.NET patches missing in the image

[angaaruriakhil]

Hi,

Thanks for the work on these images. We use the code in this repository monthly to build images for use with VMSS. I'd like to get some clarity on the .NET patches installed on the Windows images.

From the readme, it says, for .NET Core: “2 latest LTS versions and 1 latest version. For each feature version only latest patch is installed”.

Our Qualys scans are flagging up that the following patches are missing:

• Microsoft .NET Core Security Update for January 2024
• Microsoft .NET Security Update for September 2022
• Microsoft .NET Core and ASP.NET Core Security Update for November 2023
• Microsoft .NET Core and ASP.NET Core Security Update for February 2024
• Microsoft .NET Security Update for July 2023
• Microsoft .NET Security Update for June 2023
• Microsoft .NET Security Update for April 2023
• Microsoft .NET Security Update for February 2023
• Microsoft .NET Security Update for December 2022
• Microsoft .NET (NuGet Client) Security Update for October 2022
• Microsoft .NET Framework Update for April 2024
• Microsoft .NET Security Update for April 2024
• Microsoft .NET Security Update for March 2024
• Microsoft .NET Security Update for October 2023
• Microsoft .NET Security Update for September 2023
• Microsoft .NET Security Update for August 2023
• Microsoft .NET Security Update for January 2023
• Microsoft .NET Security Update for August 2022
• Microsoft .NET Security Update for June 2022

From the code, it appears that the latest patches should be getting installed which should cover these, particularly this should be covered in the Install-WindowsUpdate.ps1 script.

Are there any plans to include these patches that are missing in the image? Thanks.

Originally posted by @angaaruriakhil in https://github.com/actions/runner-images/discussions/10087