From 9868f608eb63806e83e5cbce4f2ddf92bc00fa5f Mon Sep 17 00:00:00 2001
From: "Jeff Klouda (from Dev Box)" <jeklouda@microsoft.com>
Date: Thu, 16 Jul 2026 14:35:15 -0700
Subject: [PATCH 1/2] Fix .NET SDK security alert: bump floor to 10.0.302

Bumps apps/blazor-test-app/global.json minimum SDK from >=10.0.300 to

>=10.0.302. The July 2026 .NET 10.0.10 security servicing release (SDK

10.0.302) patches 17 CVEs. The component governance alert recommended

10.0.110, but the repo already floored at the newer 10.0.3xx band; 10.0.302

is the latest patched release in that band, so this stays current without

downgrading.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c3fd8b40-f6bc-4f2b-88f5-af4d171abb61
---
 apps/blazor-test-app/global.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/blazor-test-app/global.json b/apps/blazor-test-app/global.json
index 472bda5b8a..098e2959a2 100644
--- a/apps/blazor-test-app/global.json
+++ b/apps/blazor-test-app/global.json
@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": ">=10.0.300"
+    "version": ">=10.0.302"
   }
 }

From a73616e211cef59f6c1522e6c89dd29b6885d4c4 Mon Sep 17 00:00:00 2001
From: "Jeff Klouda (from Dev Box)" <jeklouda@microsoft.com>
Date: Thu, 16 Jul 2026 14:42:40 -0700
Subject: [PATCH 2/2] Pin .NET SDK 10.0.302 in CI build templates

Component Governance detected the agent's default .NET SDK (10.0.101) as the

vulnerable component, not just the global.json floor. Add a UseDotNet@2 step

pinning SDK 10.0.302 (July 2026 security servicing, 17 CVEs) before every

dotnet/build-force-blazor step so the Blazor test app builds against a patched

SDK regardless of the agent image default. web-e2e-playwright inherits it via

build-app-host.yml.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c3fd8b40-f6bc-4f2b-88f5-af4d171abb61
---
 tools/yaml-templates/android-test.yml       | 9 +++++++++
 tools/yaml-templates/build-app-host.yml     | 9 +++++++++
 tools/yaml-templates/build-test-publish.yml | 9 +++++++++
 tools/yaml-templates/ios-test.yml           | 9 +++++++++
 4 files changed, 36 insertions(+)

diff --git a/tools/yaml-templates/android-test.yml b/tools/yaml-templates/android-test.yml
index 0d88b357e6..0786453b40 100644
--- a/tools/yaml-templates/android-test.yml
+++ b/tools/yaml-templates/android-test.yml
@@ -44,6 +44,15 @@ steps:
         pnpm install
       workingDirectory: '$(ClientSdkProjectDirectory)'
 
+  # Pin a security-patched .NET SDK so the Blazor test app builds against a
+  # non-vulnerable SDK regardless of the agent image default. Must satisfy the
+  # floor in apps/blazor-test-app/global.json.
+  - task: UseDotNet@2
+    displayName: 'Install .NET SDK 10.0.302 (security-patched)'
+    inputs:
+      packageType: sdk
+      version: '10.0.302'
+
   - task: CmdLine@2
     displayName: 'Build client sdk'
     inputs:
diff --git a/tools/yaml-templates/build-app-host.yml b/tools/yaml-templates/build-app-host.yml
index 08d505ab89..3a6bd9f9f4 100644
--- a/tools/yaml-templates/build-app-host.yml
+++ b/tools/yaml-templates/build-app-host.yml
@@ -16,6 +16,15 @@ steps:
       versionSpec: '18.x'
     displayName: 'Install Node.js'
 
+  # Pin a security-patched .NET SDK so the Blazor test app builds against a
+  # non-vulnerable SDK regardless of the agent image default. Must satisfy the
+  # floor in apps/blazor-test-app/global.json.
+  - task: UseDotNet@2
+    displayName: 'Install .NET SDK 10.0.302 (security-patched)'
+    inputs:
+      packageType: sdk
+      version: '10.0.302'
+
   # Cache task is used to create a cache of files which won't change between jobs, task, or steps.
   # In this task below a unique identifier(fingerprint) is created for the cache name, usually it's
   #   'command_name | operating_system | lockfile'
diff --git a/tools/yaml-templates/build-test-publish.yml b/tools/yaml-templates/build-test-publish.yml
index ea6c0469cc..424912cfd6 100644
--- a/tools/yaml-templates/build-test-publish.yml
+++ b/tools/yaml-templates/build-test-publish.yml
@@ -4,6 +4,15 @@ steps:
     inputs:
       versionSpec: '18.x'
 
+  # Pin a security-patched .NET SDK so the Blazor test app builds against a
+  # non-vulnerable SDK regardless of the agent image default. Must satisfy the
+  # floor in apps/blazor-test-app/global.json.
+  - task: UseDotNet@2
+    displayName: 'Install .NET SDK 10.0.302 (security-patched)'
+    inputs:
+      packageType: sdk
+      version: '10.0.302'
+
   - task: CmdLine@2
     displayName: 'Setup pnpm'
     inputs:
diff --git a/tools/yaml-templates/ios-test.yml b/tools/yaml-templates/ios-test.yml
index a72c184ad6..13bd2e0a99 100644
--- a/tools/yaml-templates/ios-test.yml
+++ b/tools/yaml-templates/ios-test.yml
@@ -55,6 +55,15 @@ steps:
         pnpm install
       workingDirectory: '$(ClientSdkProjectDirectory)'
 
+  # Pin a security-patched .NET SDK so the Blazor test app builds against a
+  # non-vulnerable SDK regardless of the agent image default. Must satisfy the
+  # floor in apps/blazor-test-app/global.json.
+  - task: UseDotNet@2
+    displayName: 'Install .NET SDK 10.0.302 (security-patched)'
+    inputs:
+      packageType: sdk
+      version: '10.0.302'
+
   - task: CmdLine@2
     displayName: 'Build client sdk'
     inputs: