Skip to content

[automated] Merge branch 'release/8.0' => 'release/8.0-staging' - #132255

Open
github-actions[bot] wants to merge 12 commits into
release/8.0-stagingfrom
merge/release/8.0-to-release/8.0-staging
Open

[automated] Merge branch 'release/8.0' => 'release/8.0-staging'#132255
github-actions[bot] wants to merge 12 commits into
release/8.0-stagingfrom
merge/release/8.0-to-release/8.0-staging

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

I detected changes in the release/8.0 branch which have not been merged yet to release/8.0-staging. I'm a robot and am configured to help you automatically keep release/8.0-staging up to date, so I've opened this PR.

This PR merges commits made on release/8.0 by the following committers:

  • hoyosjs
  • vseanreesermsft
  • dotnet-bot
  • iremyux

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout release/8.0
git pull --ff-only
git checkout release/8.0-staging
git pull --ff-only
git merge --no-ff release/8.0

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/runtime HEAD:merge/release/8.0-to-release/8.0-staging
or if you are using SSH
git push git@github.com:dotnet/runtime HEAD:merge/release/8.0-to-release/8.0-staging

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/8.0-to-release/8.0-staging'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/release/8.0-to-release/8.0-staging origin/release/8.0-staging
git pull https://github.com/dotnet/runtime merge/release/8.0-to-release/8.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/runtime HEAD:merge/release/8.0-to-release/8.0-staging
or if you are using SSH
git fetch
git checkout -b merge/release/8.0-to-release/8.0-staging origin/release/8.0-staging
git pull git@github.com:dotnet/runtime merge/release/8.0-to-release/8.0-staging
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/runtime HEAD:merge/release/8.0-to-release/8.0-staging

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

Mirroring and others added 11 commits June 26, 2026 20:13
Fix handling of BFinal in WebSocket deflate.

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix to correct WebSocket inflater handling when DEFLATE streams are terminated with the BFINAL bit set.

#### PR Summary
This pull request fixes a bug where WebSocket compression handling would hang indefinitely when receiving messages with DEFLATE streams terminated by a BFINAL=1 final block, which violates the permessage-deflate specification.

- `WebSocketInflater.cs`: Added detection of DEFLATE stream end (BFINAL=1) and throws `WebSocketException` when compressed bytes remain unconsumed after the stream terminates, preventing infinite loops.
- `WebSocketInflater.cs`: Modified `Inflate` method signature to return `streamEnded` flag tracking when zlib encounters `ErrorCode.StreamEnd`.
- `WebSocketDeflateTests.cs`: Added comprehensive test cases validating rejection of messages with BFINAL bit set, including both standalone and messages preceded by valid frames.
- `Strings.resx`: Added new error message resource `net_WebSockets_DataAfterBFinal` for the exception thrown on invalid BFINAL-terminated messages.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…HttpListenerRequest.Managed

The check used to set values > long.MaxValue to 0, allowing the communication to continue even though the real size was quite big. This behavior could lead to Content-Length desynchronization.

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix to align managed HttpListener implementation with Windows behavior by rejecting invalid Content-Length header values instead of silently accepting them.

#### PR Summary
This PR modifies the Content-Length header parsing logic in the managed HttpListener implementation to strictly reject invalid values (including those exceeding long.MaxValue) rather than treating them as valid. The change ensures stricter validation and error handling for malformed HTTP requests.

- `HttpListenerRequest.Managed.cs`: Replaced permissive ulong parsing logic with strict long.TryParse using NumberStyles.None, rejecting any Content-Length values that cannot be parsed as valid non-negative long integers
- `InvalidClientRequestTests.cs`: Added new test cases verifying that oversized Content-Length values (long.MaxValue+1 and ulong.MaxValue) trigger "Bad Request" errors and prevent context creation
- `HttpListenerRequestTests.cs`: Removed test cases that previously expected oversized Content-Length values to be accepted as 0
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to the privately built MsQuic 2.5.9

----
#### AI description  (iteration 1)
#### PR Classification
Dependency update to upgrade the MsQuic library version for QUIC protocol support.

#### PR Summary
This pull request updates the MsQuic Schannel library from version 2.4.18 to 2.5.9-ci.151956570 in the release/8.0 branch.

- `/eng/Versions.props`: Updated `MicrosoftNativeQuicMsQuicSchannelVersion` from 2.4.18 to 2.5.9-ci.151956570
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
#### AI description  (iteration 1)
#### PR Classification
Bug fix to address symlink directory traversal vulnerabilities in tar extraction and removal of test suppressions for resolved macOS-specific test failures.

#### PR Summary
This pull request fixes security vulnerabilities in tar file extraction by improving symlink resolution logic and removes `[ActiveIssue]` attributes from tests that were previously failing on macOS.

- `System/Formats/Tar/TarEntry.cs`: Enhanced symlink directory traversal protection by using logical destination paths for relative path computation, improving `ResolveSymlink` to handle dangling symlinks, and adding early guard checks to prevent path escaping
- `TarFile.ExtractToDirectory*.Tests.cs`: Removed `[ActiveIssue("https://github.com/dotnet/runtime/issues/129227")]` attributes from multiple test methods for symbolic link and hard link extraction tests
- `eng/Version.Details.xml` and `eng/Versions.props`: Updated `Microsoft.NETCore.Runtime.ICU.Transport` version from 8.0.0-rtm.26256.1 to 8.0.0-rtm.26313.2 and `Microsoft.Native.Quic.MsQuic.Schannel` from 2.4.18 to 2.5.9
- `iOS.Device.*.Test.csproj`: Added `<IgnoreForCI>true</IgnoreForCI>` to iOS device test projects due to servicing infrastructure limitations
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…_name.

#### AI description  (iteration 1)
#### PR Classification
Bug fix to handle truncation errors in IPC transport default name generation and improve error handling in Unix domain socket address allocation.

#### PR Summary
This PR fixes error handling when generating default IPC transport names, ensuring truncation errors are properly detected and handled instead of silently proceeding with invalid paths.

- `ds-ipc-pal-socket.c`: Added proper error handling with `ep_raise_error_if_nok` macros to validate socket path generation, prevent empty `sun_path` (which would bind to unsupported Linux abstract namespace), and properly cleanup allocated memory on error
- `ds-ipc-pal-socket.c` and `ds-rt-coreclr.h`: Modified `ipc_transport_get_default_name` to return `false` when name generation fails (detected by empty string), instead of always returning `true`
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
Co-authored-by: Mirroring <dnceng-mirroring@microsoft.com>
Co-authored-by: Máňa Píchová <Marie.Pichova@microsoft.com>
Co-authored-by: Irem Yuksel <iremyuksel@microsoft.com>
Co-authored-by: Sean Reeser (CSI Interfusion Inc) <v-seanreeser@microsoft.com>
Co-authored-by: Tom McDonald <Thomas.McDonald@microsoft.com>
Co-authored-by: vseanreesermsft <78103370+vseanreesermsft@users.noreply.github.com>
Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-codeflow for labeling automated codeflow

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants