[yanksyoon]

What fails

build (linux-s390x) on run 38847871799 / job 116802375689 (branch arm-tarball-fix-2.338.0) fails in Build & Layout Release:

src/Sdk/Sdk.csproj : error NU1902: Warning As Error: Package 'System.Security.Cryptography.Pkcs'
  10.0.12 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-2fmv-rv2c-59x7
src/Sdk/Sdk.csproj : error NU1903: Warning As Error: Package 'System.Security.Cryptography.Pkcs'
  10.0.12 has a known high severity vulnerability, https://github.com/advisories/GHSA-846f-f764-76mx
Failed to restore …/src/Sdk/Sdk.csproj

Root cause, in order:

1. The throwaway rebuild branch is based on the released v2.338.0 revision, which pins System.Security.Cryptography.Pkcs 10.0.12.
2. Upstream src/Directory.Build.props enables NuGetAudit with NuGetAuditMode=all / NuGetAuditLevel=moderate and sets TreatWarningsAsErrors=true, so any advisory for a pinned package becomes a hard restore error (NU1902/NU1903). The audit is architecture-independent, so all five matrix jobs fail, not only s390x.
3. The two advisories (CVE-2026-84008 high, CVE-2026-70162 moderate; patched in Pkcs 8.0.2 / 9.0.21 / 10.0.13) were published 2026-10-13 but only entered NuGet's vulnerability feed on 2026-10-15 (feed snapshots 2026.10.15.05.26.01, …17.26.04). That is why the same revision built without problems on 2026-10-14 and cannot be built now — the failure is time-dependent, not caused by any branch content.
4. Upstream fixed it by bumping the pin pair (Bump System.Formats.Asn1 and System.Security.Cryptography.Pkcs actions/runner#4777) and main received that through the patch sync (Sync main patch 796cc18f #242, Pkcs 10.0.13). Revisions cut before that keep the vulnerable pins and can no longer be built at all: v2.338.0 10.0.12, v2.337.0 10.0.11, v2.335.x/v2.336.0 10.0.7, v2.334.0 10.0.6, v2.332.0/v2.333.1 10.0.2, v2.330.0/v2.331.0 8.0.0.

What this PR does

Adds one step, Bump NuGet packages with patched advisories, to build.yml (Runner CI) and release.yml (Runner CD), right after "Update DotNet required version pin". It moves the affected pins in src/Sdk/Sdk.csproj to the versions upstream already patched:

pinned	becomes
Pkcs 8.0.0–8.0.1	8.0.2
Pkcs 9.0.0–9.0.20	9.0.21
Pkcs 10.0.0–10.0.12	10.0.13
Formats.Asn1 10.0.0–10.0.12	10.0.13 (upstream bumps the pair together)

Each sed only matches a version inside an affected range, so the step is a no-op on main (already 10.0.13) and on any revision that already pins a patched version. Packages that are not listed still fail the build, so the NuGet audit keeps its signal. No source change is committed and src/ keeps mirroring upstream.

Why not a patch file

patches/runner-*-sdk8-*.patch cannot carry this fix:

• they are regenerated from upstream by the daily patch sync, so a hunk pinned to 10.0.12 conflicts as soon as upstream pins 10.0.13 (already the case on main) and would break the sync;
• they only apply to s390x, ppc64le and arm — x64 and arm64 apply no patch, but they fail on the same audit error.

An alternative, if we would rather never fail CI on advisories: a committed src/Directory.Build.rsp with -p:WarningsNotAsErrors=NU1901%3BNU1902%3BNU1903%3BNU1904, which keeps advisories as warnings and leaves src/ untouched (MSBuild environment variables cannot override the values set in Directory.Build.props, an rsp file can). I kept the bump because it also removes the vulnerability from the rebuilt tarball and keeps the audit fatal for everything else.

Testing

• Reproduced the CI error locally with SDK 8.0.426 on a v2.338.0 worktree with the s390x patch applied: dotnet restore src/Sdk/Sdk.csproj fails with the two NU1902/NU1903 errors.
• With the step applied, ./dev.sh layout Release linux-s390x in that worktree completes with exit code 0 and no NU19x diagnostics.
• Version matrix for the seds: 8.0.0/8.0.1 → 8.0.2, 9.0.0/9.0.20 → 9.0.21, 10.0.0/10.0.12 → 10.0.13, already-patched versions unchanged, and no-op on a clean main checkout (git diff empty).
• Pkcs 10.0.13 is known good on all five runtimes: Runner CI run 38845901975 passed all five jobs with that pin.
• Vanilla runtime check (no arch patch applied, i.e. what builds linux-x64 and linux-arm64): the
  frozen revision fails ./dev.sh layout Release linux-x64 with the same NU1902/NU1903 errors, and
  the same command exits 0 with no NU19x after this step runs. The bump is therefore required by
  all five runtimes, not only by s390x/ppc64le/arm: the pinned restore is architecture-independent,
  and in run 38847871799 the other four jobs were cancelled by the matrix fail-fast before they
  could report the same error.
• Newer pins are left alone: the seds do not touch 10.0.13, 10.0.14, 10.0.20, 10.0.100, 11.0.0 or
  12.0.0, so nothing is rewritten or downgraded as upstream moves forward and the step fades out
  on its own.

Notes

• The throwaway branch arm-tarball-fix-2.338.0 already carries its own temporary bump (a98f1add) so its rebuild could finish; that commit is throwaway and is not part of this PR. This PR is what keeps future release and rebuild branches working without editing src/ per branch.
• Refs CI/CD Pipeline Failed: Runner CI #244, Bump System.Formats.Asn1 and System.Security.Cryptography.Pkcs actions/runner#4777, GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7.

[yanksyoon]

Upstream has fixed it and our sync has patched main. The only affected revision is releases/v2.338.0 which has already been released. Waiting for the fix to be released is the proper solution. Closing.