Repository navigation
[release/10.0] Update MsQuic to 2.5.12 - #136233
Merged
ViveliDuCh merged 1 commit intoOct 21, 2026
Merged
Conversation
Update the Windows MsQuic dependency to the patched public package, matching the release/8.0 and release/9.0 updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 792c8703-3703-4180-975a-9b86d809b48a
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/area-infrastructure-libraries |
Member
Author
|
/ba-g unrelated failure tracked in #136235 |
Member
Author
|
Tactics approved via email, adding the servicing-approved label |
wfurt
approved these changes
Oct 21, 2026
ViveliDuCh
added a commit
that referenced
this pull request
Oct 21, 2026
…136235) Fixes #136231 <!-- Issue Number --> main PR: Not available; this addresses the release/10.0 build dependency graph. <!-- Link to PR if any that fixed this in the main branch. --> # Description <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Pin System.Security.Cryptography.Pkcs to 9.0.21 in Crossgen2Tasks, installer.tasks, and Microsoft.DotNet.CoreSetup.Packaging.Tests through a shared version property in eng/Versions.props. These projects currently resolve Pkcs 9.0.6 transitively through NuGet.Packaging/7.0.3-rc.46203. Direct package references select the patched version without changing the NuGet toolset or suppressing vulnerability auditing. Version 9.0.21 is the patched 9.x release listed in GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7. This PR is separate from the MsQuic update in #136233. # Customer Impact <!-- What is the impact to customers of not taking this fix? --> Release/10.0 builds fail package restore with NU1902 and NU1903 because the existing Pkcs dependency is affected by denial-of-service vulnerabilities. This blocks Windows and Linux build legs before tests can run. # Regression <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> Published advisories against the existing transitive dependency trigger the existing warnings-as-errors policy. This is not a product-code regression. # Testing <!-- What kind of testing has been done with the fix. --> Windows x64, SDK 10.0.111: - All three projects restore Pkcs 9.0.21 without audit errors; both task projects and the isolated packaging test assembly compile. - Packaging tests: **3 ran, 3 failed** because required product `.nupkg` files are missing. - No full product build; the main-branch baseline was waived. <details> <summary>Exact commands and results</summary> | Command | Result | |---|---| | `.\dotnet.cmd restore .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet` | Failed before; passed after | | `.\dotnet.cmd restore .\src\tasks\installer.tasks\installer.tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet` | Failed before; passed after | | `.\dotnet.cmd restore .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet` | Failed before; passed after | | `.\dotnet.cmd build .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet` | Passed | | `.\dotnet.cmd build .\src\tasks\installer.tasks\installer.tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet` | Passed | | `.\dotnet.cmd build .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet` | Failed: unbuilt packaging dependency (NETSDK1004) | | `.\dotnet.cmd build .\src\installer\tests\Microsoft.DotNet.CoreSetup.Packaging.Tests\Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 /p:SkipBuildingSharedFrameworkTestDependencies=true -v:quiet` | Passed | | `.\dotnet.cmd test .\artifacts\bin\Microsoft.DotNet.CoreSetup.Packaging.Tests\Debug\net10.0\Microsoft.DotNet.CoreSetup.Packaging.Tests.dll --filter "category!=failing" --logger "console;verbosity=normal"` | Failed: 3/3 missing product packages | </details> # Risk <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low: a servicing patch update to a build/test dependency, with no product source changes or audit suppressions. All affected dependency graphs restore successfully and the task and test assemblies compile. Full package-dependent tests remain unverified because their product artifacts are missing locally. # Package authoring no longer needed in .NET 9 IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 792c8703-3703-4180-975a-9b86d809b48a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #136232
main PR #135749
Description
Update
MicrosoftNativeQuicMsQuicSchannelVersionfrom 2.5.11 to 2.5.12, applying the dependency change from #135883 to release/10.0. The corresponding release/9.0 change is #135884.The shared version property updates both the Windows product package and functional-test package references. No audit suppressions or managed-code changes are included.
Customer Impact
Public release/10.0 Windows builds fail restore with NU1902 because Microsoft.Native.Quic.MsQuic.Schannel 2.5.11 is affected by GHSA-2mxg-prvg-9jfg (CVE-2026-85790). Version 2.5.12 is the patched release.
This removes the MsQuic blocker also seen in #136068, but does not address the independent System.Security.Cryptography.Pkcs 9.0.6 audit failures tracked in #136231.
Regression
An advisory against the existing native dependency causes NuGet audit warnings to fail restore under the existing warnings-as-errors policy. This is not a managed-code regression.
Testing
Commands were run on Windows x64 with the repository SDK 10.0.111:
.\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quietfailed with NU1902 for Schannel 2.5.11..\dotnet.cmd build .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quietpassed with 0 warnings and 0 errors..\dotnet.cmd build /t:test .\src\libraries\System.Net.Quic\tests\FunctionalTests\System.Net.Quic.Functional.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quietfailed before test execution: "The shared framework must be built before the local targeting pack can be consumed." No functional tests ran..\dotnet.cmd restore .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quietfailed with the existing Pkcs 9.0.6 NU1902/NU1903 errors. The assets graph shows this dependency comes from NuGet.Packaging/7.0.3-rc.46203.A full main-branch baseline was explicitly waived for this dependency-only change. No full runtime/libraries build or functional test run was completed.
Risk
Low: a one-line native dependency patch-version bump, matching the version already used by main, release/8.0, and release/9.0. Targeted restore and compilation passed; native runtime behavior remains unverified locally because the functional tests could not start.
Package authoring no longer needed in .NET 9
IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.