[automated] Merge branch 'release/9.0.3xx' => 'release/10.0.1xx'#55169
Open
github-actions[bot] wants to merge 52 commits into
Open
[automated] Merge branch 'release/9.0.3xx' => 'release/10.0.1xx'#55169github-actions[bot] wants to merge 52 commits into
github-actions[bot] wants to merge 52 commits into
Conversation
backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602?path=%2Fsrc%2FCli%2Fdotnet%2FInstaller%2FWindows%2FWindowsUtils.cs file paths are slightly different but code changes should remain identical.
--client-temp must be passed because: 1. user process client may have a terminal with a different TEMP env var or TMP setting 2. sever may try to resolve TEMP to sever TEMP that does not grant reading to client (needed for manifest path) 3. user process under local only privlleges is still is a concern even if SIDs match after the point in time UAC and consolidating the --client-temp to be included within the UAC time window removes this concern 4. it is not possible to observe client temp from the server process with 100% authenticity 5. log temp resolution may fallback but falling back for the manifest path will cause a failure 6. the client and server should both always know about --client-temp because the same host is used to launch both 7. confirmed with workloads code author no further risks we could consider adding it as an optional arg to elevate
Restrict Workloads Pipe Access backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602?path=%2Fsrc%2FCli%2Fdotnet%2FInstaller%2FWindows%2FWindowsUtils.cs file paths are slightly different but code changes should remain identical. ---- #### AI description (iteration 1) #### PR Classification Security enhancement to restrict workload pipe access by implementing user-specific access controls and path validation to prevent unauthorized access and directory traversal attacks. #### PR Summary This PR enhances security for the workload installer by restricting IPC pipe access to the specific invoking user and adding comprehensive path validation to prevent traversal attacks. - `WindowsUtils.cs`: Added `GetPipeClientIdentifier()` and `CreatePipeSecurity()` methods to restrict pipe access to the parent process's user SID instead of all authenticated users, plus added `ValidateLogFilePath()`, `ValidatePackagePath()`, and `ValidatePathComponent()` methods to prevent directory traversal attacks - `NetSdkMsiInstallerServer.cs`: Updated pipe security configuration to use the new restricted access controls that limit connections to only the parent process's user - `MsiPackageCache.cs`: Added path component validation for package IDs and versions to prevent path traversal when caching payloads - `WindowsInstallerTests.cs`: Added 15 new test cases covering pipe security restrictions, path validation against traversal attacks, and sibling-prefix attacks <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…nals build 20260515.1 On relative base path root Microsoft.SourceBuild.Intermediate.source-build-externals From Version 8.0.0-alpha.1.26216.1 -> To Version 8.0.0-alpha.1.26265.1
…0260517.1 On relative base path root Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 8.0.128-servicing.26262.3 -> To Version 8.0.128-servicing.26267.1 Microsoft.TemplateEngine.Abstractions From Version 8.0.128 -> To Version 8.0.128
…als (#54327) [release/8.0.1xx] Update dependencies from dotnet/source-build-externals
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Versions.props - eng/common/*
Co-authored-by: Nikola Milosavljevic <nikolam@microsoft.com>
Replace expired PAT `$(dn-bot-dnceng-build-rw-code-rw)` with the federated access token `$(AzdoToken)` already minted by the `VmrSyncPipeline` service connection earlier in the pipeline.\n\nThe `get-federated-access-token.yml` step already runs for all internal builds and produces `$(AzdoToken)` via the `VmrSyncPipeline` WIF service connection. The internal VMR push step was still referencing the expired PAT variable instead of using this token.\n\nFixes: AB#10724 ---- #### AI description (iteration 1) #### PR Classification Authentication configuration update to use Workload Identity Federation (WIF) federated token instead of personal access token for internal VMR repository push operations. #### PR Summary This pull request updates the authentication mechanism for pushing changes to the internal dotnet-dotnet VMR repository by replacing the static personal access token with a dynamically generated federated token. - `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Changed the `--azdev-pat` parameter from `$(dn-bot-dnceng-build-rw-code-rw)` to `$(AzdoToken)` to use WIF federated token for Azure DevOps authentication <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> Related work items: #10724
…3 repositories This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100**: from 9.0.16 to 9.0.17 (parent: Microsoft.NETCore.App.Runtime.win-x64) - **Microsoft.SourceBuild.Intermediate.emsdk**: from 9.0.16-servicing.26221.3 to 9.0.17-servicing.26258.3 (parent: Microsoft.NETCore.App.Runtime.win-x64) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:fc735b81-9fd6-4d18-b1be-525bf9fe3d19) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [fc735b81-9fd6-4d18-b1be-525bf9fe3d19](https://maestro.dot.net/subscriptions?search=fc735b81-9fd6-4d18-b1be-525bf9fe3d19) - **Build**: [20260514.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975597) ([314473](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-windowsdesktop/build/314473)) - **Date Produced**: May 15, 2026 6:29:00 AM UTC - **Commit**: [9d53c54d7228c41da31238e1e2442d67c486cb39](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC9d53c54d7228c41da31238e1e2442d67c486cb39) - **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/9.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [9.0.16 to 9.0.17][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [9.0.16-servicing.26230.2 to 9.0.17-servicing.26264.1][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GC7bad09c6a7b024bc98987a9fe2c66a79332bf8c5&targetVersion=GC9d53c54d7228c41da31238e1e2442d67c486cb39&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:fc735b81-9fd6-4d18-b1be-525bf9fe3d19) [marker]: <> (Begin:8e22721a-e9f6-419b-9c3b-fbb0f0641e55) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - **Subscription**: [8e22721a-e9f6-419b-9c3b-fbb0f0641e55](https://maestro.dot.net/subscriptions?search=8e22721a-e9f6-419b-9c3b-fbb0f0641e55) - **Build**: [20260514.16](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975171) ([314446](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-runtime/build/314446)) - **Date Produced**: May 15, 2026 12:09:10 AM UTC - **Commit**: [f2c8152eed158e72950025393fde498c90a57a6b](https://dev.azure.com/dnceng/internal/...
…dnceng/internal/dotnet-windowsdesktop This pull request updates the following dependencies [marker]: <> (Begin:Coherency Updates) ## Coherency Updates The following updates ensure that dependencies with a *CoherentParentDependency* attribute were produced in a build used as input to the parent dependency's build. See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview) [DependencyUpdate]: <> (Begin) - **Coherency Updates**: - **Microsoft.NET.Sdk.WindowsDesktop**: from 9.0.17-rtm.26264.8 to 9.0.17-rtm.26267.1 (parent: Microsoft.WindowsDesktop.App.Ref) - **Microsoft.Dotnet.WinForms.ProjectTemplates**: from 9.0.17-servicing.26264.2 to 9.0.17-servicing.26265.1 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64) - **Microsoft.DotNet.Wpf.ProjectTemplates**: from 9.0.17-rtm.26264.8 to 9.0.17-rtm.26267.1 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64) [DependencyUpdate]: <> (End) [marker]: <> (End:Coherency Updates) [marker]: <> (Begin:fc735b81-9fd6-4d18-b1be-525bf9fe3d19) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop - **Subscription**: [fc735b81-9fd6-4d18-b1be-525bf9fe3d19](https://maestro.dot.net/subscriptions?search=fc735b81-9fd6-4d18-b1be-525bf9fe3d19) - **Build**: [20260518.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978264) ([314888](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-windowsdesktop/build/314888)) - **Date Produced**: May 18, 2026 11:19:48 PM UTC - **Commit**: [9c74c8784a90d64bcc5c5c552d5420eafb60fa4f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC9c74c8784a90d64bcc5c5c552d5420eafb60fa4f) - **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/9.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [9.0.17 to 9.0.17][1] - Microsoft.WindowsDesktop.App.Ref - Microsoft.WindowsDesktop.App.Runtime.win-x64 - From [9.0.17-servicing.26264.1 to 9.0.17-servicing.26268.1][1] - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0 - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0 [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GC9d53c54d7228c41da31238e1e2442d67c486cb39&targetVersion=GC9c74c8784a90d64bcc5c5c552d5420eafb60fa4f&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:fc735b81-9fd6-4d18-b1be-525bf9fe3d19)
…0260517.3 On relative base path root Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 8.0.422-servicing.26256.3 -> To Version 8.0.422-servicing.26267.3 Microsoft.TemplateEngine.Abstractions From Version 8.0.422 -> To Version 8.0.422
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Versions.props - eng/common/*
…dnceng/internal/dotnet-aspnetcore This pull request updates the following dependencies [marker]: <> (Begin:fccb84dc-5ab4-47fa-89b4-a043eabf59b7) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore - **Subscription**: [fccb84dc-5ab4-47fa-89b4-a043eabf59b7](https://maestro.dot.net/subscriptions?search=fccb84dc-5ab4-47fa-89b4-a043eabf59b7) - **Build**: [20260519.7](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979108) ([315055](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/315055)) - **Date Produced**: May 19, 2026 9:31:40 PM UTC - **Commit**: [5edf41b9c09952f18e404ad38e25670991c1b513](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC5edf41b9c09952f18e404ad38e25670991c1b513) - **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [9.0.17-servicing.26268.2 to 9.0.17-servicing.26269.7][1] - dotnet-dev-certs - dotnet-user-jwts - dotnet-user-secrets - Microsoft.AspNetCore.Analyzers - Microsoft.AspNetCore.App.Ref.Internal - Microsoft.AspNetCore.Components.SdkAnalyzers - Microsoft.AspNetCore.DeveloperCertificates.XPlat - Microsoft.AspNetCore.Mvc.Analyzers - Microsoft.AspNetCore.Mvc.Api.Analyzers - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0 - Microsoft.SourceBuild.Intermediate.aspnetcore - From [9.0.17 to 9.0.17][1] - Microsoft.AspNetCore.App.Ref - Microsoft.AspNetCore.App.Runtime.win-x64 - Microsoft.AspNetCore.Authorization - Microsoft.AspNetCore.Components.Web - Microsoft.AspNetCore.TestHost - Microsoft.Extensions.FileProviders.Embedded - Microsoft.Extensions.ObjectPool - Microsoft.JSInterop [1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC5d6e3342e5d3b1d82f5ac41a027c00ae56f31ea2&targetVersion=GC5edf41b9c09952f18e404ad38e25670991c1b513&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
…ld 20260527.1 On relative base path root Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26277.1
…ld 20260601.3 On relative base path root Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26301.3
…ld 20260602.1 On relative base path root Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26302.1
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Versions.props - eng/common/*
…8-4939-a627-2a44e0381516
…merge/release/9.0.1xx-to-release/9.0.3xx
…-merge-9.0.3xx-2026-06-09-1502
[release/9.0.3xx] Update dependencies from dotnet/arcade - Merge branch 'release/9.0.3xx' into darc-release/9.0.3xx-fd97d203-de32-409e-9c3d-b489d5871023 - Merge branch 'release/9.0.3xx' into darc-release/9.0.3xx-fd97d203-de32-409e-9c3d-b489d5871023 - Skip diag verbosity test variant that hangs testhost on FullFramework The ItUsesVerbosityPassedToDefineVerbosityOfConsoleLoggerOfTheTests test with verbosity 'diag' produces ~230K lines of MSBuild diagnostic output. When the inner build fails, FluentAssertions attempts to include the entire StdOut in the failure message, causing the testhost to hang and triggering a 15-minute blame-hang timeout. Fixes: #54781 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Version.Details.props - eng/common/* - src/SourceBuild/*
# Conflicts: # NuGet.config # eng/Version.Details.props # eng/Version.Details.xml # eng/Versions.props # eng/pipelines/templates/jobs/vmr-synchronization.yml # global.json # src/Cli/dotnet/Installer/Windows/InstallClientElevationContext.cs # src/Cli/dotnet/Installer/Windows/InstallerBase.cs # src/Cli/dotnet/Installer/Windows/MsiPackageCache.cs # src/Cli/dotnet/Installer/Windows/NativeMethods.cs # src/Cli/dotnet/Installer/Windows/WindowsUtils.cs # src/Cli/dotnet/commands/dotnet-workload/elevate/WorkloadElevateCommand.cs # src/Cli/dotnet/commands/dotnet-workload/elevate/WorkloadElevateCommandParser.cs # src/Cli/dotnet/commands/dotnet-workload/install/MsiInstallerBase.cs # src/Cli/dotnet/commands/dotnet-workload/install/NetSdkMsiInstallerServer.cs # src/SourceBuild/content/eng/Version.Details.xml # src/SourceBuild/content/eng/Versions.props # src/SourceBuild/content/global.json # test/dotnet.Tests/WindowsInstallerTests.cs
Member
|
Note This comment was generated by GitHub Copilot on behalf of @nagilson (build duty). Resolved the merge conflicts. |
nagilson
approved these changes
Jul 7, 2026
This was referenced Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I detected changes in the release/9.0.3xx branch which have not been merged yet to release/10.0.1xx. I'm a robot and am configured to help you automatically keep release/10.0.1xx up to date, so I've opened this PR.
This PR merges commits made on release/9.0.3xx by the following committers:
Instructions for merging from UI
This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.
If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.
Instructions for merging via command line
Run these commands to merge this pull request from the command line.
or if you are using SSH
After PR checks are complete push the branch
Instructions for resolving conflicts
Instructions for updating this pull request
Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/9.0.3xx-to-release/10.0.1xx'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.
or if you are using SSH
Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.