[Bug 2152598] Re: New upstream microrelease .NET 10.0.108/10.0.8

[Launchpad Bug Tracker]

This bug was fixed in the package dotnet10 -
10.0.108-10.0.8-0ubuntu1~24.04.1

---------------
dotnet10 (10.0.108-10.0.8-0ubuntu1~24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - CVE-2026-42899: Loop with unreachable exit condition ('infinite loop')
      in ASP.NET Core allows an unauthorized attacker to deny service over a
      network.

  [ Mateus Rodrigues de Morais ]
  * New upstream release (LP: #2152598)
  * d/t/regular-tests/check-test-results: match to any NU1102 error
    occurrences when ignoring package not found restore errors.
  * d/t/regular-tests/template-test/test.json: increment timeout multiplier to
    avoid timeout errors when running on the autopkgtest cloud.
  * d/t/regular-tests/tools-in-path/test.json: skip test when running on the
    toolchains-ci CI pipeline.
  * d/t/run-regular-tests: define environment variable to selectively add the
    'toolchains-ci' trait to the test runner.

 -- Ian Constantin <ian.constantin at canonical.com>  Fri, 22 May 2026
17:45:46 +0300

** Changed in: dotnet10 (Ubuntu Questing)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to dotnet10 in Ubuntu.
https://bugs.launchpad.net/bugs/2152598

Title:
  New upstream microrelease .NET 10.0.108/10.0.8

Status in dotnet10 package in Ubuntu:
  New
Status in dotnet10 source package in Noble:
  Fix Released
Status in dotnet10 source package in Questing:
  Fix Released
Status in dotnet10 source package in Resolute:
  Fix Released
Status in dotnet10 source package in Stonking:
  New

Bug description:
  This is the tracking bug for the .NET 10 May 2026 servicing release.

  [Impact]

   * This corresponds to an upstream microrelease released on May 12th, 2026. See also:
     - release announcement: https://github.com/dotnet/source-build/discussions/5559
     - .NET 10.0.8 Runtime release notes: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.8/10.0.8.md
     - .NET 10.0.108 SDK release notes: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.8/10.0.108.md

   * It is beneficial for all our users (including LTS users) to have
  access to the latest .NET stack.

  [Test Case]

   * The package should build successfully in -proposed (respectively).

   * The packages should be installable on noble and questing on
     amd64, arm64, s390x and ppc64el architectures.

   * Autopackage tests should pass.

  [Regression Potential]

   * The dotnet10 package has no reverse dependencies.

   * The upstream testing routine is usually satisfactory (see for
  example Microsoft's public Azure Pipeline for .NET related
  repositories: https://dev.azure.com/dnceng-public/public/_build), but
  there is always a risk of something breaking.

  [Other]

  * The tarball originated from here:
  https://github.com/canonical/dotnet-source-
  build/actions/runs/25848233684

  * 10.0.8 is the version number of the .NET Runtime and 10.0.108 is the version
    number of the .NET SDK.

  * We are only building the 10.0.1xx feature band, because this is the only
    feature band that allows building from source. See explanation of feature
    bands: https://learn.microsoft.com/en-us/dotnet/core/releases-and-support#feature-bands-sdk-only

  * Overview of how dotnet is versioned: https://learn.microsoft.com/en-
  us/dotnet/core/versions/

  * PPA for review: https://launchpad.net/~mateus-
  morais/+archive/ubuntu/dotnet-servicing-may-2026/+packages

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dotnet10/+bug/2152598/+subscriptions