Repository navigation
[release/11.0] Move runtime dependencies to .NET 10.0.13 - #17701
Merged
Merged
Conversation
Update System.Security.Cryptography.Pkcs and Xml to the patched 10.0.13 runtime release, and restore the central Pkcs package version so transitive pinning protects Arcade and downstream packages. Fixes #17698 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep the manually maintained dotnet/runtime package versions coherent by updating the full 10.0.11 cohort to the patched 10.0.13 servicing release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The servicing versions, provenance, and central pinning are consistent, with no blocking issues identified.
0 open findings
What changed in this PR
Backports the patched runtime dependencies to Arcade 11.x for downstream Helix consumers.
Changes:
- Updates the complete maintained runtime dependency cohort to 10.0.13.
- Centrally pins Pkcs to prevent vulnerable transitive versions.
- Updates runtime source provenance.
| File | Description |
|---|---|
| eng/Version.Details.xml | Updates dependency versions and runtime commit provenance. |
| eng/Version.Details.props | Aligns runtime package properties to 10.0.13. |
| Directory.Packages.props | Adds the central Pkcs version entry. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
keeping the base as 10.x. I'm not sure if that is the best move but maybe do that until 11.0 ships...? |
haruna99
approved these changes
Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the patched runtime dependency cohort from #17699 to the Arcade 11.x production branch. This is required because Arcade
mainnow produces 12.x packages, while dotnet-helix-machines consumes Arcade 11.x through the existingrelease/11.0Maestro subscription.Changes:
System.Security.Cryptography.Pkcsto 10.0.13 so generated packages do not retain the vulnerable transitive version6aa72daa24f66c01c3d7b6a32519e9d21396deecValidation:
./build.sh --restore --build --pack --configuration Release /p:DotNetBuildTests=falsepassedMicrosoft.Arcade.Common.11.0.0-devandMicrosoft.DotNet.Helix.JobSender.11.0.0-devpackages declareSystem.Security.Cryptography.Pkcs10.0.13The normal all-project local build additionally encounters the existing macOS test-fixture issue where
Microsoft.DotNet.MacOsPkg.Testsexpects an apphost that is not produced on this machine; the production-only build and pack succeeds.Related: #17698, #17699, #17700
Downstream Helix Machines remediation: dnceng/internal dotnet-helix-machines PR 66706.