Skip to content

[automated] Merge branch 'release/9.0.3xx' => 'release/10.0.1xx'#55280

Open
github-actions[bot] wants to merge 82 commits into
release/10.0.1xxfrom
merge/release/9.0.3xx-to-release/10.0.1xx
Open

[automated] Merge branch 'release/9.0.3xx' => 'release/10.0.1xx'#55280
github-actions[bot] wants to merge 82 commits into
release/10.0.1xxfrom
merge/release/9.0.3xx-to-release/10.0.1xx

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

I detected changes in the release/9.0.3xx branch which have not been merged yet to release/10.0.1xx. I'm a robot and am configured to help you automatically keep release/10.0.1xx up to date, so I've opened this PR.

This PR merges commits made on release/9.0.3xx by the following committers:

  • dotnet-maestro[bot]
  • nagilson
  • SimonZhao888
  • Copilot
  • github-actions[bot]
  • dotnet-sb-bot
  • premun
  • marcpopMSFT
  • vseanreesermsft
  • DonnaChen888
  • invalid-email-address
  • ellahathaway

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/9.0.3xx
git pull --ff-only
git checkout release/10.0.1xx
git pull --ff-only
git merge --no-ff release/9.0.3xx

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/sdk HEAD:merge/release/9.0.3xx-to-release/10.0.1xx
or if you are using SSH
git push git@github.com:dotnet/sdk HEAD:merge/release/9.0.3xx-to-release/10.0.1xx

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/9.0.3xx-to-release/10.0.1xx'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/9.0.3xx-to-release/10.0.1xx origin/release/10.0.1xx
git pull https://github.com/dotnet/sdk merge/release/9.0.3xx-to-release/10.0.1xx
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/sdk HEAD:merge/release/9.0.3xx-to-release/10.0.1xx
or if you are using SSH
git fetch
git checkout -b merge/release/9.0.3xx-to-release/10.0.1xx origin/release/10.0.1xx
git pull git@github.com:dotnet/sdk merge/release/9.0.3xx-to-release/10.0.1xx
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/sdk HEAD:merge/release/9.0.3xx-to-release/10.0.1xx

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

nagilson and others added 30 commits May 6, 2026 11:38
Restrict Workloads Pipe Access

backport of https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/60602?path=%2Fsrc%2FCli%2Fdotnet%2FInstaller%2FWindows%2FWindowsUtils.cs

file paths are slightly different but code changes should remain identical.

----
#### AI description  (iteration 1)
#### PR Classification
Security enhancement to restrict Named Pipe access in the .NET SDK workload installer for Windows, preventing unauthorized IPC connections.

#### PR Summary
This PR strengthens security for the Windows workload installer by restricting Named Pipe access to only the invoking user, preventing privilege escalation and path traversal attacks. The changes validate all file paths and implement stricter access controls for inter-process communication.

- `WindowsUtils.cs`: Added methods to restrict pipe access to parent process user SID instead of all authenticated users, and implemented path validation utilities to prevent directory traversal attacks
- `NetSdkMsiInstallerServer.cs`: Updated pipe security to use parent process user SID via `GetPipeClientIdentifier()` instead of granting access to all authenticated users
- `MsiPackageCache.cs`: Added validation for package ID, version, and manifest paths to prevent path traversal exploits when caching MSI packages
- `WindowsInstallerTests.cs`: Added comprehensive security tests validating pipe access controls, path traversal prevention, and component validation
- `WindowsUtils.cs`: Added `ValidateLogFilePath()`, `ValidatePackagePath()`, and `ValidatePathComponent()` methods to canonicalize and validate file paths against allowed directories
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Replace expired PAT `$(dn-bot-dnceng-build-rw-code-rw)` with the federated access token `$(AzdoToken)` already minted by the `VmrSyncPipeline` service connection earlier in the pipeline.\n\nSame fix as PR #61246 for internal/release/9.0.3xx.\n\nFixes: AB#10724

----
#### AI description  (iteration 1)
#### PR Classification
Configuration update to replace a static personal access token with a workload identity federation (WIF) federated token for authenticating VMR push operations to the internal repository.

#### PR Summary
This pull request updates the authentication mechanism for pushing changes to the internal dotnet-dotnet VMR repository by switching from a static PAT to a dynamically generated federated token.

- `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Changed the `--azdev-pat` parameter from `$(dn-bot-dnceng-build-rw-code-rw)` to `$(AzdoToken)` to use WIF-based authentication instead of a static token
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->


Related work items: #10724
…udit in tests

The unofficial CI pipeline (1472) does not have the AzureDevOps-Artifact-Feeds-Pats
variable group linked, causing $(dn-bot-dnceng-artifact-feeds-rw) to resolve to a
literal string instead of a PAT. This results in 401 Unauthorized errors when Helix
test machines try to access internal NuGet feeds.

Use $(System.AccessToken) instead, which is always available in any AzDO pipeline.
The build service identity already has read access to the internal feeds.

Additionally, disable NuGet audit (NuGetAudit=false) in two tests that intentionally
reference old vulnerable packages (System.Net.Http 4.3.0, System.Text.RegularExpressions
4.3.0, Microsoft.NETCore.App 2.1.0) for conflict resolution testing. The NU1903
vulnerability warnings were causing assertion failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:7c429c14-b12b-40f6-ae9e-395f98f369df)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [7c429c14-b12b-40f6-ae9e-395f98f369df](https://maestro.dot.net/subscriptions?search=7c429c14-b12b-40f6-ae9e-395f98f369df)
- **Build**: [20260518.2](https://dev.azure.com/dnceng/internal/_build/results?buildId=2977959) ([314847](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/314847))
- **Date Produced**: May 18, 2026 7:20:43 PM UTC
- **Commit**: [5d6e3342e5d3b1d82f5ac41a027c00ae56f31ea2](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC5d6e3342e5d3b1d82f5ac41a027c00ae56f31ea2)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16-servicing.26230.9 to 9.0.17-servicing.26268.2][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.16 to 9.0.17][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC4d825aeb5e5023588c036709c7914008b625b0eb&targetVersion=GC5d6e3342e5d3b1d82f5ac41a027c00ae56f31ea2&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:7c429c14-b12b-40f6-ae9e-395f98f369df)
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 9.0.16-rtm.26230.4 to 9.0.17-rtm.26264.8 (parent: Microsoft.WindowsDesktop.App.Ref)
    - **Microsoft.Dotnet.WinForms.ProjectTemplates**: from 9.0.16-servicing.26230.2 to 9.0.17-servicing.26264.2 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)
    - **Microsoft.DotNet.Wpf.ProjectTemplates**: from 9.0.16-rtm.26230.4 to 9.0.17-rtm.26264.8 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:87db4525-6885-42da-8dd0-7ce296d7fd1a)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [87db4525-6885-42da-8dd0-7ce296d7fd1a](https://maestro.dot.net/subscriptions?search=87db4525-6885-42da-8dd0-7ce296d7fd1a)
- **Build**: [20260514.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975597) ([314473](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-windowsdesktop/build/314473))
- **Date Produced**: May 15, 2026 6:29:00 AM UTC
- **Commit**: [9d53c54d7228c41da31238e1e2442d67c486cb39](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC9d53c54d7228c41da31238e1e2442d67c486cb39)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16 to 9.0.17][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [9.0.16-servicing.26230.2 to 9.0.17-servicing.26264.1][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GC7bad09c6a7b024bc98987a9fe2c66a79332bf8c5&targetVersion=GC9d53c54d7228c41da31238e1e2442d67c486cb39&_a=files

[DependencyUpdate]: <> (End)

[marker]: <> (End:87db4525-6885-42da-8dd0-7ce296d7fd1a)
…dnceng/internal/dotnet-runtime

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport**: from 9.0.16-servicing.26221.3 to 9.0.17-servicing.26258.3 (parent: Microsoft.NETCore.App.Runtime.win-x64)
    - **Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100**: from 9.0.16 to 9.0.17 (parent: Microsoft.NETCore.App.Runtime.win-x64)
    - **Microsoft.SourceBuild.Intermediate.emsdk**: from 9.0.16-servicing.26221.3 to 9.0.17-servicing.26258.3 (parent: Microsoft.NETCore.App.Runtime.win-x64)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:57bb26e6-6f64-40cf-a4ea-5b973f41bc22)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- **Subscription**: [57bb26e6-6f64-40cf-a4ea-5b973f41bc22](https://maestro.dot.net/subscriptions?search=57bb26e6-6f64-40cf-a4ea-5b973f41bc22)
- **Build**: [20260514.16](https://dev.azure.com/dnceng/internal/_build/results?buildId=2975171) ([314446](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-runtime/build/314446))
- **Date Produced**: May 15, 2026 12:09:10 AM UTC
- **Commit**: [f2c8152eed158e72950025393fde498c90a57a6b](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GCf2c8152eed158e72950025393fde498c90a57a6b)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16 to 9.0.17][1]
     - Microsoft.Bcl.AsyncInterfaces
     - Microsoft.Extensions.DependencyModel
     - Microsoft.Extensions.FileProviders.Abstractions
     - Microsoft.Extensions.FileSystemGlobbing
     - Microsoft.Extensions.Logging
     - Microsoft.Extensions.Logging.Abstractions
     - Microsoft.Extensions.Logging.Console
     - Microsoft.NET.ILLink.Tasks
     - Microsoft.NETCore.App.Host.win-x64
     - Microsoft.NETCore.App.Ref
     - Microsoft.NETCore.App.Runtime.win-x64
     - Microsoft.Win32.SystemEvents
     - System.CodeDom
     - System.Composition.AttributedModel
     - System.Composition.Convention
     - System.Composition.Hosting
     - System.Composition.Runtime
     - System.Composition.TypedParts
     - System.Configuration.ConfigurationManager
     - System.Formats.Asn1
     - System.Reflection.MetadataLoadContext
     - System.Resources.Extensions
     - System.Security.Cryptography.Pkcs
     - System.Security.Cryptography.ProtectedData
     - System.Security.Cryptography.Xml
     - System.Security.Permi...
…dnceng/internal/dotnet-windowsdesktop

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Sdk.WindowsDesktop**: from 9.0.17-rtm.26264.8 to 9.0.17-rtm.26267.1 (parent: Microsoft.WindowsDesktop.App.Ref)
    - **Microsoft.Dotnet.WinForms.ProjectTemplates**: from 9.0.17-servicing.26264.2 to 9.0.17-servicing.26265.1 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)
    - **Microsoft.DotNet.Wpf.ProjectTemplates**: from 9.0.17-rtm.26264.8 to 9.0.17-rtm.26267.1 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

[marker]: <> (Begin:87db4525-6885-42da-8dd0-7ce296d7fd1a)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [87db4525-6885-42da-8dd0-7ce296d7fd1a](https://maestro.dot.net/subscriptions?search=87db4525-6885-42da-8dd0-7ce296d7fd1a)
- **Build**: [20260518.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2978264) ([314888](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-windowsdesktop/build/314888))
- **Date Produced**: May 18, 2026 11:19:48 PM UTC
- **Commit**: [9c74c8784a90d64bcc5c5c552d5420eafb60fa4f](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC9c74c8784a90d64bcc5c5c552d5420eafb60fa4f)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.17 to 9.0.17][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [9.0.17-servicing.26264.1 to 9.0.17-servicing.26268.1][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GC9d53c54d7228c41da31238e1e2442d67c486cb39&targetVersion=GC9c74c8784a90d64bcc5c5c552d5420eafb60fa4f&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:87db4525-6885-42da-8dd0-7ce296d7fd1a)
…udit in tests

The unofficial CI pipeline (1472) does not have the AzureDevOps-Artifact-Feeds-Pats
variable group linked, causing $(dn-bot-dnceng-artifact-feeds-rw) to resolve to a
literal string instead of a PAT. This results in 401 Unauthorized errors when Helix
test machines try to access internal NuGet feeds.

Use $(System.AccessToken) instead, which is always available in any AzDO pipeline.
The build service identity already has read access to the internal feeds.

Additionally, disable NuGet audit (NuGetAudit=false) in two tests that intentionally
reference old vulnerable packages (System.Net.Http 4.3.0, System.Text.RegularExpressions
4.3.0, Microsoft.NETCore.App 2.1.0) for conflict resolution testing. The NU1903
vulnerability warnings were causing assertion failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:7c429c14-b12b-40f6-ae9e-395f98f369df)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [7c429c14-b12b-40f6-ae9e-395f98f369df](https://maestro.dot.net/subscriptions?search=7c429c14-b12b-40f6-ae9e-395f98f369df)
- **Build**: [20260519.7](https://dev.azure.com/dnceng/internal/_build/results?buildId=2979108) ([315055](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/315055))
- **Date Produced**: May 19, 2026 9:31:40 PM UTC
- **Commit**: [5edf41b9c09952f18e404ad38e25670991c1b513](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC5edf41b9c09952f18e404ad38e25670991c1b513)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.17-servicing.26268.2 to 9.0.17-servicing.26269.7][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.17 to 9.0.17][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC5d6e3342e5d3b1d82f5ac41a027c00ae56f31ea2&targetVersion=GC5edf41b9c09952f18e404ad38e25670991c1b513&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:7c429c14-b12b-40f6-ae9e-395f98f369df)
…de-rw-wif service connection

## Problem

Same issue as PR #61436 for `internal/release/9.0.1xx` — the VMR sync pipeline uses the `VmrSyncPipeline` service connection whose SP lacks working write access to the restricted `dotnet-dotnet` repo, causing pushes to silently fail.

## Fix

Switch to `dnceng-build-rw-code-rw-wif` — proven to work for VMR pushes to dotnet-dotnet (used by the installer repo's VMR sync). Adds explicit error handling for token acquisition.

----
#### AI description  (iteration 1)
#### PR Classification
Infrastructure change to fix VMR synchronization push functionality by switching from a federated service connection template to an Azure CLI task with a different service connection.

#### PR Summary
This PR updates the VMR synchronization pipeline to use the `dnceng-build-rw-code-rw-wif` service connection for minting Azure DevOps tokens, replacing the previous federated access token template approach.

- `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Replaced the `get-federated-access-token.yml` template step with an `AzureCLI@2` task that directly acquires the Azure DevOps access token using `az account get-access-token`
- `/eng/pipelines/templates/jobs/vmr-synchronization.yml`: Added error handling and validation for the token acquisition process, including checks for empty or whitespace tokens
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->


Related work items: #10139
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [fccb84dc-5ab4-47fa-89b4-a043eabf59b7](https://maestro.dot.net/subscriptions?search=fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
- **Build**: [20260520.11](https://dev.azure.com/dnceng/internal/_build/results?buildId=2980599) ([315317](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/315317))
- **Date Produced**: May 21, 2026 6:41:36 AM UTC
- **Commit**: [3acfb497d6f5b4e0cd0f3749bfbddb61519ee271](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GC3acfb497d6f5b4e0cd0f3749bfbddb61519ee271)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.17-servicing.26269.7 to 9.0.17-servicing.26270.11][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.17 to 9.0.17][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC5edf41b9c09952f18e404ad38e25670991c1b513&targetVersion=GC3acfb497d6f5b4e0cd0f3749bfbddb61519ee271&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
…build 20260521.2

On relative base path root
Microsoft.SourceBuild.Intermediate.source-build-assets From Version 9.0.0-alpha.1.26262.4 -> To Version 9.0.0-alpha.1.26271.2
…ld 20260527.1

On relative base path root
Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26277.1
…ld 20260601.3

On relative base path root
Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26301.3
…build 20260601.3

On relative base path root
Microsoft.SourceBuild.Intermediate.source-build-assets From Version 9.0.0-alpha.1.26262.4 -> To Version 9.0.0-alpha.1.26301.3
…ld 20260602.1

On relative base path root
Microsoft.SourceBuild.Intermediate.scenario-tests , Microsoft.DotNet.ScenarioTests.SdkTemplateTests From Version 9.0.0-preview.26263.1 -> To Version 9.0.0-preview.26302.1
…0260602.5

On relative base path root
Microsoft.SourceBuild.Intermediate.templating , Microsoft.TemplateEngine.Mocks From Version 9.0.118-servicing.26267.4 -> To Version 9.0.119-servicing.26302.5
Microsoft.TemplateEngine.Abstractions From Version 9.0.118 -> To Version 9.0.119
Copilot AI and others added 27 commits June 16, 2026 00:40
Co-authored-by: SimonZhao888 <133954995+SimonZhao888@users.noreply.github.com>
#### AI description  (iteration 1)
#### PR Classification
Infrastructure update to enable public to internal build flow with version updates and addition of NuGet audit source filtering capability.

#### PR Summary
Updates dependency versions across multiple components (scenario-tests, templating, arcade) and adds infrastructure to remove blocked audit sources from NuGet.config files during CI builds to prevent internet access during restore operations.

- Added new task `RemoveBlockedAuditSourcesFromNuGetConfig.cs` to remove blocked entries (e.g., nuget.org) from NuGet audit sources
- Updated `Directory.Build.targets` to invoke the new task when `RemoveBlockedAuditSources` property is enabled
- Enabled `RemoveBlockedAuditSources` for `nuget-client.proj` and `xdt.proj` to prevent internet access during CI builds
- Updated SDK versions from 9.0.116 to 9.0.117 in `global.json` and `Versions.props`
- Updated package versions for Microsoft.DotNet.ScenarioTests.SdkTemplateTests (26263.1 → 26302.1) and Microsoft.TemplateEngine dependencies in `Version.Details.xml`
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
#### AI description  (iteration 2)
#### PR Classification
This is a dependency update and conflict resolution pull request that merges public branch to internal, updates tooling dependencies, and adds functionality to handle NuGet audit sources in CI builds.

#### PR Summary
Updates Arcade SDK and related tooling dependencies from version 26261.1 to 26301.4, increments SDK version feature from 9.0.315 to 9.0.316, and adds a new build task to remove blocked audit sources from NuGet configurations during CI builds to prevent internet connectivity issues.

- Added `RemoveBlockedAuditSourcesFromNuGetConfig.cs` task to strip nuget.org from auditSources sections in NuGet.config files
- Updated multiple Arcade SDK packages (`Microsoft.DotNet.Arcade.Sdk`, `Microsoft.DotNet.Build.Tasks.Installers`, `Microsoft.DotNet.Helix.Sdk`, etc.) to version 9.0.0-beta.26301.4
- Updated `Versions.props` to increment `VersionFeature` from 15 to 16 (SDK 9.0.316)
- Modified `Directory.Build.targets` to integrate the new `RemoveBlockedAuditSourcesFromNuGetConfig` task into the build process
- Enabled `RemoveBlockedAuditSources` property for `nuget-client.proj` and `xdt.proj` to prevent internet access during CI builds
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…otnet-windowsdesktop build 20260617.1

On relative base path root
Microsoft.WindowsDesktop.App.Ref , Microsoft.WindowsDesktop.App.Runtime.win-x64 From Version 9.0.17 -> To Version 9.0.18
VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0 , VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0 From Version 9.0.17-servicing.26268.1 -> To Version 9.0.18-servicing.26317.1

Dependency coherency updates
On relative base path root
Microsoft.NET.Sdk.WindowsDesktop From Version 9.0.17-rtm.26267.1 -> To Version 9.0.18-rtm.26316.5 (parent: Microsoft.WindowsDesktop.App.Ref)

Microsoft.Dotnet.WinForms.ProjectTemplates From Version 9.0.17-servicing.26265.1 -> To Version 9.0.18-servicing.26316.2 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)

Microsoft.DotNet.Wpf.ProjectTemplates From Version 9.0.17-rtm.26267.1 -> To Version 9.0.18-rtm.26316.5 (parent: Microsoft.WindowsDesktop.App.Runtime.win-x64)
…otnet-runtime build 20260615.22

On relative base path root
Microsoft.Bcl.AsyncInterfaces , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Console , Microsoft.NET.ILLink.Tasks , Microsoft.NETCore.App.Host.win-x64 , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.Win32.SystemEvents , System.CodeDom , System.Composition.AttributedModel , System.Composition.Convention , System.Composition.Hosting , System.Composition.Runtime , System.Composition.TypedParts , System.Configuration.ConfigurationManager , System.Formats.Asn1 , System.Reflection.MetadataLoadContext , System.Resources.Extensions , System.Security.Cryptography.Pkcs , System.Security.Cryptography.ProtectedData , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encoding.CodePages , System.Text.Json , System.Windows.Extensions From Version 9.0.17 -> To Version 9.0.18
Microsoft.NET.HostModel , Microsoft.NETCore.Platforms , VS.Redist.Common.NetCore.SharedFramework.x64.9.0 , VS.Redist.Common.NetCore.TargetingPack.x64.9.0 , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 9.0.17-servicing.26264.16 -> To Version 9.0.18-servicing.26315.22

Dependency coherency updates
On relative base path root
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100 From Version 9.0.17 -> To Version 9.0.18 (parent: Microsoft.NETCore.App.Runtime.win-x64)

Microsoft.SourceBuild.Intermediate.emsdk From Version 9.0.17-servicing.26258.3 -> To Version 9.0.18-servicing.26310.2 (parent: Microsoft.NETCore.App.Runtime.win-x64)
…otnet-aspnetcore build 20260616.7

On relative base path root
dotnet-dev-certs , dotnet-user-jwts , dotnet-user-secrets , Microsoft.AspNetCore.Analyzers , Microsoft.AspNetCore.App.Ref.Internal , Microsoft.AspNetCore.Components.SdkAnalyzers , Microsoft.AspNetCore.DeveloperCertificates.XPlat , Microsoft.AspNetCore.Mvc.Analyzers , Microsoft.AspNetCore.Mvc.Api.Analyzers , VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0 , Microsoft.SourceBuild.Intermediate.aspnetcore From Version 9.0.17-servicing.26270.11 -> To Version 9.0.18-servicing.26316.7
Microsoft.AspNetCore.App.Ref , Microsoft.AspNetCore.App.Runtime.win-x64 , Microsoft.AspNetCore.Authorization , Microsoft.AspNetCore.Components.Web , Microsoft.AspNetCore.TestHost , Microsoft.Extensions.FileProviders.Embedded , Microsoft.Extensions.ObjectPool , Microsoft.JSInterop From Version 9.0.17 -> To Version 9.0.18
…3 repositories

This pull request updates the following dependencies

[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a *CoherentParentDependency*
attribute were produced in a build used as input to the parent dependency's build.
See [Dependency Description Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
    - **Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100**: from 9.0.17 to 9.0.18 (parent: Microsoft.NETCore.App.Runtime.win-x64)
    - **Microsoft.SourceBuild.Intermediate.emsdk**: from 9.0.17-servicing.26258.3 to 9.0.18-servicing.26310.2 (parent: Microsoft.NETCore.App.Runtime.win-x64)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)


[marker]: <> (Begin:fc735b81-9fd6-4d18-b1be-525bf9fe3d19)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop
- **Subscription**: [fc735b81-9fd6-4d18-b1be-525bf9fe3d19](https://maestro.dot.net/subscriptions?search=fc735b81-9fd6-4d18-b1be-525bf9fe3d19)
- **Build**: [20260617.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=3002473) ([319111](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-windowsdesktop/build/319111))
- **Date Produced**: June 17, 2026 6:05:01 PM UTC
- **Commit**: [889bd3cf7e1c61b6bdee233190da4931118b6e6d](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?_a=history&version=GC889bd3cf7e1c61b6bdee233190da4931118b6e6d)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.17 to 9.0.18][1]
     - Microsoft.WindowsDesktop.App.Ref
     - Microsoft.WindowsDesktop.App.Runtime.win-x64
  - From [9.0.17-servicing.26268.1 to 9.0.18-servicing.26317.1][1]
     - VS.Redist.Common.WindowsDesktop.SharedFramework.x64.9.0
     - VS.Redist.Common.WindowsDesktop.TargetingPack.x64.9.0

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-windowsdesktop/branches?baseVersion=GC9c74c8784a90d64bcc5c5c552d5420eafb60fa4f&targetVersion=GC889bd3cf7e1c61b6bdee233190da4931118b6e6d&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:fc735b81-9fd6-4d18-b1be-525bf9fe3d19)




[marker]: <> (Begin:8e22721a-e9f6-419b-9c3b-fbb0f0641e55)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- **Subscription**: [8e22721a-e9f6-419b-9c3b-fbb0f0641e55](https://maestro.dot.net/subscriptions?search=8e22721a-e9f6-419b-9c3b-fbb0f0641e55)
- **Build**: [20260615.22](https://dev.azure.com/dnceng/internal/_build/results?buildId=3001160) ([318821](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-runtime/build/318821))
- **Date Produced**: June 16, 2026 5:14:37 AM UTC
- **Commit**: [d839c41c85988aadc213e8e42269ecd7883a1790](https://dev.azure.com/dnceng/internal...
…otnet-aspnetcore build 20260617.10

On relative base path root
dotnet-dev-certs , dotnet-user-jwts , dotnet-user-secrets , Microsoft.AspNetCore.Analyzers , Microsoft.AspNetCore.App.Ref.Internal , Microsoft.AspNetCore.Components.SdkAnalyzers , Microsoft.AspNetCore.DeveloperCertificates.XPlat , Microsoft.AspNetCore.Mvc.Analyzers , Microsoft.AspNetCore.Mvc.Api.Analyzers , VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0 , Microsoft.SourceBuild.Intermediate.aspnetcore From Version 9.0.18-servicing.26316.7 -> To Version 9.0.18-servicing.26317.10
Microsoft.AspNetCore.App.Ref , Microsoft.AspNetCore.App.Runtime.win-x64 , Microsoft.AspNetCore.Authorization , Microsoft.AspNetCore.Components.Web , Microsoft.AspNetCore.TestHost , Microsoft.Extensions.FileProviders.Embedded , Microsoft.Extensions.ObjectPool , Microsoft.JSInterop From Version 9.0.18 -> To Version 9.0.18
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [fccb84dc-5ab4-47fa-89b4-a043eabf59b7](https://maestro.dot.net/subscriptions?search=fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
- **Build**: [20260617.10](https://dev.azure.com/dnceng/internal/_build/results?buildId=3002576) ([319152](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/319152))
- **Date Produced**: June 17, 2026 10:29:32 PM UTC
- **Commit**: [c2c420608bf0e24d7df00021f48a686c70928871](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCc2c420608bf0e24d7df00021f48a686c70928871)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.18-servicing.26316.7 to 9.0.18-servicing.26317.10][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.18 to 9.0.18][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GCf8834c1fdc165a41191cd294b997aae77a6ce495&targetVersion=GCc2c420608bf0e24d7df00021f48a686c70928871&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
…otnet-aspnetcore build 20260619.8

On relative base path root
dotnet-dev-certs , dotnet-user-jwts , dotnet-user-secrets , Microsoft.AspNetCore.Analyzers , Microsoft.AspNetCore.App.Ref.Internal , Microsoft.AspNetCore.Components.SdkAnalyzers , Microsoft.AspNetCore.DeveloperCertificates.XPlat , Microsoft.AspNetCore.Mvc.Analyzers , Microsoft.AspNetCore.Mvc.Api.Analyzers , VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0 , Microsoft.SourceBuild.Intermediate.aspnetcore From Version 9.0.18-servicing.26317.10 -> To Version 9.0.18-servicing.26319.8
Microsoft.AspNetCore.App.Ref , Microsoft.AspNetCore.App.Runtime.win-x64 , Microsoft.AspNetCore.Authorization , Microsoft.AspNetCore.Components.Web , Microsoft.AspNetCore.TestHost , Microsoft.Extensions.FileProviders.Embedded , Microsoft.Extensions.ObjectPool , Microsoft.JSInterop From Version 9.0.18 -> To Version 9.0.18
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [fccb84dc-5ab4-47fa-89b4-a043eabf59b7](https://maestro.dot.net/subscriptions?search=fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
- **Build**: [20260619.8](https://dev.azure.com/dnceng/internal/_build/results?buildId=3004286) ([319500](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/319500))
- **Date Produced**: June 20, 2026 12:08:52 AM UTC
- **Commit**: [b8520b5b3b90f00b2b4b2899af36e9fd1a19f9d0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCb8520b5b3b90f00b2b4b2899af36e9fd1a19f9d0)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.18-servicing.26317.10 to 9.0.18-servicing.26319.8][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.18 to 9.0.18][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GCc2c420608bf0e24d7df00021f48a686c70928871&targetVersion=GCb8520b5b3b90f00b2b4b2899af36e9fd1a19f9d0&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
…otnet-aspnetcore build 20260623.11

On relative base path root
dotnet-dev-certs , dotnet-user-jwts , dotnet-user-secrets , Microsoft.AspNetCore.Analyzers , Microsoft.AspNetCore.App.Ref.Internal , Microsoft.AspNetCore.Components.SdkAnalyzers , Microsoft.AspNetCore.DeveloperCertificates.XPlat , Microsoft.AspNetCore.Mvc.Analyzers , Microsoft.AspNetCore.Mvc.Api.Analyzers , VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0 , Microsoft.SourceBuild.Intermediate.aspnetcore From Version 9.0.18-servicing.26319.8 -> To Version 9.0.18-servicing.26323.11
Microsoft.AspNetCore.App.Ref , Microsoft.AspNetCore.App.Runtime.win-x64 , Microsoft.AspNetCore.Authorization , Microsoft.AspNetCore.Components.Web , Microsoft.AspNetCore.TestHost , Microsoft.Extensions.FileProviders.Embedded , Microsoft.Extensions.ObjectPool , Microsoft.JSInterop From Version 9.0.18 -> To Version 9.0.18
…dnceng/internal/dotnet-aspnetcore

This pull request updates the following dependencies

[marker]: <> (Begin:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore
- **Subscription**: [fccb84dc-5ab4-47fa-89b4-a043eabf59b7](https://maestro.dot.net/subscriptions?search=fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
- **Build**: [20260623.11](https://dev.azure.com/dnceng/internal/_build/results?buildId=3006568) ([319920](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-aspnetcore/build/319920))
- **Date Produced**: June 23, 2026 9:18:26 PM UTC
- **Commit**: [a95d6599f37762ec8394ba9ca01e8263b2e36a26](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?_a=history&version=GCa95d6599f37762ec8394ba9ca01e8263b2e36a26)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.18-servicing.26319.8 to 9.0.18-servicing.26323.11][1]
     - dotnet-dev-certs
     - dotnet-user-jwts
     - dotnet-user-secrets
     - Microsoft.AspNetCore.Analyzers
     - Microsoft.AspNetCore.App.Ref.Internal
     - Microsoft.AspNetCore.Components.SdkAnalyzers
     - Microsoft.AspNetCore.DeveloperCertificates.XPlat
     - Microsoft.AspNetCore.Mvc.Analyzers
     - Microsoft.AspNetCore.Mvc.Api.Analyzers
     - VS.Redist.Common.AspNetCore.SharedFramework.x64.9.0
     - Microsoft.SourceBuild.Intermediate.aspnetcore
  - From [9.0.18 to 9.0.18][1]
     - Microsoft.AspNetCore.App.Ref
     - Microsoft.AspNetCore.App.Runtime.win-x64
     - Microsoft.AspNetCore.Authorization
     - Microsoft.AspNetCore.Components.Web
     - Microsoft.AspNetCore.TestHost
     - Microsoft.Extensions.FileProviders.Embedded
     - Microsoft.Extensions.ObjectPool
     - Microsoft.JSInterop

[1]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GCb8520b5b3b90f00b2b4b2899af36e9fd1a19f9d0&targetVersion=GCa95d6599f37762ec8394ba9ca01e8263b2e36a26&_a=files

[DependencyUpdate]: <> (End)


[marker]: <> (End:fccb84dc-5ab4-47fa-89b4-a043eabf59b7)
…0260708.3

On relative base path root
Microsoft.TemplateEngine.Abstractions From Version 9.0.316 -> To Version 9.0.317
Microsoft.TemplateEngine.Mocks From Version 9.0.316-servicing.26302.6 -> To Version 9.0.317-servicing.26358.3
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: Noah Gilson <nagilson@umich.edu>
Co-authored-by: Marc Paine <marcpop@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Two bugs fixed:

1. Registry constructor chain did not forward retryDelayProvider parameter
   through intermediate constructors, so it was always null at the private
   constructor (defaulting to 1-second delay instead of the caller's value).

2. Tests used invalid digest 'sha256:testdigest1234' (not valid 64-char hex).
   The internal branch has digest validation that rejects non-hex digests,
   causing exceptions inside the retry loop that exhaust all retries and
   throw UnableToDownloadFromRepositoryException.

Each test now uses a unique valid SHA-256 digest to also avoid parallel test
interference via the shared ContentStore.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ip MauiBlazor

Skip the flaky MauiBlazor hot reload test (#54150). The NuGetAudit=false
fix for It_resolves_assembly_conflicts_with_a_NETFramework_library is already
present in this branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolve conflicts by keeping release/10.0.1xx (ours) for the diverged
dependency-flow files, and keeping the source-build/VMR files deleted
(they were removed from release/10.0.1xx during VMR extraction):

  Kept 10.0.1xx version (ours):
    NuGet.config, eng/Version.Details.xml, eng/Versions.props,
    test/dotnet-watch.Tests/HotReload/ApplyDeltaTests.cs
  Kept deleted (modify/delete, deleted in 10.0.1xx):
    eng/pipelines/templates/jobs/vmr-build.yml
    eng/pipelines/templates/jobs/vmr-synchronization.yml
    eng/pipelines/vmr-build-pr.yml
    src/SourceBuild/content/eng/Version.Details.xml
    src/SourceBuild/content/eng/Versions.props
    src/SourceBuild/content/global.json
    src/VirtualMonoRepo/source-mappings.json

Real fixes flowing forward (clean auto-merge): container registry blob
digest validation + user-level cache directory, and two test updates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 59570d89-a7e3-4993-baa9-3fb1f442a617
@dsplaisted dsplaisted force-pushed the merge/release/9.0.3xx-to-release/10.0.1xx branch from 94f3c67 to 124d46c Compare July 16, 2026 16:16
@dsplaisted dsplaisted requested a review from a team as a code owner July 16, 2026 16:16

@marcpopMSFT marcpopMSFT left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we'll likely have merge conflicts when dotnet/dotnet flows in as it'll have similar (identical?) container changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.