PR Summary

Use new .Net Core servicing build 2.0.5.
https://github.com/dotnet/cli/releases
https://blogs.msdn.microsoft.com/dotnet/2018/01/09/net-core-january-2018-update/

PR Checklist

Note: Please mark anything not applicable to this PR NA.

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• [NA] User facing Documentation needed
  • [NA] Issue filed - Issue link:
• [NA] Change is not breaking
• [NA] Make sure you've added a new test if existing tests do not effectively test the code changed
  • Add [feature] if the change is significant or affects feature tests
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: to the beginning of the title and remove the prefix when the PR is ready.

Pleas push a commit with [Feature] in the commit message.

Do we need to mention the 2 important security fixes that come with 2.0.5 in the documents?

• dotnet/announcements#52
• dotnet/announcements#51

Can someone review their severity/impact and decide whether this also means that 6.0 needs to have a patch with this update? @LeeHolmes

Should we also update the SDK in the global.json from 2.0.2 to 2.0.3, which is already in the used AppVeyor image VisualStudio2017?

I think could we move to latest SDK (2.1.4) after GA 6.0.1 to get up to date the 6.0.0 servicing branch.

Interesting, will we be able to move to CoreFX 2.1.0 preview version in our development branch - this version already contains many performance improvements and we could use new C# 7.2.

@LeeHolmes @PaulHigin @SteveL-MSFT can you please take a look at the comment #5903 (comment) and see if there's any implication on PS Core 6.0.0?

We should take dotnetcore 2.0.5 as part of 6.0.1 release

@SteveL-MSFT OK. On a related note: The WiX toolset also had a security patch 2 weeks ago: https://www.firegiant.com/blog/2017/12/31/wix-v3.10.4-and-wix-v3.11.1-released/

It seems we use WiX from AppVeyor base image - so the issue is for AppVeyor.

Yes, but I guess that MSFT uses their own servers for building the GA release. This was a remark about the upcoming patch release.

@iSazonov @SteveL-MSFT I am confused, the global.json still refers to 2.0.2 and the documentation on it here says that this is the SDK (not the runtime version). This SDK version contains the old 2.0.0. version of the .Net Runtime, see docs here
Do we not need to update the string to 2.1.4, which is the SDK containing the 2.0.5 runtime, see docs here?