Jeklouda/fix dotnet security 10.0.302 - #3091
Draft
jekloudaMSFT wants to merge 2 commits into
Draft
Conversation
Bumps apps/blazor-test-app/global.json minimum SDK from >=10.0.300 to >=10.0.302. The July 2026 .NET 10.0.10 security servicing release (SDK 10.0.302) patches 17 CVEs. The component governance alert recommended 10.0.110, but the repo already floored at the newer 10.0.3xx band; 10.0.302 is the latest patched release in that band, so this stays current without downgrading. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c3fd8b40-f6bc-4f2b-88f5-af4d171abb61
Component Governance detected the agent's default .NET SDK (10.0.101) as the vulnerable component, not just the global.json floor. Add a UseDotNet@2 step pinning SDK 10.0.302 (July 2026 security servicing, 17 CVEs) before every dotnet/build-force-blazor step so the Blazor test app builds against a patched SDK regardless of the agent image default. web-e2e-playwright inherits it via build-app-host.yml. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c3fd8b40-f6bc-4f2b-88f5-af4d171abb61
Contributor
size-limit report 📦
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For more information about how to contribute to this repo, visit this page.
Description
Resolves Component Governance .NET SDK security alert for apps/blazor-test-app
Main changes in the PR:
Validation
Validation performed:
Unit Tests added:
<Yes/No>
End-to-end tests added:
<Yes/No>
Additional Requirements
Change file added:
<Yes/No>
Related PRs:
Next/remaining steps:
Screenshots: