[dependabot]

Updated Microsoft.CodeAnalysis.CSharp from 5.9.0 to 5.12.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.11.0 to 18.12.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.12.0

Security fix

This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

• Fix TestCaseStart/Stop events dropped for data-driven tests with shared TestCase.Id by @​nohwnd in [fix] Fix TestCaseStart/Stop events dropped for data-driven tests with shared TestCase.Id microsoft/vstest#16033
• Stop the discovery manager factory from shadowing discoveryCriteria by @​nohwnd in Stop the discovery manager factory from shadowing discoveryCriteria microsoft/vstest#16391
• Gate the HTTP link checker on a fingerprint of the broken links by @​nohwnd in Gate the HTTP link checker on a fingerprint of the broken links  microsoft/vstest#16413
• Quote boolean conditions in shipped Microsoft.TestPlatform.targets by @​nohwnd in Quote boolean conditions in shipped Microsoft.TestPlatform.targets microsoft/vstest#16404
• Obsolete API hygiene: the compatibility-safe changes by @​azat-msft in Obsolete API hygiene: the compatibility-safe changes microsoft/vstest#16420
• Add xxHash128 test ids, available but not default by @​azat-msft in Add xxHash128 test ids, available but not default microsoft/vstest#16378
• Isolate attachment manager test temporary files by @​mmitche in Isolate attachment manager test temporary files microsoft/vstest#16463
• Test ids report logger by @​azat-msft in Test ids report logger microsoft/vstest#16443
• Isolate code coverage files in published output by @​azat-msft in Isolate code coverage files in published output microsoft/vstest#16483
• Preserve OutputType for Android test projects by @​jonathanpeppers in Preserve OutputType for Android test projects microsoft/vstest#16496
• Fix dotnet host resolution under proot (ARM64/Termux) by @​azat-msft in Fix dotnet host resolution under proot (ARM64/Termux) microsoft/vstest#16462
• Mark the xxHash128 test id API as experimental by @​azat-msft in Mark the xxHash128 test id API as experimental microsoft/vstest#16465
• Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @​nohwnd in [rel/18.12] Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages microsoft/vstest#16633
• Fix localized resource paths in CLI source-build/non-Windows packages by @​nohwnd in [rel/18.12] Fix localized resource paths in CLI source-build/non-Windows packages microsoft/vstest#16644

Full Changelog: microsoft/vstest@v18.11.0...v18.12.0

18.11.1

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0.
Fixed in: Microsoft.TestPlatform.CLI 18.11.1.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: microsoft/vstest#16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See microsoft/vstest#16652

What's Changed

• Security fix for CVE-2026-105544, see Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability microsoft/vstest#16654
• Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @​nohwnd in [rel/18.11] Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages microsoft/vstest#16632
• Fix localized resource paths in CLI source-build packages by @​nohwnd in [rel/18.11] Fix localized resource paths in CLI source-build/non-Windows packages microsoft/vstest#16643

Full Changelog: microsoft/vstest@v18.11.0...v18.11.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Release Assistant - Passed

PR marked as skip-release. No release will be triggered.