Repository navigation
[release/dev18.0] Source code updates from dotnet/dotnet - #13308
Merged
davidwengier merged 2 commits intoOct 19, 2026
Merged
davidwengier merged 2 commits into
davidwengier merged 2 commits into
Conversation
No dependency updates to commit [[ commit created by automation ]]
Author
|
Note Other PRs in the commit range
💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance. |
davidwengier
approved these changes
Oct 19, 2026
davidwengier
enabled auto-merge
October 19, 2026 21:44
333fred
approved these changes
Oct 19, 2026
davidwengier
deleted the
darc-release/dev18.0-9ec00d14-5544-4a61-bd00-b8cff89a8217
branch
October 19, 2026 21:44
davidwengier
added a commit
that referenced
this pull request
Oct 20, 2026
…13311) ### Summary of the changes **All changes in this PR were produced by AI; human review is required before merge.** Follow-up to #13308 for the remaining active CG alerts on this branch (which supplies the .NET 10.0.1xx SDK / source-build). Frameworks and coverage are unchanged, and nothing is dismissed or excepted in CG. - `global.json`: SDK 9.0.121 -> 9.0.122, which brings runtime, ASP.NET Core and WindowsDesktop packs to 9.0.21 (the 132 runtime-pack alerts). - `Directory.Packages.props`: MessagePack 2.5.301 -> 2.5.303. I didn't establish whether the CVE is reachable from Razor, but the bump is cheap. - Removed the `Microsoft.NET.Sdk.Razor` 6.0.0-alpha package (internal repackaged-assembly alert). The serviced 6.0.428 replacement isn't clean: it ships `System.Text.Json` and `System.Text.Encodings.Web` 6.0.0 under `tasks/net472`, and its `RazorExtension.xaml` hides two fields. Instead, the six design-time assets we actually used are copied byte-exact into `src/Shared/files/RazorDesignTime/` (from dotnet/aspnetcore `20b6779c…`), with a scoped `cgmanifest.json`, Apache-2.0 attribution in `NOTICE.txt`, provenance in the rzls Targets `Readme.md`, and a `.gitattributes` with `-text` (the generated rule names hash the XAML bytes). VSIX destinations and embedded resource bytes are unchanged. Already covered by #13308: 30 alerts (24 ASP.NET 8, 4 Xml, 2 Pkcs). Already `autoDismissed` at repo level in CG: 32 (31 microsoft/vscode, plus net6 `Microsoft.NETCore.App.Ref`), so I left those alone. Validation (all local, binlogs kept): - `dotnet restore Razor.sln -p:NuGetAudit=true -p:NuGetAuditMode=all`: passed; no `Microsoft.NET.Sdk.Razor` in any of the 48 assets files; download deps show all runtime RIDs at 9.0.21. - Desktop MSBuild of `Microsoft.VisualStudio.RazorExtension.csproj` (`-t:Build -p:DeployExtension=false`): 0 warnings, 0 errors. - `dotnet test Microsoft.VisualStudio.LanguageServices.Razor.Test --filter DefaultWindowsRazorProjectHostTest`: 44 passed. - `dotnet test Microsoft.CodeAnalysis.Razor.Workspaces.Test --filter FullyQualifiedName~Serialization`: 38 passed, 1 skipped on each of net472, net8.0, net9.0. - `dotnet publish src/Razor/src/rzls/rzls.csproj -c Release -r win-x64 -p:SelfContained=false`: passed. - Copied asset bytes verified against the original package, including checkouts with autocrlf on and off. Limitations: - No fresh official CG scan was run. The inventory is from the 2026-10-14 scan, so closure needs a new scan. - No `.vsix` was packaged or inspected, and there was no VS UI smoke test. - `rzls` is framework-dependent, so runtimes installed on consumer machines are a separate servicing matter. Fixes: Component Governance alerts for release/dev18.0 (follow-up to #13308)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.
This pull request brings the following source code changes
From https://github.com/dotnet/dotnet
Associated changes in source repos
Diff the source with this PR branch