[dotnet-maestro]

Note

This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

• Subscription: 0ca9ffca-5797-48b7-89c1-0247660753a9
• Build: 20260730.10 (325130)
• Date Produced: July 31, 2026 7:05:47 AM UTC
• Commit: 859dbf297ab10ef1ff20d30becdd6ff69eb258ff
• Commit Diff: dc6e708...859dbf2
• Branch: release/10.0.1xx

Updated Dependencies

• From 9.0.6 to 9.0.18
  • System.Formats.Asn1
  • System.Security.Cryptography.Pkcs
• From 9.0.0 to 9.0.18
  • System.Security.Cryptography.Xml

Associated changes in source repos

• dotnet/arcade@58713cb...c5d54a9
• dotnet/aspnetcore@0bfc80d...9263176
• dotnet/deployment-tools@95a979e...ce148c0
• dotnet/efcore@b146523...ada8239
• dotnet/emsdk@6cc2761...8968749
• dotnet/fsharp@375a3a6...b611d18
• dotnet/roslyn@83e5a53...95b4502
• dotnet/runtime@fc46e69...be89b18
• dotnet/scenario-tests@1fe5fb2...ba95998
• dotnet/sdk@aba047a...eb7701f
• dotnet/source-build-assets@e9cee6a...07e5dbd
• dotnet/sourcelink@02da6b2...7b1bd72
• dotnet/symreader@1536a1c...8655fee
• dotnet/templating@b02ce3a...2809d3e
• dotnet/windowsdesktop@a9c50da...080bebc
• dotnet/winforms@89c64d2...3eba060
• dotnet/wpf@a139211...826fb03

Diff the source with this PR branch

darc vmr diff --name-only https://github.com/dotnet/dotnet:859dbf297ab10ef1ff20d30becdd6ff69eb258ff..https://github.com/dotnet/msbuild:darc-vs18.0-cec68c7f-6842-4e8a-a439-a715d670c845

[dotnet-maestro]

Note

VMR PRs included in this codeflow update:

• Alternative: suppress NuGet audit advisories for OpenTelemetry + System.Security.Cryptography.Xml (compile-time-only) dotnet#7858
• Make release/10.0.1xx buildable locally on Windows dotnet#7873
• Fix Audit in 1xx dotnet#7885

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[ViktorHofer]

@copilot any idea why the NuGetAuditSuppress that is added in this PR doesn't take effect? The NU1902 in src\Build.UnitTests\Microsoft.Build.Engine.UnitTests.csproj should be suppressed by that.

[Copilot]

@copilot any idea why the NuGetAuditSuppress that is added in this PR doesn't take effect? The NU1902 in src\Build.UnitTests\Microsoft.Build.Engine.UnitTests.csproj should be suppres...

NuGetAuditSuppress is scoped to the project that declares it — NuGet writes it into that project's restore spec only, and it does not flow across ProjectReference. The suppression was added to src/Framework/Microsoft.Build.Framework.csproj, but src/Build.UnitTests/Microsoft.Build.Engine.UnitTests.csproj has its own net472 PackageReferences to Microsoft.VisualStudio.OpenTelemetry.ClientExtensions / .Collector (lines 31-32), so OpenTelemetry.Api is in its own restore graph and NU1902 is raised there independently.

Added the same suppression to Microsoft.Build.Engine.UnitTests.csproj in 95c4cb3. Verified after restore that GHSA-g94r-2vxg-569j now appears in that project's nuget.dgspec.json/project.assets.json, which it did not before.

(These two are the only projects referencing the OpenTelemetry packages, so per-project suppressions are enough; if it spreads further, moving the item to Directory.Build.props would be the alternative.)