microsoft · AArnott · Oct 16, 2025 · Oct 17, 2025 · Oct 20, 2025 · Oct 21, 2025
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "powershell": {
-      "version": "7.5.3",
+      "version": "7.5.4",
       "commands": [
         "pwsh"
       ],
@@ -17,14 +17,14 @@
       "rollForward": false
     },
     "nbgv": {
-      "version": "3.8.118",
+      "version": "3.9.50",
       "commands": [
         "nbgv"
       ],
       "rollForward": false
     },
     "docfx": {
-      "version": "2.78.3",
+      "version": "2.78.4",
       "commands": [
         "docfx"
       ],

diff --git a/.github/actions/publish-artifacts/action.yaml b/.github/actions/publish-artifacts/action.yaml
@@ -14,46 +14,46 @@ runs:
 
   - name: 📢 Upload project.assets.json files
     if: always()
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: projectAssetsJson-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/projectAssetsJson
     continue-on-error: true
   - name: 📢 Upload variables
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: variables-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/Variables
     continue-on-error: true
   - name: 📢 Upload build_logs
     if: always()
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: build_logs-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/build_logs
     continue-on-error: true
   - name: 📢 Upload testResults
     if: always()
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: testResults-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/testResults
     continue-on-error: true
   - name: 📢 Upload coverageResults
     if: always()
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: coverageResults-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/coverageResults
     continue-on-error: true
   - name: 📢 Upload symbols
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: symbols-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/symbols
     continue-on-error: true
   - name: 📢 Upload deployables
-    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     with:
       name: deployables-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/deployables

diff --git a/.github/workflows/docs_validate.yml b/.github/workflows/docs_validate.yml
@@ -27,4 +27,3 @@ jobs:
       shell: pwsh
     - name: 📚 Verify docfx build
       run: dotnet docfx docfx/docfx.json --warningsAsErrors --disableGitFeatures
-      if: runner.os == 'Linux'
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -15,6 +15,7 @@
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <ProduceReferenceAssembly>true</ProduceReferenceAssembly>
+    <RestoreEnablePackagePruning>true</RestoreEnablePackagePruning>
 
     <!-- https://learn.microsoft.com/en-us/dotnet/fundamentals/apicompat/package-validation/overview -->
     <EnablePackageValidation>true</EnablePackageValidation>
@@ -40,7 +41,7 @@
   </PropertyGroup>
 
   <PropertyGroup>
-    <LangVersion Condition="'$(MSBuildProjectExtension)'=='.csproj'">13</LangVersion>
+    <LangVersion Condition="'$(MSBuildProjectExtension)'=='.csproj'">14</LangVersion>
     <LangVersion Condition="'$(MSBuildProjectExtension)'=='.vbproj'">16.9</LangVersion>
   </PropertyGroup>
 

diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -4,7 +4,7 @@
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
-    <MicroBuildVersion>2.0.201</MicroBuildVersion>
+    <MicroBuildVersion>2.0.208</MicroBuildVersion>
     <CodeAnalysisVersion>3.11.0</CodeAnalysisVersion>
     <CodeAnalysisVersionForTests>4.13.0</CodeAnalysisVersionForTests>
     <CodefixTestingVersion>1.1.2</CodefixTestingVersion>
@@ -48,7 +48,7 @@
     <PackageVersion Update="Microsoft.CodeAnalysis.VisualBasic" Version="$(CodeAnalysisVersionForTests)" />
   </ItemGroup>
   <ItemGroup Label="Library.Template">
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
     <PackageVersion Include="Microsoft.VisualStudio.Internal.MicroBuild.NonShipping" Version="$(MicroBuildVersion)" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageVersion Include="xunit" Version="2.9.3" />
@@ -61,7 +61,7 @@
     <GlobalPackageReference Include="DotNetAnalyzers.DocumentationAnalyzers" Version="1.0.0-beta.59" />
     <GlobalPackageReference Include="Microsoft.VisualStudio.Internal.MicroBuild.VisualStudio" Version="$(MicroBuildVersion)" />
     <!-- The condition works around https://github.com/dotnet/sdk/issues/44951 -->
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.8.118" Condition="!('$(TF_BUILD)'=='true' and '$(dotnetformat)'=='true')" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.9.50" Condition="!('$(TF_BUILD)'=='true' and '$(dotnetformat)'=='true')" />
     <GlobalPackageReference Include="PolySharp" Version="1.15.0" />
     <GlobalPackageReference Include="StyleCop.Analyzers.Unstable" Version="1.2.0.556" />
   </ItemGroup>

diff --git a/azure-pipelines/OptProf.yml b/azure-pipelines/OptProf.yml
@@ -97,6 +97,10 @@ stages:
         TeamEmail: $(TeamEmail)
         SkipCreatePR: true
         CustomScriptExecutionCommand: src\VSSDK\NuGet\AllowUnstablePackages.ps1
+        ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
+          ConnectedVSDropServiceName: 'VSEng-VSDrop-MI'
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     - task: benjhuser.tfs-extensions-build-tasks.trigger-build-task.TriggerBuild@3
       displayName: Trigger a new build of DD-CB-TestSignVS-devCI
       inputs:

diff --git a/azure-pipelines/build.yml b/azure-pipelines/build.yml
@@ -29,14 +29,17 @@ parameters:
 - name: artifact_names
   type: object
   default:
-    - build_logs
-    - coverageResults
-    - deployables
-    - projectAssetsJson
-    - symbols
-    - testResults
-    - test_symbols
-    - Variables
+    - name: build_logs
+    - name: coverageResults
+    - name: deployables
+      sbomEnabled: true
+    - name: projectAssetsJson
+    - name: symbols
+    - name: testResults
+      testOnly: true
+    - name: test_symbols
+      testOnly: true
+    - name: Variables
 # The Enable*Build parameters turn non-Windows agents on or off.
 # Their default value should be based on whether the build and tests are expected/required to pass on that platform.
 # Callers (e.g. Official.yml) *may* expose these parameters at queue-time in order to turn OFF optional agents.
@@ -57,6 +60,11 @@ parameters:
 - name: Is1ESPT
   type: boolean
 
+# Indicates whether the 'official' 1ES PT templates are being used (as opposed to the unofficial ones).
+- name: Is1ESPTOfficial
+  type: boolean
+  default: false
+
 - name: RealSign
   type: boolean
   default: false
@@ -148,13 +156,21 @@ jobs:
 
       outputParentDirectory: $(Build.ArtifactStagingDirectory)
       outputs:
-      - ${{ each artifact_name in parameters.artifact_names }}:
-        - ${{ if or(ne(artifact_name, 'testResults'), parameters.RunTests) }}:
+      - ${{ each artifact in parameters.artifact_names }}:
+        - ${{ if or(ne(artifact.testOnly, 'true'), parameters.RunTests) }}:
           - output: pipelineArtifact
-            displayName: 📢 Publish ${{ artifact_name }}-Windows
-            targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact_name }}-Windows
-            artifactName: ${{ artifact_name }}-Windows
-            condition: succeededOrFailed()
+            displayName: 📢 Publish ${{ artifact.name }}-Windows
+            targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-Windows
+            artifactName: ${{ artifact.name }}-Windows
+            ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+              sbomEnabled: true
+          - output: pipelineArtifact
+            displayName: 📢 Publish ${{ artifact.name }}-Windows (for failed attempts)
+            targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-Windows
+            artifactName: ${{ artifact.name }}-Windows-$(System.PhaseAttempt)
+            ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+              sbomEnabled: true
+            condition: failed()
       - output: pipelineArtifact
         displayName: 📢 Publish VSInsertion-Windows
         targetPath: $(Build.ArtifactStagingDirectory)/VSInsertion-Windows
@@ -191,7 +207,6 @@ jobs:
     - template: microbuild.before.yml
       parameters:
         EnableLocalization: ${{ parameters.EnableLocalization }}
-        EnableOptProf: ${{ parameters.EnableOptProf }}
         IsOptProf: ${{ parameters.IsOptProf }}
         ShouldSkipOptimize: ${{ parameters.ShouldSkipOptimize }}
         RealSign: ${{ parameters.RealSign }}
@@ -212,7 +227,6 @@ jobs:
   - ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
     - template: microbuild.after.yml
       parameters:
-        EnableOptProf: ${{ parameters.EnableOptProf }}
         IsOptProf: ${{ parameters.IsOptProf }}
         SkipCodesignVerify: ${{ parameters.SkipCodesignVerify }}
 
@@ -230,13 +244,21 @@ jobs:
                 signWithProd: true
           outputParentDirectory: $(Build.ArtifactStagingDirectory)
           outputs:
-          - ${{ each artifact_name in parameters.artifact_names }}:
-            - ${{ if or(ne(artifact_name, 'testResults'), parameters.RunTests) }}:
+          - ${{ each artifact in parameters.artifact_names }}:
+            - ${{ if or(ne(artifact.testOnly, 'true'), parameters.RunTests) }}:
+              - output: pipelineArtifact
+                displayName: 📢 Publish ${{ artifact.name }}-Linux
+                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-Linux
+                artifactName: ${{ artifact.name }}-Linux
+                ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+                  sbomEnabled: true
               - output: pipelineArtifact
-                displayName: 📢 Publish ${{ artifact_name }}-Linux
-                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact_name }}-Linux
-                artifactName: ${{ artifact_name }}-Linux
-                condition: succeededOrFailed()
+                displayName: 📢 Publish ${{ artifact.name }}-Linux (for failed attempts)
+                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-Linux
+                artifactName: ${{ artifact.name }}-Linux-$(System.PhaseAttempt)
+                ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+                  sbomEnabled: true
+                condition: failed()
       steps:
       - checkout: self
         fetchDepth: 0 # avoid shallow clone so nbgv can do its work.
@@ -267,13 +289,21 @@ jobs:
                 signWithProd: true
           outputParentDirectory: $(Build.ArtifactStagingDirectory)
           outputs:
-          - ${{ each artifact_name in parameters.artifact_names }}:
-            - ${{ if or(ne(artifact_name, 'testResults'), parameters.RunTests) }}:
+          - ${{ each artifact in parameters.artifact_names }}:
+            - ${{ if or(ne(artifact.testOnly, 'true'), parameters.RunTests) }}:
+              - output: pipelineArtifact
+                displayName: 📢 Publish ${{ artifact.name }}-macOS
+                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-macOS
+                artifactName: ${{ artifact.name }}-macOS
+                ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+                  sbomEnabled: true
               - output: pipelineArtifact
-                displayName: 📢 Publish ${{ artifact_name }}-macOS
-                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact_name }}-macOS
-                artifactName: ${{ artifact_name }}-macOS
-                condition: succeededOrFailed()
+                displayName: 📢 Publish ${{ artifact.name }}-macOS (for failed attempts)
+                targetPath: $(Build.ArtifactStagingDirectory)/${{ artifact.name }}-macOS
+                artifactName: ${{ artifact.name }}-macOS-$(System.PhaseAttempt)
+                ${{ if and(parameters.Is1ESPTOfficial, eq(artifact.sbomEnabled, 'true')) }}:
+                  sbomEnabled: true
+                condition: failed()
       steps:
       - checkout: self
         fetchDepth: 0 # avoid shallow clone so nbgv can do its work.

diff --git a/azure-pipelines/microbuild.after.yml b/azure-pipelines/microbuild.after.yml
@@ -1,7 +1,4 @@
 parameters:
-- name: EnableOptProf
-  type: boolean
-  default: false
 - name: IsOptProf
   type: boolean
   default: false

diff --git a/azure-pipelines/microbuild.before.yml b/azure-pipelines/microbuild.before.yml
@@ -2,9 +2,6 @@ parameters:
 - name: EnableLocalization
   type: boolean
   default: false
-- name: EnableOptProf
-  type: boolean
-  default: false
 - name: IsOptProf
   type: boolean
   default: false
@@ -26,7 +23,7 @@ steps:
     inputs:
       outputfile: $(System.DefaultWorkingDirectory)/obj/NOTICE
       outputformat: text
-    retryCountOnTaskFailure: 3 # fails when the cloud service is overloaded
+    retryCountOnTaskFailure: 10 # fails when the cloud service is overloaded
     continueOnError: ${{ not(parameters.RealSign) }} # Tolerate failures when we're not building something that may ship.
 
 - ${{ if parameters.IsOptProf }}:

diff --git a/azure-pipelines/official.yml b/azure-pipelines/official.yml
@@ -68,6 +68,7 @@ extends:
       - template: /azure-pipelines/build.yml@self
         parameters:
           Is1ESPT: true
+          Is1ESPTOfficial: true
           RealSign: true
           ShouldSkipOptimize: ${{ parameters.ShouldSkipOptimize }}
           EnableAPIScan: ${{ parameters.EnableAPIScan }}

diff --git a/azure-pipelines/release.yml b/azure-pipelines/release.yml
@@ -28,7 +28,8 @@ extends:
     stages:
     - stage: release
       jobs:
-      - job: release
+      - job: nuget
+        displayName: 📦 Push nuget.org packages
         pool:
           name: AzurePipelines-EO
           demands:
@@ -45,6 +46,28 @@ extends:
             publishFeedCredentials: VisualStudioExtensibility (nuget.org)
         steps:
         - checkout: none
+        - download: CI
+          artifact: deployables-Windows
+          displayName: 🔻 Download deployables-Windows artifact
+          patterns: 'NuGet/*'
+      - job: github
+        displayName: 📢 GitHub release
+        dependsOn: nuget
+        pool:
+          name: AzurePipelines-EO
+          demands:
+          - ImageOverride -equals 1ESPT-Ubuntu22.04
+          os: Linux
+        templateContext:
+          type: releaseJob
+          isProduction: true
+          inputs:
+          - input: pipelineArtifact
+            pipeline: CI
+            artifactName: deployables-Windows
+            targetPath: $(Pipeline.Workspace)/CI/deployables-Windows
+        steps:
+        - checkout: none
         - powershell: |
             Write-Host "##vso[build.updatebuildnumber]$(resources.pipeline.CI.runName)"
             if ('$(resources.pipeline.CI.runName)'.Contains('-')) {
@@ -53,10 +76,6 @@ extends:
               Write-Host "##vso[task.setvariable variable=IsPrerelease]false"
             }
           displayName: ⚙ Set up pipeline
-        - download: CI
-          artifact: deployables-Windows
-          displayName: 🔻 Download deployables-Windows artifact
-          patterns: 'NuGet/*'
         - task: GitHubRelease@1
           displayName: 📢 GitHub release (create)
           inputs:

diff --git a/azure-pipelines/vs-insertion.yml b/azure-pipelines/vs-insertion.yml
@@ -69,6 +69,11 @@ extends:
             AutoCompletePR: true
             AutoCompleteMergeStrategy: Squash
             ShallowClone: true
+            ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
+              ConnectedVSDropServiceName: 'VSEng-VSDrop-MI'
+          env:
+            SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+
         - powershell: |
             $contentType = 'application/json';
             $headers = @{ Authorization = 'Bearer $(System.AccessToken)' };

diff --git a/azure-pipelines/vs-validation.yml b/azure-pipelines/vs-validation.yml
@@ -111,6 +111,10 @@ extends:
             DraftPR: false # set to true and update InsertionBuildPolicy when we can specify all the validations we want to run (https://dev.azure.com/devdiv/DevDiv/_workitems/edit/2224288)
             AutoCompletePR: false
             ShallowClone: true
+            ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
+              ConnectedVSDropServiceName: 'VSEng-VSDrop-MI'
+          env:
+            SYSTEM_ACCESSTOKEN: $(System.AccessToken)
         - powershell: |
             $insertionPRId = azure-pipelines/Get-InsertionPRId.ps1
             $Markdown = @"

diff --git a/global.json b/global.json
@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "9.0.306",
+    "version": "10.0.100",
     "rollForward": "patch",
     "allowPrerelease": false
   },