Skip to content

[automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx'#55158

Open
github-actions[bot] wants to merge 53 commits into
release/9.0.1xxfrom
merge/release/8.0.4xx-to-release/9.0.1xx
Open

[automated] Merge branch 'release/8.0.4xx' => 'release/9.0.1xx'#55158
github-actions[bot] wants to merge 53 commits into
release/9.0.1xxfrom
merge/release/8.0.4xx-to-release/9.0.1xx

Conversation

@github-actions

@github-actions github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

I detected changes in the release/8.0.4xx branch which have not been merged yet to release/9.0.1xx. I'm a robot and am configured to help you automatically keep release/9.0.1xx up to date, so I've opened this PR.

This PR merges commits made on release/8.0.4xx by the following committers:

  • nagilson
  • dotnet-bot
  • github-actions[bot]
  • joeloff
  • dotnet-maestro[bot]
  • marcpopMSFT
  • vseanreesermsft
  • SimonZhao888
  • dsplaisted
  • DonnaChen888

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/8.0.4xx
git pull --ff-only
git checkout release/9.0.1xx
git pull --ff-only
git merge --no-ff release/8.0.4xx

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/sdk HEAD:merge/release/8.0.4xx-to-release/9.0.1xx
or if you are using SSH
git push git@github.com:dotnet/sdk HEAD:merge/release/8.0.4xx-to-release/9.0.1xx

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/8.0.4xx-to-release/9.0.1xx'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/8.0.4xx-to-release/9.0.1xx origin/release/9.0.1xx
git pull https://github.com/dotnet/sdk merge/release/8.0.4xx-to-release/9.0.1xx
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/sdk HEAD:merge/release/8.0.4xx-to-release/9.0.1xx
or if you are using SSH
git fetch
git checkout -b merge/release/8.0.4xx-to-release/9.0.1xx origin/release/9.0.1xx
git pull git@github.com:dotnet/sdk merge/release/8.0.4xx-to-release/9.0.1xx
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/sdk HEAD:merge/release/8.0.4xx-to-release/9.0.1xx

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

Mirroring and others added 30 commits May 6, 2026 06:04
Restrict workloads pipe access 8.0

backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602 for 8.0 with 8.0 code changes

----
#### AI description  (iteration 1)
#### PR Classification
Security enhancement to restrict IPC pipe access and validate file paths in the Windows workload installer.

#### PR Summary
This PR strengthens security in the Windows installer by restricting named pipe access to specific users and adding path validation to prevent directory traversal attacks.

- `WindowsUtils.cs`: Added methods to retrieve process user SIDs, create restricted pipe security (granting access only to the parent process user instead of all authenticated users), and validate log file paths and package paths against directory traversal attacks
- `NetSdkMsiInstallerServer.cs`: Updated pipe security configuration to use parent process user SID instead of granting access to all authenticated users
- `MsiInstallerBase.cs`: Added log file path validation before creating MSI logs and package path validation before installing MSI packages
- `MsiPackageCache.cs`: Added validation for package ID, version, and manifest path to prevent path traversal when caching payloads
- `WindowsInstallerTests.cs`: Added comprehensive unit tests for pipe security, path validation, and directory traversal attack prevention
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…udit in tests

The unofficial CI pipeline (1472) does not have the AzureDevOps-Artifact-Feeds-Pats
variable group linked, causing $(dn-bot-dnceng-artifact-feeds-rw) to resolve to a
literal string instead of a PAT. This results in 401 Unauthorized errors when Helix
test machines try to access internal NuGet feeds.

Use $(System.AccessToken) instead, which is always available in any AzDO pipeline.
The build service identity already has read access to the internal feeds.

Additionally, disable NuGet audit (NuGetAudit=false) in two tests that intentionally
reference old vulnerable packages (System.Net.Http 4.3.0, System.Text.RegularExpressions
4.3.0, Microsoft.NETCore.App 2.1.0) for conflict resolution testing. The NU1903
vulnerability warnings were causing assertion failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…3 repositories

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Workload.Emscripten.Current.Manifest-8.0.100**: from 8.0.27 to 8.0.28 (parent: Microsoft.NETCore.App.Runtime.win-x64)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)


[marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e)
- **Build**: [20260514.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975598) ([314475](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314475))
- **Date Produced**: May 15, 2026 6:39:55 AM UTC
- **Commit**: [a2e8b8fd21f2fc18e5c0758c0584245e343ebeb7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.27 to 8.0.28][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [8.0.27-servicing.26230.1 to 8.0.28-servicing.26264.2][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCf219383822edeeaf58b32c4808576cf4b159ba71&targetVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e)




[marker]: <> (Begin:82bc8158-ef88-4a27-3f7b-08dca299e604)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- **Subscription**: [82bc8158-ef88-4a27-3f7b-08dca299e604](https://maestro.dot.net/subscriptions?search=82bc8158-ef88-4a27-3f7b-08dca299e604)
- **Build**: [20260514.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975153) ([314438](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-runtime/build/314438))
- **Date Produced**: May 14, 2026 11:26:57 PM UTC
- **Commit**: [46295af5828b062bbbf93a9cef50fd8cb9fbcb09](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GC46295af5828b062bbbf93a9cef50fd8cb9fbcb09)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dncen...
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26264.9 to 8.0.28-servicing.26265.4 (parent: Microsoft.WindowsDesktop.App.Ref)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e)
- **Build**: [20260518.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978265) ([314896](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314896))
- **Date Produced**: May 19, 2026 12:00:47 AM UTC
- **Commit**: [ec791e700315d8dcaecb11a6a1850092afad1ca7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCec791e700315d8dcaecb11a6a1850092afad1ca7)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [8.0.28-servicing.26264.2 to 8.0.28-servicing.26268.2][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&targetVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e)
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:1ab2aba6-b648-40a9-9fe8-08dca2920c50)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [1ab2aba6-b648-40a9-9fe8-08dca2920c50](https://maestro.dot.net/subscriptions?search=1ab2aba6-b648-40a9-9fe8-08dca2920c50)
- **Build**: [20260519.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979206) ([315073](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/315073))
- **Date Produced**: May 19, 2026 11:13:23 PM UTC
- **Commit**: [bb9eccba9080e07bce32c0bc27c3564c753a7cfe](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28-servicing.26268.3 to 8.0.28-servicing.26269.13][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&targetVersion=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:1ab2aba6-b648-40a9-9fe8-08dca2920c50)
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26265.4 to 8.0.28-servicing.26269.2 (parent: Microsoft.WindowsDesktop.App.Ref)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:11ffd28b-eb51-469a-d3fb-08dca292067e)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [11ffd28b-eb51-469a-d3fb-08dca292067e](https://maestro.dot.net/subscriptions?search=11ffd28b-eb51-469a-d3fb-08dca292067e)
- **Build**: [20260519.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979365) ([315092](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/315092))
- **Date Produced**: May 20, 2026 1:17:40 AM UTC
- **Commit**: [432d0577ee8d6a36654d23a83182a0c7da27a69f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC432d0577ee8d6a36654d23a83182a0c7da27a69f)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [8.0.28-servicing.26268.2 to 8.0.28-servicing.26269.1][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&targetVersion=GC432d0577ee8d6a36654d23a83182a0c7da27a69f&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:11ffd28b-eb51-469a-d3fb-08dca292067e)
…uild 20260524.2

On relative base path root
Microsoft.SourceBuild.Intermediate.roslyn-analyzers , Microsoft.CodeAnalysis.PublicApiAnalyzers From Version 3.11.0-beta1.26255.1 -> To Version 3.11.0-beta1.26274.2
Microsoft.CodeAnalysis.NetAnalyzers From Version 8.0.0-preview.26255.1 -> To Version 8.0.0-preview.26274.2
…527.2

On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.26224.3 -> To Version 8.0.0-beta.26277.2
…527.2

On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.26224.3 -> To Version 8.0.0-beta.26277.2
…528.3

On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.26224.3 -> To Version 8.0.0-beta.26278.3
…528.3

On relative base path root
Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XUnitExtensions From Version 8.0.0-beta.26224.3 -> To Version 8.0.0-beta.26278.3
…nals build 20260601.1

On relative base path root
Microsoft.SourceBuild.Intermediate.source-build-externals From Version 8.0.0-alpha.1.26265.1 -> To Version 8.0.0-alpha.1.26301.1
…nals build 20260601.1

On relative base path root
Microsoft.SourceBuild.Intermediate.source-build-externals From Version 8.0.0-alpha.1.26265.1 -> To Version 8.0.0-alpha.1.26301.1
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
DonnaChen888 and others added 22 commits June 3, 2026 10:04
…0260602.3

On relative base path root
Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 8.0.128-servicing.26267.1 -> To Version 8.0.129-servicing.26302.3
Microsoft.TemplateEngine.Abstractions From Version 8.0.128 -> To Version 8.0.129
…merge/release/8.0.1xx-to-release/8.0.4xx
…0260602.7

On relative base path root
Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 8.0.128-servicing.26267.1 -> To Version 8.0.129-servicing.26302.7
Microsoft.TemplateEngine.Abstractions From Version 8.0.128 -> To Version 8.0.129
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
…0260602.9

On relative base path root
Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 8.0.422-servicing.26267.3 -> To Version 8.0.423-servicing.26302.9
Microsoft.TemplateEngine.Abstractions From Version 8.0.422 -> To Version 8.0.423
…610.7

On relative base path root
dotnet-format From Version 8.3.657409 -> To Version 8.3.731007
Co-authored-by: Mirroring <dnceng-mirroring@microsoft.com>
Co-authored-by: Noah Gilson <noahgilson@microsoft.com>
Co-authored-by: ProductConstructionServiceProd <ProductConstructionServiceProd>
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: DonnaChen888 <v-donnachen@microsoft.com>
Co-authored-by: Daniel Plaisted <daplaist@microsoft.com>
Co-authored-by: Sean Reeser <v-seanreeser@microsoft.com>
Co-authored-by: Marc Paine <marcpop@microsoft.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: SimonZhao888 <133954995+SimonZhao888@users.noreply.github.com>
Co-authored-by: Simon Zhao (BEYONDSOFT CONSULTING INC) <v-weidzh@microsoft.com>
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
# Conflicts:
#	eng/Versions.props
#	src/Cli/dotnet/commands/dotnet-workload/elevate/WorkloadElevateCommand.cs
#	src/Cli/dotnet/commands/dotnet-workload/elevate/WorkloadElevateCommandParser.cs
#	src/Tests/dotnet.Tests/WindowsInstallerTests.cs
@nagilson nagilson enabled auto-merge July 7, 2026 17:21
@nagilson

nagilson commented Jul 7, 2026

Copy link
Copy Markdown
Member

Note

This comment was generated by GitHub Copilot on behalf of @nagilson (build duty).

Resolved the merge conflicts in favor of the newer target branch (9.0.1xx): eng/Versions.props and the workload elevate commands take the 9.0.1xx version, and WindowsInstallerTests.cs (deleted in 9.0.1xx) is removed. I also proactively fixed the same silent WindowsUtils.cs duplicate-member auto-merge that affected #55168 (8.0.4xx defined security helpers inline; 9.0.1xx uses SecurityUtils) by taking 9.0.1xx's version. Verified base is a superset and the merged tree is identical to 9.0.1xx.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants