Skip to content

[main] Source code updates from dotnet/dotnet #20058

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dotnet-maestro wants to merge 9 commits into
base: main
Choose a base branch
from
Open

[main] Source code updates from dotnet/dotnet #20058

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f7b33e5
Backflow from https://github.com/dotnet/dotnet / 50dbab4 build 322464
dotnet-maestro[bot] Jul 11, 2026
3c6bfdf
Update dependencies from build 322464
dotnet-maestro[bot] Jul 11, 2026
20aef7e
Update dependencies from build 322734
dotnet-maestro[bot] Jul 14, 2026
e75eaeb
Update dependencies from build 322911
dotnet-maestro[bot] Jul 15, 2026
eb65159
Update dependencies from build 323048
dotnet-maestro[bot] Jul 16, 2026
af80fc4
Fix NU1903 audit failures from updated transitive dependencies
Copilot Jul 21, 2026
2a9ce9a
Merge remote-tracking branch 'origin/main' into darc-main-b65a9935-28…
invalid-email-address Jul 21, 2026
e2878bb
Pin MessagePack to patched 2.5.302 to fix NU1902/NU1903 audit
Copilot Jul 21, 2026
8ec1d03
Fix malformed Version.Details.xml (duplicate closing Dependency tag)
invalid-email-address Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions NuGet.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,4 +35,8 @@
<fallbackPackageFolders>
<clear />
</fallbackPackageFolders>
<auditSources>
<clear />
<add key="nuget.org" value="https://data.nuget.org/v3/index.json" />
</auditSources>
</configuration>
10 changes: 5 additions & 5 deletions eng/Version.Details.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ This file should be imported by eng/Versions.props
<!-- dotnet-arcade dependencies -->
<MicrosoftDotNetArcadeSdkPackageVersion>10.0.0-beta.26324.4</MicrosoftDotNetArcadeSdkPackageVersion>
<!-- dotnet-msbuild dependencies -->
<MicrosoftBuildPackageVersion>18.10.0-1.26370.18</MicrosoftBuildPackageVersion>
<MicrosoftBuildFrameworkPackageVersion>18.10.0-1.26370.18</MicrosoftBuildFrameworkPackageVersion>
<MicrosoftBuildTasksCorePackageVersion>18.10.0-1.26370.18</MicrosoftBuildTasksCorePackageVersion>
<MicrosoftBuildUtilitiesCorePackageVersion>18.10.0-1.26370.18</MicrosoftBuildUtilitiesCorePackageVersion>
<MicrosoftBuildPackageVersion>18.10.0-preview-26357-08</MicrosoftBuildPackageVersion>
<MicrosoftBuildFrameworkPackageVersion>18.10.0-preview-26357-08</MicrosoftBuildFrameworkPackageVersion>
<MicrosoftBuildTasksCorePackageVersion>18.10.0-preview-26357-08</MicrosoftBuildTasksCorePackageVersion>
<MicrosoftBuildUtilitiesCorePackageVersion>18.10.0-preview-26357-08</MicrosoftBuildUtilitiesCorePackageVersion>
<!-- dotnet-optimization dependencies -->
<optimizationlinuxarm64MIBCRuntimePackageVersion>1.0.0-prerelease.26318.1</optimizationlinuxarm64MIBCRuntimePackageVersion>
<optimizationlinuxx64MIBCRuntimePackageVersion>1.0.0-prerelease.26318.1</optimizationlinuxx64MIBCRuntimePackageVersion>
Expand All @@ -32,7 +32,7 @@ This file should be imported by eng/Versions.props
<SystemCompositionPackageVersion>10.0.8</SystemCompositionPackageVersion>
<SystemDiagnosticsDiagnosticSourcePackageVersion>10.0.8</SystemDiagnosticsDiagnosticSourcePackageVersion>
<SystemReflectionMetadataPackageVersion>10.0.8</SystemReflectionMetadataPackageVersion>
<SystemSecurityCryptographyXmlPackageVersion>10.0.8</SystemSecurityCryptographyXmlPackageVersion>
<SystemSecurityCryptographyXmlPackageVersion>10.0.10</SystemSecurityCryptographyXmlPackageVersion>
</PropertyGroup>
<!--Property group for alternate package version names-->
<PropertyGroup>
Expand Down
20 changes: 10 additions & 10 deletions eng/Version.Details.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,22 @@
<?xml version="1.0" encoding="utf-8"?>
<Dependencies>
<Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="1358fe9202089df7bdb79282a191c9dbbb773a06" BarId="320196" />
<Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="cb8306a63c5cf24e9381108a3a9eb58907fd0f60" BarId="323048" />
<ProductDependencies>
<Dependency Name="Microsoft.Build" Version="18.10.0-1.26370.18">
<Dependency Name="Microsoft.Build" Version="18.10.0-preview-26357-08">
<Uri>https://github.com/dotnet/msbuild</Uri>
<Sha>eae54023463db15e9a9081f35a959c9162797643</Sha>
<Sha>746aeb090c9e2bcedc398751370da862014ebf7a</Sha>
</Dependency>
<Dependency Name="Microsoft.Build.Framework" Version="18.10.0-1.26370.18">
<Dependency Name="Microsoft.Build.Framework" Version="18.10.0-preview-26357-08">
<Uri>https://github.com/dotnet/msbuild</Uri>
<Sha>eae54023463db15e9a9081f35a959c9162797643</Sha>
<Sha>746aeb090c9e2bcedc398751370da862014ebf7a</Sha>
</Dependency>
<Dependency Name="Microsoft.Build.Tasks.Core" Version="18.10.0-1.26370.18">
<Dependency Name="Microsoft.Build.Tasks.Core" Version="18.10.0-preview-26357-08">
<Uri>https://github.com/dotnet/msbuild</Uri>
<Sha>eae54023463db15e9a9081f35a959c9162797643</Sha>
<Sha>746aeb090c9e2bcedc398751370da862014ebf7a</Sha>
</Dependency>
<Dependency Name="Microsoft.Build.Utilities.Core" Version="18.10.0-1.26370.18">
<Dependency Name="Microsoft.Build.Utilities.Core" Version="18.10.0-preview-26357-08">
<Uri>https://github.com/dotnet/msbuild</Uri>
<Sha>eae54023463db15e9a9081f35a959c9162797643</Sha>
<Sha>746aeb090c9e2bcedc398751370da862014ebf7a</Sha>
</Dependency>
<Dependency Name="Microsoft.CodeAnalysis" Version="5.10.0-1.26365.3">
<Uri>https://github.com/dotnet/roslyn</Uri>
Expand Down Expand Up @@ -75,7 +75,7 @@
</Sha>
</Dependency>
<!-- Necessary for source-build. This allows the live version of the package to be used by source-build. -->
<Dependency Name="System.Security.Cryptography.Xml" Version="10.0.8">
<Dependency Name="System.Security.Cryptography.Xml" Version="10.0.10">
<Uri>https://github.com/dotnet/runtime</Uri>
<Sha>
</Sha>
Expand Down
3 changes: 3 additions & 0 deletions eng/Versions.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,9 @@
<SystemBuffersVersion>4.6.1</SystemBuffersVersion>
<SystemMemoryVersion>4.6.3</SystemMemoryVersion>
<SystemRuntimeCompilerServicesUnsafeVersion>6.1.2</SystemRuntimeCompilerServicesUnsafeVersion>
<!-- Overrides for vulnerable transitive net472 facades pulled in via Microsoft.CodeAnalysis.Test.Resources.Proprietary -> NETStandard.Library 1.6.1. -->
<SystemNetHttpVersion>4.3.4</SystemNetHttpVersion>
<SystemTextRegularExpressionsVersion>4.3.1</SystemTextRegularExpressionsVersion>
<!-- System.* packages from dotnet/runtime are managed in Version.Details.xml / Version.Details.props for source-build. -->
</PropertyGroup>

Expand Down
2 changes: 2 additions & 0 deletions src/FSharp.Compiler.LanguageServer/FSharp.Compiler.LanguageServer.fsproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
<PackageReference Include="Microsoft.VisualStudio.LanguageServer.Protocol" Version="17.13.6-preview" />
<PackageReference Include="Microsoft.VisualStudio.Threading" Version="17.12.21" />
<PackageReference Include="StreamJsonRpc" Version="2.25.29" />
<!-- Pin the transitive MessagePack (via StreamJsonRpc) to a patched version. Older versions (< 2.5.301) have known vulnerabilities (NU1902/NU1903). -->
<PackageReference Include="MessagePack" Version="2.5.302" />
</ItemGroup>

<ItemGroup>
Expand Down
5 changes: 5 additions & 0 deletions src/fsc/fscProject/fsc.fsproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@
<Error Condition="'$(Configuration)' == 'Proto' AND !Exists('$(MibcFile)')" Text="Mibc file '$(MibcFile)' does not exist." />
</Target>

<!-- Override vulnerable System.Security.Cryptography.Xml pulled in transitively by Microsoft.Build.Tasks.Core (via FSharp.Build) on .NET (NU1903). net472 is excluded because it has no such transitive and the override's dependencies conflict with System.ValueTuple there. -->
<ItemGroup Condition="'$(TargetFramework)' == '$(FSharpNetCoreProductTargetFramework)'">
<PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
</ItemGroup>

<Import Project="$([MSBuild]::GetPathOfFileAbove('fsc.targets', '$(MSBuildThisFileDirectory)../'))" />

</Project>
5 changes: 5 additions & 0 deletions src/fsi/fsiProject/fsi.fsproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,11 @@
<IntermediateOutputPath>$(ArtifactsDir)obj/$(MSBuildProjectName)/$(Configuration)/</IntermediateOutputPath>
</PropertyGroup>

<!-- Override vulnerable System.Security.Cryptography.Xml pulled in transitively by Microsoft.Build.Tasks.Core (via FSharp.Build) on .NET (NU1903). net472 is excluded because it has no such transitive and the override's dependencies conflict with System.ValueTuple there. -->
<ItemGroup Condition="'$(TargetFramework)' == '$(FSharpNetCoreProductTargetFramework)'">
<PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
</ItemGroup>

<Import Project="$([MSBuild]::GetPathOfFileAbove('fsi.targets', '$(MSBuildThisFileDirectory)../'))" />

</Project>
5 changes: 5 additions & 0 deletions tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,9 @@
<PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
</ItemGroup>

<!-- Override vulnerable System.Security.Cryptography.Xml pulled in transitively by Microsoft.Build.Tasks.Core on .NET (NU1903). net472 is excluded because it has no such transitive and the override's dependencies conflict with System.ValueTuple there. -->
<ItemGroup Condition="'$(TargetFramework)' == '$(FSharpNetCoreProductTargetFramework)'">
<PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
</ItemGroup>

</Project>
3 changes: 3 additions & 0 deletions tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,9 @@
<ItemGroup Condition="'$(TargetFramework)' != '$(FSharpNetCoreProductTargetFramework)'">
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataVersion)" />
<PackageReference Include="System.Diagnostics.DiagnosticSource" Version="$(SystemDiagnosticsDiagnosticSourceVersion)" />
<!-- Override vulnerable 4.3.0 facades brought in transitively via Microsoft.CodeAnalysis.Test.Resources.Proprietary -> NETStandard.Library 1.6.1 (NU1903). -->
<PackageReference Include="System.Net.Http" Version="$(SystemNetHttpVersion)" />
<PackageReference Include="System.Text.RegularExpressions" Version="$(SystemTextRegularExpressionsVersion)" />
</ItemGroup>
<PropertyGroup>
<NoWarn>$(NoWarn);NU1510;44</NoWarn> <!-- NU1510: Project is explicitly referencing the runtime assembly 'System.Collections.Immutable', however, if we remove it, it tries to find it on the wrong path. Also, local NoWarn does not help - This is just me trying to enforce it -->
Expand Down
Loading