[dotnet-maestro]

Note

This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

• Subscription: 5019eed9-1a14-4b5a-a013-70856ae5a777
• Build: 20261104.22 (340084)
• Date Produced: November 5, 2026 4:03:55 PM UTC
• Commit: 4b7e675ba8250553c58bf9cb230277425a32dafd
• Commit Diff: ad6c34f...4b7e675
• Branch: release/11.0.1xx

Updated Dependencies

• From 10.0.14 to 10.0.14 (commit link unavailable)
  • System.Security.Cryptography.Xml

Associated changes in source repos

• dotnet/arcade@d7737fa...42933ea
• dotnet/aspnetcore@91671c7...c02583a
• dotnet/cecil@1ac3140...9e371fa
• dotnet/command-line-api@8a70ae0...87881de
• dotnet/diagnostics@bcce635...6f33efd
• dotnet/efcore@c24253f...5b99d0d
• dotnet/emsdk@d846b1a...d43bc9c
• dotnet/msbuild@9912e17...a0bc5e4
• NuGet/NuGet.Client@846846f...7719b20
• dotnet/runtime@5a720bf...4dc878a
• dotnet/scenario-tests@22f775f...09731a6
• dotnet/sdk@93718bf...3e46321
• microsoft/vstest@3620645...658fbb9
• dotnet/winforms@bf49e6c...1fd6ea7

Diff the source with this PR branch

darc vmr diff --name-only https://github.com/dotnet/dotnet:4b7e675ba8250553c58bf9cb230277425a32dafd..https://github.com/dotnet/fsharp:darc-release/11.0.1xx-c9456dc4-7df9-436c-9969-1d0078f6a873

[dotnet-maestro]

Note

VMR PRs included in this codeflow update:

• [release/11.0.1xx] Bump F# System.Security.Cryptography.Xml to 10.0.14 (NU1902/NU1903) dotnet#10620

Other PRs in the commit range

• [release/11.0.1xx] Source code updates from nuget/nuget.client dotnet#10614
• [release/11.0.1xx] Source code updates from dotnet/cecil dotnet#10615
• [release/11.0.1xx] Source code updates from dotnet/msbuild dotnet#10622
• [release/11.0.1xx] Source code updates from dotnet/sdk dotnet#10630
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10632
• [release/11.0.1xx] Source code updates from dotnet/diagnostics dotnet#10639
• [release/11.0.1xx] Source code updates from dotnet/scenario-tests dotnet#10641
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10647
• [release/11.0.1xx] Source code updates from dotnet/emsdk dotnet#10655
• [release/11.0.1xx] Source code updates from dotnet/arcade dotnet#10662

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[dotnet-maestro]

Note

Other PRs in the commit range

• [release/11.0.1xx] Source code updates from dotnet/command-line-api dotnet#10664
• [release/11.0.1xx] Make official PGO optional while retaining the 1xx default dotnet#10671
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10666
• [release/11.0.1xx] Source code updates from dotnet/diagnostics dotnet#10678
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10692
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10696
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10699
• [release/11.0.1xx] Source code updates from dotnet/sdk dotnet#10701
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10698
• [release/11.0.1xx] Source code updates from microsoft/vstest dotnet#10709
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10712
• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10713
• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10720
• [release/11.0.1xx] Source code updates from dotnet/winforms dotnet#10722

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[github-actions]

Build Failure Analysis

Summary - Both NativeAOT restore legs failed because the .NET 11 RC1 SDK implicitly selects vulnerable Microsoft.DotNet.ILCompiler 10.0.9 for the net10.0 test project.

Root cause: SDK-pinned NativeAOT compiler pack is vulnerable

All 20 supplied binlogs were queried. Eighteen compiled successfully; only the classic- and compressed-metadata restore logs failed. Both report NU1903 from RestoreTask for tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj. The SDK's KnownILCompilerPack entry pins net10.0 to 10.0.9, and the published advisory identifies 10.0.14 as the first fixed .NET 10 release.

Affected errors

• NativeAOT_Test.fsproj - NU1903: Package 'Microsoft.DotNet.ILCompiler' 10.0.9 has a known high severity vulnerability, GHSA-p3jp-9v83-76w9 (classic metadata)
• NativeAOT_Test.fsproj - the identical NU1903 (compressed metadata)

Fix attempt - blocked

Delivery - none

The minimal candidate is to update the KnownILCompilerPack metadata for net10.0 to 10.0.14 so both the compiler and NativeAOT runtime packs stay aligned. No code was published because targeted restore validation could not be executed in this non-interactive environment.

Checks - ./eng/common/dotnet.sh --info exited 0 and installed SDK 11.0.100-rc.1.26420.103. The unchanged command .dotnet/dotnet restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj --no-cache -v:minimal -bl:/tmp/gh-aw/agent/nativeaot-before.binlog was rejected before process start with Permission denied because no interactive user response was available; therefore it had no exit code. The patched command was not run because the original failure could not be reproduced under the playbook's validation rules. Remaining diagnostics are the two CI NU1903 errors above.

Build evidence

Legs	Result	Evidence
AOT classic metadata restore	Failed	2 errors, including NU1903; project duration 7.6s
AOT compressed metadata restore	Failed	2 errors, including NU1903; project duration 8.2s
Remaining 18 binlogs	Succeeded	0 errors in every log

The failing assets request Microsoft.DotNet.ILCompiler 10.0.9 and Microsoft.NETCore.App.Runtime.NativeAOT.win-x64 [10.0.9, 10.0.9]. PR head 680864df8cd7507d55134e20f9ed2a36c91be914 and merge ref 33a276e037b94357cdb69dde034040b66d632034 were revalidated immediately before publication. Workflow run

Structured data:

{
  "artifact_kind": "analysis",
  "fix_delivery": "none",
  "fix_status": "blocked",
  "workflow_artifact": "build-failure-analysis"
}

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• builds.dotnet.microsoft.com
• ci.dot.net
• southcentralus0.in.applicationinsights.azure.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "builds.dotnet.microsoft.com"
    - "ci.dot.net"
    - "southcentralus0.in.applicationinsights.azure.com"

See Network Configuration for more information.

Automated content by GitHub Copilot. Generated by the Build Failure Analysis workflow. · copilot · gpt56 · 184.1 AIC · ⌖ 8.55 AIC · ⊞ 22.1K | [History]( · ◷)