Issues

• Port authorizedHosts (self-hosted VCS attestation) to C# VcpPortableRoot

  microsoft/sarif-sdk#3131 · Filter by author aasim opened on Jul 7, 2026

• Adopt Microsoft.Json.* 2.3.0 and add missing UriConverter attributes to Uri properties

  microsoft/sarif-sdk#3121 · Filter by author michaelcfanning opened on Jul 1, 2026

• Intermittent test failure in Test.UnitTests.Sarif.Multitool.Library under full-suite runs

  microsoft/sarif-sdk#3092 · Filter by author michaelcfanning opened on Jun 23, 2026

• TS get-schema emit-finalize throws despite bundled ai-log.schema.json (.NET serves it) — incomplete TS port of #2970/#3077 in 5.3.0

  bugjavascript
  microsoft/sarif-sdk#3083 · Filter by author michaelcfanning opened on Jun 22, 2026

• publish-to-ghas skill: document that a gh CLI OAuth token (repo scope) works without a PAT (PAT-restricted orgs)

  microsoft/sarif-sdk#3081 · Filter by author michaelcfanning opened on Jun 21, 2026

• CweTaxonomyEnricher: CWE descriptors get a one-sentence fullDescription (MITRE short Description), no markdown, and often no shortDescription

  microsoft/sarif-sdk#3078 · Filter by author michaelcfanning opened on Jun 21, 2026

• emit-finalize: deprecated CWEs in CweSecuritySeverity produce nameless rule descriptors that fail the SDK's own GHAzDO2012

  microsoft/sarif-sdk#3075 · Filter by author michaelcfanning opened on Jun 21, 2026

• publish-to-ghazdo/ghas skills: add post-publish verification + wrong-tenant (302) edge case

  microsoft/sarif-sdk#3074 · Filter by author michaelcfanning opened on Jun 21, 2026

• emit-sarif: document the TF_BUILD -> GHAZDO publishability coupling (local runs cannot be published)

  microsoft/sarif-sdk#3064 · Filter by author michaelcfanning opened on Jun 19, 2026

• emit-sarif: skill validates Sarif;AI only; GHAzDO ingestion checks (GHAzDO1014/1019/1020) are documented only in publish-to-ghazdo

  microsoft/sarif-sdk#3063 · Filter by author michaelcfanning opened on Jun 19, 2026

• emit-sarif: document that emit-finalize strips the AI1012-mandated ruleId sub-id (and relocates it nowhere)

  microsoft/sarif-sdk#3061 · Filter by author michaelcfanning opened on Jun 19, 2026
  1

• v6.0.0 tracking: drop SARIF v1 + nullable enums + Newtonsoft->STJ (one coordinated break)

  microsoft/sarif-sdk#3043 · Filter by author michaelcfanning opened on Jun 18, 2026 · v6.0.0
  1

• Migrate JSON serialization Newtonsoft.Json -> System.Text.Json (source-gen) to unblock NativeAOT

  microsoft/sarif-sdk#3038 · Filter by author michaelcfanning opened on Jun 17, 2026 · v6.0.0
  1

• Re-evaluate PublishTrimmed on net8.0 for the multitool npm binaries (2020 evidence is stale)

  microsoft/sarif-sdk#3030 · Filter by author michaelcfanning opened on Jun 17, 2026

• Tracking: robust, thread-safe target identification & file enumeration for the core SDK

  microsoft/sarif-sdk#3019 · Filter by author michaelcfanning opened on Jun 14, 2026

• Fast-follow: broaden VCP-driven emit-finalize rebasing (receipt-time validation, non-github hosts, multi-repo/submodule fixtures)

  microsoft/sarif-sdk#2972 · Filter by author michaelcfanning opened on Jun 5, 2026

• Author finalized whole-log AI SARIF schema (ai-log.schema.json) and serve via get-schema emit-finalize

  enhancement
  microsoft/sarif-sdk#2970 · Filter by author michaelcfanning opened on Jun 4, 2026

• Proposal: canonical AI notification descriptor taxonomy in docs/ai/

  microsoft/sarif-sdk#2952 · Filter by author michaelcfanning opened on May 27, 2026
  1

• Adopt ILogger<T> DI + LoggerMessage source generator for multitool verbs

  enhancement
  microsoft/sarif-sdk#2920 · Filter by author michaelcfanning opened on May 22, 2026

• Enable Nullable reference types repo-wide

  enhancement
  microsoft/sarif-sdk#2919 · Filter by author michaelcfanning opened on May 22, 2026

• Migrate SDK from Newtonsoft.Json to System.Text.Json

  enhancement
  microsoft/sarif-sdk#2917 · Filter by author michaelcfanning opened on May 22, 2026

• SDK serializes index: -1 by default, then SDK validator flags it as a dangling reference

  microsoft/sarif-sdk#2910 · Filter by author jmprieur opened on May 19, 2026
  1

• [RULE REQUEST] Validate versionControlProvenance (repositoryUri, revisionId, branch)

  microsoft/sarif-sdk#2882 · Filter by author jsoref opened on Dec 10, 2025

• Expose underlying Run property in SarifLogger or otherwise improve its extensibility.

  microsoft/sarif-sdk#2870 · Filter by author michaelcfanning opened on Sep 10, 2025

• Minor issues with: sarif-sdk/docs /multitool-usage.md file

  microsoft/sarif-sdk#2850 · Filter by author davewichers opened on Jan 20, 2025