[main] Update dependencies from dotnet/arcade, dotnet/arcade-services, dotnet/dnceng

[dotnet-maestro]

This pull request updates the following dependencies

From https://github.com/dotnet/arcade

• Subscription: e1494738-68cf-4cfe-3661-08d8e287a9c2
• Build: 20260511.2 (313781)
• Date Produced: May 11, 2026 12:26:23 PM UTC
• Commit: 0fa6fd65a34f5c719499d98c735b23c92b64603d
• Branch: main

• Dependency Updates:
  • From 11.0.0-beta.26230.2 to 11.0.0-beta.26261.2
    • Microsoft.DotNet.Arcade.Sdk
    • Microsoft.DotNet.Helix.Sdk

From https://github.com/dotnet/dnceng

• Subscription: 2dcf631d-13b8-4cac-ab86-08dcc13e8b5d
• Build: 20260511.2 (313817)
• Date Produced: May 11, 2026 4:26:01 PM UTC
• Commit: fe34a4c64727a272e58670947430c1f38546cd34
• Branch: main

• Dependency Updates:
  • From 1.1.0-beta.26223.1 to 1.1.0-beta.26261.2
    • Microsoft.DncEng.SecretManager

[mmitche]

Waiting on new update to move arcade-services back to 7.0.3

[ViktorHofer]

@premun @dkurepa how do we get a new arcade-services version flowing here? I triggered the subscription but nothing happened. Not sure who promotes to the prod channel.

[premun]

@ViktorHofer only when roll out Maestro we promote a build. We could flow from - Int where we have our main.

[ViktorHofer]

Was just curious :)

[premun]

@ViktorHofer not sure how to handle the dependency on arcade-services. In there, we bump to latest GAed 10.0 packages to clear CG - such as 10.0.6 of extension libraries while Arcade is only on 10.0.3.
Maybe we should get rid of the dependency completely.

[akoeplinger]

Maybe we should get rid of the dependency completely.

YESSS

[ViktorHofer]

I think it makes sense to update dependencies automatically via dependabot. It looks like arcade-services is configured correctly to receive updates but arcade isn't. It would be good to fix that. Source-build won't be impacted by most of these changes as it a) overrides the version and b) only depends on a very small subset of external dependencies.

Now that we don't target .NET Framework in msbuild tasks anymore and don't need to constraint ourselves on the host environment (i.e. binding redirects), dependency updates should be able to happen freely.

Overall, I don't see a problem with the arcade-services dependency here or in the VMR.

[mmitche]

I think it makes sense to update dependencies automatically via dependabot. It looks like arcade-services is configured correctly to receive updates but arcade isn't. It would be good to fix that. Source-build won't be impacted by most of these changes as it a) overrides the version and b) only depends on a very small subset of external dependencies.

Now that we don't target .NET Framework in msbuild tasks anymore and don't need to constraint ourselves on the host environment (i.e. binding redirects), dependency updates should be able to happen freely.

Overall, I don't see a problem with the arcade-services dependency here or in the VMR.

Source-build might be affected. It does override versions, but not in all cases. For reference packages, SBRP produces a specific set of versions of each package, and uses of the ref packages are NOT overridden downstream. So, we do need to be careful about upgrading with abandon.

[ViktorHofer]

NuGet dependencies recently got added to use PSB in Arcade. Looking at Versions.props, I don't see anything remaining that would fall into the "can't update in Arcade but in arcade-services" bucket. Sure, things like Newtonsoft.Json that come via SBE need some manual work to update but that happens very infrequently.