path)
+    {
+        if (path.Length < 2)
+        {
+            // It isn't fixed, it must be relative.  There is no way to specify a fixed
+            // path with one character (or less).
+            return true;
+        }
+
+        if (IsDirectorySeparator(path[0]))
+        {
+            // There is no valid way to specify a relative path with two initial slashes or
+            // \? as ? isn't valid for drive relative paths and \??\ is equivalent to \\?\
+            return !(path[1] == '?' || IsDirectorySeparator(path[1]));
+        }
+
+        // The only way to specify a fixed path that doesn't begin with two slashes
+        // is the drive, colon, slash format- i.e. C:\
+        return !((path.Length >= 3)
+            && (path[1] == Path.VolumeSeparatorChar)
+            && IsDirectorySeparator(path[2])
+            // To match old behavior we'll check the drive character for validity as the path is technically
+            // not qualified if you don't have a valid drive. "=:\" is the "=" file's default data stream.
+            && IsValidDriveChar(path[0]));
+    }
+
+    /// <summary>
+    /// True if the given character is a directory separator.
+    /// </summary>
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    internal static bool IsDirectorySeparator(char c)
+    {
+        return c == Path.DirectorySeparatorChar || c == Path.AltDirectorySeparatorChar;
+    }
+
+    /// <summary>
+    /// Returns true if the given character is a valid drive letter
+    /// </summary>
+    internal static bool IsValidDriveChar(char value)
+    {
+        return (uint)((value | 0x20) - 'a') <= (uint)('z' - 'a');
+    }
+
+    // Copied from https://github.com/dotnet/runtime/blob/main/src/libraries/System.Private.CoreLib/src/System/IO/Path.cs
+
+    private static readonly string s_directorySeparatorCharAsString = Path.DirectorySeparatorChar.ToString();
+
+    extension(Path)
+    {
+        public static string Join(string? path1, string? path2)
+        {
+            if (string.IsNullOrEmpty(path1))
+                return path2 ?? string.Empty;
+
+            if (string.IsNullOrEmpty(path2))
+                return path1;
+
+            return JoinInternal(path1, path2);
+        }
+    }
+
+    private static string JoinInternal(string first, string second)
+    {
+        Debug.Assert(first.Length > 0 && second.Length > 0, "should have dealt with empty paths");
+
+        bool hasSeparator = IsDirectorySeparator(first[^1]) || IsDirectorySeparator(second[0]);
+
+        return hasSeparator ?
+            string.Concat(first, second) :
+            string.Concat(first, s_directorySeparatorCharAsString, second);
+    }
+#endif
+}