GeezerVison

Merged PR 67325: [release/9.0] Update Brotli to 1.1.1

#### AI description  (iteration 1)
#### PR Classification
Dependency update addressing a security vulnerability (CVE-2026-111497) in the Brotli library.

#### PR Summary
Updates the vendored Brotli library from version 1.1.0 to 1.1.1 to fix a security vulnerability allowing out-of-bounds write/remote code execution, along with associated decoder error-handling improvements.
- `dec/decode.c`: Refactored block-type switch functions to return `BrotliDecoderErrorCode` instead of `BROTLI_BOOL`, adding a new `BROTLI_SAFE_WITH_STATUS` macro for improved error propagation and a new bounds check for `meta_block_remaining_len`.
- `include/brotli/decode.h`: Added new `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` error code (previously reserved value -17).
- `common/version.h` and `brotli-version.txt`: Bumped version to 1.1.1 and ABI revision.
- `cgmanifest.json`: Updated commit hash reference to the new Brotli version.
- Added `CHANGELOG.md` and `.bazelignore` files to the vendored Brotli source.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

Merged PR 67358: [9.0-hotfix] Update Brotli to 1.1.1

#### AI description  (iteration 1)
#### PR Classification
Security fix: upgrades the vendored Brotli library to 1.1.1 to address CVE-2026-111497, an out-of-bounds write vulnerability that could permit remote code execution.

#### PR Summary
This PR updates the bundled Brotli dependency from 1.1.0 to 1.1.1, incorporating a decoder fix for a security vulnerability along with improved error handling in block type/length decoding.
- `dec/decode.c`: Refactors block switch decoding functions to return `BrotliDecoderErrorCode` instead of `BROTLI_BOOL`, enabling more precise error propagation (e.g., distinguishing `NEEDS_MORE_INPUT` from format errors), and adds a new `BROTLI_SAFE_WITH_STATUS` macro.
- `include/brotli/decode.h`: Adds new error code `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (previously reserved as -17).
- `common/version.h` and `brotli-version.txt`: Bump version to 1.1.1 and ABI revision to 1.
- `cgmanifest.json`: Updates commit hash reference to match the new Brotli version.
- Adds `CHANGELOG.md` and `.bazelignore` as new files from the upstream Brotli repository.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

Merged PR 67306: [release/8.0] Update Brotli to 1.0.10

Update Brotli to 1.0.10

----
#### AI description  (iteration 1)
#### PR Classification
Dependency update that vendors a new upstream version of the Brotli library, including bug fixes in the decoder's error handling.

#### PR Summary
This PR updates the vendored Brotli library from version 1.0.9 to 1.0.10, incorporating upstream fixes for block-switch decoding error handling.
- `decode.c`: Refactored block-switch decoding functions (`DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch`, `DecodeDistanceBlockSwitch`, `DecodeBlockTypeAndLength`) to return `BrotliDecoderErrorCode` instead of `BROTLI_BOOL`, enabling more granular error reporting (e.g., distinguishing "needs more input" from format errors); added `BROTLI_SAFE_WITH_STATUS` macro to propagate these statuses.
- `decode.h`: Added new error code `BROTLI_ERROR_FORMAT_BLOCK_SWITCH` (-17) for block switch failures.
- `version.h` and `brotli-version.txt`: Bumped version to 1.0.10 and updated ABI version.
- `cgmanifest.json`: Updated the tracked commit hash for the vendored Brotli source.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

Merged PR 67357: [8.0-hotfix] Update Brotli to 1.0.10

#### AI description  (iteration 1)
#### PR Classification
Dependency update/bug fix: upgrades the vendored Brotli library to version 1.0.10 to incorporate upstream decoder fixes.

#### PR Summary
This PR updates the bundled Brotli native dependency from 1.0.9 to 1.0.10, primarily fixing decoder error handling for block switch operations.
- `dec/decode.c`: Refactored block switch decoding functions (`DecodeLiteralBlockSwitch`, `DecodeCommandBlockSwitch`, `DecodeDistanceBlockSwitch`, and `DecodeBlockTypeAndLength`) to return `BrotliDecoderErrorCode` instead of `BROTLI_BOOL`, adding a new `BROTLI_SAFE_WITH_STATUS` macro for improved error propagation.
- `include/brotli/decode.h`: Added new error code `BLOCK_SWITCH` (-17) to the error code enumeration.
- `common/version.h`: Bumped `BROTLI_VERSION` and `BROTLI_ABI_VERSION` to reflect the 1.0.10 release.
- `cgmanifest.json` and `brotli-version.txt`: Updated commit hash and version metadata to 1.0.10.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

[release/11.0] Update dependencies from dotnet/icu (#136067)

This pull request updates the following dependencies

[marker]: <> (Begin:6a84f872-3d62-42ab-b609-66bc4451b876)
## From https://github.com/dotnet/icu
- **Subscription**:
[6a84f872-3d62-42ab-b609-66bc4451b876](https://maestro.dot.net/subscriptions?search=6a84f872-3d62-42ab-b609-66bc4451b876)
- **Build**:
[20261017.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=3108123)
([337031](https://maestro.dot.net/channel/8297/github:dotnet:icu/build/337031))
- **Date Produced**: October 17, 2026 12:14:26 PM UTC
- **Commit**:
[cc0636e50d30b71ebf043284bb66cc77a4289446](dotnet/icu@cc0636e)
- **Branch**:
[dotnet/release/11.0](https://github.com/dotnet/icu/tree/dotnet/release/11.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [11.0.0-alpha.1.26505.3 to 11.0.0-alpha.1.26517.3][1]
     - Microsoft.NETCore.Runtime.ICU.Transport

[1]: dotnet/icu@bbfd532...cc0636e

[DependencyUpdate]: <> (End)


[marker]: <> (End:6a84f872-3d62-42ab-b609-66bc4451b876)

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

[release/10.0] Fix MemoryCache negative _cacheSize drift that permane…

…ntly latches a size-limited cache (#129510)

Backport of #129215 to release/10.0

/cc @cincuranet @sablancoleis

## Customer Impact

Customer reported - description from @sablancoleis who reported it:
> It's severe, and it's a direct customer impact for us. We don't use
this cache as a perf/load optimization, we use it to drive the
replication logic between two systems. And because the failure is silent
and permanent, every Set is dropped with no exception or log, and it
never self-recovers, the cache stays dead until we restart the node. We
only even caught it after adding the cache-size telemetry. It happens
consistently, across most of our clusters globally. It's not a rare race
needing a perfect storm, under normal concurrent load with SizeLimit
set, clusters drift into the negative state and stay there. The
CentralIndia example is typical: every backend went negative and stayed
negative until we restarted.

## Regression

From #103931 in .NET 9

## Testing

Tests added.

## Risk

Medium. Concurrency-sensitive accounting code. Stress test added.

---------

Co-authored-by: Santiago Blanco <[email protected]>
Co-authored-by: Jiri Cincura ↹ <[email protected]>

Merged PR 66111: Update MsQuic to 2.5.11-ci-159417053

Update MsQuic to 2.5.11-ci-159417053

----
#### AI description  (iteration 1)
#### PR Classification
Dependency version update.

#### PR Summary
Updates the MsQuic package version to a newer CI build.
- `eng/Versions.props`: bumped `MicrosoftNativeQuicMsQuicSchannelVersion` from `2.5.11-ci.156755675` to `2.5.11-ci.159417053`.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

Merged PR 66114: Update MsQuic to 2.5.11-ci-159417053

Update MsQuic to 2.5.11-ci-159417053

----
#### AI description  (iteration 1)
#### PR Classification
Dependency update to bump the MsQuic package version.

#### PR Summary
Updates the pinned MsQuic dependency version to a newer CI build.
- `eng/Versions.props`: Bumped `MicrosoftNativeQuicMsQuicSchannelVersion` from `2.5.11-ci.156755675` to `2.5.11-ci.159417053`.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

[release/11.0-rc2] Managed HPKE (#134443)

cherry-pick of 2023ab7 (#133804)

## Customer Impact

- [ ] Customer reported
- [X] Found internally

New API for .NET 11 to support using HPKE as part of the PQC transition
effort.

## Regression

- [ ] Yes
- [X] No

## Testing

This standalone feature is extensively tested in this PR.

## Risk

Low. The feature is entirely isolated, only consumers of these new
`[Experimental]` types are affected.

This change contains the full API set for the feature, but does not
represent full functionality (e.g. Win32 interop instead of the managed
implementation on Windows), which can be added in servicing.

[release/11.0-rc2] Managed HPKE (#134443)

cherry-pick of 2023ab7 (#133804)

## Customer Impact

- [ ] Customer reported
- [X] Found internally

New API for .NET 11 to support using HPKE as part of the PQC transition
effort.

## Regression

- [ ] Yes
- [X] No

## Testing

This standalone feature is extensively tested in this PR.

## Risk

Low. The feature is entirely isolated, only consumers of these new
`[Experimental]` types are affected.

This change contains the full API set for the feature, but does not
represent full functionality (e.g. Win32 interop instead of the managed
implementation on Windows), which can be added in servicing.