Repository navigation
Update MsQuic to version 2.5.12 - #135749
Merged
Merged
Conversation
Use the session-local certificate-context trust in the shared SslStream validator, preserving explicit chain-policy precedence. Add client/server regression coverage and document the behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6d5a8419-cfc5-4387-9608-25a391994e6d
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
rzikm
force-pushed
the
msquic-update-2.5.12
branch
from
October 14, 2026 07:21
95d4195 to
cf7acb6
Compare
cincuranet
approved these changes
Oct 14, 2026
rzikm
enabled auto-merge (squash)
October 14, 2026 07:23
This was referenced Oct 14, 2026
wfurt
approved these changes
Oct 14, 2026
This was referenced Oct 15, 2026
ViveliDuCh
added a commit
that referenced
this pull request
Oct 15, 2026
Fixes #135880 main PR #135749 # Description <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Updates the public release/9.0 servicing branch to use the publicly available MsQuic 2.5.12 package. This completes the private-to-public security servicing handoff so internal-to-public merges do not retain the private `2.5.11-ci.159417053` identifier that public CI cannot restore. # Customer Impact <!-- What is the impact to customers of not taking this fix? --> Public release/9.0 builds fail restore with NU1603 because the private MsQuic servicing package is unavailable to public CI, blocking clean servicing builds. # Regression <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> This is not a product-code regression. The failure occurs during the post-disclosure dependency handoff from private MSRC bits to the corresponding public package. # Testing <!-- What kind of testing has been done with the fix. --> Passed: ```console .\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache ``` The restore resolved MsQuic 2.5.12 without NU1603. # Risk <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low. This is a one-line patch-version dependency update to the public servicing package, with no managed-code changes. Full functional testing is delegated to CI. # Package authoring no longer needed in .NET 9 IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7
ViveliDuCh
added a commit
that referenced
this pull request
Oct 16, 2026
Fixes #135879 main PR #135749 # Description <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Updates the public release/8.0 servicing branch to use the publicly available MsQuic 2.5.12 package. This completes the private-to-public security servicing handoff so internal-to-public merges do not retain the private `2.5.11-ci.159417053` identifier that public CI cannot restore. # Customer Impact <!-- What is the impact to customers of not taking this fix? --> Public release/8.0 builds fail restore with NU1603 because the private MsQuic servicing package is unavailable to public CI, blocking clean servicing builds. # Regression <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> This is not a product-code regression. The failure occurs during the post-disclosure dependency handoff from private MSRC bits to the corresponding public package. # Testing <!-- What kind of testing has been done with the fix. --> Passed: ```console .\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache ``` The restore resolved MsQuic 2.5.12 without NU1603. # Risk <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low. This is a one-line patch-version dependency update to the public servicing package, with no managed-code changes. Full functional testing is delegated to CI. # Package authoring signed off? IMPORTANT: If this change touches code that ships in a NuGet package, please make certain that you have added any necessary [package authoring](../../docs/project/library-servicing.md) and gotten it explicitly reviewed. No package project or package metadata is changed; this only updates the pinned native dependency version. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7
ViveliDuCh
added a commit
that referenced
this pull request
Oct 16, 2026
Fixes #135880 main PR #135749 <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Updates the public release/9.0 servicing branch to use the publicly available MsQuic 2.5.12 package. This completes the private-to-public security servicing handoff so internal-to-public merges do not retain the private `2.5.11-ci.159417053` identifier that public CI cannot restore. <!-- What is the impact to customers of not taking this fix? --> Public release/9.0 builds fail restore with NU1603 because the private MsQuic servicing package is unavailable to public CI, blocking clean servicing builds. <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> This is not a product-code regression. The failure occurs during the post-disclosure dependency handoff from private MSRC bits to the corresponding public package. <!-- What kind of testing has been done with the fix. --> Passed: ```console .\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache ``` The restore resolved MsQuic 2.5.12 without NU1603. <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low. This is a one-line patch-version dependency update to the public servicing package, with no managed-code changes. Full functional testing is delegated to CI. IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7 (cherry picked from commit 3b202ff)
ViveliDuCh
added a commit
that referenced
this pull request
Oct 16, 2026
Fixes #135880 main PR #135749 <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Updates the public release/9.0 servicing branch to use the publicly available MsQuic 2.5.12 package. This completes the private-to-public security servicing handoff so internal-to-public merges do not retain the private `2.5.11-ci.159417053` identifier that public CI cannot restore. <!-- What is the impact to customers of not taking this fix? --> Public release/9.0 builds fail restore with NU1603 because the private MsQuic servicing package is unavailable to public CI, blocking clean servicing builds. <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> This is not a product-code regression. The failure occurs during the post-disclosure dependency handoff from private MSRC bits to the corresponding public package. <!-- What kind of testing has been done with the fix. --> Passed: ```console .\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache ``` The restore resolved MsQuic 2.5.12 without NU1603. <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low. This is a one-line patch-version dependency update to the public servicing package, with no managed-code changes. Full functional testing is delegated to CI. IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7 (cherry picked from commit 3b202ff)
Member
Author
|
/ba-g OSX failures are unrelated |
rzikm
disabled auto-merge
October 19, 2026 11:33
ViveliDuCh
added a commit
that referenced
this pull request
Oct 21, 2026
Fixes #136232 <!-- Issue Number --> main PR #135749 <!-- Link to PR if any that fixed this in the main branch. --> # Description <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Update `MicrosoftNativeQuicMsQuicSchannelVersion` from 2.5.11 to 2.5.12, applying the dependency change from #135883 to release/10.0. The corresponding release/9.0 change is #135884. The shared version property updates both the Windows product package and functional-test package references. No audit suppressions or managed-code changes are included. # Customer Impact <!-- What is the impact to customers of not taking this fix? --> Public release/10.0 Windows builds fail restore with NU1902 because Microsoft.Native.Quic.MsQuic.Schannel 2.5.11 is affected by GHSA-2mxg-prvg-9jfg (CVE-2026-85790). Version 2.5.12 is the patched release. This removes the MsQuic blocker also seen in #136068, but does not address the independent System.Security.Cryptography.Pkcs 9.0.6 audit failures tracked in #136231. # Regression <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> An advisory against the existing native dependency causes NuGet audit warnings to fail restore under the existing warnings-as-errors policy. This is not a managed-code regression. # Testing <!-- What kind of testing has been done with the fix. --> Commands were run on Windows x64 with the repository SDK 10.0.111: - Before the change, `.\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet` failed with NU1902 for Schannel 2.5.11. - After the change, the same restore command passed (exit 0), and project.assets.json resolved Microsoft.Native.Quic.MsQuic.Schannel/2.5.12. - `.\dotnet.cmd build .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet` passed with 0 warnings and 0 errors. - `.\dotnet.cmd build /t:test .\src\libraries\System.Net.Quic\tests\FunctionalTests\System.Net.Quic.Functional.Tests.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 -v:quiet` failed before test execution: "The shared framework must be built before the local targeting pack can be consumed." No functional tests ran. - As a separate blocker check, `.\dotnet.cmd restore .\src\tasks\Crossgen2Tasks\Crossgen2Tasks.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache -v:quiet` failed with the existing Pkcs 9.0.6 NU1902/NU1903 errors. The assets graph shows this dependency comes from NuGet.Packaging/7.0.3-rc.46203. A full main-branch baseline was explicitly waived for this dependency-only change. No full runtime/libraries build or functional test run was completed. # Risk <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low: a one-line native dependency patch-version bump, matching the version already used by main, release/8.0, and release/9.0. Targeted restore and compilation passed; native runtime behavior remains unverified locally because the functional tests could not start. # Package authoring no longer needed in .NET 9 IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 792c8703-3703-4180-975a-9b86d809b48a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.