Skip to content

[automated] Merge branch 'release/9.0' => 'release/9.0-staging'#128153

Merged
svick merged 18 commits into
release/9.0-stagingfrom
merge/release/9.0-to-release/9.0-staging
May 13, 2026
Merged

[automated] Merge branch 'release/9.0' => 'release/9.0-staging'#128153
svick merged 18 commits into
release/9.0-stagingfrom
merge/release/9.0-to-release/9.0-staging

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

I detected changes in the release/9.0 branch which have not been merged yet to release/9.0-staging. I'm a robot and am configured to help you automatically keep release/9.0-staging up to date, so I've opened this PR.

This PR merges commits made on release/9.0 by the following committers:

  • svick
  • dotnet-maestro[bot]
  • vseanreesermsft
  • rzikm
  • alinpahontu2912
  • iremyux

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/9.0
git pull --ff-only
git checkout release/9.0-staging
git pull --ff-only
git merge --no-ff release/9.0

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging
or if you are using SSH
git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/9.0-to-release/9.0-staging'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging
git pull https://github.com/dotnet/runtime merge/release/9.0-to-release/9.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging
or if you are using SSH
git fetch
git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging
git pull git@github.com:dotnet/runtime merge/release/9.0-to-release/9.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

alinpahontu2912 and others added 18 commits March 31, 2026 16:55
…edAttributes size in TarHeader

Adds check for the "size" attribute in the ExdendedAttributes section of a tar file to prevent infinite loop with negative size. Follows the same throw logic for TarHeader's size.

The negative sized tar file cannot be reproduced using .NET, hence the lack of tests.

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix to add validation for negative size values in TAR extended attributes.

#### PR Summary
Adds a safety check to prevent negative size values when reading TAR extended attributes from the PaxEaSize field, throwing an `InvalidDataException` if a negative size is encountered.

- `TarHeader.Read.cs`: Added validation to check if the extended attributes size is negative before assignment, throwing `InvalidDataException` with `TarSizeFieldNegative` error message if true.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Fix Windows tar vulnerability that allows creating a symlink to a file (and only a file, not a directory) to anywhere on the same drive where the tar is extracted.

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix to address incorrect symlink validation on Windows when extracting tar files with rooted paths.

#### PR Summary
Fixes symlink path validation in tar extraction on Windows by replacing `Path.IsPathFullyQualified` with `Path.IsPathRooted` and adding `Path.GetFullPath` calls to properly detect and reject symlinks pointing outside the destination directory.

- `TarEntry.cs`: Changed symlink validation logic from `Path.IsPathFullyQualified` to `Path.IsPathRooted` with `Path.GetFullPath` for both entry names and link targets to correctly identify rooted paths on Windows
- `TarFile.ExtractToDirectory.File.Tests.Windows.cs`: Added test case `ExtractToDirectory_RejectsSymlinkWithRootedTargetOutsideDestination` to verify symlinks with rooted targets outside the destination are properly rejected
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…hannelVersion 2.4.18

Updated Versions.props -  MicrosoftNativeQuicMsQuicSchannelVersion 2.4.18

----
#### AI description  (iteration 1)
#### PR Classification
Dependency version update to upgrade the MsQuic Schannel package from version 2.4.17 to 2.4.18.

#### PR Summary
This pull request updates the MsQuic Schannel dependency to a newer patch version.

- `/eng/Versions.props`: Updated `MicrosoftNativeQuicMsQuicSchannelVersion` from 2.4.17 to 2.4.18
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
This pull request updates the following dependencies

[marker]: <> (Begin:f85f62c8-5e7d-4706-1003-08dcbc30275f)
## From https://github.com/dotnet/emsdk
- **Subscription**:
[f85f62c8-5e7d-4706-1003-08dcbc30275f](https://maestro.dot.net/subscriptions?search=f85f62c8-5e7d-4706-1003-08dcbc30275f)
- **Build**:
[20260508.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2970290)
([313592](https://maestro.dot.net/channel/3883/github:dotnet:emsdk/build/313592))
- **Date Produced**: May 8, 2026 12:57:27 PM UTC
- **Commit**:
[b634e009d59f72e9254f984a6b89e685955e0eb8](dotnet/emsdk@b634e00)
- **Branch**:
[release/9.0](https://github.com/dotnet/emsdk/tree/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16-servicing.26221.3 to 9.0.17-servicing.26258.3][4]
     - Microsoft.SourceBuild.Intermediate.emsdk
- Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport
  - From [9.0.16 to 9.0.17][4]
     - Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100

[4]: dotnet/emsdk@e2909c0...b634e00

[DependencyUpdate]: <> (End)


[marker]: <> (End:f85f62c8-5e7d-4706-1003-08dcbc30275f)









[marker]: <> (Begin:Coherency Updates)
## Coherency Updates

The following updates ensure that dependencies with a
*CoherentParentDependency*
attribute were produced in a build used as input to the parent
dependency's build.
See [Dependency Description
Format](https://github.com/dotnet/arcade/blob/master/Documentation/DependencyDescriptionFormat.md#dependency-description-overview)

[DependencyUpdate]: <> (Begin)

- **Coherency Updates**:
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.JIT.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**:
from 19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
-
**runtime.linux-musl-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**:
from 19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.linux-musl-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**:
from 19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.win-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)
- **runtime.osx-x64.Microsoft.NETCore.Runtime.Mono.LLVM.Tools**: from
19.1.0-alpha.1.26202.3 to 19.1.0-alpha.1.26256.3 (parent:
Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100.Transport)

[DependencyUpdate]: <> (End)

[marker]: <> (End:Coherency Updates)

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: Larry Ewing <lewing@microsoft.com>
@github-actions github-actions Bot added the area-codeflow for labeling automated codeflow label May 13, 2026
@svick
Copy link
Copy Markdown
Member

svick commented May 13, 2026

/ba-g only known errors

@svick svick added the Servicing-approved Approved for servicing release label May 13, 2026
@svick svick merged commit 2029088 into release/9.0-staging May 13, 2026
289 of 346 checks passed
@svick svick deleted the merge/release/9.0-to-release/9.0-staging branch May 13, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-codeflow for labeling automated codeflow Servicing-approved Approved for servicing release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants