oss/Portal
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases 1 Packages Wiki Activity

Update dependency Microsoft.NET.Test.Sdk to 18.12.0 #24

Merged
oss merged 1 commit from renovate/vstest-monorepo into main 2026-11-14 20:59:10 +01:00
Conversation 0 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-11-11 04:04:57 +01:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
Microsoft.NET.Test.Sdk 18.11.0 → 18.12.0 age confidence

Release Notes

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.12.0

Security fix

This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: #​16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See #​16652

What's Changed

Full Changelog: https://github.com/microsoft/vstest/compare/v18.11.0...v18.12.0

v18.11.1

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0.
Fixed in: Microsoft.TestPlatform.CLI 18.11.1.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: #​16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See #​16652

What's Changed

  • Security fix for CVE-2026-105544, see #​16654
  • Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @​nohwnd in #​16632
  • Fix localized resource paths in CLI source-build packages by @​nohwnd in #​16643

Full Changelog: https://github.com/microsoft/vstest/compare/v18.11.0...v18.11.1

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest) | `18.11.0` → `18.12.0` | ![age](https://developer.mend.io/api/mc/badges/age/nuget/Microsoft.NET.Test.Sdk/18.12.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/nuget/Microsoft.NET.Test.Sdk/18.11.0/18.12.0?slim=true) | --- ### Release Notes <details> <summary>microsoft/vstest (Microsoft.NET.Test.Sdk)</summary> ### [`v18.12.0`](https://github.com/microsoft/vstest/releases/tag/v18.12.0) #### Security fix This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged `executionComplete.json` written by another local user, and then run attacker-controlled output handling. Affected: `Microsoft.TestPlatform.CLI` 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0. `Microsoft.TestPlatform.CLI` is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions. The fix is also released in the `Microsoft.TestPlatform.CLI` package, for completeness. That package is rarely used directly. It is not a dependency of `Microsoft.NET.Test.Sdk` or `Microsoft.TestPlatform`, so those packages do not bring it in. Details: [#&#8203;16654](https://github.com/microsoft/vstest/issues/16654) and [dotnet/announcements#517](https://github.com/dotnet/announcements/issues/517) Using custom Docker images or Nano Server? See [#&#8203;16652](https://github.com/microsoft/vstest/issues/16652) #### What's Changed - Fix TestCaseStart/Stop events dropped for data-driven tests with shared TestCase.Id by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16033](https://github.com/microsoft/vstest/pull/16033) - Stop the discovery manager factory from shadowing discoveryCriteria by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16391](https://github.com/microsoft/vstest/pull/16391) - Gate the HTTP link checker on a fingerprint of the broken links by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16413](https://github.com/microsoft/vstest/pull/16413) - Quote boolean conditions in shipped Microsoft.TestPlatform.targets by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16404](https://github.com/microsoft/vstest/pull/16404) - Obsolete API hygiene: the compatibility-safe changes by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16420](https://github.com/microsoft/vstest/pull/16420) - Add xxHash128 test ids, available but not default by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16378](https://github.com/microsoft/vstest/pull/16378) - Isolate attachment manager test temporary files by [@&#8203;mmitche](https://github.com/mmitche) in [#&#8203;16463](https://github.com/microsoft/vstest/pull/16463) - Test ids report logger by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16443](https://github.com/microsoft/vstest/pull/16443) - Isolate code coverage files in published output by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16483](https://github.com/microsoft/vstest/pull/16483) - Preserve OutputType for Android test projects by [@&#8203;jonathanpeppers](https://github.com/jonathanpeppers) in [#&#8203;16496](https://github.com/microsoft/vstest/pull/16496) - Fix dotnet host resolution under proot (ARM64/Termux) by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16462](https://github.com/microsoft/vstest/pull/16462) - Mark the xxHash128 test id API as experimental by [@&#8203;azat-msft](https://github.com/azat-msft) in [#&#8203;16465](https://github.com/microsoft/vstest/pull/16465) - Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16633](https://github.com/microsoft/vstest/pull/16633) - Fix localized resource paths in CLI source-build/non-Windows packages by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16644](https://github.com/microsoft/vstest/pull/16644) **Full Changelog**: <https://github.com/microsoft/vstest/compare/v18.11.0...v18.12.0> ### [`v18.11.1`](https://github.com/microsoft/vstest/releases/tag/v18.11.1) #### Security fix This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged `executionComplete.json` written by another local user, and then run attacker-controlled output handling. Affected: `Microsoft.TestPlatform.CLI` 18.11.0. Fixed in: `Microsoft.TestPlatform.CLI` 18.11.1. `Microsoft.TestPlatform.CLI` is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions. The fix is also released in the `Microsoft.TestPlatform.CLI` package, for completeness. That package is rarely used directly. It is not a dependency of `Microsoft.NET.Test.Sdk` or `Microsoft.TestPlatform`, so those packages do not bring it in. Details: [#&#8203;16654](https://github.com/microsoft/vstest/issues/16654) and [dotnet/announcements#517](https://github.com/dotnet/announcements/issues/517) Using custom Docker images or Nano Server? See [#&#8203;16652](https://github.com/microsoft/vstest/issues/16652) #### What's Changed - Security fix for CVE-2026-105544, see [#&#8203;16654](https://github.com/microsoft/vstest/issues/16654) - Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16632](https://github.com/microsoft/vstest/pull/16632) - Fix localized resource paths in CLI source-build packages by [@&#8203;nohwnd](https://github.com/nohwnd) in [#&#8203;16643](https://github.com/microsoft/vstest/pull/16643) **Full Changelog**: <https://github.com/microsoft/vstest/compare/v18.11.0...v18.11.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjcuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjIzNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate-bot force-pushed renovate/vstest-monorepo from 55018b3383 to 3865ce2f70 2026-11-12 04:03:33 +01:00 Compare
renovate-bot changed title from Update dependency Microsoft.NET.Test.Sdk to 18.11.1 to Update dependency Microsoft.NET.Test.Sdk to 18.12.0 2026-11-12 04:03:35 +01:00
oss merged commit 4206282937 into main 2026-11-14 20:59:10 +01:00
oss deleted branch renovate/vstest-monorepo 2026-11-14 20:59:10 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
oss/Portal!24
No description provided.