[dotnet-maestro]

Note

This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

• Subscription: 5019eed9-1a14-4b5a-a013-70856ae5a777
• Build: 20261105.8 (340151)
• Date Produced: November 6, 2026 1:36:09 AM UTC
• Commit: 1f64ef47a8bab8b70faef698083e1d7a45dc4146
• Commit Diff: ad6c34f...1f64ef4
• Branch: release/11.0.1xx

Updated Dependencies

• From 10.0.14 to 10.0.14 (commit link unavailable)
  • System.Security.Cryptography.Xml

Associated changes in source repos

• dotnet/arcade@d7737fa...42933ea
• dotnet/aspnetcore@91671c7...c02583a
• dotnet/cecil@1ac3140...9e371fa
• dotnet/command-line-api@8a70ae0...87881de
• dotnet/diagnostics@bcce635...6f33efd
• dotnet/efcore@c24253f...5b99d0d
• dotnet/emsdk@d846b1a...d43bc9c
• dotnet/msbuild@9912e17...a0bc5e4
• NuGet/NuGet.Client@846846f...7719b20
• dotnet/runtime@5a720bf...b9df461
• dotnet/scenario-tests@22f775f...09731a6
• dotnet/sdk@93718bf...782b84a
• microsoft/vstest@3620645...658fbb9
• dotnet/winforms@bf49e6c...1fd6ea7

Diff the source with this PR branch

darc vmr diff --name-only https://github.com/dotnet/dotnet:1f64ef47a8bab8b70faef698083e1d7a45dc4146..https://github.com/dotnet/fsharp:darc-release/11.0.1xx-c9456dc4-7df9-436c-9969-1d0078f6a873

[dotnet-maestro]

Note

VMR PRs included in this codeflow update:

• [release/11.0.1xx] Bump F# System.Security.Cryptography.Xml to 10.0.14 (NU1902/NU1903) dotnet#10620

Other PRs in the commit range

• [release/11.0.1xx] Source code updates from nuget/nuget.client dotnet#10614
• [release/11.0.1xx] Source code updates from dotnet/cecil dotnet#10615
• [release/11.0.1xx] Source code updates from dotnet/msbuild dotnet#10622
• [release/11.0.1xx] Source code updates from dotnet/sdk dotnet#10630
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10632
• [release/11.0.1xx] Source code updates from dotnet/diagnostics dotnet#10639
• [release/11.0.1xx] Source code updates from dotnet/scenario-tests dotnet#10641
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10647
• [release/11.0.1xx] Source code updates from dotnet/emsdk dotnet#10655
• [release/11.0.1xx] Source code updates from dotnet/arcade dotnet#10662

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[dotnet-maestro]

Note

Other PRs in the commit range

• [release/11.0.1xx] Source code updates from dotnet/command-line-api dotnet#10664
• [release/11.0.1xx] Make official PGO optional while retaining the 1xx default dotnet#10671
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10666
• [release/11.0.1xx] Source code updates from dotnet/diagnostics dotnet#10678
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10692
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10696
• [release/11.0.1xx] Source code updates from dotnet/efcore dotnet#10699
• [release/11.0.1xx] Source code updates from dotnet/sdk dotnet#10701
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10698
• [release/11.0.1xx] Source code updates from microsoft/vstest dotnet#10709
• [release/11.0.1xx] Source code updates from dotnet/aspnetcore dotnet#10712
• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10713
• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10720
• [release/11.0.1xx] Source code updates from dotnet/winforms dotnet#10722

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[dotnet-maestro]

Note

Other PRs in the commit range

• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10738
• [release/11.0.1xx] Source code updates from dotnet/sdk dotnet#10740
• [release/11.0.1xx] Source code updates from dotnet/runtime dotnet#10742

💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance.

[github-actions]

Build Failure Analysis

Summary - Two independent build failures were captured: NativeAOT restore rejected the SDK-selected Microsoft.DotNet.ILCompiler 10.0.9 as vulnerable, while the IcedTasks test repository hit a concurrent stamp-file write.

Root cause: vulnerable SDK-selected NativeAOT compiler pack

Both the classic- and compressed-metadata NativeAOT legs failed while restoring tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj. The .NET SDK's Microsoft.NETCoreSdk.BundledVersions.props selects Microsoft.DotNet.ILCompiler 10.0.9 for net10.0; NuGet then promoted advisory GHSA-p3jp-9v83-76w9 to NU1903 because the project enables TreatWarningsAsErrors.

Affected errors

• tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj - NU1903: Package 'Microsoft.DotNet.ILCompiler' 10.0.9 has a known high severity vulnerability in both NativeAOT configurations.
• External TestRepo/Directory.Build.targets:22 - MSB3371: parallel ToolRestore targets attempted to touch the same dotnet-tool-restore-...-Windows_NT stamp file. This is separate from the F# repository source and is not fixed by changing the PR.

Fix attempt - blocked

Delivery - none

No code was published. A safe package/version override must be checked against both NativeAOT configurations, but targeted validation could not run because this checkout has no usable .NET SDK. The PR changes only eng/Version.Details.props and eng/Version.Details.xml; neither selects the implicit ILCompiler package.

Checks

• Queried errors and build overviews for all 22 supplied binlogs. Remaining build errors: two equivalent NU1903 NativeAOT restores and one independent MSB3371 IcedTasks stamp-file race; all other binlogs report successful builds.
• dotnet restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj --no-cache --force --verbosity:minimal - exit 155; the runner reported that no .NET SDK was available.
• ./.dotnet/dotnet restore tests/AheadOfTime/NativeAOT/NativeAOT_Test.fsproj --no-cache --force --verbosity:minimal - not started; execution of the repository-local SDK was denied by the runner.

Build evidence

Leg	Result	Evidence
Windows classic metadata NativeAOT	Failed	Restore selected Microsoft.DotNet.ILCompiler@10.0.9; NU1903
Windows compressed metadata NativeAOT	Failed	Same restore failure and package version
IcedTasks Test Debug BinaryLogs	Failed	Touch task in ToolRestore; shared stamp file in use
Remaining 19 binlogs	Succeeded	Zero reported errors and successful build overview

PR head remained 881f67042190a662c6c7d8093a652a54f359fd19; the current merge ref remained 103bcf99179ac79ab18311e9735a4d45ae086fbe immediately before publication. Workflow run

Structured data:

{
  "artifact_kind": "analysis",
  "fix_delivery": "none",
  "fix_status": "blocked",
  "workflow_artifact": "build-failure-analysis"
}

Automated content by GitHub Copilot. Generated by the Build Failure Analysis workflow. · copilot · gpt56 · 174.8 AIC · ⌖ 19.3 AIC · ⊞ 22.1K | [History]( · ◷)