Skip to content

[release/10.0.4xx] Source code updates from dotnet/dotnet - #55465

Merged
marcpopMSFT merged 4 commits into
release/10.0.4xxfrom
darc-release/10.0.4xx-735125e1-267b-44e4-95a9-d18a446914c9
Jul 28, 2026
Merged

[release/10.0.4xx] Source code updates from dotnet/dotnet#55465
marcpopMSFT merged 4 commits into
release/10.0.4xxfrom
darc-release/10.0.4xx-735125e1-267b-44e4-95a9-d18a446914c9

Conversation

@dotnet-maestro

@dotnet-maestro dotnet-maestro Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Note

This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

Updated Dependencies

  • From 10.4.0-preview.26360.115 to 10.4.0-preview.26374.102
    • Microsoft.AspNetCore.Mvc.Razor.Extensions.Tooling.Internal
    • Microsoft.CodeAnalysis.Razor.Tooling.Internal
    • Microsoft.NET.Sdk.Razor.SourceGenerators.Transport
  • From 18.9.2 to 18.9.4
    • Microsoft.Build
  • From 18.9.2-servicing-26360-115 to 18.9.4-servicing-26374-102
    • Microsoft.Build.Localization
  • From 7.9.0-rc.36115 to 7.9.0-rc.37502
    • Microsoft.Build.NuGetSdkResolver
    • NuGet.Build.Tasks
    • NuGet.Build.Tasks.Console
    • NuGet.Build.Tasks.Pack
    • NuGet.CommandLine.XPlat
    • NuGet.Commands
    • NuGet.Common
    • NuGet.Configuration
    • NuGet.Credentials
    • NuGet.DependencyResolver.Core
    • NuGet.Frameworks
    • NuGet.LibraryModel
    • NuGet.Localization
    • NuGet.Packaging
    • NuGet.ProjectModel
    • NuGet.Protocol
    • NuGet.Versioning
  • From 10.0.400-alpha.26360.115 to 10.0.400
    • Microsoft.Build.Tasks.Git
    • Microsoft.SourceLink.AzureRepos.Git
    • Microsoft.SourceLink.Bitbucket.Git
    • Microsoft.SourceLink.Common
    • Microsoft.SourceLink.GitHub
    • Microsoft.SourceLink.GitLab
  • From 5.9.0-1.26360.115 to 5.9.0-1.26374.102
    • Microsoft.CodeAnalysis
    • Microsoft.CodeAnalysis.BuildClient
    • Microsoft.CodeAnalysis.CSharp
    • Microsoft.CodeAnalysis.CSharp.CodeStyle
    • Microsoft.CodeAnalysis.CSharp.Features
    • Microsoft.CodeAnalysis.CSharp.Workspaces
    • Microsoft.CodeAnalysis.ExternalAccess.HotReload
    • Microsoft.CodeAnalysis.PublicApiAnalyzers
    • Microsoft.CodeAnalysis.Workspaces.Common
    • Microsoft.CodeAnalysis.Workspaces.MSBuild
    • Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost
    • Microsoft.Net.Compilers.Toolset
    • Microsoft.Net.Compilers.Toolset.Framework
  • From 10.0.0-beta.26360.115 to 10.0.0-beta.26374.102
    • Microsoft.DotNet.Arcade.Sdk
    • Microsoft.DotNet.Build.Tasks.Installers
    • Microsoft.DotNet.Build.Tasks.Templating
    • Microsoft.DotNet.Build.Tasks.Workloads
    • Microsoft.DotNet.Helix.Sdk
    • Microsoft.DotNet.SignTool
    • Microsoft.DotNet.XliffTasks
    • Microsoft.DotNet.XUnitExtensions
  • From 15.2.400-servicing.26360.115 to 15.2.400-servicing.26374.102
    • Microsoft.FSharp.Compiler
  • From 18.7.0-release-26360-115 to 18.7.0-release-26374-102
    • Microsoft.NET.Test.Sdk
    • Microsoft.TestPlatform.Build
    • Microsoft.TestPlatform.CLI
  • From 10.0.400-preview.26360.115 to 10.0.400
    • Microsoft.TemplateEngine.Abstractions
    • Microsoft.TemplateEngine.Authoring.TemplateVerifier
    • Microsoft.TemplateEngine.Edge
    • Microsoft.TemplateEngine.Orchestrator.RunnableProjects
    • Microsoft.TemplateEngine.Utils
    • Microsoft.TemplateSearch.Common
  • From 10.0.400-preview.26360.115 to 10.0.400-preview.26374.102
    • Microsoft.TemplateEngine.Mocks
    • Microsoft.TemplateEngine.TestHelper
    • Microsoft.TemplateSearch.TemplateDiscovery
  • From 10.0.9 to 10.0.10
    • Microsoft.AspNetCore.App.Ref
    • Microsoft.AspNetCore.Authentication.Facebook
    • Microsoft.AspNetCore.Authentication.Google
    • Microsoft.AspNetCore.Authentication.MicrosoftAccount
    • Microsoft.AspNetCore.Authorization
    • Microsoft.AspNetCore.Components
    • Microsoft.AspNetCore.Components.Analyzers
    • Microsoft.AspNetCore.Components.Forms
    • Microsoft.AspNetCore.Components.Web
    • Microsoft.AspNetCore.Components.WebAssembly
    • Microsoft.AspNetCore.Components.WebAssembly.Server
    • Microsoft.AspNetCore.Components.WebView
    • Microsoft.AspNetCore.Metadata
    • Microsoft.AspNetCore.TestHost
    • Microsoft.Bcl.AsyncInterfaces
    • Microsoft.DotNet.Web.ItemTemplates.10.0
    • Microsoft.DotNet.Web.ProjectTemplates.10.0
    • Microsoft.Extensions.Configuration.Ini
    • Microsoft.Extensions.DependencyInjection.Abstractions
    • Microsoft.Extensions.DependencyModel
    • Microsoft.Extensions.FileProviders.Abstractions
    • Microsoft.Extensions.FileProviders.Embedded
    • Microsoft.Extensions.FileSystemGlobbing
    • Microsoft.Extensions.Logging
    • Microsoft.Extensions.Logging.Abstractions
    • Microsoft.Extensions.Logging.Console
    • Microsoft.Extensions.ObjectPool
    • Microsoft.JSInterop
    • Microsoft.NET.ILLink.Tasks
    • Microsoft.NET.Runtime.Emscripten.3.1.56.Cache.win-x64
    • Microsoft.NETCore.App.Ref
    • Microsoft.Win32.SystemEvents
    • Microsoft.WindowsDesktop.App.Ref
    • System.CodeDom
    • System.ComponentModel.Composition
    • System.Composition.AttributedModel
    • System.Composition.Convention
    • System.Composition.Hosting
    • System.Composition.Runtime
    • System.Composition.TypedParts
    • System.Configuration.ConfigurationManager
    • System.Diagnostics.DiagnosticSource
    • System.Formats.Asn1
    • System.IO.Hashing
    • System.Reflection.MetadataLoadContext
    • System.Resources.Extensions
    • System.Security.Cryptography.Pkcs
    • System.Security.Cryptography.ProtectedData
    • System.Security.Cryptography.Xml
    • System.Security.Permissions
    • System.ServiceProcess.ServiceController
    • System.Text.Encoding.CodePages
    • System.Text.Json
    • System.Windows.Extensions
  • From 10.0.9-servicing.26270.113 to 10.0.10-servicing.26326.116
    • dotnet-dev-certs
    • dotnet-user-jwts
    • dotnet-user-secrets
    • Microsoft.AspNetCore.Analyzers
    • Microsoft.AspNetCore.App.Ref.Internal
    • Microsoft.AspNetCore.Components.SdkAnalyzers
    • Microsoft.AspNetCore.DeveloperCertificates.XPlat
    • Microsoft.AspNetCore.Mvc.Analyzers
    • Microsoft.AspNetCore.Mvc.Api.Analyzers
    • Microsoft.Dotnet.WinForms.ProjectTemplates
    • Microsoft.DotNet.Wpf.ProjectTemplates
    • Microsoft.NET.HostModel
    • Microsoft.NET.Sdk.WindowsDesktop
    • Microsoft.NETCore.Platforms
    • Microsoft.WindowsDesktop.App.Internal
  • From 3.2.9 to 3.2.10
    • Microsoft.Web.Xdt
  • From 2.0.9 to 2.0.10
    • System.CommandLine
  • From 2.2.9 to 2.2.10
    • Microsoft.DiaSymReader
  • From 2.0.0-rtm.1.26270.113 to 2.0.0-rtm.1.26326.116
    • Microsoft.Deployment.DotNet.Releases

Associated changes in source repos

Diff the source with this PR branch 
darc vmr diff --name-only https://github.com/dotnet/dotnet:981be135426277fabd550b94fa14cdaf7271b9c2..https://github.com/dotnet/sdk:darc-release/10.0.4xx-735125e1-267b-44e4-95a9-d18a446914c9

dotnet-maestro Bot added 2 commits July 24, 2026 21:21
@dotnet-maestro
Backflow from https://github.com/dotnet/dotnet / 981be13 build 324315
4fec7db 
Diff: https://github.com/dotnet/dotnet/compare/54004d2bbae6cef898a6b2819c56ca9530d65a3d..981be135426277fabd550b94fa14cdaf7271b9c2

From: dotnet/dotnet@54004d2
To: dotnet/dotnet@981be13

[[ commit created by automation ]]
@dotnet-maestro
Update dependencies from build 324315
d9d27b8 
Updated Dependencies:
Microsoft.AspNetCore.Mvc.Razor.Extensions.Tooling.Internal, Microsoft.CodeAnalysis.Razor.Tooling.Internal, Microsoft.NET.Sdk.Razor.SourceGenerators.Transport (Version 10.4.0-preview.26360.115 -> 10.4.0-preview.26374.102)
Microsoft.Build (Version 18.9.2 -> 18.9.4)
Microsoft.Build.Localization (Version 18.9.2-servicing-26360-115 -> 18.9.4-servicing-26374-102)
Microsoft.Build.NuGetSdkResolver, NuGet.Build.Tasks, NuGet.Build.Tasks.Console, NuGet.Build.Tasks.Pack, NuGet.CommandLine.XPlat, NuGet.Commands, NuGet.Common, NuGet.Configuration, NuGet.Credentials, NuGet.DependencyResolver.Core, NuGet.Frameworks, NuGet.LibraryModel, NuGet.Localization, NuGet.Packaging, NuGet.ProjectModel, NuGet.Protocol, NuGet.Versioning (Version 7.9.0-rc.36115 -> 7.9.0-rc.37502)
Microsoft.Build.Tasks.Git, Microsoft.SourceLink.AzureRepos.Git, Microsoft.SourceLink.Bitbucket.Git, Microsoft.SourceLink.Common, Microsoft.SourceLink.GitHub, Microsoft.SourceLink.GitLab (Version 10.0.400-alpha.26360.115 -> 10.0.400)
Microsoft.CodeAnalysis, Microsoft.CodeAnalysis.BuildClient, Microsoft.CodeAnalysis.CSharp, Microsoft.CodeAnalysis.CSharp.CodeStyle, Microsoft.CodeAnalysis.CSharp.Features, Microsoft.CodeAnalysis.CSharp.Workspaces, Microsoft.CodeAnalysis.ExternalAccess.HotReload, Microsoft.CodeAnalysis.PublicApiAnalyzers, Microsoft.CodeAnalysis.Workspaces.Common, Microsoft.CodeAnalysis.Workspaces.MSBuild, Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost, Microsoft.Net.Compilers.Toolset, Microsoft.Net.Compilers.Toolset.Framework (Version 5.9.0-1.26360.115 -> 5.9.0-1.26374.102)
Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Build.Tasks.Workloads, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.SignTool, Microsoft.DotNet.XliffTasks, Microsoft.DotNet.XUnitExtensions (Version 10.0.0-beta.26360.115 -> 10.0.0-beta.26374.102)
Microsoft.FSharp.Compiler (Version 15.2.400-servicing.26360.115 -> 15.2.400-servicing.26374.102)
Microsoft.NET.Test.Sdk, Microsoft.TestPlatform.Build, Microsoft.TestPlatform.CLI (Version 18.7.0-release-26360-115 -> 18.7.0-release-26374-102)
Microsoft.TemplateEngine.Abstractions, Microsoft.TemplateEngine.Authoring.TemplateVerifier, Microsoft.TemplateEngine.Edge, Microsoft.TemplateEngine.Orchestrator.RunnableProjects, Microsoft.TemplateEngine.Utils, Microsoft.TemplateSearch.Common (Version 10.0.400-preview.26360.115 -> 10.0.400)
Microsoft.TemplateEngine.Mocks, Microsoft.TemplateEngine.TestHelper, Microsoft.TemplateSearch.TemplateDiscovery (Version 10.0.400-preview.26360.115 -> 10.0.400-preview.26374.102)
Microsoft.NETCore.App.Ref, System.IO.Hashing, Microsoft.Extensions.DependencyModel, Microsoft.NET.Runtime.Emscripten.3.1.56.Cache.win-x64, Microsoft.NET.ILLink.Tasks, System.CodeDom, System.ComponentModel.Composition, System.Formats.Asn1, System.Security.Cryptography.ProtectedData, System.Text.Encoding.CodePages, System.Resources.Extensions, Microsoft.WindowsDesktop.App.Ref, Microsoft.AspNetCore.App.Ref, Microsoft.AspNetCore.Authentication.Facebook, Microsoft.AspNetCore.Authentication.Google, Microsoft.AspNetCore.Authentication.MicrosoftAccount, Microsoft.AspNetCore.Components, Microsoft.AspNetCore.Components.Analyzers, Microsoft.AspNetCore.Components.Forms, Microsoft.AspNetCore.Components.WebAssembly, Microsoft.AspNetCore.Components.WebAssembly.Server, Microsoft.AspNetCore.Components.WebView, Microsoft.AspNetCore.Metadata, Microsoft.Extensions.FileProviders.Embedded, Microsoft.AspNetCore.Authorization, Microsoft.AspNetCore.Components.Web, Microsoft.JSInterop, Microsoft.Extensions.ObjectPool, Microsoft.AspNetCore.TestHost, Microsoft.DotNet.Web.ItemTemplates.10.0, Microsoft.DotNet.Web.ProjectTemplates.10.0, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.FileSystemGlobbing, System.ServiceProcess.ServiceController, System.Text.Json, Microsoft.Bcl.AsyncInterfaces, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Win32.SystemEvents, System.Composition.AttributedModel, System.Composition.Convention, System.Composition.Hosting, System.Composition.Runtime, System.Composition.TypedParts, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Security.Cryptography.Pkcs, System.Security.Cryptography.Xml, System.Security.Permissions, System.Windows.Extensions, System.Reflection.MetadataLoadContext, Microsoft.Extensions.Configuration.Ini (Version 10.0.9 -> 10.0.10)
Microsoft.NETCore.Platforms, Microsoft.NET.HostModel, Microsoft.WindowsDesktop.App.Internal, Microsoft.Dotnet.WinForms.ProjectTemplates, Microsoft.DotNet.Wpf.ProjectTemplates, Microsoft.NET.Sdk.WindowsDesktop, Microsoft.AspNetCore.App.Ref.Internal, dotnet-dev-certs, dotnet-user-jwts, dotnet-user-secrets, Microsoft.AspNetCore.Analyzers, Microsoft.AspNetCore.Components.SdkAnalyzers, Microsoft.AspNetCore.Mvc.Analyzers, Microsoft.AspNetCore.Mvc.Api.Analyzers, Microsoft.AspNetCore.DeveloperCertificates.XPlat (Version 10.0.9-servicing.26270.113 -> 10.0.10-servicing.26326.116)
Microsoft.Web.Xdt (Version 3.2.9 -> 3.2.10)
System.CommandLine (Version 2.0.9 -> 2.0.10)
Microsoft.DiaSymReader (Version 2.2.9 -> 2.2.10)
Microsoft.Deployment.DotNet.Releases (Version 2.0.0-rtm.1.26270.113 -> 2.0.0-rtm.1.26326.116)
[[ commit created by automation ]]
@dotnet-maestro

dotnet-maestro Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Note

VMR PRs included in this codeflow update:

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@azure-pipelines

azure-pipelines Bot commented Jul 24, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@joeloff

joeloff commented Jul 24, 2026

Copy link
Copy Markdown
Member

Audit failure for MessagePackage. Will update

@joeloff

joeloff commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

CI Analysis — Build 1525908

Updated: corrected the root cause of the Windows failure below (it is an NU1903 audit regression, not the MSBuild version banner).

Build Analysis is red with 0 known-issue matches. Two distinct failures, only one of which is retryable:

# Test / Job Verdict
1 Microsoft.NET.Build.Tests — Windows (FullFramework and TestBuild) 🔴 PR-related regression
2 Microsoft.NET.ToolPack.Tests — macOS (TestBuild) 🟡 Flaky (test isolation)

1. GivenThatWeWantToBuildADesktopLibrary.It_resolves_assembly_conflicts_with_a_NETFramework_library — fails consistently on both Windows jobs (exit 1, BuildFailure).

The test has no baseline/expected-output file; it asserts the build passes and its stdout contains no warning and no MSB3243 (test source):

buildCommand.Execute().Should().Pass()
    .And.NotHaveStdOutContaining("warning")
    .And.NotHaveStdOutContaining("MSB3243");

The NotHaveStdOutContaining("warning") assertion now fails because the build emits two NU1903 package-vulnerability warnings:

NETFrameworkLibrary.csproj : warning NU1903: Package 'System.Net.Http' 4.3.0 has a known high severity vulnerability
NETFrameworkLibrary.csproj : warning NU1903: Package 'System.Text.RegularExpressions' 4.3.0 has a known high severity vulnerability

(The Did not expect string "MSBuild version 18.9.4…" text in the raw log is just FluentAssertions echoing the full captured stdout — that banner is incidental, not the cause.)

This is a NuGet audit (NU1903) regression surfaced by this codeflow PR — the build now flags the transitive System.Net.Http / System.Text.RegularExpressions 4.3.0 packages as vulnerable, most plausibly due to the NuGet update in this PR. It reproduces across two independent jobs, so a retry will not clear it. It needs either a test fix (e.g. NuGetAudit/NoWarn handling in the test asset, or relaxing the assertion) or a product-side decision. No existing issue tracks it.

2. GivenThatWeWantToPackAToolProjectWithP2PReference.It_does_not_add_p2p_references_as_package_references_to_nuspec — macOS only, single occurrence (exit 1):

System.IO.IOException: The process cannot access the file '...BzBWs7.binlog' because it is being used by another process.

The locked binlog belongs to a different test, indicating concurrent file-handle interference / test isolation — not related to this PR''s content. This one is retryable.

Recommendation: Retrying won''t get this green while failure #1 stands. The Windows It_resolves_assembly_conflicts_with_a_NETFramework_library failure needs the NU1903 vulnerability warnings addressed (in the test asset or assertion). Once that''s resolved, the macOS flake should clear on rerun.

@dotnet-maestro

dotnet-maestro Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id a044a5f5-0173-4a27-800f-d0339ec8ba32
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id a044a5f5-0173-4a27-800f-d0339ec8ba32 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@nagilson
[release/10.0.4xx] Disable NuGetAudit in It_resolves_assembly_conflic…
4e90567 
…ts_with_a_NETFramework_library

The intentionally-old conflict-resolution packages trigger NuGet audit
(NU1903) warnings, tripping the NotHaveStdOutContaining(warning) assertion.
Disable auditing for this test project. Backport of the fix on main.
Addresses codeflow PR #55465.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: dabd701c-a6bf-476e-a508-8c852cc72677
@dotnet-maestro

dotnet-maestro Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id a044a5f5-0173-4a27-800f-d0339ec8ba32
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id a044a5f5-0173-4a27-800f-d0339ec8ba32 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@marcpopMSFT
marcpopMSFT merged commit 042be08 into release/10.0.4xx Jul 28, 2026
34 checks passed
@marcpopMSFT
marcpopMSFT deleted the darc-release/10.0.4xx-735125e1-267b-44e4-95a9-d18a446914c9 branch July 28, 2026 20:28
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Jul 28, 2026
Merged
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Aug 7, 2026
Merged
@dotnet-milestone-bot dotnet-milestone-bot Bot added this to the 11.0-rc1 milestone Aug 7, 2026
@wtgodbe wtgodbe removed this from the 11.0-rc1 milestone Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcpopMSFT marcpopMSFT marcpopMSFT approved these changes
@nagilson nagilson nagilson approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@joeloff @marcpopMSFT @nagilson @wtgodbe