From e409da5f10ebdf746e8116ba2ba422a9b8471780 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Mon, 30 Jun 2025 10:10:50 -0700
Subject: [PATCH 1/5] Update Microsoft.Build versions

---
 eng/Versions.props | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/eng/Versions.props b/eng/Versions.props
index 4d3c6c4940bc..42d1b5846d85 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -223,13 +223,13 @@
     <MicrosoftCodeAnalysisRazorVersion>6.0.0</MicrosoftCodeAnalysisRazorVersion>
     <!-- Partner teams -->
     <MicrosoftBCLHashCodeVersion>1.1.1</MicrosoftBCLHashCodeVersion>
-    <MicrosoftBuildVersion>17.4.0</MicrosoftBuildVersion>
+    <MicrosoftBuildVersion>17.8.29</MicrosoftBuildVersion>
     <MicrosoftAzureSignalRVersion>1.2.0</MicrosoftAzureSignalRVersion>
-    <MicrosoftBuildFrameworkVersion>17.4.0</MicrosoftBuildFrameworkVersion>
-    <MicrosoftBuildTasksCoreVersion>17.4.0</MicrosoftBuildTasksCoreVersion>
-    <MicrosoftBuildUtilitiesCoreVersion>17.4.0</MicrosoftBuildUtilitiesCoreVersion>
+    <MicrosoftBuildFrameworkVersion>17.8.29</MicrosoftBuildFrameworkVersion>
+    <MicrosoftBuildTasksCoreVersion>17.8.29</MicrosoftBuildTasksCoreVersion>
+    <MicrosoftBuildUtilitiesCoreVersion>17.8.29</MicrosoftBuildUtilitiesCoreVersion>
     <MicrosoftBuildLocatorVersion>1.2.6</MicrosoftBuildLocatorVersion>
-    <MicrosoftBuildUtilitiesCoreVersion>17.4.0</MicrosoftBuildUtilitiesCoreVersion>
+    <MicrosoftBuildUtilitiesCoreVersion>17.8.29</MicrosoftBuildUtilitiesCoreVersion>
     <!--
       Temporarily override the Microsoft.NET.Test.Sdk version Arcade defaults to. That's incompatible w/ test
       framework in current .NET SDKs.

From d3bfcdda889d85fa923d8a2d8cdf14b7f393e65a Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Mon, 30 Jun 2025 10:12:26 -0700
Subject: [PATCH 2/5] Update eng/Versions.props

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 eng/Versions.props | 1 -
 1 file changed, 1 deletion(-)

diff --git a/eng/Versions.props b/eng/Versions.props
index 42d1b5846d85..2ade86c20377 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -229,7 +229,6 @@
     <MicrosoftBuildTasksCoreVersion>17.8.29</MicrosoftBuildTasksCoreVersion>
     <MicrosoftBuildUtilitiesCoreVersion>17.8.29</MicrosoftBuildUtilitiesCoreVersion>
     <MicrosoftBuildLocatorVersion>1.2.6</MicrosoftBuildLocatorVersion>
-    <MicrosoftBuildUtilitiesCoreVersion>17.8.29</MicrosoftBuildUtilitiesCoreVersion>
     <!--
       Temporarily override the Microsoft.NET.Test.Sdk version Arcade defaults to. That's incompatible w/ test
       framework in current .NET SDKs.

From c26b128c17e30006e9f0d95182e260176d8e5feb Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Mon, 30 Jun 2025 10:28:51 -0700
Subject: [PATCH 3/5] Update SourceBuildPrebuiltBaseline.xml

---
 eng/SourceBuildPrebuiltBaseline.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/eng/SourceBuildPrebuiltBaseline.xml b/eng/SourceBuildPrebuiltBaseline.xml
index dda41055550d..f92cf6f96b1b 100644
--- a/eng/SourceBuildPrebuiltBaseline.xml
+++ b/eng/SourceBuildPrebuiltBaseline.xml
@@ -42,5 +42,12 @@
 
     <!-- Transitive dependency of System.Security.Cryptography.Pkcs.5.0.*. -->
     <UsagePattern IdentityGlob="System.Formats.Asn1/6.0.0" />
+
+    <!-- Used only for RepoTasks -->
+    <UsagePattern IdentityGlob="Microsoft.Build.Framework/17.8.29" />
+    <UsagePattern IdentityGlob="Microsoft.Build.Tasks.Core/17.8.29" />
+    <UsagePattern IdentityGlob="Microsoft.Build.Utilities.Core/17.8.29" />
+    <UsagePattern IdentityGlob="Microsoft.NET.StringTools/17.8.29" />
+    <UsagePattern IdentityGlob="Microsoft.VisualStudio.Setup.Configuration.Interop/3.2.2146" />
   </IgnorePatterns>
 </UsageData>

From a7108aae2ad7fcd14dc0d9af15468a6326caf836 Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Mon, 8 Sep 2025 14:27:35 -0700
Subject: [PATCH 4/5] Remove outdated PackageReference for security package

---
 eng/tools/RepoTasks/RepoTasks.csproj | 2 --
 1 file changed, 2 deletions(-)

diff --git a/eng/tools/RepoTasks/RepoTasks.csproj b/eng/tools/RepoTasks/RepoTasks.csproj
index 001b709fffae..d1fa1d66d7a6 100644
--- a/eng/tools/RepoTasks/RepoTasks.csproj
+++ b/eng/tools/RepoTasks/RepoTasks.csproj
@@ -29,8 +29,6 @@
     <PackageReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" />
     <PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
-    <!-- Manually updated version from 6.0.0 to address CVE-2021-43877 -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(RepoTasksSystemSecurityCryptographyXmlVersion)" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net472'">

From 84ff3e4a59a65c177f23bf9833c8db793f6265cb Mon Sep 17 00:00:00 2001
From: William Godbe <wigodbe@microsoft.com>
Date: Mon, 8 Sep 2025 14:27:57 -0700
Subject: [PATCH 5/5] Remove CVE-2021-43877 update comment

---
 eng/Versions.props | 2 --
 1 file changed, 2 deletions(-)

diff --git a/eng/Versions.props b/eng/Versions.props
index 2ade86c20377..ac2c4a81bfd5 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -198,8 +198,6 @@
     <MicrosoftExtensionsDiagnosticAdapterVersion>5.0.0-preview.3.20215.2</MicrosoftExtensionsDiagnosticAdapterVersion>
     <!-- Build tool dependencies -->
     <MicrosoftVSSDKBuildToolsVersion>15.9.3032</MicrosoftVSSDKBuildToolsVersion>
-    <!-- Manually updated version from 6.0.0 to address CVE-2021-43877 -->
-    <RepoTasksSystemSecurityCryptographyXmlVersion>6.0.1</RepoTasksSystemSecurityCryptographyXmlVersion>
     <AnalyzersSystemTextJsonVersion>8.0.5</AnalyzersSystemTextJsonVersion>
     <!-- Stable dotnet/corefx packages no longer updated for .NET Core 3 -->
     <MicrosoftCSharpVersion>4.7.0</MicrosoftCSharpVersion>