[release/9.0.1xx] Update dependencies from dotnet/arcade #48964

dotnet-maestro · 2025-05-14T21:16:32Z

This pull request updates the following dependencies

From https://github.com/dotnet/arcade

Subscription: fb3f8aec-5167-4ffc-ab85-08dcc13e8b5d
Build: 20250602.2
Date Produced: June 2, 2025 9:40:50 PM UTC
Commit: 0d52a8b262d35fa2fde84e398cb2e791b8454bd2
Branch: refs/heads/release/9.0

Updates:
- Microsoft.SourceBuild.Intermediate.arcade: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.Arcade.Sdk: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.Build.Tasks.Installers: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.Helix.Sdk: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.SignTool: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.XliffTasks: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2
- Microsoft.DotNet.XUnitExtensions: from 9.0.0-beta.25263.2 to 9.0.0-beta.25302.2

…513.5 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Installers , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XliffTasks , Microsoft.DotNet.XUnitExtensions From Version 9.0.0-beta.25263.2 -> To Version 9.0.0-beta.25263.5

v-wuzhai · 2025-05-15T06:26:42Z

@dotnet/source-build Could you take a look at the failures here?

NikolaMilosavljevic · 2025-05-15T14:31:50Z

These are all NuGet Audit errors - @ViktorHofer do you know if these show up in repo builds in 9.0 branches?

Latest arcade CI or PR, 9.0, builds were on Tuesday, before the Audit errors were triggered. So, this explains why we have not seen this in arcade builds yet.

ViktorHofer · 2025-05-15T14:42:52Z

I'm not 100% sure which version of NuGet inserted into 9.0 but assuming it was 6.11, NuGetAudit is enabled by default for direct dependencies (not transitives): https://github.com/NuGet/NuGet.Client/blob/5469bd0d9de8108f15f21644759773b85471366c/src/NuGet.Core/NuGet.Build.Tasks/NuGet.targets#L71-L72

So any direct reference to i.e. the Microsoft.Build.Tasks.Core package that got marked as vulnerable yesterday will error.

NikolaMilosavljevic · 2025-05-15T14:44:21Z

Errors are very similar to those seen in 10.0 branches, i.e.:

    /vmr/src/arcade/src/Microsoft.DotNet.Build.Tasks.TargetFramework/src/Microsoft.DotNet.Build.Tasks.TargetFramework.csproj : error NU1901: Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.8.3 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [/vmr/src/arcade/Arcade.sln]
##[error]/vmr/src/arcade/src/Microsoft.DotNet.Build.Tasks.TargetFramework/src/Microsoft.DotNet.Build.Tasks.TargetFramework.csproj(0,0): error NU1901: (NETCORE_ENGINEERING_TELEMETRY=Restore) Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.8.3 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
    /vmr/src/arcade/src/Microsoft.DotNet.Build.Tasks.Packaging/src/Microsoft.DotNet.Build.Tasks.Packaging.csproj : error NU1901: Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.8.3 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc [/vmr/src/arcade/Arcade.sln]
##[error]/vmr/src/arcade/src/Microsoft.DotNet.Build.Tasks.Packaging/src/Microsoft.DotNet.Build.Tasks.Packaging.csproj(0,0): error NU1901: (NETCORE_ENGINEERING_TELEMETRY=Restore) Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.8.3 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc

NikolaMilosavljevic · 2025-05-15T21:16:08Z

Arcade uses packages from SBRP, version 17.8.3, which is considered vulnerable. Next up, in the same range, that isn't vulnerable is 17.8.29. I'll produce SBRP packages and flow them to arcade, so the version can be updated. This should eventually resolve the issue.

NikolaMilosavljevic · 2025-05-16T21:50:38Z

I've merged the fix in arcade repo - dotnet/arcade#15843. It should be picked up by this flow after successful build. That should resolve the source-build issue.

…6-409a-8baa-38923669dc4f

NikolaMilosavljevic · 2025-05-17T01:55:58Z

I've triggered the arcade->sdk flow for 9.0.1xx - it should update this PR shortly and start a rerun of the checks.

…516.2 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Installers , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XliffTasks , Microsoft.DotNet.XUnitExtensions From Version 9.0.0-beta.25263.2 -> To Version 9.0.0-beta.25266.2

…darc-release/9.0.1xx-530ae970-10b6-409a-8baa-38923669dc4f

…521.1 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Installers , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XliffTasks , Microsoft.DotNet.XUnitExtensions From Version 9.0.0-beta.25263.2 -> To Version 9.0.0-beta.25271.1

…6-409a-8baa-38923669dc4f

…602.2 Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Installers , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.SignTool , Microsoft.DotNet.XliffTasks , Microsoft.DotNet.XUnitExtensions From Version 9.0.0-beta.25263.2 -> To Version 9.0.0-beta.25302.2

v-wuzhai · 2025-06-05T05:44:35Z

/azp run dotnet-sdk-public-ci,sdk-source-build,sdk-unified-build

azure-pipelines · 2025-06-05T05:44:52Z

Azure Pipelines successfully started running 2 pipeline(s).

v-wuzhai · 2025-06-05T08:05:50Z

@dotnet/source-build Could you take a look at this sdk-source-build failure?

Build FAILED.

/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.8.0 has a known low severity vulnerability, GHSA-h4j7-5rxr-p4wc [TargetFramework=net9.0]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.8.0 has a known low severity vulnerability, GHSA-h4j7-5rxr-p4wc [TargetFramework=netstandard2.0]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.8.0 has a known low severity vulnerability, GHSA-h4j7-5rxr-p4wc [TargetFramework=net9.0]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : warning NU1901: Package 'Microsoft.Build.Tasks.Core' 16.8.0 has a known low severity vulnerability, GHSA-h4j7-5rxr-p4wc [TargetFramework=netstandard2.0]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : error NU1901: Package 'Microsoft.Build.Tasks.Core' 16.8.0 has a known low severity vulnerability, GHSA-h4j7-5rxr-p4wc [/vmr/src/nuget-client/build/restorehelper.targets]
4 Warning(s)
1 Error(s)

v-wuzhai · 2025-06-09T07:43:41Z

@dotnet/source-build @NikolaMilosavljevic Just wanted to follow up on this—any updates?

ellahathaway · 2025-06-10T15:52:53Z

@dotnet/source-build @NikolaMilosavljevic Just wanted to follow up on this—any updates?

The issue occurs when building nuget-client with netstandard2.0. It's this line that's causing the issue:

<MicrosoftBuildVersion Condition="'$(TargetFramework)' == 'netcoreapp3.1' Or '$(TargetFramework)' == 'netstandard2.0'">16.8.0</MicrosoftBuildVersion>

NuGet/NuGet.Client#6488 fixed this issue in main. @zivkan - can you please take a look?

…6-409a-8baa-38923669dc4f

marcpopMSFT · 2025-06-10T18:58:58Z

superseded.

v-wuzhai approved these changes May 15, 2025

View reviewed changes

This was referenced May 16, 2025

Adding MSBuild 17.8.29 packages dotnet/source-build-reference-packages#1254

Merged

Update MSBuild versions to latest dotnet/arcade#15843

Merged

Merge branch 'release/9.0.1xx' into darc-release/9.0.1xx-530ae970-10b…

aa428ea

…6-409a-8baa-38923669dc4f

dotnet-maestro bot and others added 2 commits May 17, 2025 02:03

Merge branch 'release/9.0.1xx' of https://github.com/dotnet/sdk into …

3829460

…darc-release/9.0.1xx-530ae970-10b6-409a-8baa-38923669dc4f

This was referenced May 19, 2025

dotnet-watch tests failing #40006

Open

[dotnet watch] Cannot open project Lib.fsproj because extension fsproj is not associated with a language #46378

Open

Throttling of Docker Downloads dotnet/arcade#15659

Open

v-wuzhai added the Branch Lockdown label May 20, 2025

dotnet-maestro bot and others added 2 commits May 22, 2025 02:02

Merge branch 'release/9.0.1xx' into darc-release/9.0.1xx-530ae970-10b…

cb5cf2c

…6-409a-8baa-38923669dc4f

build-analysis bot mentioned this pull request Jun 2, 2025

Test failure - AllWebProjectsRestoreAndBuild fails with Unbalanced Condition for F# MVC templates #40073

Open

dotnet-maestro bot and others added 2 commits June 3, 2025 02:02

Fix minimum width of Author column in tabular output

e012f84

v-wuzhai requested a review from a team as a code owner June 5, 2025 02:16

v-wuzhai added Branch Lockdown and removed Branch Lockdown labels Jun 5, 2025

This was referenced Jun 5, 2025

[release/9.0.1xx] Fix minimum width of Author column in tabular output #49173

Closed

Update branding to 9.0.108 #49245

Merged

v-wuzhai removed the Branch Lockdown label Jun 5, 2025

Merge branch 'release/9.0.1xx' into darc-release/9.0.1xx-530ae970-10b…

9199c59

…6-409a-8baa-38923669dc4f

marcpopMSFT closed this Jun 10, 2025

dotnet-maestro bot deleted the darc-release/9.0.1xx-530ae970-10b6-409a-8baa-38923669dc4f branch June 10, 2025 19:01

This was referenced Jun 10, 2025

Checkout failure: "Git fetch failed with exit code 128" dotnet/arcade#9009

Open

Unable to checkout dotnet/dnceng#4115

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[release/9.0.1xx] Update dependencies from dotnet/arcade #48964

[release/9.0.1xx] Update dependencies from dotnet/arcade #48964

Uh oh!

dotnet-maestro bot commented May 14, 2025 •

edited

Loading

Uh oh!

v-wuzhai commented May 15, 2025

Uh oh!

NikolaMilosavljevic commented May 15, 2025 •

edited

Loading

Uh oh!

ViktorHofer commented May 15, 2025 •

edited

Loading

Uh oh!

NikolaMilosavljevic commented May 15, 2025

Uh oh!

NikolaMilosavljevic commented May 15, 2025 •

edited

Loading

Uh oh!

NikolaMilosavljevic commented May 16, 2025

Uh oh!

NikolaMilosavljevic commented May 17, 2025

Uh oh!

v-wuzhai commented Jun 5, 2025

Uh oh!

azure-pipelines bot commented Jun 5, 2025

Uh oh!

v-wuzhai commented Jun 5, 2025

Uh oh!

v-wuzhai commented Jun 9, 2025

Uh oh!

ellahathaway commented Jun 10, 2025 •

edited

Loading

Uh oh!

marcpopMSFT commented Jun 10, 2025

Uh oh!

Uh oh!

[release/9.0.1xx] Update dependencies from dotnet/arcade #48964

[release/9.0.1xx] Update dependencies from dotnet/arcade #48964

Uh oh!

Conversation

dotnet-maestro bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

From https://github.com/dotnet/arcade

Uh oh!

v-wuzhai commented May 15, 2025

Uh oh!

NikolaMilosavljevic commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ViktorHofer commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NikolaMilosavljevic commented May 15, 2025

Uh oh!

NikolaMilosavljevic commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NikolaMilosavljevic commented May 16, 2025

Uh oh!

NikolaMilosavljevic commented May 17, 2025

Uh oh!

v-wuzhai commented Jun 5, 2025

Uh oh!

azure-pipelines bot commented Jun 5, 2025

Uh oh!

v-wuzhai commented Jun 5, 2025

Uh oh!

v-wuzhai commented Jun 9, 2025

Uh oh!

ellahathaway commented Jun 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marcpopMSFT commented Jun 10, 2025

Uh oh!

Uh oh!

dotnet-maestro bot commented May 14, 2025 •

edited

Loading

NikolaMilosavljevic commented May 15, 2025 •

edited

Loading

ViktorHofer commented May 15, 2025 •

edited

Loading

NikolaMilosavljevic commented May 15, 2025 •

edited

Loading

ellahathaway commented Jun 10, 2025 •

edited

Loading