Update PowerShell to build with .NET Core 2.0.5 - #5903

Pleas push a commit with [Feature] in the commit message.

Do we need to mention the 2 important security fixes that come with 2.0.5 in the documents?

• Microsoft Security Advisory CVE-2018-0764: Denial of Service when parsing XML documents dotnet/announcements#52
• Microsoft Security Advisory CVE-2018-0786: Security Feature Bypass in X509 Certificate Validation dotnet/announcements#51

Can someone review their severity/impact and decide whether this also means that 6.0 needs to have a patch with this update? Lee Holmes (@LeeHolmes)

Should we also update the SDK in the global.json from 2.0.2 to 2.0.3, which is already in the used AppVeyor image VisualStudio2017?

I think could we move to latest SDK (2.1.4) after GA 6.0.1 to get up to date the 6.0.0 servicing branch.

Interesting, will we be able to move to CoreFX 2.1.0 preview version in our development branch - this version already contains many performance improvements and we could use new C# 7.2.

Lee Holmes (@LeeHolmes) Paul Higinbotham (@PaulHigin) Steve Lee (@SteveL-MSFT) can you please take a look at the comment #5903 (comment) and see if there's any implication on PS Core 6.0.0?

We should take dotnetcore 2.0.5 as part of 6.0.1 release

Steve Lee (@SteveL-MSFT) OK. On a related note: The WiX toolset also had a security patch 2 weeks ago: https://www.firegiant.com/blog/2017/12/31/wix-v3.10.4-and-wix-v3.11.1-released/

It seems we use WiX from AppVeyor base image - so the issue is for AppVeyor.

Yes, but I guess that MSFT uses their own servers for building the GA release. This was a remark about the upcoming patch release.

Ilya (@iSazonov) I am confused, the global.json still refers to 2.0.2 and the documentation on it here says that this is the SDK (not the runtime version). This SDK version contains the old 2.0.0. version of the .Net Runtime, see docs here
Do we not need to update the string to 2.1.4, which is the SDK containing the 2.0.5 runtime, see docs here?

Christoph Bergmeister (@bergmeister) It is a trick - we use different versions of runtime and CLI. See Dongbo Wang (@daxian-dbw) comment.
RuntimeFrameworkVersion really set minimal patch version of .Net Core runtime.
(I found great design docs https://github.com/dotnet/designs/issues/3)

What I would really like to see is that we could start using C# 7.2 and Span/Memory (used runtime 2.0.* already contains Span support).
Also interesting when we can use .Net Core 2.1.0 - they have already done a lot to increase performance and continue to increase it.