Skip to content

[main] Source code updates from dotnet/dotnet - #20058

Merged
T-Gro merged 9 commits into
mainfrom
darc-main-b65a9935-28e2-420d-a350-5ffd0a001c93
Aug 3, 2026
Merged

[main] Source code updates from dotnet/dotnet#20058
T-Gro merged 9 commits into
mainfrom
darc-main-b65a9935-28e2-420d-a350-5ffd0a001c93

Conversation

@dotnet-maestro

@dotnet-maestro dotnet-maestro Bot commented Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

Updated Dependencies

Associated changes in source repos

Diff the source with this PR branch 
darc vmr diff --name-only https://github.com/dotnet/dotnet:cb8306a63c5cf24e9381108a3a9eb58907fd0f60..https://github.com/dotnet/fsharp:darc-main-b65a9935-28e2-420d-a350-5ffd0a001c93

dotnet-maestro Bot added 2 commits July 11, 2026 02:11
@dotnet-maestro
Backflow from https://github.com/dotnet/dotnet / 50dbab4 build 322464
f7b33e5 
Diff: https://github.com/dotnet/dotnet/compare/920a0d55f8d87a0423dd3a89555f70d9c9004584..50dbab4de210e882172b07934e9666313b7065f1

From: dotnet/dotnet@920a0d5
To: dotnet/dotnet@50dbab4

[[ commit created by automation ]]
@dotnet-maestro
Update dependencies from build 322464
3c6bfdf 
Updated Dependencies:
Microsoft.Build, Microsoft.Build.Framework, Microsoft.Build.Tasks.Core, Microsoft.Build.Utilities.Core (Version 18.10.0-1.26359.10 -> 18.10.0-preview-26357-08)
[[ commit created by automation ]]
@dotnet-maestro
dotnet-maestro Bot requested a review from a team as a code owner July 11, 2026 02:12
@dotnet-maestro

dotnet-maestro Bot commented Jul 11, 2026

Copy link
Copy Markdown
Contributor Author

Note

VMR PRs included in this codeflow update:

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@github-actions

github-actions Bot commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

✅ No release notes required

@github-actions github-actions Bot added the AI-Tooling-Check-Bypassed Tooling check: non-fork PR, not diff-analyzed label Jul 11, 2026
dotnet-maestro Bot added 3 commits July 14, 2026 02:07
@dotnet-maestro
Update dependencies from build 322734
20aef7e 
No dependency updates to commit
[[ commit created by automation ]]
@dotnet-maestro
Update dependencies from build 322911
e75eaeb 
No dependency updates to commit
[[ commit created by automation ]]
@dotnet-maestro
Update dependencies from build 323048
eb65159 
No dependency updates to commit
[[ commit created by automation ]]
@T-Gro T-Gro mentioned this pull request Jul 21, 2026
Merged
Copilot AI and others added 4 commits July 21, 2026 10:47
Fix NU1903 audit failures from updated transitive dependencies
af80fc4 
The codeflow update to Microsoft.Build.* now transitively pulls
System.Security.Cryptography.Xml 10.0.8 (newly flagged by GHSA advisories,
patched in 10.0.10) on .NET, and Microsoft.CodeAnalysis.Test.Resources.Proprietary
-> NETStandard.Library 1.6.1 pulls vulnerable System.Net.Http 4.3.0 and
System.Text.RegularExpressions 4.3.0 on net472.

- Bump System.Security.Cryptography.Xml override to 10.0.10 (Version.Details).
- Add .NET-only Cryptography.Xml overrides in fsc/fsi/FSharp.Build.UnitTests
  (net472 excluded: no such transitive there and its deps conflict with
  System.ValueTuple). These cascade to Microsoft.FSharp.Compiler and FSharpSuite.Tests.
- Override the net472 System.Net.Http/System.Text.RegularExpressions facades to
  patched 4.3.4/4.3.1 in FSharp.Test.Utilities.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merge remote-tracking branch 'origin/main' into darc-main-b65a9935-28…
2a9ce9a 
…e2-420d-a350-5ffd0a001c93

# Conflicts:
#	eng/Version.Details.props
#	eng/Version.Details.xml
Pin MessagePack to patched 2.5.302 to fix NU1902/NU1903 audit
e2878bb 
StreamJsonRpc 2.25.29 pulls MessagePack transitively; some restore
environments resolve the vulnerable 2.5.198 (< 2.5.301 patched line),
tripping NuGetAudit warnings-as-errors in FSharp.Compiler.LanguageServer.Tests.
Add an explicit direct reference at 2.5.302 (StreamJsonRpc's own minimum,
already patched) so the resolved version is deterministic everywhere.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fix malformed Version.Details.xml (duplicate closing Dependency tag)
8ec1d03 
A merge conflict resolution left a stray </Dependency> closing tag after
Microsoft.Build.Utilities.Core, making the XML invalid and failing the
Maestro Version.Details.props Validation and Codeflow verification checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions github-actions Bot added ⚠️ Affects-Build-Infra Tooling check: PR touches build infrastructure ⚠️ Affects-Restore Tooling check: PR touches NuGet packages or feeds labels Jul 26, 2026
@github-actions

github-actions Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

🔍 Tooling Safety Check — Affects-Build-Infra, Affects-Restore
Affects-Build-Infra: modifies NuGet.config, eng/Version.Details, adds PackageReference entries
Affects-Restore: changes package versions and adds auditSources to NuGet.config

Generated by PR Tooling Safety Check · opus46 11.6M · ◷

@dotnet-maestro

dotnet-maestro Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

4 similar comments
@dotnet-maestro

dotnet-maestro Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@dotnet-maestro

dotnet-maestro Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@dotnet-maestro

dotnet-maestro Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@dotnet-maestro

dotnet-maestro Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Important

While this PR was open, the source repository has received code changes from this repository (an opposite codeflow merged).
To avoid complex conflicts, the codeflow cannot continue until this PR is closed or merged.

You can continue with one of the following options:

  • Ignore this and merge this PR as usual without waiting for the new changes.
    Once merged, Maestro will create a new codeflow PR with the new changes.
  • Close this PR and wait for Maestro to open a new one with old and new changes included.
    You will lose any manual changes made in this PR.
    You can also manually trigger the new codeflow right away by running: 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81
  • Force a codeflow into this PR at your own risk if you want the new changes.
    User commits made to this PR might be reverted. 
    darc trigger-subscriptions --id 33aad187-a5d7-4947-b09f-777f8ea29e81 --force

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

@T-Gro
T-Gro merged commit f5c88eb into main Aug 3, 2026
56 checks passed
@T-Gro
T-Gro deleted the darc-main-b65a9935-28e2-420d-a350-5ffd0a001c93 branch August 3, 2026 18:40
T-Gro added a commit that referenced this pull request Aug 3, 2026
@T-Gro
Clean up #20058 per-project vuln workarounds via CPM transitive pinning
4c44a42 
PR #20058 added per-project package overrides to work around the LACK of
Central Package Management. Now that CPM + transitive pinning is enabled here,
those overrides are redundant AND invalid (a PackageReference under CPM cannot
carry Version=, so they trip NU1008). This removes/consolidates them:

- fsc/fsi/FSharp.Build.UnitTests: drop the 3 identical netcore-only
  System.Security.Cryptography.Xml overrides. It is centrally pinned
  (10.0.10) and transitive pinning now raises the Microsoft.Build.Tasks.Core
  transitive on netcore automatically (verified via restore); net472 is
  untouched (crypto.xml not in its graph -> no ValueTuple conflict).
- LanguageServer: drop the per-project MessagePack 2.5.302 override; pin it
  centrally instead so transitive pinning patches it wherever StreamJsonRpc is
  used (LanguageServer AND the CLASP.Framework.Proxy), not just one project.
- Test.Utilities: keep the net472-only System.Net.Http/System.Text.RegularExpressions
  facade overrides but as local VersionOverride (no global eng/Versions.props
  properties), keeping the deviation minimal and scoped.

Also resolves union-merge duplicate PackageReference blocks introduced by the
merge from main in Microsoft.FSharp.Compiler, LanguageServer, and Test.Utilities.

Verified by clean bootstrap ./build.sh -c Debug (0 warnings, 0 errors) and by
inspecting restored versions: crypto.xml 10.0.10 (fsc), MessagePack 2.5.302
(LanguageServer + Proxy), StreamJsonRpc 2.26.5.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Aug 3, 2026
Closed
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Aug 4, 2026
Open
T-Gro pushed a commit that referenced this pull request Aug 4, 2026
Remove duplicate System.Security.Cryptography.Xml PackageReference (f…
e7ccfa6 
…ix NU1504)

The backflow added the canonical PrivateAssets=all override into the shared
fsc.targets/fsi.targets and the FSharp.Build.UnitTests item group, but the
earlier codeflow (#20058) had already added a conditional (net-core-only)
override directly in fsc.fsproj, fsi.fsproj and FSharp.Build.UnitTests.fsproj.
This produced two identical PackageReference items for net11.0, failing restore
with NU1504 (WarnAsError) across all CI jobs.

Removing the redundant conditional blocks aligns these projects with the VMR
(dotnet/dotnet) canonical state; each project now references the package
exactly once via the shared item group / .targets import.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Aug 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@T-Gro T-Gro T-Gro approved these changes

Assignees

No one assigned

Labels

⚠️ Affects-Build-Infra Tooling check: PR touches build infrastructure ⚠️ Affects-Restore Tooling check: PR touches NuGet packages or feeds AI-Tooling-Check-Bypassed Tooling check: non-fork PR, not diff-analyzed

Projects

F# Compiler and Tooling
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@T-Gro