From a13928cfd36dcbfa202fc0868691f4f40c3e35ec Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 20 May 2026 12:42:25 -0700
Subject: [PATCH 1/2] Update System.Security.Cryptography.Xml in RepoTasks

Updated System.Security.Cryptography.Xml package version to address CVE-2023-29331.
---
 eng/tools/RepoTasks/RepoTasks.csproj | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/eng/tools/RepoTasks/RepoTasks.csproj b/eng/tools/RepoTasks/RepoTasks.csproj
index d1fa1d66d7a6..36dacb13de4f 100644
--- a/eng/tools/RepoTasks/RepoTasks.csproj
+++ b/eng/tools/RepoTasks/RepoTasks.csproj
@@ -29,6 +29,8 @@
     <PackageReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" />
     <PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
+    <!-- Manually updated version from 6.0.0 to address CVE-2023-29331 -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(RepoTasksSystemSecurityCryptographyXmlVersion)" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net472'">

From 1b46d3bc51b70a6e4ba0b781a27cff9918158520 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Wed, 20 May 2026 12:43:14 -0700
Subject: [PATCH 2/2] Update RepoTasksSystemSecurityCryptographyXmlVersion to
 8.0.3

---
 eng/Versions.props | 1 +
 1 file changed, 1 insertion(+)

diff --git a/eng/Versions.props b/eng/Versions.props
index 79fae3e14045..f997d3d5cef6 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -199,6 +199,7 @@
     <MicrosoftVSSDKBuildToolsVersion>15.9.3032</MicrosoftVSSDKBuildToolsVersion>
     <AnalyzersSystemTextJsonVersion>$(SystemTextJsonVersion)</AnalyzersSystemTextJsonVersion>
     <!-- Stable dotnet/corefx packages no longer updated for .NET Core 3 -->
+    <RepoTasksSystemSecurityCryptographyXmlVersion>8.0.3</RepoTasksSystemSecurityCryptographyXmlVersion>
     <MicrosoftCSharpVersion>4.7.0</MicrosoftCSharpVersion>
     <MicrosoftWin32RegistryVersion>5.0.0</MicrosoftWin32RegistryVersion>
     <NETStandardLibraryVersion>2.0.3</NETStandardLibraryVersion>