From f7b33e5ab5d70adba0d103b1cb10903fcb49a96d Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Sat, 11 Jul 2026 02:11:48 +0000 Subject: [PATCH 1/8] Backflow from https://github.com/dotnet/dotnet / 50dbab4 build 322464 Diff: https://github.com/dotnet/dotnet/compare/920a0d55f8d87a0423dd3a89555f70d9c9004584..50dbab4de210e882172b07934e9666313b7065f1 From: https://github.com/dotnet/dotnet/commit/920a0d55f8d87a0423dd3a89555f70d9c9004584 To: https://github.com/dotnet/dotnet/commit/50dbab4de210e882172b07934e9666313b7065f1 [[ commit created by automation ]] --- NuGet.config | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/NuGet.config b/NuGet.config index 527f95b5c87..a6df74bb15e 100644 --- a/NuGet.config +++ b/NuGet.config @@ -35,4 +35,8 @@ + + + + From 3c6bfdfe1bd762687a58beea3ffdee2ca835c346 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Sat, 11 Jul 2026 02:11:59 +0000 Subject: [PATCH 2/8] Update dependencies from build 322464 Updated Dependencies: Microsoft.Build, Microsoft.Build.Framework, Microsoft.Build.Tasks.Core, Microsoft.Build.Utilities.Core (Version 18.10.0-1.26359.10 -> 18.10.0-preview-26357-08) [[ commit created by automation ]] --- eng/Version.Details.props | 8 ++++---- eng/Version.Details.xml | 18 +++++++++--------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/eng/Version.Details.props b/eng/Version.Details.props index fb64aafcc65..a72e7a4d967 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -8,10 +8,10 @@ This file should be imported by eng/Versions.props 10.0.0-beta.26324.4 - 18.10.0-1.26359.10 - 18.10.0-1.26359.10 - 18.10.0-1.26359.10 - 18.10.0-1.26359.10 + 18.10.0-preview-26357-08 + 18.10.0-preview-26357-08 + 18.10.0-preview-26357-08 + 18.10.0-preview-26357-08 1.0.0-prerelease.26318.1 1.0.0-prerelease.26318.1 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index e446d5e3f40..c59d4206bb6 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,22 +1,22 @@ - + - + https://github.com/dotnet/msbuild - ad7e074ca3a93f4af30405c4cd24db04151d7ce8 + 746aeb090c9e2bcedc398751370da862014ebf7a - + https://github.com/dotnet/msbuild - ad7e074ca3a93f4af30405c4cd24db04151d7ce8 + 746aeb090c9e2bcedc398751370da862014ebf7a - + https://github.com/dotnet/msbuild - ad7e074ca3a93f4af30405c4cd24db04151d7ce8 + 746aeb090c9e2bcedc398751370da862014ebf7a - + https://github.com/dotnet/msbuild - ad7e074ca3a93f4af30405c4cd24db04151d7ce8 + 746aeb090c9e2bcedc398751370da862014ebf7a https://github.com/dotnet/roslyn From 20aef7ec839eb501e691cff9274ae1e12eafb86b Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Tue, 14 Jul 2026 02:07:11 +0000 Subject: [PATCH 3/8] Update dependencies from build 322734 No dependency updates to commit [[ commit created by automation ]] --- eng/Version.Details.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index c59d4206bb6..5f286a1daef 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,6 +1,6 @@ - + https://github.com/dotnet/msbuild From e75eaebe28671821f2717faab6253c5fae8746e6 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Wed, 15 Jul 2026 02:06:18 +0000 Subject: [PATCH 4/8] Update dependencies from build 322911 No dependency updates to commit [[ commit created by automation ]] --- eng/Version.Details.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 5f286a1daef..ba40b77c7a2 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,6 +1,6 @@ - + https://github.com/dotnet/msbuild From eb6515980b14be2bf98f4202e85f694a05bbbcd1 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Thu, 16 Jul 2026 02:06:24 +0000 Subject: [PATCH 5/8] Update dependencies from build 323048 No dependency updates to commit [[ commit created by automation ]] --- eng/Version.Details.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index ba40b77c7a2..071afa32a68 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,6 +1,6 @@ - + https://github.com/dotnet/msbuild From af80fc488439837d40f01359b8af29dc7bcdeb6a Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 10:47:29 +0200 Subject: [PATCH 6/8] Fix NU1903 audit failures from updated transitive dependencies The codeflow update to Microsoft.Build.* now transitively pulls System.Security.Cryptography.Xml 10.0.8 (newly flagged by GHSA advisories, patched in 10.0.10) on .NET, and Microsoft.CodeAnalysis.Test.Resources.Proprietary -> NETStandard.Library 1.6.1 pulls vulnerable System.Net.Http 4.3.0 and System.Text.RegularExpressions 4.3.0 on net472. - Bump System.Security.Cryptography.Xml override to 10.0.10 (Version.Details). - Add .NET-only Cryptography.Xml overrides in fsc/fsi/FSharp.Build.UnitTests (net472 excluded: no such transitive there and its deps conflict with System.ValueTuple). These cascade to Microsoft.FSharp.Compiler and FSharpSuite.Tests. - Override the net472 System.Net.Http/System.Text.RegularExpressions facades to patched 4.3.4/4.3.1 in FSharp.Test.Utilities. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- eng/Version.Details.props | 2 +- eng/Version.Details.xml | 2 +- eng/Versions.props | 3 +++ src/fsc/fscProject/fsc.fsproj | 5 +++++ src/fsi/fsiProject/fsi.fsproj | 5 +++++ tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj | 5 +++++ tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj | 3 +++ 7 files changed, 23 insertions(+), 2 deletions(-) diff --git a/eng/Version.Details.props b/eng/Version.Details.props index a72e7a4d967..4d76759debe 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -32,7 +32,7 @@ This file should be imported by eng/Versions.props 10.0.2 10.0.2 10.0.2 - 10.0.8 + 10.0.10 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 071afa32a68..25aa3f24ae1 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -75,7 +75,7 @@ - + https://github.com/dotnet/runtime diff --git a/eng/Versions.props b/eng/Versions.props index 60486fabcaa..4455c61766c 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -89,6 +89,9 @@ 4.6.1 4.6.3 6.1.2 + + 4.3.4 + 4.3.1 diff --git a/src/fsc/fscProject/fsc.fsproj b/src/fsc/fscProject/fsc.fsproj index a8d694360c1..c66429fe0dc 100644 --- a/src/fsc/fscProject/fsc.fsproj +++ b/src/fsc/fscProject/fsc.fsproj @@ -37,6 +37,11 @@ + + + + + diff --git a/src/fsi/fsiProject/fsi.fsproj b/src/fsi/fsiProject/fsi.fsproj index 1b955f9564e..a143d749475 100644 --- a/src/fsi/fsiProject/fsi.fsproj +++ b/src/fsi/fsiProject/fsi.fsproj @@ -24,6 +24,11 @@ $(ArtifactsDir)obj/$(MSBuildProjectName)/$(Configuration)/ + + + + + diff --git a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj index 2018b41cb92..08df369bf4a 100644 --- a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj +++ b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj @@ -34,4 +34,9 @@ + + + + + diff --git a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj index a4f64a0f893..e60fa89b94c 100644 --- a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj +++ b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj @@ -96,6 +96,9 @@ + + + $(NoWarn);NU1510;44 From e2878bb740a44a3c053ad779b37fe4cc394df2bd Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 12:21:55 +0200 Subject: [PATCH 7/8] Pin MessagePack to patched 2.5.302 to fix NU1902/NU1903 audit StreamJsonRpc 2.25.29 pulls MessagePack transitively; some restore environments resolve the vulnerable 2.5.198 (< 2.5.301 patched line), tripping NuGetAudit warnings-as-errors in FSharp.Compiler.LanguageServer.Tests. Add an explicit direct reference at 2.5.302 (StreamJsonRpc's own minimum, already patched) so the resolved version is deterministic everywhere. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../FSharp.Compiler.LanguageServer.fsproj | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/FSharp.Compiler.LanguageServer/FSharp.Compiler.LanguageServer.fsproj b/src/FSharp.Compiler.LanguageServer/FSharp.Compiler.LanguageServer.fsproj index e1b1f0b35f9..c5cc30680bc 100644 --- a/src/FSharp.Compiler.LanguageServer/FSharp.Compiler.LanguageServer.fsproj +++ b/src/FSharp.Compiler.LanguageServer/FSharp.Compiler.LanguageServer.fsproj @@ -12,6 +12,8 @@ + + From 8ec1d038b89a24ae127695427b79922a6b5c8422 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 21 Jul 2026 13:26:22 +0200 Subject: [PATCH 8/8] Fix malformed Version.Details.xml (duplicate closing Dependency tag) A merge conflict resolution left a stray closing tag after Microsoft.Build.Utilities.Core, making the XML invalid and failing the Maestro Version.Details.props Validation and Codeflow verification checks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- eng/Version.Details.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 0272a2f0b72..5e1354d0746 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -18,7 +18,6 @@ https://github.com/dotnet/msbuild 746aeb090c9e2bcedc398751370da862014ebf7a - https://github.com/dotnet/roslyn 3d32d464e2949f054086fbb5346e4beea0c6df56