Skip to content

[automated] Merge branch 'release/8.0.1xx' => 'release/8.0.4xx'#55168

Open
github-actions[bot] wants to merge 21 commits into
release/8.0.4xxfrom
merge/release/8.0.1xx-to-release/8.0.4xx
Open

[automated] Merge branch 'release/8.0.1xx' => 'release/8.0.4xx'#55168
github-actions[bot] wants to merge 21 commits into
release/8.0.4xxfrom
merge/release/8.0.1xx-to-release/8.0.4xx

Conversation

@github-actions

@github-actions github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

I detected changes in the release/8.0.1xx branch which have not been merged yet to release/8.0.4xx. I'm a robot and am configured to help you automatically keep release/8.0.4xx up to date, so I've opened this PR.

This PR merges commits made on release/8.0.1xx by the following committers:

  • nagilson
  • dotnet-bot
  • marcpopMSFT
  • vseanreesermsft
  • dsplaisted
  • DonnaChen888
  • dotnet-maestro[bot]

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/8.0.1xx
git pull --ff-only
git checkout release/8.0.4xx
git pull --ff-only
git merge --no-ff release/8.0.1xx

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/sdk HEAD:merge/release/8.0.1xx-to-release/8.0.4xx
or if you are using SSH
git push git@github.com:dotnet/sdk HEAD:merge/release/8.0.1xx-to-release/8.0.4xx

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/8.0.1xx-to-release/8.0.4xx'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/8.0.1xx-to-release/8.0.4xx origin/release/8.0.4xx
git pull https://github.com/dotnet/sdk merge/release/8.0.1xx-to-release/8.0.4xx
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/sdk HEAD:merge/release/8.0.1xx-to-release/8.0.4xx
or if you are using SSH
git fetch
git checkout -b merge/release/8.0.1xx-to-release/8.0.4xx origin/release/8.0.4xx
git pull git@github.com:dotnet/sdk merge/release/8.0.1xx-to-release/8.0.4xx
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/sdk HEAD:merge/release/8.0.1xx-to-release/8.0.4xx

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

Mirroring and others added 20 commits May 6, 2026 06:04
similar to https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/commit/24d060950e77e6c35cb491286c282434b77c2637?refName=refs%2Fheads%2Fnagilson-nagilson%2Fpipe-restrict-int8.0.3xx but slightly different due to msi package method changes in 100 vs 300

----
#### AI description  (iteration 1)
#### PR Classification
Security enhancement to restrict and validate workload installer IPC pipe access and file path operations.

#### PR Summary
This PR strengthens security in the .NET workload installer by restricting named pipe access to specific users and validating all file paths to prevent traversal attacks. The changes ensure that elevated installer operations cannot be exploited to access arbitrary system locations.

- `WindowsUtils.cs`: Added methods to retrieve process user SIDs, create restricted pipe security (granting access only to the parent process user instead of all authenticated users), and validate file paths against traversal attacks
- `NetSdkMsiInstallerServer.cs`: Modified pipe security configuration to use parent process user SID instead of the broad "authenticated users" group
- `MsiInstallerBase.cs` and `MsiPackageCache.cs`: Added path validation to ensure log files and package paths remain within expected directories (cache root or user temp)
- `WindowsInstallerTests.cs`: Added comprehensive unit tests covering pipe security, log file path validation, package path validation, and path component validation
- `NativeMethods.cs`: Added P/Invoke declaration for `OpenProcessToken` to support retrieving process security identifiers
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…3 repositories

This pull request updates the following dependencies

[marker]: <> (Begin:5ae73aca-14b4-4570-17b0-08dbd53e3897)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [5ae73aca-14b4-4570-17b0-08dbd53e3897](https://maestro.dot.net/subscriptions?search=5ae73aca-14b4-4570-17b0-08dbd53e3897)
- **Build**: [20260518.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2977960) ([314868](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/314868))
- **Date Produced**: May 18, 2026 9:39:51 PM UTC
- **Commit**: [206e82da31a67bbe713cf7aac8d6f04de099a9f8](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.27-servicing.26230.8 to 8.0.28-servicing.26268.3][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0
  - From [8.0.27 to 8.0.28][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GCbe2530c3035e4bfa7670c6b18f5a64ef89e0e80d&targetVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:5ae73aca-14b4-4570-17b0-08dbd53e3897)



[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.27-servicing.26230.2 to 8.0.28-servicing.26264.9 (parent: Microsoft.WindowsDesktop.App.Ref)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)


[marker]: <> (Begin:dd95552e-72fb-4363-9b59-08dbd5a5c3e7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- **Subscription**: [dd95552e-72fb-4363-9b59-08dbd5a5c3e7](https://maestro.dot.net/subscriptions?search=dd95552e-72fb-4363-9b59-08dbd5a5...
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26264.9 to 8.0.28-servicing.26265.4 (parent: Microsoft.WindowsDesktop.App.Ref)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [43ca46dd-3142-499e-f076-08dbd5a5cbe7](https://maestro.dot.net/subscriptions?search=43ca46dd-3142-499e-f076-08dbd5a5cbe7)
- **Build**: [20260518.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978265) ([314896](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/314896))
- **Date Produced**: May 19, 2026 12:00:47 AM UTC
- **Commit**: [ec791e700315d8dcaecb11a6a1850092afad1ca7](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GCec791e700315d8dcaecb11a6a1850092afad1ca7)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [8.0.28-servicing.26264.2 to 8.0.28-servicing.26268.2][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCa2e8b8fd21f2fc18e5c0758c0584245e343ebeb7&targetVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:5ae73aca-14b4-4570-17b0-08dbd53e3897)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [5ae73aca-14b4-4570-17b0-08dbd53e3897](https://maestro.dot.net/subscriptions?search=5ae73aca-14b4-4570-17b0-08dbd53e3897)
- **Build**: [20260519.13](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979206) ([315073](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-aspnetcore/build/315073))
- **Date Produced**: May 19, 2026 11:13:23 PM UTC
- **Commit**: [bb9eccba9080e07bce32c0bc27c3564c753a7cfe](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28-servicing.26268.3 to 8.0.28-servicing.26269.13][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.8.0
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC206e82da31a67bbe713cf7aac8d6f04de099a9f8&targetVersion=GCbb9eccba9080e07bce32c0bc27c3564c753a7cfe&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:5ae73aca-14b4-4570-17b0-08dbd53e3897)
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 8.0.28-servicing.26265.4 to 8.0.28-servicing.26269.2 (parent: Microsoft.WindowsDesktop.App.Ref)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [43ca46dd-3142-499e-f076-08dbd5a5cbe7](https://maestro.dot.net/subscriptions?search=43ca46dd-3142-499e-f076-08dbd5a5cbe7)
- **Build**: [20260519.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979365) ([315092](https://maestro.dot.net/channel/3880/azdo:dnceng:internal:dotnet-windowsdesktop/build/315092))
- **Date Produced**: May 20, 2026 1:17:40 AM UTC
- **Commit**: [432d0577ee8d6a36654d23a83182a0c7da27a69f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC432d0577ee8d6a36654d23a83182a0c7da27a69f)
- **Branch**: [refs/heads/internal/release/8.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/8.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [8.0.28 to 8.0.28][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [8.0.28-servicing.26268.2 to 8.0.28-servicing.26269.1][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.8.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.8.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GCec791e700315d8dcaecb11a6a1850092afad1ca7&targetVersion=GC432d0577ee8d6a36654d23a83182a0c7da27a69f&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:43ca46dd-3142-499e-f076-08dbd5a5cbe7)
…build 20260601.2

On relative base path root
Microsoft.SourceBuild.Intermediate.source-build-assets From Version 8.0.0-alpha.1.26262.3 -> To Version 8.0.0-alpha.1.26301.2
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
@nagilson

nagilson commented Jul 7, 2026

Copy link
Copy Markdown
Member

Note

This comment was generated by GitHub Copilot on behalf of @nagilson (build duty).

Resolved the merge conflict. Only src/Cli/dotnet/Installer/Windows/MsiPackageCache.cs conflicted: release/8.0.1xx called the local MoveAndSecureFile(...) while release/8.0.4xx moved it into SecurityUtils.MoveAndSecureFile(...). Both retain the security fix; I kept the newer target-branch (8.0.4xx) form, which is the only compilable option since the local method no longer exists in the merged tree.

# Conflicts:
#	src/Cli/dotnet/Installer/Windows/MsiPackageCache.cs
@nagilson nagilson force-pushed the merge/release/8.0.1xx-to-release/8.0.4xx branch from ee33c23 to 398a7a4 Compare July 7, 2026 17:17
@nagilson nagilson enabled auto-merge July 7, 2026 17:20
@nagilson nagilson requested a review from a team July 7, 2026 17:20
@nagilson

nagilson commented Jul 7, 2026

Copy link
Copy Markdown
Member

Note

This comment was generated by GitHub Copilot on behalf of @nagilson (build duty).

Correction: my first resolution left a silent bad auto-merge in WindowsUtils.cs — 8.0.1xx defined the security helpers inline while 8.0.4xx moved them into SecurityUtils, and git textually combined both, producing duplicate members (CS0111 x16, caught by the TemplateEngine build leg). I force-pushed a corrected merge that takes the newer branch's (8.0.4xx) WindowsUtils.cs verbatim. Verified: base 8.0.4xx is a superset of 8.0.1xx's methods (nothing lost) and the merged tree is now identical to 8.0.4xx.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants