Uh oh!
There was an error while loading. Please reload this page.
[main] Source code updates from dotnet/dotnet - #20135
Merged
Merged
Conversation
No dependency updates to commit [[ commit created by automation ]]
ContributorAuthor
Note VMR PRs included in this codeflow update:
💡 You may consult the FAQ for more information or tag @dotnet/prodconsvcs for assistance. |
…ix NU1504) The backflow added the canonical PrivateAssets=all override into the shared fsc.targets/fsi.targets and the FSharp.Build.UnitTests item group, but the earlier codeflow (#20058) had already added a conditional (net-core-only) override directly in fsc.fsproj, fsi.fsproj and FSharp.Build.UnitTests.fsproj. This produced two identical PackageReference items for net11.0, failing restore with NU1504 (WarnAsError) across all CI jobs. Removing the redundant conditional blocks aligns these projects with the VMR (dotnet/dotnet) canonical state; each project now references the package exactly once via the shared item group / .targets import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…8b-4922-aad5-dde14cfbee8e
The Microsoft.CommonLanguageServerProtocol.Framework.Proxy project pulls MessagePack 2.5.108 transitively via Microsoft.CommonLanguageServerProtocol.Framework. That version has known moderate/high severity vulnerabilities, so NuGetAudit (WarnAsError) failed restore/build with NU1902/NU1903 on every Windows CI job that builds VisualFSharp.slnx. Pin MessagePack to the patched 2.5.302, mirroring the existing pin already present in the sibling FSharp.Compiler.LanguageServer.fsproj. PrivateAssets="all" keeps the dependency private to match the wrapped framework reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Brings the direct delegates feature into the darc dependency-update branch: - New DirectDelegate optimization (src/Compiler/Optimize/DelegateForwarding.fs) wired into Optimizer.fs and IlxGen.fs codegen - LanguageFeature flag + FSComp diagnostic (with localized xlf updates) - EmittedIL DirectDelegates component tests and baselines - Central Package Management migration (Directory.Packages.props, eng/Packages.props and per-project PackageReference/version updates) Conflicts resolved by the previous session. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The codeflow merge of 'Implement direct delegates' combined the pre-CPM proxy csproj (with Version= attributes plus the MessagePack security pin) with the CPM-compatible version from main, producing duplicate PackageReference items. Under Central Package Management this caused NU1504 (duplicate items) and NU1008 (Version not allowed on PackageReference). Dedupe to the CPM-compatible form: drop the Version= attributes, keep the MessagePack pin (central PackageVersion is already 2.5.302, preserving the NU1902/NU1903 fix) and the Microsoft.VisualStudio.Threading VersionOverride. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PR #20081 (Secure release-note checks for fork pull requests) downgraded the check_release_notes workflow permissions from 'pull-requests: write' to 'pull-requests: read' while keeping 'issues: write'. Commenting on a pull request via GitHub Actions requires 'pull-requests: write' (issues: write alone is insufficient for PR conversation comments), so the final 'Create or update comment' step began failing with 'Resource not accessible by integration' (HTTP 403). PR #20135 is the first codeflow PR to run the new workflow and surfaced the regression. Restore 'pull-requests: write' at both workflow and job level while keeping the rest of the #20081 hardening (contents: read, explicit env, stale-head guards). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
✅ No release notes required |
…8b-4922-aad5-dde14cfbee8e
No dependency updates to commit [[ commit created by automation ]]
T-Gro
approved these changes
Aug 5, 2026
Uh oh!
There was an error while loading. Please reload this page.
bartelink pushed a commit
to bartelink/fsharp
that referenced
this pull request
Aug 6, 2026
* Backflow from https://github.com/dotnet/dotnet / 322f500 build 325363 Diff: https://github.com/dotnet/dotnet/compare/2ed1bf0ccb2d62d14c6161ac689f3d41b70066e9..322f5005d6589845edf1d69d55820a7d1ab9a09c From: dotnet/dotnet@2ed1bf0 To: dotnet/dotnet@322f500 [[ commit created by automation ]] * Update dependencies from build 325363 No dependency updates to commit [[ commit created by automation ]] * Remove duplicate System.Security.Cryptography.Xml PackageReference (fix NU1504) The backflow added the canonical PrivateAssets=all override into the shared fsc.targets/fsi.targets and the FSharp.Build.UnitTests item group, but the earlier codeflow (dotnet#20058) had already added a conditional (net-core-only) override directly in fsc.fsproj, fsi.fsproj and FSharp.Build.UnitTests.fsproj. This produced two identical PackageReference items for net11.0, failing restore with NU1504 (WarnAsError) across all CI jobs. Removing the redundant conditional blocks aligns these projects with the VMR (dotnet/dotnet) canonical state; each project now references the package exactly once via the shared item group / .targets import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Pin transitive MessagePack in CLaSP Proxy project (fix NU1902/NU1903) The Microsoft.CommonLanguageServerProtocol.Framework.Proxy project pulls MessagePack 2.5.108 transitively via Microsoft.CommonLanguageServerProtocol.Framework. That version has known moderate/high severity vulnerabilities, so NuGetAudit (WarnAsError) failed restore/build with NU1902/NU1903 on every Windows CI job that builds VisualFSharp.slnx. Pin MessagePack to the patched 2.5.302, mirroring the existing pin already present in the sibling FSharp.Compiler.LanguageServer.fsproj. PrivateAssets="all" keeps the dependency private to match the wrapped framework reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix duplicate PackageReference in CLaSP Proxy under CPM (NU1504/NU1008) The codeflow merge of 'Implement direct delegates' combined the pre-CPM proxy csproj (with Version= attributes plus the MessagePack security pin) with the CPM-compatible version from main, producing duplicate PackageReference items. Under Central Package Management this caused NU1504 (duplicate items) and NU1008 (Version not allowed on PackageReference). Dedupe to the CPM-compatible form: drop the Version= attributes, keep the MessagePack pin (central PackageVersion is already 2.5.302, preserving the NU1902/NU1903 fix) and the Microsoft.VisualStudio.Threading VersionOverride. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Restore pull-requests: write for release-notes check comment step PR dotnet#20081 (Secure release-note checks for fork pull requests) downgraded the check_release_notes workflow permissions from 'pull-requests: write' to 'pull-requests: read' while keeping 'issues: write'. Commenting on a pull request via GitHub Actions requires 'pull-requests: write' (issues: write alone is insufficient for PR conversation comments), so the final 'Create or update comment' step began failing with 'Resource not accessible by integration' (HTTP 403). PR dotnet#20135 is the first codeflow PR to run the new workflow and surfaced the regression. Restore 'pull-requests: write' at both workflow and job level while keeping the rest of the dotnet#20081 hardening (contents: read, explicit env, stale-head guards). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update dependencies from build 325626 No dependency updates to commit [[ commit created by automation ]] --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com>
This was referenced Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This is a codeflow update. It may contain both source code changes from
the VMR
as well as dependency updates. Learn more here.
This pull request brings the following source code changes
From https://github.com/dotnet/dotnet
Associated changes in source repos
Diff the source with this PR branch