Migrate PerfView to .NET 10 and remediate CVE-2026-62900

[Brian Robbins (brianrob)]

Summary

• pin the repository and public build pipelines to .NET SDK 10.0.401
• upgrade Microsoft.SourceLink.GitHub to 10.0.401, removing the vulnerable Microsoft.Build.Tasks.Git 8.0.0 dependency
• upgrade System.IO.Hashing to 10.0.12 and embed the updated binary in PerfView
• retarget all public net8.0 and net8.0-windows projects to .NET 10

Internal dependency

Azure DevOps PR 781163 has merged, preparing the internal mirror by updating its private pipelines, projects, and fuzz targets to .NET 10.0.401.

Validation

• full Debug and Release solution builds with Visual Studio 2026 and exact .NET SDK 10.0.401
• all test projects passed; PerfView.Tests passed 194/194 with the CI VSTest host
• PerfViewCollect Release publish succeeded for net10.0-windows
• Release PDBs contain the expected raw.githubusercontent.com/microsoft/perfview Source Link mapping
• embedded and extracted System.IO.Hashing.dll is version 10.0.0.12 and byte-identical to package version 10.0.12
• restored assets contain Microsoft.Build.Tasks.Git 10.0.401 and no vulnerable 8.0.0 or interim 10.0.303 Source Link packages

Component Governance clearance is expected after merge and the next mirror ingestion scan.