[main] Source code updates from dotnet/dotnet

[dotnet-maestro]

Note

This is a codeflow update. It may contain both source code changes from the VMR as well as dependency updates. Learn more here.

This pull request brings the following source code changes

From https://github.com/dotnet/dotnet

• Subscription: 94ba9a9b-a084-4c1e-bf44-d0c711c17773
• Build: 20251021.6 (288041)
• Date Produced: October 22, 2025 12:27:13 AM UTC
• Commit: ce8b0d8b87e180c6c044ee5828bd4fffab60951d
• Commit Diff: be28ec7...ce8b0d8
• Branch: main

Updated Dependencies

• From 10.0.0-rc.1.25515.110 to 10.0.0-rc.1.25521.106
  • dotnet-dev-certs
  • dotnet-user-jwts
  • dotnet-user-secrets
  • Microsoft.AspNetCore.Analyzers
  • Microsoft.AspNetCore.App.Ref
  • Microsoft.AspNetCore.App.Ref.Internal
  • Microsoft.AspNetCore.Authentication.Facebook
  • Microsoft.AspNetCore.Authentication.Google
  • Microsoft.AspNetCore.Authentication.MicrosoftAccount
  • Microsoft.AspNetCore.Authorization
  • Microsoft.AspNetCore.Components
  • Microsoft.AspNetCore.Components.Analyzers
  • Microsoft.AspNetCore.Components.Forms
  • Microsoft.AspNetCore.Components.SdkAnalyzers
  • Microsoft.AspNetCore.Components.Web
  • Microsoft.AspNetCore.Components.WebAssembly
  • Microsoft.AspNetCore.Components.WebAssembly.Server
  • Microsoft.AspNetCore.Components.WebView
  • Microsoft.AspNetCore.DeveloperCertificates.XPlat
  • Microsoft.AspNetCore.Metadata
  • Microsoft.AspNetCore.Mvc.Analyzers
  • Microsoft.AspNetCore.Mvc.Api.Analyzers
  • Microsoft.AspNetCore.TestHost
  • Microsoft.Bcl.AsyncInterfaces
  • Microsoft.DotNet.Web.ItemTemplates.10.0
  • Microsoft.DotNet.Web.ProjectTemplates.10.0
  • Microsoft.Extensions.Configuration.Ini
  • Microsoft.Extensions.DependencyModel
  • Microsoft.Extensions.FileProviders.Abstractions
  • Microsoft.Extensions.FileProviders.Embedded
  • Microsoft.Extensions.FileSystemGlobbing
  • Microsoft.Extensions.Logging
  • Microsoft.Extensions.Logging.Abstractions
  • Microsoft.Extensions.Logging.Console
  • Microsoft.Extensions.ObjectPool
  • Microsoft.JSInterop
  • Microsoft.NET.HostModel
  • Microsoft.NET.ILLink.Tasks
  • Microsoft.NET.Runtime.Emscripten.3.1.56.Cache.win-x64
  • Microsoft.NET.Sdk.WindowsDesktop
  • Microsoft.NETCore.App.Ref
  • Microsoft.NETCore.Platforms
  • Microsoft.Win32.SystemEvents
  • Microsoft.WindowsDesktop.App.Internal
  • Microsoft.WindowsDesktop.App.Ref
  • System.CodeDom
  • System.ComponentModel.Composition
  • System.Composition.AttributedModel
  • System.Composition.Convention
  • System.Composition.Hosting
  • System.Composition.Runtime
  • System.Composition.TypedParts
  • System.Configuration.ConfigurationManager
  • System.Diagnostics.DiagnosticSource
  • System.Formats.Asn1
  • System.IO.Hashing
  • System.Reflection.MetadataLoadContext
  • System.Resources.Extensions
  • System.Security.Cryptography.Pkcs
  • System.Security.Cryptography.ProtectedData
  • System.Security.Cryptography.Xml
  • System.Security.Permissions
  • System.ServiceProcess.ServiceController
  • System.Text.Encoding.CodePages
  • System.Text.Json
  • System.Windows.Extensions
• From 10.0.0-preview.25515.110 to 10.0.0-preview.25521.106
  • Microsoft.AspNetCore.Mvc.Razor.Extensions.Tooling.Internal
  • Microsoft.CodeAnalysis.Razor.Tooling.Internal
  • Microsoft.NET.Sdk.Razor.SourceGenerators.Transport
• From 18.1.0-preview-25515-110 to 18.1.0-preview-25521-106
  • Microsoft.Build
  • Microsoft.Build.Localization
  • Microsoft.NET.Test.Sdk
  • Microsoft.TestPlatform.Build
  • Microsoft.TestPlatform.CLI
• From 7.0.0-preview.1.1610 to 7.0.0-preview.1.2206
  • Microsoft.Build.NuGetSdkResolver
  • NuGet.Build.Tasks
  • NuGet.Build.Tasks.Console
  • NuGet.Build.Tasks.Pack
  • NuGet.CommandLine.XPlat
  • NuGet.Commands
  • NuGet.Common
  • NuGet.Configuration
  • NuGet.Credentials
  • NuGet.DependencyResolver.Core
  • NuGet.Frameworks
  • NuGet.LibraryModel
  • NuGet.Localization
  • NuGet.Packaging
  • NuGet.ProjectModel
  • NuGet.Protocol
  • NuGet.Versioning
• From 10.0.0-beta.25515.110 to 10.0.0-beta.25521.106
  • Microsoft.Build.Tasks.Git
  • Microsoft.SourceLink.AzureRepos.Git
  • Microsoft.SourceLink.Bitbucket.Git
  • Microsoft.SourceLink.Common
  • Microsoft.SourceLink.GitHub
  • Microsoft.SourceLink.GitLab
• From 5.3.0-1.25515.110 to 5.3.0-1.25521.106
  • Microsoft.CodeAnalysis
  • Microsoft.CodeAnalysis.BuildClient
  • Microsoft.CodeAnalysis.CSharp
  • Microsoft.CodeAnalysis.CSharp.CodeStyle
  • Microsoft.CodeAnalysis.CSharp.Features
  • Microsoft.CodeAnalysis.CSharp.Workspaces
  • Microsoft.CodeAnalysis.PublicApiAnalyzers
  • Microsoft.CodeAnalysis.Workspaces.Common
  • Microsoft.CodeAnalysis.Workspaces.MSBuild
  • Microsoft.Net.Compilers.Toolset
  • Microsoft.Net.Compilers.Toolset.Framework
• From 2.0.0-preview.1.25515.110 to 2.0.0-preview.1.25521.106
  • Microsoft.Deployment.DotNet.Releases
• From 2.2.0-beta.25515.110 to 2.2.0-beta.25521.106
  • Microsoft.DiaSymReader
• From 11.0.0-beta.25515.110 to 11.0.0-beta.25521.106
  • Microsoft.DotNet.Arcade.Sdk
  • Microsoft.DotNet.Build.Tasks.Installers
  • Microsoft.DotNet.Build.Tasks.Templating
  • Microsoft.DotNet.Build.Tasks.Workloads
  • Microsoft.DotNet.Helix.Sdk
  • Microsoft.DotNet.SignTool
  • Microsoft.DotNet.XliffTasks
  • Microsoft.DotNet.XUnitExtensions
• From 14.0.0-alpha1.25515.110 to 15.0.0-alpha1.25521.106
  • Microsoft.FSharp.Compiler
• From 11.0.100-alpha.25515.110 to 11.0.100-alpha.25521.106
  • Microsoft.TemplateEngine.Abstractions
  • Microsoft.TemplateEngine.Authoring.TemplateVerifier
  • Microsoft.TemplateEngine.Edge
  • Microsoft.TemplateEngine.Mocks
  • Microsoft.TemplateEngine.Orchestrator.RunnableProjects
  • Microsoft.TemplateEngine.TestHelper
  • Microsoft.TemplateEngine.Utils
  • Microsoft.TemplateSearch.Common
  • Microsoft.TemplateSearch.TemplateDiscovery
• From 3.2.0-preview.25515.110 to 3.2.0-preview.25521.106
  • Microsoft.Web.Xdt
• From 2.0.0-rc.1.25515.110 to 2.0.0-rc.1.25521.106
  • System.CommandLine

Associated changes in source repos

• dotnet/arcade@488413f...16f3dcc
• dotnet/aspnetcore@0aefdae...d434929
• dotnet/diagnostics@53c7e6f...297a926
• dotnet/efcore@0a2e257...a025407
• dotnet/fsharp@38e7655...1ff7cb1
• dotnet/msbuild@ce41c05...8fb7c0b
• dotnet/razor@e42cd30...e6d2b8b
• dotnet/runtime@a2f46fc...4f50696
• dotnet/source-build-reference-packages@e6ae81a...0eed3a9
• dotnet/templating@6f87c6d...0cb802c

[joeloff]

@dotnet/razor-compiler, @arunchndr Could you help take a look at the razor/formatting failure. Not sure if this is more razor or more formatting issue. Seems like a bit of a crossover. We observed similar errors in other PRs yesterday. Some were closed to take an updated backflow PR instead, but it failed again.

[SimonZhao888]

@MiYanni, @marcpopMSFT could you please help me to see the test failure in the TemplateEngine?

[dotnet-policy-service]

Thanks for your PR, @@dotnet-maestro[bot].
To learn about the PR process and branching schedule of this repo, please take a look at the SDK PR Guide.

[SimonZhao888]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[dotnet-maestro]

Important

The source repository has received code changes from an opposite flow. Any additional codeflows into this PR may potentially result in lost changes.

Please continue with one of the following options:

1. Close or merge this PR and let the codeflow continue normally
2. Close or merge this PR and receive the new codeflow immediately by triggering the subscription:
   darc trigger-subscriptions --id 94ba9a9b-a084-4c1e-bf44-d0c711c17773
3. Force-flow new changes into this PR at your own risk (some PR commits might be reverted):
   darc trigger-subscriptions --force --id 94ba9a9b-a084-4c1e-bf44-d0c711c17773

💡 You may consult the FAQ for more information or tag @dotnet/product-construction for assistance.

[joeloff]

I see a few tests failing with

MissingMethodException: Method not found: '!!0 System.Text.Json.JsonSerializer.Deserialize(System.ReadOnlySpan1<Byte>, System.Text.Json.Serialization.Metadata.JsonTypeInfo1<!!0>)'

[marcpopMSFT]

Specifically, the static web assets task. Is there another dependency mismatch between msbuild and what's in the task? @ericstj any suggestions on how to dig into this?

obj\Debug\net10.0\staticwebassets.build.json : error : MissingMethodException: Method not found: '!!0 System.Text.Json.JsonSerializer.Deserialize(System.ReadOnlySpan1, System.Text.Json.Serialization.Metadata.JsonTypeInfo1<!!0>)'. [C:\h\w\BB6B09DD\t\dotnetSdkTests\hwddmiiq.uhx\JsModules_Hos---8E53139E\blazorhosted\blazorhosted.csproj]
obj\Debug\net10.0\staticwebassets.build.json : error : at Microsoft.AspNetCore.StaticWebAssets.Tasks.StaticWebAssetsManifest.FromJsonBytes(Byte[] jsonBytes) [C:\h\w\BB6B09DD\t\dotnetSdkTests\hwddmiiq.uhx\JsModules_Hos---8E53139E\blazorhosted\blazorhosted.csproj]
obj\Debug\net10.0\staticwebassets.build.json : error : at Microsoft.AspNetCore.StaticWebAssets.Tasks.ReadStaticWebAssetsManifestFile.Execute() in //src/StaticWebAssetsSdk/Tasks/ReadStaticWebAssetsManifestFile.cs:line 52 [C:\h\w\BB6B09DD\t\dotnetSdkTests\hwddmiiq.uhx\JsModules_Hos---8E53139E\blazorhosted\blazorhosted.csproj]

[ericstj]

Looks like something is not agreeing on the version of ReadOnlySpan<T>. So in this case ReadStaticWebAssetsManifestFile has bound to a different version of System.Memory than System.Text.Json has. These failures are only happening on Windows and .NETFramework - so it speaks to a binding problem without redirects.

Looking at https://helixr1107v0xdeko0k025g8.blob.core.windows.net/dotnet-sdk-refs-pull-51402-merge-e384093d60c442fb8b/EndToEnd.Tests.dll.1/3/console.2401e55b.log

[xUnit.net 00:11:57.63] EndToEnd.Tests.ProjectBuildTests.ItCanRunAnAppUsingTheWebSdk [OUTPUT] Executing 'C:\Program Files\Microsoft Visual Studio\2022\Preview\MSBuild\Current\Bin\msbuild.exe /t:Build C:\h\w\A7CA0940\t\dotnetSdkTests\cgzah2su.rs5\ItCanRunAnApp---11F653B3\ItCanRunAnApp---11F653B3.csproj /restore':
Process ID: 4696
[xUnit.net 00:11:57.90] EndToEnd.Tests.ProjectBuildTests.ItCanRunAnAppUsingTheWebSdk [OUTPUT] 》MSBuild version 17.14.19+164abd434 for .NET Framework

So it's running under .NETFramework MSBuild, binding redirects are here ==> https://github.com/dotnet/msbuild/blob/164abd434ee16ef434f6405d3a1b5d479ce3e46f/src/MSBuild/app.config#L79-L82
System.Memory - 4.0.2.0. System.Text.Json - 9.0.0.0

If I examine the Microsoft.NET.Sdk.StaticWebAssets.Tasks.dll references I see

System.Memory, Version=4.0.5.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51
System.Text.Json, Version=9.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51

So it's using the 9.0.0.0 version of JSON and will be redirected to the MSBuild copy, but is using the 4.0.5.0 version of Memory. This causes the break.
Meanwhile it redistributes a private copy of both assemblies 🙃

The higher version of System.Memory is coming from this dependency path:
Microsoft.Build.Utilities.Core (v17.14.28) -> System.Configuration.ConfigurationManager (9.0.0) -> System.Memory
System.Configuration.ConfigurationManager (transitively pinned to 10.0.0-rc.1.25521.106) -> System.Memory (4.6.3)

So the problem here is that you've transitively pinned ConfigurationManager to the 10.x version. Fix would be to add it to this list:

sdk/src/StaticWebAssetsSdk/Tasks/Microsoft.NET.Sdk.StaticWebAssets.Tasks.csproj

Lines 50 to 52 in 65384c6

	<PackageReference Include="System.Reflection.Metadata" VersionOverride="$(SystemReflectionMetadataToolsetPackageVersion)" />
	<PackageReference Include="System.Text.Json" VersionOverride="$(SystemTextJsonToolsetPackageVersion)" />
	<PackageReference Include="System.Diagnostics.DiagnosticSource" VersionOverride="$(SystemDiagnosticsDiagnosticSourceToolsetPackageVersion)" />

Anything in the transitive close of MSBuild that is overlapping with your pinned packages needs an override here.

As we've discussed before, tasks need to choose their path - either latest packages, redistribute them, and ensure zero need for redirects, or msbuild's packages, don't redistribute them, and redirects are permitted. The latter is much preferred as it ensures a smaller SDK and more code-sharing. This is a place where our NuGet plans for External Deployment would help.