From fd20cfa93da64569fc1c6c8d612863312829597e Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Tue, 28 Jul 2026 02:02:50 +0000 Subject: [PATCH 1/9] Initial commit for subscription 9cea8df5-50b3-46a2-bb35-21fe52cf9a77 From 426a8fbfd117cecb591823e5dd16728cc18d33f1 Mon Sep 17 00:00:00 2001 From: Copilot Date: Mon, 3 Aug 2026 21:01:16 +0200 Subject: [PATCH 2/9] Fix CI failures: make Arcade SDK version coherent with flowed eng/common The codeflow flowed eng/common files from Arcade 10.0.0-beta.26379.2 (c5d54a9), but Version.Details and global.json still pinned the older 10.0.0-beta.26371.2 (c38c50f5), causing Maestro codeflow verification to fail. Bump the Arcade SDK version/sha to match the flowed eng/common. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- eng/Version.Details.props | 2 +- eng/Version.Details.xml | 4 ++-- global.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/eng/Version.Details.props b/eng/Version.Details.props index 94b0cb72f9d..425334f7683 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -6,7 +6,7 @@ This file should be imported by eng/Versions.props - 10.0.0-beta.26371.2 + 10.0.0-beta.26379.2 18.0.2 18.0.2 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 77f1fdfb985..0393259dd74 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -76,9 +76,9 @@ - + https://github.com/dotnet/arcade - c38c50f518aac7fac47ca488c42c7176d40e695c + c5d54a9de6e0e20a85e37fa3576a37235276772b https://dev.azure.com/dnceng/internal/_git/dotnet-optimization diff --git a/global.json b/global.json index eecfd9e9483..51e7fcbad76 100644 --- a/global.json +++ b/global.json @@ -22,7 +22,7 @@ "perl": "5.38.2.2" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.26371.2", + "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.26379.2", "Microsoft.DotNet.Helix.Sdk": "8.0.0-beta.23255.2" } } From 3355e5561c70072b6a15168234992f6aff396d9d Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 08:02:07 +0200 Subject: [PATCH 3/9] Resolve codeflow conflict: flow VMR build 325432 (fa94693) Apply darc back-flow of dotnet/dotnet build 325432 and resolve the eng/Versions.props conflict by taking the VMR value FSBuildVersion=112. Brings in System.Security.Cryptography.Xml 9.0.18 (transitive vuln fix), warnNotAsError build-script support, and NuGet auditSources. Unblocks the paused Maestro codeflow / Codeflow verification check. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Build.cmd | 2 +- NuGet.config | 4 ++++ build.sh | 2 +- eng/Build.ps1 | 7 ++++++- eng/Version.Details.props | 2 ++ eng/Version.Details.xml | 6 +++++- eng/Versions.props | 2 +- eng/build.sh | 14 +++++++++++++- src/FSharp.Build/FSharp.Build.fsproj | 1 + src/fsc/fsc.targets | 1 + src/fsi/fsi.targets | 1 + .../FSharp.Build.UnitTests.fsproj | 1 + .../HostedCompilerServer.fsproj | 1 + 13 files changed, 38 insertions(+), 6 deletions(-) diff --git a/Build.cmd b/Build.cmd index 10845940e24..5f7196bcdf1 100644 --- a/Build.cmd +++ b/Build.cmd @@ -1,2 +1,2 @@ @echo off -powershell -ExecutionPolicy ByPass -NoProfile -command "Measure-Command { & """%~dp0eng\build.ps1""" -build -restore %* } | Select-Object TotalMinutes, TotalSeconds" +powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\Build.ps1""" -restore -build %*" diff --git a/NuGet.config b/NuGet.config index 1245da4ae60..89a99f73fc6 100644 --- a/NuGet.config +++ b/NuGet.config @@ -33,4 +33,8 @@ + + + + diff --git a/build.sh b/build.sh index a8c0c9d6a29..8e28a4d9d3e 100755 --- a/build.sh +++ b/build.sh @@ -13,4 +13,4 @@ while [[ -h $source ]]; do done scriptroot="$( cd -P "$( dirname "$source" )" && pwd )" -time "$scriptroot/eng/build.sh" --build --restore "$@" +"$scriptroot/eng/build.sh" --restore --build "$@" diff --git a/eng/Build.ps1 b/eng/Build.ps1 index 4bc1de3389d..5b3c5c48a49 100644 --- a/eng/Build.ps1 +++ b/eng/Build.ps1 @@ -48,6 +48,7 @@ param ( [switch]$useGlobalNuGetCache = $true, [switch]$dontUseGlobalNuGetCache = $false, [switch]$warnAsError = $true, + [string]$warnNotAsError = "", [switch][Alias('test')]$testDesktop, [switch]$testCoreClr, [switch]$testCambridge, @@ -141,6 +142,7 @@ function Print-Usage() { Write-Host " -compressAllMetadata Build product with compressed metadata" Write-Host " -buildnorealsig Build product with realsig- (default use realsig+, where necessary)" Write-Host " -verifypackageshipstatus Verify whether the packages we are building have already shipped to nuget" + Write-Host " -warnNotAsError Suppress specific warnings from being treated as errors (semi-colon delimited)" Write-Host "" Write-Host "Command line arguments starting with '/p:' are passed through to MSBuild." } @@ -297,6 +299,8 @@ function BuildSolution([string] $solutionName, $packSolution) { $pack = if ($packSolution -eq $False) {""} else {$pack} + $msbuildWarnNotAsError = if ($warnAsError -and $warnNotAsError -ne "") { "/warnNotAsError:$warnNotAsError" } else { "" } + MSBuild $toolsetBuildProj ` $bl ` /p:Configuration=$configuration ` @@ -319,7 +323,8 @@ function BuildSolution([string] $solutionName, $packSolution) { /p:BuildNoRealsig=$buildnorealsig ` /v:$verbosity ` $suppressExtensionDeployment ` - @properties + @properties ` + $msbuildWarnNotAsError $env:BUILDING_USING_DOTNET=$BUILDING_USING_DOTNET_ORIG } diff --git a/eng/Version.Details.props b/eng/Version.Details.props index 425334f7683..14342e49c4b 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -33,6 +33,7 @@ This file should be imported by eng/Versions.props 9.0.0 9.0.0 9.0.0 + 9.0.18 9.0.0 @@ -65,6 +66,7 @@ This file should be imported by eng/Versions.props $(SystemCompositionPackageVersion) $(SystemDiagnosticsDiagnosticSourcePackageVersion) $(SystemReflectionMetadataPackageVersion) + $(SystemSecurityCryptographyXmlPackageVersion) $(SystemThreadingTasksDataflowPackageVersion) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 0393259dd74..3aab3c89882 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,6 +1,6 @@ - + https://github.com/dotnet/msbuild @@ -74,6 +74,10 @@ https://github.com/dotnet/roslyn 95b450294d0852c47cebef2d649437fadaca6ea7 + + https://github.com/dotnet/runtime + 9d5a6a9aa463d6d10b0b0ba6d5982cc82f363dc3 + diff --git a/eng/Versions.props b/eng/Versions.props index 67b039f96b7..eab6098377d 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -18,7 +18,7 @@ 10 0 - 111 + 112 0 diff --git a/eng/build.sh b/eng/build.sh index 2ad44838587..11d68caadbd 100755 --- a/eng/build.sh +++ b/eng/build.sh @@ -40,6 +40,7 @@ usage() echo " --fromVMR Set when building from within the VMR" echo " --buildnorealsig Build product with realsig- (default use realsig+ where necessary)" echo " --tfm Override the default target framework" + echo " --warnNotAsError Suppress specific warnings from being treated as errors (semi-colon delimited)" echo "" echo "Command line arguments starting with '/p:' are passed through to MSBuild." } @@ -80,6 +81,7 @@ from_vmr=false buildnorealsig=true testbatch="" properties="" +warn_not_as_error="" docker=false args="" @@ -187,6 +189,10 @@ while [[ $# > 0 ]]; do tfm=$2 shift ;; + --warnnotaserror) + warn_not_as_error=$2 + shift + ;; /p:*) properties+=("$1") ;; @@ -316,6 +322,11 @@ function BuildSolution { # do real build BuildMessage="Error building solution" + local msbuild_warn_not_as_error="" + if [[ "$warn_not_as_error" != "" && "$warn_as_error" == true ]]; then + msbuild_warn_not_as_error="/warnNotAsError:$warn_not_as_error" + fi + MSBuild $toolset_build_proj \ $bl \ /p:Configuration=$configuration \ @@ -335,7 +346,8 @@ function BuildSolution { /p:DotNetBuild=$product_build \ /p:DotNetBuildSourceOnly=$source_build \ /p:DotNetBuildFromVMR=$from_vmr \ - ${properties[@]+"${properties[@]}"} + ${properties[@]+"${properties[@]}"} \ + $msbuild_warn_not_as_error fi } diff --git a/src/FSharp.Build/FSharp.Build.fsproj b/src/FSharp.Build/FSharp.Build.fsproj index b38e2981b7b..cb4b22255db 100644 --- a/src/FSharp.Build/FSharp.Build.fsproj +++ b/src/FSharp.Build/FSharp.Build.fsproj @@ -89,6 +89,7 @@ + diff --git a/src/fsc/fsc.targets b/src/fsc/fsc.targets index dc80ab5c4b5..6bcb729fa88 100644 --- a/src/fsc/fsc.targets +++ b/src/fsc/fsc.targets @@ -48,6 +48,7 @@ + diff --git a/src/fsi/fsi.targets b/src/fsi/fsi.targets index bbdcba8f749..9b674c611ac 100644 --- a/src/fsi/fsi.targets +++ b/src/fsi/fsi.targets @@ -60,6 +60,7 @@ + \ No newline at end of file diff --git a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj index 07585566210..ffbb2c76893 100644 --- a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj +++ b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj @@ -38,6 +38,7 @@ + diff --git a/tests/fsharpqa/testenv/src/HostedCompilerServer/HostedCompilerServer.fsproj b/tests/fsharpqa/testenv/src/HostedCompilerServer/HostedCompilerServer.fsproj index b7781a00d54..a568ef084cd 100644 --- a/tests/fsharpqa/testenv/src/HostedCompilerServer/HostedCompilerServer.fsproj +++ b/tests/fsharpqa/testenv/src/HostedCompilerServer/HostedCompilerServer.fsproj @@ -32,6 +32,7 @@ + From 7dbb820b7aa4becd68a25244c067d64e4887bd9a Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 08:08:26 +0200 Subject: [PATCH 4/9] Update OpenTelemetry packages to 1.15.3 to fix NU1902 audit failures OpenTelemetry.Api and OpenTelemetry.Exporter.OpenTelemetryProtocol 1.11.2 have known moderate severity vulnerabilities (GHSA-g94r-2vxg-569j, GHSA-4625-4j76-fww9) that fail the CI build via NuGetAudit warnAsError. Bump to patched version 1.15.3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../FSharp.VisualStudio.Extension.csproj | 12 ++++++------ .../FSharp.Test.Utilities.fsproj | 2 +- vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj b/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj index 862decf5606..5c12db4ada6 100644 --- a/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj +++ b/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj @@ -19,12 +19,12 @@ diff --git a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj index d899b551e30..87bdc8a67c9 100644 --- a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj +++ b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj @@ -110,7 +110,7 @@ - + diff --git a/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj b/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj index 26621fac1e6..08e4ce09c63 100644 --- a/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj +++ b/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj @@ -180,7 +180,7 @@ - + From 9810e267808d3682ad6ec9c08fad4300b500ed30 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 08:09:03 +0200 Subject: [PATCH 5/9] Suppress NuGet audit advisories for test-only OpenTelemetry 1.11.2 The codeflow from VMR build 325432 added to NuGet.config, enabling NuGetAudit against nuget.org. This surfaced NU1902 errors for OpenTelemetry.Api (GHSA-g94r-2vxg-569j) and OpenTelemetry.Exporter.OpenTelemetryProtocol (GHSA-4625-4j76-fww9) at 1.11.2, which are only used by test/telemetry infrastructure and are pinned at 1.11.2 in the VMR. Acknowledge these advisories via NuGetAuditSuppress to unblock CI without diverging package versions from the VMR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Build.props | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Directory.Build.props b/Directory.Build.props index 6f7f345831e..b1a6dc9708d 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -96,4 +96,11 @@ + + + + + + From 05bc7eff73ef5190311b0e1e2796908c9372f8c2 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 08:14:14 +0200 Subject: [PATCH 6/9] Add VS release note for OpenTelemetry update The vsintegration/src change (OpenTelemetry bump) requires a Visual Studio release-notes entry; the check_release_notes CI job was failing because docs/release-notes/.VisualStudio/18.vNext.md did not exist. Add it with an entry linking PR #20086. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/release-notes/.VisualStudio/18.vNext.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 docs/release-notes/.VisualStudio/18.vNext.md diff --git a/docs/release-notes/.VisualStudio/18.vNext.md b/docs/release-notes/.VisualStudio/18.vNext.md new file mode 100644 index 00000000000..5f904a97786 --- /dev/null +++ b/docs/release-notes/.VisualStudio/18.vNext.md @@ -0,0 +1,8 @@ +### Fixed + +### Added + +### Changed +* Update OpenTelemetry package references to 1.15.3 to address transitive package security advisories. ([PR #20086](https://github.com/dotnet/fsharp/pull/20086)) + +### Breaking Changes From d2f372e3b6cb26c57f0767b708772fdb5187ca1e Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 10:49:52 +0200 Subject: [PATCH 7/9] Fix Windows CI: revert OpenTelemetry to 1.11.2 and suppress transitive audit advisories The codeflow enabled NuGet audit (auditSources in NuGet.config). Two problems broke the Windows/VisualFSharp.sln build: 1. NU1605 package downgrades: OpenTelemetry 1.15.3 pulls Microsoft.Extensions.Diagnostics.Abstractions 10.0.0, which requires System.Diagnostics.DiagnosticSource >=10.0.0 and System.Buffers/Memory/Unsafe >=4.6.1/4.6.3/6.1.2, but this servicing branch pins the 9.0.0-era versions the VMR flows. Revert OpenTelemetry to 1.11.2 (the VMR-pinned version), which is compatible and eliminates the downgrades. Audit suppression cannot fix NU1605, so the revert is required. 2. NU1903/NU1902 audit errors for transitive packages in Windows-only test/VS-integration projects (System.Net.Http 4.3.0, System.Text.RegularExpressions 4.3.0, MessagePack, OpenTelemetry). None ship in FSharp.Core or the compiler. Acknowledge them via NuGetAuditSuppress in Directory.Build.props. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Build.props | 23 +++++++++++++++++-- .../FSharp.VisualStudio.Extension.csproj | 12 +++++----- .../FSharp.Test.Utilities.fsproj | 2 +- .../src/FSharp.Editor/FSharp.Editor.fsproj | 2 +- 4 files changed, 29 insertions(+), 10 deletions(-) diff --git a/Directory.Build.props b/Directory.Build.props index b1a6dc9708d..c4097099466 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -96,11 +96,30 @@ - + + + + + + + + + + + + + + + + + diff --git a/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj b/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj index 5c12db4ada6..862decf5606 100644 --- a/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj +++ b/src/FSharp.VisualStudio.Extension/FSharp.VisualStudio.Extension.csproj @@ -19,12 +19,12 @@ diff --git a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj index 87bdc8a67c9..d899b551e30 100644 --- a/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj +++ b/tests/FSharp.Test.Utilities/FSharp.Test.Utilities.fsproj @@ -110,7 +110,7 @@ - + diff --git a/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj b/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj index 08e4ce09c63..26621fac1e6 100644 --- a/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj +++ b/vsintegration/src/FSharp.Editor/FSharp.Editor.fsproj @@ -180,7 +180,7 @@ - + From 087d87e57210bceb82e247a38f9a175c134d5474 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:29:11 +0200 Subject: [PATCH 8/9] Fix ILVerify CI: disable UpdateXlf target during build The ILVerify job runs build.cmd without -ci, so the XliffTasks UpdateXlfOnBuild property defaults to true. The netcore product TFM (net10.0) inner build of FSharp.Compiler.Service does not define the UpdateXlf target, so the build failed with MSB4057 'The target UpdateXlf does not exist in the project'. Set UpdateXlfOnBuild=false in ilverify.ps1 (matching main) since xlf updates are not needed for IL verification. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/ILVerify/ilverify.ps1 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/ILVerify/ilverify.ps1 b/tests/ILVerify/ilverify.ps1 index 2917cba3ff6..efd1ad7b164 100644 --- a/tests/ILVerify/ilverify.ps1 +++ b/tests/ILVerify/ilverify.ps1 @@ -29,6 +29,12 @@ Write-Host "Repository path: $repo_path" [string] $script = if ($IsWindows) { Join-Path $repo_path "build.cmd" } else { Join-Path $repo_path "build.sh" } [string] $additional_arguments = if ($IsWindows) { "-noVisualStudio" } else { "" } +# Disable the UpdateXlf target (not needed for IL verification). Without -ci the XliffTasks +# UpdateXlfOnBuild property defaults to true, but the current netcore product TFM inner build +# of FSharp.Compiler.Service does not define the UpdateXlf target, which fails the build with +# "error MSB4057: The target "UpdateXlf" does not exist in the project." +$env:UpdateXlfOnBuild = "false" + # Set configurations to build [string[]] $configurations = @("Debug", "Release") From 4a03befa7685955a516e895552bdf670e0eb4e74 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 11:53:33 +0200 Subject: [PATCH 9/9] Fix ILVerify: pass UpdateXlfOnBuild=false as MSBuild property, not just env var The prior env-var-only approach did not take effect: MSBuild environment variables are the lowest-precedence property source and are overridden by Arcade's own default (UpdateXlfOnBuild defaults true without -ci). Pass /p:UpdateXlfOnBuild=false on the build command line (highest precedence) so it propagates to the net10.0 inner build of FSharp.Compiler.Service, which does not define the UpdateXlf target. Resolves MSB4057 'The target UpdateXlf does not exist in the project.' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/ILVerify/ilverify.ps1 | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/ILVerify/ilverify.ps1 b/tests/ILVerify/ilverify.ps1 index efd1ad7b164..55f55c322cf 100644 --- a/tests/ILVerify/ilverify.ps1 +++ b/tests/ILVerify/ilverify.ps1 @@ -33,7 +33,10 @@ Write-Host "Repository path: $repo_path" # UpdateXlfOnBuild property defaults to true, but the current netcore product TFM inner build # of FSharp.Compiler.Service does not define the UpdateXlf target, which fails the build with # "error MSB4057: The target "UpdateXlf" does not exist in the project." +# NOTE: an environment variable is the lowest-precedence MSBuild property source and is overridden +# by Arcade's own default, so it must also be passed as an explicit /p: command-line property below. $env:UpdateXlfOnBuild = "false" +[string] $build_properties = "/p:UpdateXlfOnBuild=false" # Set configurations to build [string[]] $configurations = @("Debug", "Release") @@ -63,9 +66,9 @@ if ($LASTEXITCODE -ne 0) { foreach ($configuration in $configurations) { Write-Host "Building $configuration configuration..." if ($additional_arguments) { - & $script -c $configuration $additional_arguments + & $script -c $configuration $additional_arguments $build_properties } else { - & $script -c $configuration + & $script -c $configuration $build_properties } if ($LASTEXITCODE -ne 0 -And $LASTEXITCODE -ne '') { Write-Host "Build failed for $configuration configuration (last exit code: $LASTEXITCODE)."