[dotnet-maestro]

This pull request updates the following dependencies

From https://github.com/dotnet/dotnet

• Subscription: f1a3de1a-4eac-4ea9-b99c-a6c6d26bd86b
• Build: 20261103.21 (339795)
• Date Produced: November 4, 2026 1:14:27 PM UTC
• Commit: ff41d8ee47bfc3bd0e5e9dfe7b0a4f5e89fc385a
• Branch: release/10.0.1xx

• Dependency Updates:
  • From 10.0.15 to 10.0.15
    • System.Collections.Immutable
    • System.Composition
    • System.Diagnostics.DiagnosticSource
    • System.Reflection.Metadata
    • System.Security.Cryptography.Xml

[github-actions]

Build Failure Analysis

Summary - Both Windows NativeAOT variants fail while restoring the test project because NuGet audit promotes NU1903 for the SDK-injected Microsoft.DotNet.ILCompiler 10.0.13 to an error.

Root cause: vulnerable implicit NativeAOT compiler pack

The classic- and compressed-metadata restore legs both resolve Microsoft.DotNet.ILCompiler@10.0.13 and runtime.win-x64.Microsoft.DotNet.ILCompiler@10.0.13. Package download and signature verification succeed from dotnet-public; restore then fails on advisory GHSA-p3jp-9v83-76w9. The other 12 supplied binlogs compile successfully. The project enables both TreatWarningsAsErrors and PublishAot, so the SDK's implicit compiler-pack version is build-blocking.

Affected errors

• tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj - NU1903: Package 'Microsoft.DotNet.ILCompiler' 10.0.13 has a known high severity vulnerability
• Same error in both Windows_classic_metadata and Windows_compressed_metadata restore legs.

Fix attempt - blocked

Delivery - none

No code was published. The likely surgical direction is to align this NativeAOT test with a patched 10.0 runtime/ILCompiler pack rather than suppressing NuGet audit, but a candidate version change was not published because targeted validation could not run in this runner.

Checks

• dotnet restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj -r win-x64 --no-cache --force-evaluate -v:minimal - exit 155; the repository-pinned SDK was initially absent.
• ./eng/common/dotnet.sh --info - exit 0; installed and selected SDK 11.0.100-rc.2.26504.105, matching the binlog MSBuild version.
• ./eng/common/dotnet.sh restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj -r win-x64 --no-cache --force-evaluate -v:minimal - exit 1 before restore; .NET failed creating its named mutex because /run/user/1001 is unavailable in this runner.
• Remaining build diagnostics: NU1903 in both failing restore binlogs; no source edit was made and no after-fix command was claimed.

Build evidence

Variant	Status	Project	Evidence
classic metadata	failed	NativeAOT_Test.fsproj	Microsoft.DotNet.ILCompiler@10.0.13, NU1903
compressed metadata	failed	NativeAOT_Test.fsproj	Microsoft.DotNet.ILCompiler@10.0.13, NU1903
remaining 12 binlogs	succeeded	various	0 errors each

Analyzed head eccd5e780021b773f7f18606ab3536d52c4c4bb6 and merge revision 1beea1639a5d83d4d03e86d392d46fb8cc23e3c6 were revalidated immediately before publication. Workflow run.

Structured data:

{
  "artifact_kind": "analysis",
  "fix_delivery": "none",
  "fix_status": "blocked",
  "workflow_artifact": "build-failure-analysis"
}

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

• 169.254.169.254
• builds.dotnet.microsoft.com
• ci.dot.net
• southcentralus0.in.applicationinsights.azure.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "169.254.169.254"
    - "builds.dotnet.microsoft.com"
    - "ci.dot.net"
    - "southcentralus0.in.applicationinsights.azure.com"

See Network Configuration for more information.

Automated content by GitHub Copilot. Generated by the Build Failure Analysis workflow. · copilot · gpt56 · 155.9 AIC · ⌖ 20 AIC · ⊞ 23.9K | [History]( · ◷)