From c2878ae79a0ca9507b48ee9c45738d092b06c4e8 Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 02:05:48 +0000
Subject: [PATCH 1/3] Backflow from https://github.com/dotnet/dotnet / ae1c2e7
 build 325824

Diff: https://github.com/dotnet/dotnet/compare/13a51a374931ee7021dd6b366d3f7256ddfa2871..ae1c2e796871b41b1ffc4357e4aec0dd8c1f4f90

From: https://github.com/dotnet/dotnet/commit/13a51a374931ee7021dd6b366d3f7256ddfa2871
To: https://github.com/dotnet/dotnet/commit/ae1c2e796871b41b1ffc4357e4aec0dd8c1f4f90

[[ commit created by automation ]]
---
 src/FSharp.Build/FSharp.Build.fsproj                     | 6 ++++++
 .../FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/FSharp.Build/FSharp.Build.fsproj b/src/FSharp.Build/FSharp.Build.fsproj
index 90912e95fe2..d2da9b00327 100644
--- a/src/FSharp.Build/FSharp.Build.fsproj
+++ b/src/FSharp.Build/FSharp.Build.fsproj
@@ -89,6 +89,12 @@
     <PackageReference Include="Microsoft.Build.Framework" />
     <PackageReference Include="Microsoft.Build.Tasks.Core" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" />
+    <PackageReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" />
+    <PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" PrivateAssets="all" /> <!-- Update transitive vulnerable package -->
+    <PackageReference Include="System.Memory" Version="$(SystemMemoryVersion)" />
+    <PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="$(SystemRuntimeCompilerServicesUnsafeVersion)" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj
index 0b489b6cc7c..15863c1c97d 100644
--- a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj
+++ b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj
@@ -32,6 +32,15 @@
     <PackageReference Include="Microsoft.Build.Framework" />
     <PackageReference Include="Microsoft.Build.Tasks.Core" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" />
+    <PackageReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" />
+    <PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" PrivateAssets="all" /> <!-- Update transitive vulnerable package -->
+  </ItemGroup>
+
+  <!-- Override vulnerable System.Security.Cryptography.Xml pulled in transitively by Microsoft.Build.Tasks.Core on .NET (NU1903). net472 is excluded because it has no such transitive and the override's dependencies conflict with System.ValueTuple there. -->
+  <ItemGroup Condition="'$(TargetFramework)' == '$(FSharpNetCoreProductTargetFramework)'">
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="$(SystemSecurityCryptographyXmlVersion)" />
   </ItemGroup>
 
 </Project>

From e3a84df79789d883394faa3a3904bc1efd8592bc Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 02:05:55 +0000
Subject: [PATCH 2/3] Update dependencies from build 325824 No dependency
 updates to commit [[ commit created by automation ]]

---
 eng/Version.Details.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 579f03c52de..cc965e4586f 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
-  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="aedf05ae4b6c7f74f789e64a0a8d9d169414f04f" BarId="325626" />
+  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="ae1c2e796871b41b1ffc4357e4aec0dd8c1f4f90" BarId="325824" />
   <ProductDependencies>
     <Dependency Name="Microsoft.Build" Version="18.10.0-preview-26357-08">
       <Uri>https://github.com/dotnet/msbuild</Uri>

From 761ba1cfbb5c2e8f94c3d0ea7b7cad122d2896ac Mon Sep 17 00:00:00 2001
From: "dotnet-maestro[bot]" <dotnet-maestro[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 02:06:01 +0000
Subject: [PATCH 3/3] Update dependencies from build 326034 No dependency
 updates to commit [[ commit created by automation ]]

---
 eng/Version.Details.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index cc965e4586f..85bf83f5060 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
-  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="ae1c2e796871b41b1ffc4357e4aec0dd8c1f4f90" BarId="325824" />
+  <Source Uri="https://github.com/dotnet/dotnet" Mapping="fsharp" Sha="6c7fa710f4337334575f0c30f1691edc244518d1" BarId="326034" />
   <ProductDependencies>
     <Dependency Name="Microsoft.Build" Version="18.10.0-preview-26357-08">
       <Uri>https://github.com/dotnet/msbuild</Uri>