From 3df44a08b396b7f0dfe3b58da9d2fb9fd434bd4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C5=99emek=20Vysok=C3=BD?= <premek.vysoky@microsoft.com>
Date: Wed, 5 Nov 2025 12:40:30 +0100
Subject: [PATCH 1/3] [release/9.0] Update vulnerable MSBuild packages (#16270)

---
 eng/Version.Details.xml                             | 4 ++--
 eng/Versions.props                                  | 8 ++++----
 src/Microsoft.DotNet.SignTool.Tests/FakeSignTool.cs | 2 --
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 227088c7ffd..300c4a85162 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -160,9 +160,9 @@
       <SourceBuild RepoName="source-build-externals" ManagedOnly="true" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->
-    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="9.0.0-alpha.1.25266.1">
+    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="9.0.0-alpha.1.25521.3">
       <Uri>https://github.com/dotnet/source-build-reference-packages</Uri>
-      <Sha>2bdf6b694572c45f6249c5406ae2303d678cda3f</Sha>
+      <Sha>a9cadb09ddcc99b1e535efb0648047634f0c4f40</Sha>
       <SourceBuild RepoName="source-build-reference-packages" ManagedOnly="true" />
     </Dependency>
     <!-- Transitive dependency needed for source build. -->
diff --git a/eng/Versions.props b/eng/Versions.props
index c9c2755033e..af4de766d1d 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -26,10 +26,10 @@
     <MicrosoftSymbolUploaderBuildTaskVersion>2.0.0-preview.1.23470.14</MicrosoftSymbolUploaderBuildTaskVersion>
     <MicrosoftSymbolUploaderVersion>2.0.0-preview.1.23470.14</MicrosoftSymbolUploaderVersion>
     <!-- msbuild -->
-    <MicrosoftBuildFrameworkVersion>17.8.29</MicrosoftBuildFrameworkVersion>
-    <MicrosoftBuildTasksCoreVersion>17.8.29</MicrosoftBuildTasksCoreVersion>
-    <MicrosoftBuildUtilitiesCoreVersion>17.8.29</MicrosoftBuildUtilitiesCoreVersion>
-    <MicrosoftBuildVersion>17.8.29</MicrosoftBuildVersion>
+    <MicrosoftBuildFrameworkVersion>17.8.43</MicrosoftBuildFrameworkVersion>
+    <MicrosoftBuildTasksCoreVersion>17.8.43</MicrosoftBuildTasksCoreVersion>
+    <MicrosoftBuildUtilitiesCoreVersion>17.8.43</MicrosoftBuildUtilitiesCoreVersion>
+    <MicrosoftBuildVersion>17.8.43</MicrosoftBuildVersion>
     <!-- netstandard -->
     <NETStandardLibraryVersion>2.0.3</NETStandardLibraryVersion>
     <!-- nuget -->
diff --git a/src/Microsoft.DotNet.SignTool.Tests/FakeSignTool.cs b/src/Microsoft.DotNet.SignTool.Tests/FakeSignTool.cs
index 8bfa4870af6..57a7e6d16e3 100644
--- a/src/Microsoft.DotNet.SignTool.Tests/FakeSignTool.cs
+++ b/src/Microsoft.DotNet.SignTool.Tests/FakeSignTool.cs
@@ -2,9 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using System;
-using System.Diagnostics;
 using System.IO;
-using System.IO.Packaging;
 using Microsoft.Build.Framework;
 using Microsoft.Build.Utilities;
 

From 9eaf7b289d5003a94ee23658f057a6c06ddcd570 Mon Sep 17 00:00:00 2001
From: Djuradj Kurepa <91743470+dkurepa@users.noreply.github.com>
Date: Wed, 5 Nov 2025 13:33:46 +0100
Subject: [PATCH 2/3] [release/9.0] Install .NET 8 before running Publish Using
 Darc (#16265)

---
 eng/common/core-templates/job/publish-build-assets.yml | 5 +++++
 eng/common/core-templates/post-build/post-build.yml    | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml
index a58c8a418e8..6b5ff28cc70 100644
--- a/eng/common/core-templates/job/publish-build-assets.yml
+++ b/eng/common/core-templates/job/publish-build-assets.yml
@@ -145,6 +145,11 @@ jobs:
           PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }}
           is1ESPipeline: ${{ parameters.is1ESPipeline }}
 
+      # Darc is targeting 8.0, so make sure it's installed
+      - task: UseDotNet@2
+        inputs:
+          version: 8.0.x
+
       - task: AzureCLI@2
         displayName: Publish Using Darc
         inputs:
diff --git a/eng/common/core-templates/post-build/post-build.yml b/eng/common/core-templates/post-build/post-build.yml
index 2ee8bbfff54..221d1ac6de1 100644
--- a/eng/common/core-templates/post-build/post-build.yml
+++ b/eng/common/core-templates/post-build/post-build.yml
@@ -305,6 +305,11 @@ stages:
 
         - task: NuGetAuthenticate@1
 
+        # Darc is targeting 8.0, so make sure it's installed
+        - task: UseDotNet@2
+          inputs:
+            version: 8.0.x
+
         - task: AzureCLI@2
           displayName: Publish Using Darc
           inputs:

From bcc287603101fa751ff666f17b661c5e40fef60f Mon Sep 17 00:00:00 2001
From: Missy Messa <47990216+missymessa@users.noreply.github.com>
Date: Tue, 11 Nov 2025 08:23:42 -0800
Subject: [PATCH 3/3] Upgrade JSON version (#16282)

---
 eng/BuildTask.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index cd1bf0cc854..0814869332e 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -8,7 +8,7 @@
     <PackageVersion Update="System.Reflection.MetadataLoadContext" Version="8.0.0" />
     <PackageVersion Update="System.Resources.Extensions" Version="8.0.0" />
     <PackageVersion Update="System.Text.Encodings.Web" Version="8.0.0" />
-    <PackageVersion Update="System.Text.Json" Version="8.0.3" />
+    <PackageVersion Update="System.Text.Json" Version="8.0.5" />
     <PackageVersion Update="System.Threading.Tasks.Dataflow" Version="8.0.0" />
 
     <!-- Packages that transitively bring above dependencies in. -->