Skip to content

[automated] Merge branch 'release/9.0' => 'release/9.0-staging' - #135671

Merged
ViveliDuCh merged 37 commits into
release/9.0-stagingfrom
merge/release/9.0-to-release/9.0-staging
Oct 21, 2026
Merged

ViveliDuCh merged 37 commits into
release/9.0-stagingfrom
merge/release/9.0-to-release/9.0-staging

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

I detected changes in the release/9.0 branch which have not been merged yet to release/9.0-staging. I'm a robot and am configured to help you automatically keep release/9.0-staging up to date, so I've opened this PR.

This PR merges commits made on release/9.0 by the following committers:

  • svick
  • dotnet-maestro[bot]

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/9.0
git pull --ff-only
git checkout release/9.0-staging
git pull --ff-only
git merge --no-ff release/9.0

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging
or if you are using SSH
git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/9.0-to-release/9.0-staging'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging
git pull https://github.com/dotnet/runtime merge/release/9.0-to-release/9.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging
or if you are using SSH
git fetch
git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging
git pull git@github.com:dotnet/runtime merge/release/9.0-to-release/9.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

Tarek Mahmoud Sayed and others added 30 commits August 12, 2026 15:04
… directory on Unix

On Unix, we were using an incorrect default servicing directory of `opt/servicing` instead of `/opt/servicing`, resulting in resolution based on the relative path.

This change fixes that constructed path and rejects servicing directories without the needed access permissions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Decode didn't merge attributes on .NET Framework, and we don't merge them
in SignedCms, or in EnvelopedCms except on Windows.
#### AI description  (iteration 1)
#### PR Classification
Bug fix to prevent proxy authentication credentials from being inadvertently sent to origin servers during HTTP redirects.

#### PR Summary
This PR fixes a security issue where proxy authentication headers were incorrectly forwarded to destination servers when following redirects. The fix ensures that `Proxy-Authorization` headers are cleared along with `Authorization` headers during redirects.

- `RedirectHandler.cs`: Added clearing of `Proxy-Authorization` header alongside `Authorization` header during redirect handling
- `HttpClientHandlerTest.Proxy.cs`: Added two test cases to verify proxy credentials are not leaked to origin servers during HTTP-to-HTTPS and HTTP-to-no-proxy redirects
- `LoopbackProxyServer.cs`: Disabled auto-redirect on the outbound client to ensure the proxy correctly relays redirect responses back to clients
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to 2.5.11-ci.156755675

----
#### AI description  (iteration 1)
#### PR Classification
Dependency update to upgrade the MsQuic package version from 2.5.10 to 2.5.11-ci.156755675.

#### PR Summary
This pull request updates the MsQuic Schannel dependency to a newer continuous integration build version.

- `/eng/Versions.props`: Updated `MicrosoftNativeQuicMsQuicSchannelVersion` from 2.5.10 to 2.5.11-ci.156755675
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…links during tar extraction

#### AI description  (iteration 1)
#### PR Classification
Security bug fix to prevent directory traversal vulnerabilities during tar extraction by implementing deferred symlink processing and enhanced validation of symlink targets containing relative parent references.

#### PR Summary
This PR adds comprehensive security measures to prevent malicious tar archives from using symlinks with relative parent paths (`..`) to write files outside the intended extraction directory. The fix introduces a deferred symlink mechanism where symlinks containing `..` are created as placeholder files during extraction and resolved after all entries are processed.

- `TarFile.ExtractToDirectory.File.Tests.cs`: Added 16 new test cases covering symlink directory traversal attacks, deferred symlink processing, circular symlink handling, symlink depth limits, and various edge cases for validating that symlinks with `..` cannot escape the destination directory or follow chains that lead outside the extraction boundary.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
#### AI description  (iteration 1)
#### PR Classification
Dependency version updates and build infrastructure improvements.

#### PR Summary
This pull request updates numerous dependency versions across the repository, primarily upgrading toolset components (Arcade, Cecil, LLVM, XHarness, etc.) to newer versions. It also introduces new GitHub App-based authentication support for build pipelines and updates third-party license notices.

- `/eng/Version.Details.xml` and `/eng/Versions.props`: Updated versions for Microsoft.DotNet.Cecil, Microsoft.DotNet.Arcade.Sdk, runtime packages, optimization packages, and numerous other dependencies to newer releases
- `/eng/common/Get-GitHubAppToken.ps1` (new file) and `/eng/common/core-templates/steps/get-github-app-token.yml` (new file): Added GitHub App installation token minting functionality for Azure DevOps pipelines
- `/eng/common/cross/toolchain.cmake`: Improved Tizen toolchain path detection to dynamically find version subdirectories
- `/eng/common/core-templates/job/onelocbuild.yml`: Added Entra token acquisition and GitHub App authentication support for localization builds
- `/THIRD-PARTY-NOTICES.TXT`: Updated zlib-ng license notice with improved formatting
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…eges/permissions

Don't try changing permissions for globally visible directories and don't follow symlinks if someone deletes and recreates the directory before we can fix permissions

#### Differences from .NET 10

- .NET 9 doesn't have user-scoped mutexes before this change
----
#### AI description  (iteration 1)
#### PR Classification
Bug fix addressing security and race condition issues in shared memory directory creation and permission handling.

#### PR Summary
This PR fixes privilege and permission handling for shared mutex operations by addressing race conditions in directory creation and strengthening security checks. The changes replace symbolic link-vulnerable operations with safer alternatives and ensure proper permission validation.

- `sharedmemory.cpp`: Replaced `stat()` with `lstat()` to prevent symbolic link attacks and ensure proper directory validation
- `sharedmemory.cpp`: Changed `chmod()` to `fchmod()` on file descriptors opened with `O_NOFOLLOW | O_DIRECTORY` flags to eliminate race conditions during permission setting
- `sharedmemory.cpp`: Simplified permission checking logic to strictly enforce required permissions mask and fail immediately if conditions are not met
- `sharedmemory.cpp`: Introduced differentiated permission masks (`PermissionsMask_CurrentUser_ReadWriteExecute` for system directories, `PermissionsMask_AllUsers_ReadWriteExecute` for others)
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…er`, controllable via a new feature switch

#### AI description  (iteration 1)
#### PR Classification
Bug fix / security hardening: adds maximum depth enforcement to `CborReader` to prevent stack overflow from deeply nested CBOR data, with a configurable AppContext switch.

#### PR Summary
Introduces a default max nesting depth of 64 for `CborReader`, configurable via the `System.Formats.Cbor.CborReader.MaxDepth` AppContext switch, and throws `CborContentException` when the depth is exceeded.
- `CborReader.cs`: Adds `GetMaxDepth()`, `EnsureMaxDepthNotExceeded()`, and `s_maxDepth` static field with default value 64, configurable via AppContext.
- `CborReader.Array.cs` and `CborReader.Map.cs`: Add depth check calls in `ReadStartArray` and `ReadStartMap`.
- `CborReader.String.cs`: Adds depth checks in indefinite-length byte/text string reading paths.
- `Strings.resx`: Adds new error message `Cbor_Reader_MaximumDepthExceeded`.
- Tests updated/added in `CborReaderTests.cs` and `CborReaderTests.SkipValue.cs` to validate default and configurable max depth behavior, replacing prior overflow test with `RemoteExecutor`-based test using the new switch.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…dle permissions itself

If a user tries to run a .NET process with `sudo` in a Docker container, named mutexes would be created/modified in the root's `HOME` directory, which may have different permissions than 0700. Don't block this as the SB depends on this being allowed for SB Validation.


----
#### AI description  (iteration 1)
#### PR Classification
Code cleanup / permission handling change: removes explicit ownership and permission validation for shared memory directories used by shared mutexes, delegating enforcement to the filesystem.

#### PR Summary
This PR removes manual `fstat`-based ownership and permission checks in shared memory directory handling, letting the filesystem itself enforce access control instead.
- `sharedmemory.cpp`: Removed the `validateDirectory` lambda and its invocation calls in `EnsurePersistedUserDirectoryExists`, eliminating explicit uid/permission validation of the home and shared directories.
- `sharedmemory.cpp` (`EnsureDirectoryExists`): Removed `fstat`-based checks for directory ownership and permission mask, simplifying the function to directly return the directory file descriptor.
- Removed related error reporting and retry/cleanup logic tied to failed permission validation.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to 2.5.11-ci-159417053

----
#### AI description  (iteration 1)
#### PR Classification
Dependency version update.

#### PR Summary
Updates the MsQuic package version to a newer CI build.
- `eng/Versions.props`: bumped `MicrosoftNativeQuicMsQuicSchannelVersion` from `2.5.11-ci.156755675` to `2.5.11-ci.159417053`.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
This pull request updates the following dependencies

[marker]: <> (Begin:f85f62c8-5e7d-4706-1003-08dcbc30275f)
## From https://github.com/dotnet/emsdk
- **Subscription**:
[f85f62c8-5e7d-4706-1003-08dcbc30275f](https://maestro.dot.net/subscriptions?search=f85f62c8-5e7d-4706-1003-08dcbc30275f)
- **Build**:
[20261008.5](https://dev.azure.com/dnceng/internal/_build/results?buildId=3099573)
([335707](https://maestro.dot.net/channel/3883/github:dotnet:emsdk/build/335707))
- **Date Produced**: October 8, 2026 3:45:46 PM UTC
- **Commit**:
[a84b7393bb5e3c30caf5fc50752c732913cc1fce](dotnet/emsdk@a84b739)
- **Branch**:
[release/9.0](https://github.com/dotnet/emsdk/tree/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.21-servicing.26464.5 to 9.0.22-servicing.26508.5][6]
     - Microsoft.SourceBuild.Intermediate.emsdk
- Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport
  - From [9.0.21 to 9.0.22][6]
     - Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100

[6]: dotnet/emsdk@2b4c425...a84b739

[DependencyUpdate]: <> (End)


[marker]: <> (End:f85f62c8-5e7d-4706-1003-08dcbc30275f)

















[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a
*CoherentParentDependency*
attribute were produced in a build used as input to the parent
dependency's build.
See [Dependency Description
Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**:
from 19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
-
**runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**:
from 19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26457.4 to 19.1.0-alpha.1.26505.5 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
dotnet-maestro Bot and others added 2 commits October 12, 2026 10:05
This pull request updates the following dependencies

[marker]: <> (Begin:abfb473c-f50b-41c8-64c2-08dcbc356d11)
## From https://github.com/dotnet/arcade
- **Subscription**:
[abfb473c-f50b-41c8-64c2-08dcbc356d11](https://maestro.dot.net/subscriptions?search=abfb473c-f50b-41c8-64c2-08dcbc356d11)
- **Build**:
[20261007.8](https://dev.azure.com/dnceng/internal/_build/results?buildId=3099005)
([335616](https://maestro.dot.net/channel/5175/github:dotnet:arcade/build/335616))
- **Date Produced**: October 8, 2026 1:09:10 AM UTC
- **Commit**:
[ca4c91e56da9ae88fc62578058d8aee531679dba](dotnet/arcade@ca4c91e)
- **Branch**:
[release/9.0](https://github.com/dotnet/arcade/tree/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.0-beta.26458.10 to 9.0.0-beta.26507.8][3]
     - Microsoft.SourceBuild.Intermediate.arcade
     - Microsoft.DotNet.Arcade.Sdk
     - Microsoft.DotNet.Build.Tasks.Archives
     - Microsoft.DotNet.Build.Tasks.Feed
     - Microsoft.DotNet.Build.Tasks.Installers
     - Microsoft.DotNet.Build.Tasks.Packaging
     - Microsoft.DotNet.Build.Tasks.TargetFramework
     - Microsoft.DotNet.Build.Tasks.Templating
     - Microsoft.DotNet.Build.Tasks.Workloads
     - Microsoft.DotNet.CodeAnalysis
     - Microsoft.DotNet.GenAPI
     - Microsoft.DotNet.GenFacades
     - Microsoft.DotNet.Helix.Sdk
     - Microsoft.DotNet.PackageTesting
     - Microsoft.DotNet.RemoteExecutor
     - Microsoft.DotNet.SharedFramework.Sdk
     - Microsoft.DotNet.VersionTools.Tasks
     - Microsoft.DotNet.XliffTasks
     - Microsoft.DotNet.XUnitExtensions
  - From [2.9.0-beta.26458.10 to 2.9.0-beta.26507.8][3]
     - Microsoft.DotNet.XUnitAssert
     - Microsoft.DotNet.XUnitConsoleRunner

[3]: dotnet/arcade@c11157d...ca4c91e

[DependencyUpdate]: <> (End)


[marker]: <> (End:abfb473c-f50b-41c8-64c2-08dcbc356d11)

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-bot and others added 2 commits October 13, 2026 21:52
…nternal-to-public builds (#135907)

#135884

The current internal-to-public merge against `release/9.0` is failing
across multiple Windows build legs because of the same warning-as-error:

src/libraries/System.Net.Quic/src/System.Net.Quic.csproj(0,0): error
NU1603: Warning As Error: System.Net.Quic depends on
Microsoft.Native.Quic.MsQuic.Schannel (>= 2.5.11-ci.159417053) but
Microsoft.Native.Quic.MsQuic.Schannel 2.5.11-ci.159417053 was not found.
Microsoft.Native.Quic.MsQuic.Schannel 2.5.11-rc was resolved instead.

`2.5.11-ci.159417053` is the private MsQuic package used internally
during coordinated MSRC servicing, so it is intentionally unavailable to
public builds. Now that the corresponding public servicing package is
available as `2.5.12`,
[#135884](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdotnet%2Fruntime%2Fpull%2F135884&data=05%7C02%7Cvivianad%40microsoft.com%7C98d3318ead20454faf1908df2aee27ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C639276874519544099%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=JIfQXtmjD%2FWBgKaNh5ZZXLClxdNNZQM0b5Z60o2MNjM%3D&reserved=0)
updates `release/9.0-staging` to that version. A targeted
`System.Net.Quic` restore passed locally without `NU1603`. Once this
change reaches `release/9.0` and the internal-to-public merge is
refreshed, public CI should be able to restore the dependency normally.
ViveliDuCh and others added 2 commits October 16, 2026 09:02
Fixes #135880

main PR #135749

<!-- Give a brief summary of the issue and how the pull request is
fixing it. -->

Updates the public release/9.0 servicing branch to use the publicly
available MsQuic 2.5.12 package. This completes the private-to-public
security servicing handoff so internal-to-public merges do not retain
the private `2.5.11-ci.159417053` identifier that public CI cannot
restore.

<!-- What is the impact to customers of not taking this fix? -->

Public release/9.0 builds fail restore with NU1603 because the private
MsQuic servicing package is unavailable to public CI, blocking clean
servicing builds.

<!-- Is this fixing a problem that was introduced in the most recent
release, ie., fixing a regression? -->

This is not a product-code regression. The failure occurs during the
post-disclosure dependency handoff from private MSRC bits to the
corresponding public package.

<!-- What kind of testing has been done with the fix. -->

Passed:

```console
.\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache
```

The restore resolved MsQuic 2.5.12 without NU1603.

<!-- Please assess the risk of taking this fix. Provide details backing
up your assessment. -->

Low. This is a one-line patch-version dependency update to the public
servicing package, with no managed-code changes. Full functional testing
is delegated to CI.

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet
package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older
versions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7
(cherry picked from commit 3b202ff)
This PR updates version branding on branch `release/9.0`.

**Changes:**
- Repository: runtime
  - PatchVersion: `22` -> `23`

**Files Modified:**
- eng/Versions.props (+2 -2)

Co-authored-by: dotnet-release-bot[bot] <280112824+dotnet-release-bot[bot]@users.noreply.github.com>
@ViveliDuCh

Copy link
Copy Markdown
Member

/ba-g Known failures tracked in #136061 (XML timeout), #136193 (WASM timeout), #134003 (Android queue/backport gap), #135649, #123796, #29383, and #96798.

@ViveliDuCh ViveliDuCh added the Servicing-approved Approved for servicing release label Oct 21, 2026
@ViveliDuCh
ViveliDuCh merged commit 0901d94 into release/9.0-staging Oct 21, 2026
277 of 291 checks passed
@ViveliDuCh
ViveliDuCh deleted the merge/release/9.0-to-release/9.0-staging branch October 21, 2026 04:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-codeflow for labeling automated codeflow Servicing-approved Approved for servicing release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants