[dotnet-maestro]

This pull request updates the following dependencies

From https://github.com/dotnet/dotnet

• Subscription: d90a5187-7ed5-4166-926b-56b72c4a71b8
• Build: 20261104.14 (339997)
• Date Produced: November 5, 2026 10:29:09 AM UTC
• Commit: 295ff616832ba1f8b192f8178c4188a133affe93
• Branch: release/10.0.1xx

• Dependency Updates:
  • From 10.0.14 to 10.0.15
    • System.Collections.Immutable
    • System.Composition
    • System.Diagnostics.DiagnosticSource
    • System.Reflection.Metadata
    • System.Security.Cryptography.Xml

[github-actions]

Build Failure Analysis

Summary - The classic- and compressed-metadata NativeAOT legs both failed during restore because the pinned .NET SDK auto-referenced vulnerable Microsoft.DotNet.ILCompiler 10.0.9 and the project promotes NU1903 to an error.

Root cause: SDK-bundled NativeAOT compiler pack is vulnerable

All 14 supplied binlogs were queried. The two restore binlogs failed identically; the other 12 binlogs completed successfully. SDK 11.0.100-rc.1.26420.103 targets net10.0 and its embedded Microsoft.NETCoreSdk.BundledVersions.props selects ILCompilerPackVersion="10.0.9". NativeAOT_Test.fsproj enables NativeAOT and treats warnings as errors, so NuGet advisory GHSA-p3jp-9v83-76w9 stops restore. The PR changes only NuGet.config and the 10.0.15 System package dependency-flow entries; it does not pin the ILCompiler pack.

Affected errors

• tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj - NU1903: Package 'Microsoft.DotNet.ILCompiler' 10.0.9 has a known high severity vulnerability in both metadata-mode restore legs.

Fix attempt - blocked

Delivery - none

No code was published. A safe replacement version could not be validated: the repository SDK bootstrapped successfully, but the targeted restore was rejected by the non-interactive runner permission gate before a process started. Suppressing NU1903 or guessing an ILCompiler version would violate the build policy and would not constitute a validated fix.

Checks - ./eng/common/dotnet.sh --info exited 0 and installed SDK 11.0.100-rc.1.26420.103. ./.dotnet/dotnet restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj --no-cache --verbosity minimal did not start (runner permission gate; no process exit code). Remaining diagnostics are the same two NU1903 restore failures. Analysis source: Azure build 1666927; publication status is visible in workflow run 42158719733.

Build evidence

Metadata mode	Build result	Project	Error
classic	Failed in Restore	NativeAOT_Test.fsproj	NU1903 for Microsoft.DotNet.ILCompiler 10.0.9
compressed	Failed in Restore	NativeAOT_Test.fsproj	NU1903 for Microsoft.DotNet.ILCompiler 10.0.9
remaining 12 binlogs	Succeeded	1-78 projects per binlog	None

The restore graph records auto-referenced Microsoft.DotNet.ILCompiler@10.0.9 and runtime.win-x64.Microsoft.DotNet.ILCompiler@10.0.9, downloaded successfully before vulnerability auditing failed the restore.

Structured data:

{
  "artifact_kind": "analysis",
  "fix_delivery": "none",
  "fix_status": "blocked",
  "workflow_artifact": "build-failure-analysis"
}

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

• builds.dotnet.microsoft.com
• ci.dot.net
• southcentralus0.in.applicationinsights.azure.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "builds.dotnet.microsoft.com"
    - "ci.dot.net"
    - "southcentralus0.in.applicationinsights.azure.com"

See Network Configuration for more information.

Automated content by GitHub Copilot. Generated by the Build Failure Analysis workflow. · copilot · gpt56 · 128.8 AIC · ⌖ 11.4 AIC · ⊞ 23K | [History]( · ◷)