dotnet10 (10.0.110-10.0.10-0ubuntu1~24.04.1) noble-security; urgency=medium

  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-57108: .NET runtime - CryptoNative_GetX509NameInfo - UPN
      BOOLEAN ASN.1 type-confusion DoS.
  * SECURITY UPDATE:
    - CVE-2026-47303: ASP.NET Core - Negotiate/LdapAdapter.cs - LDAP
      identifier confusion CN vs sAMAccountName.
  * SECURITY UPDATE: code injection
    - CVE-2026-47300: LdapAdapter query validation fix - LDAP injection via
      unvalidated filter input.
  * SECURITY UPDATE: code injection
    - CVE-2026-50659: System.Net.Mail - SMTP smuggling via CRLF split across
      buffers.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-50528: System.Net.Security - additional SslStream fix (auth
      bypass via ignored channel binding).
  * SECURITY UPDATE: denial of service
    - CVE-2026-50525: EncryptedXml/TransformChain - DoS via XML transform
      chain DTD/base64 amplification.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-47304: EncryptedXml - XML Encryption vulnerability
      (SignedXml.CheckSignature forgery via empty HMAC).
  * SECURITY UPDATE: stack overflow
    - CVE-2026-50527: EncryptedXml - System.Security.Cryptography.Xml.Utils -
      Unauth XML triggers Type.GetType stack overflow.
  * SECURITY UPDATE: denial of service
    - CVE-2026-50648: EncryptedXml - XmlDecryptionTransform document-rooted
      XPath queries causing O(n²) CPU DoS.
  * SECURITY UPDATE: denial of service
    - CVE-2026-47302: EncryptedXml - XML Encryption vulnerability +
      XmlTextReaderImpl.Read duplicate attributes DoS.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-50524: System.Net.Security - SslStream handshake with malformed
      TLS packets.
  * SECURITY UPDATE: blob injection
    - CVE-2026-50526: .NET SDK - Container image build cache uses predictable
      world-writable location enabling blob injection.
  * SECURITY UPDATE: denial of service
    - CVE-2026-50651: SocketsHttpHandler Http2Connection - HTTP/2
      SETTINGS/PING ACK flood causing OOM.
  * Fix `dotnet sdk check` command source URL. (LP: #2156464)
    - d/eng/dotnet-pkg-info.mk: strip suffixes from changelog distribution
      name to avoid using wrong release names.
    - d/t/regular-tests/dotnet-sdk-check-url-verification: test to verify the
      sdk check command queries a URL with a valid release name.
    - d/t/regular-tests/README.md: add distro-info as a necessary dependency
      for the testsuite.
    - d/t/control: add distro-info as a test dependency.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 07 Jul 2026 17:52:34 -0300

dotnet10 (10.0.109-10.0.9-0ubuntu1~24.04.1) noble-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: arbitrary file write
    - CVE-2026-45491: improper link resolution before file access
      ('link following') in .NET allows an unauthorized attacker to perform
      local tampering.
  * SECURITY UPDATE: denial of service
    - CVE-2026-45591: Stack overflow DoS via deeply-nested MessagePack arrays.

 -- Ian Constantin <ian.constantin@canonical.com>  Wed, 10 Jun 2026 10:35:01 +0300

dotnet10 (10.0.108-10.0.8-0ubuntu1~24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - CVE-2026-42899: Loop with unreachable exit condition ('infinite loop')
      in ASP.NET Core allows an unauthorized attacker to deny service over a
      network.

  [ Mateus Rodrigues de Morais ]
  * New upstream release (LP: #2152598)
  * d/t/regular-tests/check-test-results: match to any NU1102 error
    occurrences when ignoring package not found restore errors.
  * d/t/regular-tests/template-test/test.json: increment timeout multiplier to
    avoid timeout errors when running on the autopkgtest cloud.
  * d/t/regular-tests/tools-in-path/test.json: skip test when running on the
    toolchains-ci CI pipeline.
  * d/t/run-regular-tests: define environment variable to selectively add the
    'toolchains-ci' trait to the test runner.

 -- Ian Constantin <ian.constantin@canonical.com>  Fri, 22 May 2026 17:45:46 +0300

dotnet10 (10.0.107-10.0.7-0ubuntu1~24.04.1) noble-security; urgency=medium

  * New upstream release
  * SECURITY UPDATE: elevation of privilege
    - CVE-2026-40372: A bug in Microsoft.AspNetCore.DataProtection
      10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to
      execute an Elevation of Privilege attack by forging authentication
      cookies, and also allows some protected payloads to be decrypted.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Wed, 22 Apr 2026 09:43:45 -0300

dotnet10 (10.0.106-10.0.6-0ubuntu1~24.04.1) noble-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-33116: Possible denial of service via infinite recursion in
      XmlDecryptionTransform.
  * SECURITY UPDATE: denial of service
    - CVE-2026-32203: Possible denial of service via stack overflow in
      EncryptedKey nested decryption.
  * SECURITY UPDATE: remote code execution
    - CVE-2026-32178: SMTP command injection and header injection via
      MailAddress parsing flaw in System.Net.Mail.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-26171: denial of service and security feature bypass via unsafe
      transforms in EncryptedXml.

 -- Ian Constantin <ian.constantin@canonical.com>  Tue, 14 Apr 2026 19:43:50 +0000

dotnet10 (10.0.105-10.0.5-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream release. (LP: #2144328)

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Thu, 12 Mar 2026 17:11:45 -0300

dotnet10 (10.0.104-10.0.4-0ubuntu1~24.04.1) noble-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-26130: Possible denial-of-service via SignalR stateful
      reconnect buffer overfill.
  * SECURITY UPDATE: denial of service
    - CVE-2026-26127: System.Buffers.Text.Base64Url.DecodeFromChars
      out-of-bounds read from malformed Base64Url input. A bug in the
      implementation causes out-of-bound reads of the DecodingMap, potentially
      leading to Access Violation Exceptions (AVEs) when unsafe code is used.

 -- Ian Constantin <ian.constantin@canonical.com>  Sun, 08 Mar 2026 21:33:40 +0200

dotnet10 (10.0.103-10.0.3-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream release
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-21218: An attacker could exploit this vulnerability in
      System.Security.Cryptography.Cose by crafting a malicious payload that
      bypasses the security checks in the affected .NET versions, potentially
      leading to unauthorized access or data manipulation.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Mon, 02 Feb 2026 17:30:30 -0300

dotnet10 (10.0.102-10.0.2-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream release (LP: #2138378)
  * d/p/0007-fix-identitymodel-version.patch: dropped patch included upstream.
  * d/copyright: fix missing newline between entries.
  * d/rules: remove temporary --branding parameter in build script call.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Mon, 26 Jan 2026 10:27:55 -0300

dotnet10 (10.0.101-10.0.1-0ubuntu1~24.04.2) noble; urgency=medium

  * Resolve package build failures (LP: #2134505):
    - d/p/0007-fix-identitymodel-version.patch: fix FTBFS caused by date-based
      version string calculation in the Microsoft.IdentityModel.Abstractions
      package.
    - d/t/regular-tests/cgroup-limit/test.sh: fix autopkgtest regression in
      Ubuntu releases with rust-coreutils by comparing the cgroup filesystem ID
      instead of friendly name.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Fri, 16 Jan 2026 11:17:22 -0300

dotnet10 (10.0.101-10.0.1-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream release. (LP: #2134505)
  * d/p/0007-fix-tempdir-on-exit-trap.patch: dropped patch included upstream.
  * Clean up source tree and sync tests with upstream.
    - d/t/regular-tests: synced with upstream.
      + Removed release-version-sane test following upstream.
      + Removed unnecessary files from source tree.
      + Normalized newline characters to Unix.
    - d/t/run-regular-tests: fixed test username typo.
    - d/eng/test-runner: removed unnecessary files from source tree.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 09 Dec 2025 18:28:55 -0300

dotnet10 (10.0.100-10.0.0-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream release (LP: #2130891)
  * d/{sdk-check-config.json,rules}: `dotnet sdk check` tool points to
    Canonical's release database.
  * d/rules: add `--branding rtm` to DOTNET_BUILD_ARGS.
  * d/p/0007-fix-tempdir-on-exit-trap.patch: fix unbound variable error.
  * d/dotnet-host-10.0.links: fixed dnx link name to /usr/bin/dnx (DNX_BIN).
  * d/t/regular-tests: synced with upstream to fix failing tests and add new
    ones for .NET 10.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Fri, 07 Nov 2025 16:11:30 +0100

dotnet10 (10.0.100-10.0.0~rc2-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2025-55247: A vulnerability exists in .NET Core where predictable
      paths for MSBuild's temporary directories on Linux let another user
      create the directories ahead of MSBuild, leading to DoS of builds.
  * SECURITY UPDATE: validation bypass
    - CVE-2025-55315: Inconsistent interpretation of http requests
      ('http request/response smuggling') in ASP.NET Core allows an authorized
      attacker to bypass a security feature over a network.
  * SECURITY UPDATE: information disclosure
    - CVE-2025-55248: MITM (man in the middle) attacker may prevent use of TLS
      between client and SMTP server, forcing client to send data over
      unencrypted connection.
  * debian/copyright: add copyright information
  * source/lintian-overrides: update lintian-overrides for source package
  * eng/test-runner: sync changes with upstream
  * tests/control, tests/regular-tests: sync changes with upstream
  * debian/rules: remove temporary .NET 10 RC 1 fixups

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 08 Oct 2025 13:50:38 +0300

dotnet10 (10.0.100-10.0.0~rc1-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release
  * d/control, d/rules: remove package netstandard-targeting-pack-2.1-10.0:
    Upstream removed this package, see: https://github.com/dotnet/sdk/pull/50354.

    IMPORTANT: If you had previous preview version of the `dotnet10` package
    installed and have installed one of the following packages: `dotnet9`,
    `dotnet8`, `dotnet7` or `dotnet6`, we recommend to reinstall these packages.
    Otherwise the .NET standard 2.1 targeting pack package will not receive any
    updates.

  * d/p/0002-roslyn-analyzers-dont-use-apphost.patch: roslyn-analyzers don't get
    built anymore, see: https://github.com/dotnet/dotnet/pull/1979
  * d/rules: add `--branding default` to DOTNET_BUILD_ARGS, see also:
    https://github.com/dotnet/source-build/issues/5337
  * d/rules: remove uninstalled netstandard-targeting-pack-2.1-10.0 files

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 10 Sep 2025 11:26:09 +0300

dotnet10 (10.0.100-10.0.0~preview7-0ubuntu1~24.04.1~ppa3) noble; urgency=medium

  * d/dotnet-sdk-aot-10.0.install: update installation layout
    (see also: https://github.com/dotnet/docs/pull/46910)
  * d/dotnet-host-10.0.install, d/dotnet-host-10.0.links: add dnx tool
    (see also: https://github.com/dotnet/docs/pull/47094)

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Thu, 14 Aug 2025 00:41:10 +0300

dotnet10 (10.0.100-10.0.0~preview7-0ubuntu1~24.04.1~ppa2) noble; urgency=medium

  * d/dotnet-sdk-10.0.install: remove sdk-manifest for microsoft.net.sdk.aspire
    (see: https://github.com/dotnet/source-build/issues/4735)

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 13 Aug 2025 21:42:00 +0300

dotnet10 (10.0.100-10.0.0~preview7-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release.

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 13 Aug 2025 18:04:04 +0300

dotnet10 (10.0.100-10.0.0~preview6-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Mon, 21 Jul 2025 15:04:08 -0300

dotnet10 (10.0.100-10.0.0~preview5-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release.

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Sat, 14 Jun 2025 12:51:42 +0300

dotnet10 (10.0.100-10.0.0~preview4-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release.

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Thu, 29 May 2025 12:45:19 +0300

dotnet10 (10.0.100-10.0.0~preview3-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * New upstream release.

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Fri, 11 Apr 2025 15:29:13 +0300

dotnet10 (10.0.100-10.0.0~preview2-0ubuntu1~24.04.1~ppa1) noble; urgency=medium

  * Initial packaging.

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 09 Apr 2025 17:27:07 +0300
