[automated] Merge branch 'release/10.0.4xx' => 'release/11.0.1xx' - #56136
Open
github-actions[bot] wants to merge 232 commits into
Open
[automated] Merge branch 'release/10.0.4xx' => 'release/11.0.1xx'#56136github-actions[bot] wants to merge 232 commits into
github-actions[bot] wants to merge 232 commits into
Conversation
backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602 for 8.0 with 8.0 code changes
backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602 for 8.0 with 8.0 code changes
similar to https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/commit/24d060950e77e6c35cb491286c282434b77c2637?refName=refs%2Fheads%2Fnagilson-nagilson%2Fpipe-restrict-int8.0.3xx but slightly different due to msi package method changes in 100 vs 300 ---- #### AI description (iteration 1) #### PR Classification Security enhancement to restrict and validate workload installer IPC pipe access and file path operations. #### PR Summary This PR strengthens security in the .NET workload installer by restricting named pipe access to specific users and validating all file paths to prevent traversal attacks. The changes ensure that elevated installer operations cannot be exploited to access arbitrary system locations. - `WindowsUtils.cs`: Added methods to retrieve process user SIDs, create restricted pipe security (granting access only to the parent process user instead of all authenticated users), and validate file paths against traversal attacks - `NetSdkMsiInstallerServer.cs`: Modified pipe security configuration to use parent process user SID instead of the broad "authenticated users" group - `MsiInstallerBase.cs` and `MsiPackageCache.cs`: Added path validation to ensure log files and package paths remain within expected directories (cache root or user temp) - `WindowsInstallerTests.cs`: Added comprehensive unit tests covering pipe security, log file path validation, package path validation, and path component validation - `NativeMethods.cs`: Added P/Invoke declaration for `OpenProcessToken` to support retrieving process security identifiers <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Restrict workloads pipe access 8.0 backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602 for 8.0 with 8.0 code changes ---- #### AI description (iteration 1) #### PR Classification Security enhancement to restrict IPC pipe access and validate file paths in the Windows workload installer. #### PR Summary This PR strengthens security in the Windows installer by restricting named pipe access to specific users and adding path validation to prevent directory traversal attacks. - `WindowsUtils.cs`: Added methods to retrieve process user SIDs, create restricted pipe security (granting access only to the parent process user instead of all authenticated users), and validate log file paths and package paths against directory traversal attacks - `NetSdkMsiInstallerServer.cs`: Updated pipe security configuration to use parent process user SID instead of granting access to all authenticated users - `MsiInstallerBase.cs`: Added log file path validation before creating MSI logs and package path validation before installing MSI packages - `MsiPackageCache.cs`: Added validation for package ID, version, and manifest path to prevent path traversal when caching payloads - `WindowsInstallerTests.cs`: Added comprehensive unit tests for pipe security, path validation, and directory traversal attack prevention <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…udit in tests The unofficial CI pipeline (1472) does not have the AzureDevOps-Artifact-Feeds-Pats variable group linked, causing $(dn-bot-dnceng-artifact-feeds-rw) to resolve to a literal string instead of a PAT. This results in 401 Unauthorized errors when Helix test machines try to access internal NuGet feeds. Use $(System.AccessToken) instead, which is always available in any AzDO pipeline. The build service identity already has read access to the internal feeds. Additionally, disable NuGet audit (NuGetAudit=false) in two tests that intentionally reference old vulnerable packages (System.Net.Http 4.3.0, System.Text.RegularExpressions 4.3.0, Microsoft.NETCore.App 2.1.0) for conflict resolution testing. The NU1903 vulnerability warnings were causing assertion failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…3 repositories This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Workload.Emscripten.Current.Manifest-8.0.100**: from 8.0.27 to 8.0.28 (parent: Microsoft.NETCore.App.Runtime.win-x64) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e) - **Build**: [20260514.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975598) ([314475](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314475)) - **Date Produced**: May 15, 2026 6:39:55 AM UTC - **Commit**: [a2e8b8fd21f2fc18e5c0758c0584245e343ebeb7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.27 to 8.0.28][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [8.0.27-servicing.26230.1 to 8.0.28-servicing.26264.2][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCf219383822edeeaf58b32c4808576cf4b159ba71&targetVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e) [marker]: <> (Begin:82bc8158-ef88-4a27-3f7b-08dca299e604) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - **Subscription**: [82bc8158-ef88-4a27-3f7b-08dca299e604](https://maestro.dot.net/subscriptions?search=82bc8158-ef88-4a27-3f7b-08dca299e604) - **Build**: [20260514.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975153) ([314438](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-runtime/build/314438)) - **Date Produced**: May 14, 2026 11:26:57 PM UTC - **Commit**: [46295af5828b062bbbf93a9cef50fd8cb9fbcb09](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GC46295af5828b062bbbf93a9cef50fd8cb9fbcb09) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dncen...
…3 repositories This pull request updates the following dependencies [marker]: <> (Begin:5ae73aca-14b4-4570-17b0-08dbd53e3897) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore - **Subscription**: [5ae73aca-14b4-4570-17b0-08dbd53e3897](https://maestro.dot.net/subscriptions?search=5ae73aca-14b4-4570-17b0-08dbd53e3897) - **Build**: [20260518.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2977960) ([314868](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/314868)) - **Date Produced**: May 18, 2026 9:39:51 PM UTC - **Commit**: [206e82da31a67bbe713cf7aac8d6f04de099a9f8](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.27-servicing.26230.8 to 8.0.28-servicing.26268.3][1] - dotnet-dev-certs - dotnet-user-jwts - dotnet-user-secrets - Microsoft.AspNetCore.Analyzers - Microsoft.AspNetCore.App.Ref.Internal - Microsoft.AspNetCore.Components.SdkAnalyzers - Microsoft.AspNetCore.DeveloperCertificates.XPlat - Microsoft.AspNetCore.Mvc.Analyzers - Microsoft.AspNetCore.Mvc.Api.Analyzers - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0 - From [8.0.27 to 8.0.28][1] - Microsoft.AspNetCore.App.Ref - Microsoft.AspNetCore.App.Runtime.win-x64 - Microsoft.AspNetCore.Authorization - Microsoft.AspNetCore.Components.Web - Microsoft.AspNetCore.TestHost - Microsoft.Extensions.FileProviders.Embedded - Microsoft.Extensions.ObjectPool - Microsoft.JSInterop [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GCbe2530c3035e4bfa7670c6b18f5a64ef89e0e80d&targetVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:5ae73aca-14b4-4570-17b0-08dbd53e3897) [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.27-servicing.26230.2 to 8.0.28-servicing.26264.9 (parent: Microsoft.WindowsDesktop.App.Ref) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:dd95552e-72fb-4363-9b59-08dbd5a5c3e7) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - **Subscription**: [dd95552e-72fb-4363-9b59-08dbd5a5c3e7](https://maestro.dot.net/subscriptions?search=dd95552e-72fb-4363-9b59-08dbd5a5...
…dnceng/internal/dotnet-windowsdesktop This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26264.9 to 8.0.28-servicing.26265.4 (parent: Microsoft.WindowsDesktop.App.Ref) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:43ca46dd-3142-499e-f076-08dbd5a5cbe7) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [43ca46dd-3142-499e-f076-08dbd5a5cbe7](https://maestro.dot.net/subscriptions?search=43ca46dd-3142-499e-f076-08dbd5a5cbe7) - **Build**: [20260518.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978265) ([314896](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314896)) - **Date Produced**: May 19, 2026 12:00:47 AM UTC - **Commit**: [ec791e700315d8dcaecb11a6a1850092afad1ca7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCec791e700315d8dcaecb11a6a1850092afad1ca7) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28 to 8.0.28][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [8.0.28-servicing.26264.2 to 8.0.28-servicing.26268.2][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&targetVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
…dnceng/internal/dotnet-windowsdesktop This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26264.9 to 8.0.28-servicing.26265.4 (parent: Microsoft.WindowsDesktop.App.Ref) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e) - **Build**: [20260518.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978265) ([314896](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314896)) - **Date Produced**: May 19, 2026 12:00:47 AM UTC - **Commit**: [ec791e700315d8dcaecb11a6a1850092afad1ca7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCec791e700315d8dcaecb11a6a1850092afad1ca7) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28 to 8.0.28][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [8.0.28-servicing.26264.2 to 8.0.28-servicing.26268.2][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&targetVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e)
…dnceng/internal/dotnet-aspnetcore This pull request updates the following dependencies [marker]: <> (Begin:5ae73aca-14b4-4570-17b0-08dbd53e3897) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore - **Subscription**: [5ae73aca-14b4-4570-17b0-08dbd53e3897](https://maestro.dot.net/subscriptions?search=5ae73aca-14b4-4570-17b0-08dbd53e3897) - **Build**: [20260519.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979206) ([315073](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/315073)) - **Date Produced**: May 19, 2026 11:13:23 PM UTC - **Commit**: [bb9eccba9080e07bce32c0bc27c3564c753a7cfe](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28-servicing.26268.3 to 8.0.28-servicing.26269.13][1] - dotnet-dev-certs - dotnet-user-jwts - dotnet-user-secrets - Microsoft.AspNetCore.Analyzers - Microsoft.AspNetCore.App.Ref.Internal - Microsoft.AspNetCore.Components.SdkAnalyzers - Microsoft.AspNetCore.DeveloperCertificates.XPlat - Microsoft.AspNetCore.Mvc.Analyzers - Microsoft.AspNetCore.Mvc.Api.Analyzers - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0 - From [8.0.28 to 8.0.28][1] - Microsoft.AspNetCore.App.Ref - Microsoft.AspNetCore.App.Runtime.win-x64 - Microsoft.AspNetCore.Authorization - Microsoft.AspNetCore.Components.Web - Microsoft.AspNetCore.TestHost - Microsoft.Extensions.FileProviders.Embedded - Microsoft.Extensions.ObjectPool - Microsoft.JSInterop [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&targetVersion=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:5ae73aca-14b4-4570-17b0-08dbd53e3897)
…dnceng/internal/dotnet-aspnetcore This pull request updates the following dependencies [marker]: <> (Begin:1ab2aba6-b648-40a9-9fe8-08dca2920c50) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore - **Subscription**: [1ab2aba6-b648-40a9-9fe8-08dca2920c50](https://maestro.dot.net/subscriptions?search=1ab2aba6-b648-40a9-9fe8-08dca2920c50) - **Build**: [20260519.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979206) ([315073](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/315073)) - **Date Produced**: May 19, 2026 11:13:23 PM UTC - **Commit**: [bb9eccba9080e07bce32c0bc27c3564c753a7cfe](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28-servicing.26268.3 to 8.0.28-servicing.26269.13][1] - dotnet-dev-certs - dotnet-user-jwts - dotnet-user-secrets - Microsoft.AspNetCore.Analyzers - Microsoft.AspNetCore.App.Ref.Internal - Microsoft.AspNetCore.Components.SdkAnalyzers - Microsoft.AspNetCore.DeveloperCertificates.XPlat - Microsoft.AspNetCore.Mvc.Analyzers - Microsoft.AspNetCore.Mvc.Api.Analyzers - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0 - From [8.0.28 to 8.0.28][1] - Microsoft.AspNetCore.App.Ref - Microsoft.AspNetCore.App.Runtime.win-x64 - Microsoft.AspNetCore.Authorization - Microsoft.AspNetCore.Components.Web - Microsoft.AspNetCore.TestHost - Microsoft.Extensions.FileProviders.Embedded - Microsoft.Extensions.ObjectPool - Microsoft.JSInterop [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&targetVersion=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:1ab2aba6-b648-40a9-9fe8-08dca2920c50)
…dnceng/internal/dotnet-windowsdesktop This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26265.4 to 8.0.28-servicing.26269.2 (parent: Microsoft.WindowsDesktop.App.Ref) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:43ca46dd-3142-499e-f076-08dbd5a5cbe7) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [43ca46dd-3142-499e-f076-08dbd5a5cbe7](https://maestro.dot.net/subscriptions?search=43ca46dd-3142-499e-f076-08dbd5a5cbe7) - **Build**: [20260519.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979365) ([315092](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/315092)) - **Date Produced**: May 20, 2026 1:17:40 AM UTC - **Commit**: [432d0577ee8d6a36654d23a83182a0c7da27a69f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC432d0577ee8d6a36654d23a83182a0c7da27a69f) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28 to 8.0.28][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [8.0.28-servicing.26268.2 to 8.0.28-servicing.26269.1][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&targetVersion=GC432d0577ee8d6a36654d23a83182a0c7da27a69f&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
…dnceng/internal/dotnet-windowsdesktop This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26265.4 to 8.0.28-servicing.26269.2 (parent: Microsoft.WindowsDesktop.App.Ref) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e) - **Build**: [20260519.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979365) ([315092](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/315092)) - **Date Produced**: May 20, 2026 1:17:40 AM UTC - **Commit**: [432d0577ee8d6a36654d23a83182a0c7da27a69f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC432d0577ee8d6a36654d23a83182a0c7da27a69f) - **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.28 to 8.0.28][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [8.0.28-servicing.26268.2 to 8.0.28-servicing.26269.1][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&targetVersion=GC432d0577ee8d6a36654d23a83182a0c7da27a69f&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e)
…de-rw-wif service connection ## Problem The VMR sync pipeline (`sdk-dotnet-dotnet-synchronization-internal`) has been silently failing to push commits to `dotnet-dotnet`'s `internal/release/9.0.1xx` branch since ~April 30, 2026. The sync step succeeds (creates local commits), but `darc vmr push` reports success without actually updating the remote branch. ## Root Cause The pipeline uses the `VmrSyncPipeline` service connection (SP App ID `6a305b75-9314-42bd-b669-9feb14f21d5a`) to mint an AzDO access token for the push. This SP does **not** have working write access to the `dotnet-dotnet` repo (which has restricted permissions where even Contributors are denied access). ## Fix Switch to `dnceng-build-rw-code-rw-wif` — the same service connection used by the **installer** repo's VMR sync on `internal/release/8.0.4xx`, which is proven to work for pushing to `dotnet-dotnet`. This change also adds explicit error handling for token acquisition (empty token, non-zero exit code) matching the installer's pattern. ## Evidence - Build 2981189: Sync created commits successfully, push logged `Pushed branch refs/heads/internal/release/9.0.1xx to remote origin` but the branch tip hasn't moved since April 30 (commit `14d5ddefede18b29eb0f2ea918c79861a5211177`) - The installer repo (`internal/release/8.0.4xx`) uses `dnceng-build-rw-code-rw-wif` with the same `darc vmr push` command and succeeds - Permission grants to the VmrSyncPipeline SP (ACEs, group membership) did not resolve the issue ---- #### AI description (iteration 1) #### PR Classification Infrastructure change to switch authentication method for VMR synchronization from a federated service connection to a workload identity federation (WIF) service connection. #### PR Summary Updates the VMR synchronization pipeline to use the `dnceng-build-rw-code-rw-wif` Azure service connection for minting Azure DevOps tokens, replacing the previous federated access token template approach. - `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Replaced the `get-federated-access-token.yml` template step with an `AzureCLI@2` task that directly acquires an AzDO access token using the new WIF service connection - `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Added error handling and validation logic to ensure the minted token is valid before proceeding with VMR push operations <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
…0260812.4 On relative base path root Microsoft.TemplateEngine.Abstractions From Version 9.0.318 -> To Version 9.0.318 Microsoft.TemplateEngine.Mocks From Version 9.0.318-servicing.26411.5 -> To Version 9.0.318-servicing.26412.4
Updated Dependencies: dotnet-dev-certs, dotnet-user-jwts, dotnet-user-secrets, Microsoft.AspNetCore.Analyzers, Microsoft.AspNetCore.App.Ref.Internal, Microsoft.AspNetCore.Components.SdkAnalyzers, Microsoft.AspNetCore.DeveloperCertificates.XPlat, Microsoft.AspNetCore.Mvc.Analyzers, Microsoft.AspNetCore.Mvc.Api.Analyzers, Microsoft.Dotnet.WinForms.ProjectTemplates, Microsoft.DotNet.Wpf.ProjectTemplates, Microsoft.NET.HostModel, Microsoft.NET.Sdk.WindowsDesktop, Microsoft.NETCore.Platforms, Microsoft.WindowsDesktop.App.Internal (Version 10.0.12-servicing.26414.116 -> 10.0.12-servicing.26418.103) Microsoft.AspNetCore.App.Ref, Microsoft.AspNetCore.Authentication.Facebook, Microsoft.AspNetCore.Authentication.Google, Microsoft.AspNetCore.Authentication.MicrosoftAccount, Microsoft.AspNetCore.Authorization, Microsoft.AspNetCore.Components, Microsoft.AspNetCore.Components.Analyzers, Microsoft.AspNetCore.Components.Forms, Microsoft.AspNetCore.Components.Web, Microsoft.AspNetCore.Components.WebAssembly, Microsoft.AspNetCore.Components.WebAssembly.Server, Microsoft.AspNetCore.Components.WebView, Microsoft.AspNetCore.Metadata, Microsoft.AspNetCore.TestHost, Microsoft.Bcl.AsyncInterfaces, Microsoft.DotNet.Web.ItemTemplates.10.0, Microsoft.DotNet.Web.ProjectTemplates.10.0, Microsoft.Extensions.Configuration.Ini, Microsoft.Extensions.DependencyModel, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.FileProviders.Embedded, Microsoft.Extensions.FileSystemGlobbing, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.ObjectPool, Microsoft.JSInterop, Microsoft.McpServer.ProjectTemplates.10.0, Microsoft.NET.ILLink.Tasks, Microsoft.NET.Runtime.Emscripten.3.1.56.Cache.win-x64, Microsoft.NETCore.App.Ref, Microsoft.Win32.SystemEvents, Microsoft.WindowsDesktop.App.Ref, System.CodeDom, System.ComponentModel.Composition, System.Composition.AttributedModel, System.Composition.Convention, System.Composition.Hosting, System.Composition.Runtime, System.Composition.TypedParts, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Formats.Asn1, System.IO.Hashing, System.Reflection.MetadataLoadContext, System.Resources.Extensions, System.Security.Cryptography.Pkcs, System.Security.Cryptography.ProtectedData, System.Security.Cryptography.Xml, System.Security.Permissions, System.ServiceProcess.ServiceController, System.Text.Encoding.CodePages, System.Text.Json, System.Windows.Extensions (Version 10.0.12 -> 10.0.12) Microsoft.AspNetCore.Mvc.Razor.Extensions.Tooling.Internal, Microsoft.CodeAnalysis.Razor.Tooling.Internal, Microsoft.NET.Sdk.Razor.SourceGenerators.Transport (Version 10.0.0-preview.26414.116 -> 10.0.0-preview.26418.103) Microsoft.Build (Version 18.0.11 -> 18.0.11) Microsoft.Build.Localization (Version 18.0.11-servicing-26414-116 -> 18.0.11-servicing-26418-103) Microsoft.Build.NuGetSdkResolver, NuGet.Build.Tasks, NuGet.Build.Tasks.Console, NuGet.Build.Tasks.Pack, NuGet.CommandLine.XPlat, NuGet.Commands, NuGet.Common, NuGet.Configuration, NuGet.Credentials, NuGet.DependencyResolver.Core, NuGet.Frameworks, NuGet.LibraryModel, NuGet.Localization, NuGet.Packaging, NuGet.ProjectModel, NuGet.Protocol, NuGet.Versioning (Version 7.0.3-rc.41516 -> 7.0.3-rc.41903) Microsoft.Build.Tasks.Git, Microsoft.SourceLink.AzureRepos.Git, Microsoft.SourceLink.Bitbucket.Git, Microsoft.SourceLink.Common, Microsoft.SourceLink.GitHub, Microsoft.SourceLink.GitLab, Microsoft.TemplateEngine.Abstractions, Microsoft.TemplateEngine.Authoring.TemplateVerifier, Microsoft.TemplateEngine.Edge, Microsoft.TemplateEngine.Orchestrator.RunnableProjects, Microsoft.TemplateEngine.Utils, Microsoft.TemplateSearch.Common (Version 10.0.112 -> 10.0.112) Microsoft.CodeAnalysis, Microsoft.CodeAnalysis.BuildClient, Microsoft.CodeAnalysis.CSharp, Microsoft.CodeAnalysis.CSharp.CodeStyle, Microsoft.CodeAnalysis.CSharp.Features, Microsoft.CodeAnalysis.CSharp.Workspaces, Microsoft.CodeAnalysis.PublicApiAnalyzers, Microsoft.CodeAnalysis.Workspaces.Common, Microsoft.CodeAnalysis.Workspaces.MSBuild, Microsoft.Net.Compilers.Toolset, Microsoft.Net.Compilers.Toolset.Framework (Version 5.0.0-2.26414.116 -> 5.0.0-2.26418.103) Microsoft.Deployment.DotNet.Releases (Version 2.0.0-rtm.1.26414.116 -> 2.0.0-rtm.1.26418.103) Microsoft.DiaSymReader (Version 2.2.12 -> 2.2.12) Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Build.Tasks.Workloads, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.SignTool, Microsoft.DotNet.XliffTasks, Microsoft.DotNet.XUnitExtensions (Version 10.0.0-beta.26414.116 -> 10.0.0-beta.26418.103) Microsoft.FSharp.Compiler (Version 14.0.112-servicing.26414.116 -> 14.0.112-servicing.26418.103) Microsoft.NET.Test.Sdk, Microsoft.TestPlatform.Build, Microsoft.TestPlatform.CLI (Version 18.0.2-release-26414-116 -> 18.0.2-release-26418-103) Microsoft.TemplateEngine.Mocks, Microsoft.TemplateEngine.TestHelper, Microsoft.TemplateSearch.TemplateDiscovery (Version 10.0.112-servicing.26414.116 -> 10.0.112-servicing.26418.103) Microsoft.Web.Xdt (Version 3.2.12 -> 3.2.12) System.CommandLine (Version 2.0.12 -> 2.0.12) [[ commit created by automation ]]
Co-authored-by: Tomáš Matoušek <tmat@users.noreply.github.com> Co-authored-by: Mirroring <dnceng-mirroring@microsoft.com> Co-authored-by: Tomas Matousek <Tomas.Matousek@microsoft.com> Co-authored-by: ProductConstructionServiceProd <ProductConstructionServiceProd>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 09c018b7-c312-4602-8545-4dba038b497d
Restore the macOS exclusions that were lost while resolving the inter-branch merge conflicts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 21920d2-3a27-47ae-840a-6085e446b430
Co-authored-by: github-actions <github-actions@github.com>
[release/10.0.1xx] Source code updates from dotnet/dotnet
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Version.Details.props - eng/common/*
…ease/10.0.1xx-to-release/10.0.4xx # Conflicts: # eng/Versions.props Co-authored-by: mthalman <15789599+mthalman@users.noreply.github.com>
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
[release/10.0.4xx] Source code updates from dotnet/dotnet - Merge branch 'release/10.0.4xx' into darc-release/10.0.4xx-5b4ed4bf-bc32-4448-bec7-470d092b9ee3 - Restore test publish assets after code coverage copy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
[release/10.0.1xx] Source code updates from dotnet/dotnet
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Version.Details.props - eng/common/*
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Matt Thalman <mthalman@microsoft.com> Copilot-Session: faa04794-4e11-475b-a0ac-c1d237720025
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Version.Details.props - eng/common/*
github-actions
Bot
requested review from
a team,
lbussell and
mthalman
as code owners
September 4, 2026 18:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I detected changes in the release/10.0.4xx branch which have not been merged yet to release/11.0.1xx. I'm a robot and am configured to help you automatically keep release/11.0.1xx up to date, so I've opened this PR.
This PR merges commits made on release/10.0.4xx by the following committers:
Instructions for merging from UI
This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.
If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.
Instructions for merging via command line
Run these commands to merge this pull request from the command line.
or if you are using SSH
After PR checks are complete push the branch
Instructions for resolving conflicts
Instructions for updating this pull request
Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/10.0.4xx-to-release/11.0.1xx'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.
or if you are using SSH
Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.