[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Microsoft.NET.Test.Sdk	18.11.0 → 18.12.0

---

Release Notes

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.12.0

Security fix

This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: #​16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See #​16652

What's Changed

• Fix TestCaseStart/Stop events dropped for data-driven tests with shared TestCase.Id by @​nohwnd in #​16033
• Stop the discovery manager factory from shadowing discoveryCriteria by @​nohwnd in #​16391
• Gate the HTTP link checker on a fingerprint of the broken links by @​nohwnd in #​16413
• Quote boolean conditions in shipped Microsoft.TestPlatform.targets by @​nohwnd in #​16404
• Obsolete API hygiene: the compatibility-safe changes by @​azat-msft in #​16420
• Add xxHash128 test ids, available but not default by @​azat-msft in #​16378
• Isolate attachment manager test temporary files by @​mmitche in #​16463
• Test ids report logger by @​azat-msft in #​16443
• Isolate code coverage files in published output by @​azat-msft in #​16483
• Preserve OutputType for Android test projects by @​jonathanpeppers in #​16496
• Fix dotnet host resolution under proot (ARM64/Termux) by @​azat-msft in #​16462
• Mark the xxHash128 test id API as experimental by @​azat-msft in #​16465
• Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @​nohwnd in #​16633
• Fix localized resource paths in CLI source-build/non-Windows packages by @​nohwnd in #​16644

Full Changelog: microsoft/vstest@v18.11.0...v18.12.0

v18.11.1

Security fix

This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.

Affected: Microsoft.TestPlatform.CLI 18.11.0.
Fixed in: Microsoft.TestPlatform.CLI 18.11.1.

Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.

The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.

Details: #​16654 and dotnet/announcements#517

Using custom Docker images or Nano Server? See #​16652

What's Changed

• Security fix for CVE-2026-105544, see #​16654
• Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @​nohwnd in #​16632
• Fix localized resource paths in CLI source-build packages by @​nohwnd in #​16643

Full Changelog: microsoft/vstest@v18.11.0...v18.11.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (10717d8) to head (7143a9e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #644   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           22        22           
  Lines          261       261           
  Branches        38        38           
=========================================
  Hits           261       261           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[samtrion]

Automated approval by NetEvolve.Socks (v1.0.0.0)