Repository navigation
Update vulnerable cryptography packages to 10.0.13 - #17699
Merged
Merged
Conversation
Update System.Security.Cryptography.Pkcs and Xml to the patched 10.0.13 runtime release, and restore the central Pkcs package version so transitive pinning protects Arcade and downstream packages. Fixes dotnet#17698 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The version, provenance, and central package-management changes are consistent and appropriately validated.
0 open findings
What changed in this PR
Updates vulnerable cryptography dependencies to patched runtime 10.0.13 packages and enables central transitive pinning for Pkcs.
Changes:
- Updates Pkcs and Xml versions to 10.0.13.
- Records the matching runtime v10.0.13 commit.
- Restores central Pkcs package version management.
| File | Description |
|---|---|
eng/Version.Details.xml |
Updates dependency versions and provenance. |
eng/Version.Details.props |
Updates package version properties. |
Directory.Packages.props |
Adds central Pkcs transitive pinning. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
missymessa
previously approved these changes
Oct 14, 2026
haruna99
previously approved these changes
Oct 14, 2026
Keep the manually maintained dotnet/runtime package versions coherent by updating the full 10.0.11 cohort to the patched 10.0.13 servicing release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Oct 14, 2026
MichaelSimons
approved these changes
Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
6aa72daa24f66c01c3d7b6a32519e9d21396deecfrom tagv10.0.13PackageVersionentry so central transitive pinning applies repository-wide and to produced package metadataFixes #17698. Release/10.0 follow-up: #17700.
Dependency-flow behavior
The dotnet/runtime entries in
Version.Details.propsandVersion.Details.xmlare manually maintained; there is no direct runtime-to-Arcade Darc subscription updating this cohort. Prior PR #17446 started as a Maestro/Darc Arcade self-flow, then added manual commit733041bto move the complete runtime cohort from 10.0.10 to 10.0.11 after the generated update caused downgrades. Current pending dotnet/dotnet codeflow PR #17696 changes only the top-level source SHA and leaves this cohort at 10.0.11.This PR follows the established pattern by moving the full coherent cohort to 10.0.13. The resulting Arcade build will carry these versions into subsequent self-flows instead of allowing the next generated dependency update to reintroduce 10.0.11.
Security advisories
Validation
./build.sh --restore --build --pack --configuration Releasesucceeded