From e6c5c47cb5a0034834deffca9bf7ee83e17217a2 Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Thu, 16 Oct 2025 08:04:48 -0700
Subject: [PATCH 1/4] Fix build

---
 .../typespec-vs/src/Microsoft.TypeSpec.VS.csproj     | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
index b81c3599597..8b6d2419844 100644
--- a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
+++ b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
@@ -50,16 +50,14 @@
     <!-- The 'Microsoft.VisualStudio.Composition' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace' -->
     <!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace" will report warning NU1603 because its desired version not found and higher version will be used -->
     <!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
-    <PackageReference Include="Microsoft.VisualStudio.Composition" Version="17.12.18" />
+    <PackageReference Include="Microsoft.VisualStudio.Composition" Version="17.13.41" />
     <!-- Use 17.0.x or latest 16.x if no 17.0.x for compatible API-->
-    <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.12.40392" ExcludeAssets="Runtime" />
-    <!-- The 'Microsoft.VisualStudio.Shell.15.0' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace.VSIntegration' -->
-    <!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace.VSIntegration" will report warning NU1603 because its desired version not found and higher version will be used -->
-    <!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
-    <PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.12.40392" />
+    <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.14.40265" ExcludeAssets="Runtime" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace" Version="17.12.19" ExcludeAssets="Runtime" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace.VSIntegration" Version="17.12.19" ExcludeAssets="Runtime" />
-    <PackageReference Include="Microsoft.VSSDK.BuildTools" Version="17.9.3184">
+    <!-- https://github.com/advisories/GHSA-w3q9-fxm7-j8fq -->
+    <PackageReference Include="Microsoft.Build" Version="17.14.28"/>
+    <PackageReference Include="Microsoft.VSSDK.BuildTools" Version="17.14.2120">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

From bf8fc10ab26229a50d65599fbbf9639220e2c9f4 Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Thu, 16 Oct 2025 08:15:44 -0700
Subject: [PATCH 2/4] Fix typo in VS dependency upgrade message

---
 .../fix-vs-vulnerability-build-2025-9-16-15-5-57.md       | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 .chronus/changes/fix-vs-vulnerability-build-2025-9-16-15-5-57.md

diff --git a/.chronus/changes/fix-vs-vulnerability-build-2025-9-16-15-5-57.md b/.chronus/changes/fix-vs-vulnerability-build-2025-9-16-15-5-57.md
new file mode 100644
index 00000000000..f937c8e6f5c
--- /dev/null
+++ b/.chronus/changes/fix-vs-vulnerability-build-2025-9-16-15-5-57.md
@@ -0,0 +1,8 @@
+---
+# Change versionKind to one of: internal, fix, dependencies, feature, deprecation, breaking
+changeKind: fix
+packages:
+  - typespec-vs
+---
+
+Upgrade VS dependencies to fix vulnerability 

From 2015fb3843c3d73f170bddff4a3816251cd101c8 Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Thu, 16 Oct 2025 08:34:27 -0700
Subject: [PATCH 3/4] revert

---
 packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
index 8b6d2419844..7e8a34274e9 100644
--- a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
+++ b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
@@ -53,6 +53,10 @@
     <PackageReference Include="Microsoft.VisualStudio.Composition" Version="17.13.41" />
     <!-- Use 17.0.x or latest 16.x if no 17.0.x for compatible API-->
     <PackageReference Include="Microsoft.VisualStudio.SDK" Version="17.14.40265" ExcludeAssets="Runtime" />
+    <!-- The 'Microsoft.VisualStudio.Shell.15.0' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace.VSIntegration' -->
+    <!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace.VSIntegration" will report warning NU1603 because its desired version not found and higher version will be used -->
+    <!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
+    <PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.12.40392" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace" Version="17.12.19" ExcludeAssets="Runtime" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace.VSIntegration" Version="17.12.19" ExcludeAssets="Runtime" />
     <!-- https://github.com/advisories/GHSA-w3q9-fxm7-j8fq -->

From daa0c23eb96796635041d6e3c64c6647163bab91 Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Thu, 16 Oct 2025 08:35:43 -0700
Subject: [PATCH 4/4] revert

---
 packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
index 7e8a34274e9..804b1067d02 100644
--- a/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
+++ b/packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj
@@ -56,7 +56,7 @@
     <!-- The 'Microsoft.VisualStudio.Shell.15.0' is not used directly but referenced by nuget package 'Microsoft.VisualStudio.Workspace.VSIntegration' -->
     <!-- Have to add it explicitly here because otherwise 'Microsoft.VisualStudio.Workspace.VSIntegration" will report warning NU1603 because its desired version not found and higher version will be used -->
     <!-- TODO: [#5368] remove this explicit reference after 'Microsoft.VisualStudio...' releases new version without the warning-->
-    <PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.12.40392" />
+    <PackageReference Include="Microsoft.VisualStudio.Shell.15.0" Version="17.14.40264" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace" Version="17.12.19" ExcludeAssets="Runtime" />
     <PackageReference Include="Microsoft.VisualStudio.Workspace.VSIntegration" Version="17.12.19" ExcludeAssets="Runtime" />
     <!-- https://github.com/advisories/GHSA-w3q9-fxm7-j8fq -->