Repository navigation
fix(http-client-csharp): patch playground container Brotli - #12440
Merged
JoshLove-msft merged 3 commits intoOct 29, 2026
Merged
JoshLove-msft merged 3 commits into
JoshLove-msft merged 3 commits into
Conversation
Upgrade the Ubuntu SDK base's libbrotli1 in both build and runtime stages and require the fixed package version. Co-authored-by: Copilot App <[email protected]>
JoshLove-msft
requested review from
Alan Zimmer (alzimmermsft),
Jorge Rangel (jorgerangel-msft),
Jose Arriaga Maldonado (joseharriaga) and
m-nash
as code owners
October 29, 2026 18:22
microsoft-github-policy-service
Bot
added
emitter:client:csharp
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The container-hardening change has no active review issues.
No open issues 🎉
What changed in this PR
Hardens the C# playground server container by upgrading Brotli in a shared SDK base used by both build and runtime stages.
Changes:
- Selects the explicit Ubuntu Noble .NET 10 SDK image.
- Upgrades
libbrotli1and fails the build unless its version is at least1.1.0-2ubuntu0.1. - Retains the full SDK required to run the generator.
| File | Description |
|---|---|
packages/http-client-csharp/playground-server/Dockerfile |
Adds a shared Noble SDK base with a Brotli upgrade and minimum-version assertion. |
Review effort: Balanced
commit: |
Contributor
|
No changes needing a change description found. |
Keep the Brotli package upgrade without a hard-coded minimum version check. Co-authored-by: Copilot App <[email protected]>
Jorge Rangel (jorgerangel-msft)
approved these changes
Oct 29, 2026
Apply Prettier shell indentation and allow the Brotli package name in spell check. Co-authored-by: Copilot App <[email protected]>
Jorge Rangel (jorgerangel-msft)
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
apt-get updateand upgrade Ubuntu'slibbrotli1in a shared build/runtime base, without a hard-coded package-version assertion.Mitigation performed
Rebuilt with
--pull --no-cacheusing ACR Tasks runcfpy, verifiedlibbrotli1is1.1.0-2ubuntu0.1(the Defender-reported fix for CVE-2026-111497), and pushedtypespecacr.azurecr.io/csharp-playground-server:brotli-patch-20261029.The only consumer found across accessible Azure resources was App Service
csharp-playground-serverin resource grouptypespec; it has no deployment slots. It was redeployed with an immutable digest reference:7016045(correlated with platform startup logs)sha256:963528d8bd5ed90111769f609cc40f359571bcaca142c8f4f91d20e20406bec3sha256:e201597194a5eff3cec753c39f1dfe66396b7e945dece2aeeb5a64108cdcbfa2Base image:
mcr.microsoft.com/dotnet/sdk:10.0-noble@sha256:de4fe90a98845d75910b9769662465c84de1a934665c431279d1382b2bddc02b.The subsequent removal of the hard-coded version assertion is source-only; no additional production rebuild or deployment was performed.
Verification and caveats
2026-10-29T18:21:37Z;/healthreturnsstatus: okandgeneratorFound: true./generaterequest returns the sameModelReaderWriterContextDefinitioninitialization error before and after the patch. This pre-existing functional failure is not fixed here; health endpoint success does not establish successful generation.