Bump the nuget group with 6 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updated Microsoft.CodeAnalysis.Analyzers from 5.3.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp from 4.12.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.6.0 to 18.9.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.9.0

What's Changed

• Fix tilde/exclamation characters corrupted in TerminalLogger test output by @​nohwnd in [fix] Fix tilde/exclamation characters corrupted in TerminalLogger test output vstest#16046
• Make TranslationLayer Native AOT-compatible by @​drewnoakes in Make TranslationLayer Native AOT-compatible vstest#16045
• Guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order by @​nohwnd in [fix] fix: guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order vstest#16072
• Add RequestingAssembly to AssemblyResolveEventArgs for binary compat by @​nohwnd in [fix] fix: add RequestingAssembly to AssemblyResolveEventArgs for binary compat vstest#16076
• Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector by @​Evangelink in Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector vstest#16082
• Fix TRX attachment paths when LogFileName contains a subdirectory by @​nohwnd in [fix] Fix TRX attachment paths when LogFileName contains a subdirectory vstest#15791
• Fix missing dumps for .NET Framework child processes in NetClientHangDumper by @​nohwnd in [fix] Fix missing dumps for .NET Framework child processes in NetClientHangDumper vstest#16098
• Fix data collection channels to use negotiated protocol version instead of V1 by @​nohwnd in [fix] Fix data collection channels to use negotiated protocol version instead of V1 vstest#16096
• Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet by @​nohwnd in [fix] Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet vstest#16065
• Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files by @​nohwnd in [fix] Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files vstest#16101
• Include testhost process path in crash error messages by @​nohwnd in [fix] Include testhost process path in crash error messages vstest#16108
• Fix DataDriven test results being double-counted in TRX logger totals by @​nohwnd in [fix] Fix DataDriven test results being double-counted in TRX logger totals vstest#15766
• Fix datacollector crash visibility: replace Assert with throwable exceptions by @​nohwnd in [fix] Fix datacollector crash visibility: replace Assert with throwable exceptions vstest#16048
• Add TreatErrorMessagesAsWarnings parameter to TRX logger by @​nohwnd in [fix] Add TreatErrorMessagesAsWarnings parameter to TRX logger vstest#16106
• Wait for testhost stderr to drain before reading its crash output by @​nohwnd in Wait for testhost stderr to drain before reading its crash output vstest#16128
• Handle runtimeconfig.dev.json without additionalProbingPaths by @​tmat in Handle runtimeconfig.dev.json without additionalProbingPaths vstest#16166
• Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost by @​nohwnd in Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost vstest#16169
• Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#​16151) by @​azat-msft in Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#16151) vstest#16156
• Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests by @​nohwnd in [fix] Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests vstest#16167

New Contributors

• @​drewnoakes made their first contribution in Make TranslationLayer Native AOT-compatible vstest#16045

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

18.8.1

What's Changed

• Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) by @​nohwnd in Fix protocol negotiation timeout when STJ reflection is disabled (18.8.1) vstest#16281

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

• Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @​nohwnd in feat: migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) vstest#15687
  • For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/
• Create source-only filter package by @​Youssef1313 in Create source-only filter package vstest#15638
• Add ARM64 msdia140.dll support to test platform packages by @​nohwnd in Cherry-pick: Add ARM64 msdia140.dll support to test platform packages vstest#15692
• Fix mutex cleanup crash on macOS/Linux by @​nohwnd in Fix mutex cleanup crash on macOS/Linux vstest#15684
• Restrict artifact temp directory permissions on Unix by @​nohwnd in Restrict artifact temp directory permissions on Unix vstest#15729
• Add support for filtering uncategorized tests with TestCategory=None by @​Evangelink in Add support for filtering uncategorized tests with TestCategory=None vstest#15727
• Fix SCI binding failure in DTA hosts (main) by @​nohwnd in Fix SCI binding failure in DTA hosts (main) vstest#15724
• Fix HTML logger parallel file collision by @​nohwnd in [fix] Fix HTML logger parallel file collision vstest#15435
• Improve error message when testhost cannot be found by @​nohwnd in [fix] Improve error message when testhost cannot be found vstest#16053
• Fix HTML logger exception on invalid XML chars in test display names by @​nohwnd in [fix] Fix HTML logger exception on invalid XML chars in test display names vstest#16051

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

• Add ARM64 msdia140.dll support to test platform packages by @​jamesmcroft in Add ARM64 msdia140.dll support to test platform packages vstest#15689
• Update System.Memory from 4.5.5 to 4.6.3 by @​nohwnd in Update System.Memory from 4.5.5 to 4.6.3 vstest#15706

New Contributors

• @​jamesmcroft made their first contribution in Add ARM64 msdia140.dll support to test platform packages vstest#15689

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

Commits viewable in compare view.

Updated Microsoft.Windows.CsWin32 from 0.3.269 to 0.3.333.

Release notes

Sourced from Microsoft.Windows.CsWin32's releases.

0.3.333

Feature Improvements

• Smarter COM marshalling (#​1771). CsWin32 now automatically marshals recognized COM outputs as WinRT objects when appropriate.
• Simpler IID/PPV calls (#​1720). IID and void** parameter pairs now produce generic <T> overloads.

Before:

shellItem.BindToHandler(pbc, in bhid, typeof(IStream).GUID, out object result);
IStream stream = (IStream)result;

After:

shellItem.BindToHandler<IStream>(pbc, in bhid, out IStream stream);

CsWin32 supplies the IID and returns the strongly typed interface directly.

Changes:

Fixes:

• #​1745: Invalid Code Generated for CsWin32.UI.Accessibility methods/interfaces/Delegates With "allowMarshaling": true
• #​1739: NullReferenceException from passing null as CallbackParam for MiniDumpWriteDump

Others:

• #​1812: Make generator path quoting test cross-platform
• #​1810: Preserve coclass generic type fields for AOT
• #​1809: Quote generator tool path in command line
• #​1771: Automatically marshal COM outputs as WinRT
• #​1789: Update dotnet monorepo to 5.9.0
• #​1797: Update dependency nerdbank.dotnetrepotools to v1.5.42

See More

• #​1803: Update dependency CSharpIsNullAnalyzer to 0.2.19 - autoclosed
• #​1801: Update dependency Microsoft.Windows.SDK.CPP to 10.0.28000.2705
• #​1800: Update dependency Microsoft.Windows.SDK.BuildTools to 10.0.28000.2705
• #​1788: Update dependency Microsoft.NET.Test.Sdk to 18.9.0
• #​1787: Update dependency powershell to v7.6.5
• #​1782: Update Dockerfile and global.json updates
• #​1786: Qualify special string typedefs (PCWSTR) to Windows.Win32.Foundation for non-Win32 metadata
• #​1784: Update dependency NuGet.Protocol to 7.9.0
• #​1781: Null-terminate PCSTR friendly overload strings
• #​1775: Generated string-friendly overloads for PCSTR parameters do not append a null terminator
  ... (truncated)

0.3.298

Changes:

• #​1734: Run COM runtime tests on GitHub Actions windows-latest
• #​1733: Fix managed IID_PPV_ARGS overloads for native COM out pointers

This list of changes was auto generated.

0.3.296

Changes:

Fixes:

• #​1703: CsWin32-generated COM structs trip CS3016 under [assembly: CLSCompliant(true)]

Enhancements:

• #​408: Fields in Anonymous nested structs should be exposed with property getters on the nesting struct
• #​1720: Generate generic overloads for IID_PPV_ARGS pattern on COM methods

Others:

• #​1531: Update nbgv and nerdbank.gitversioning updates to 3.9.50
• #​1727: Flatten anonymous bitfield sub-properties (#​408 phase 2)
• #​1721: Flatten anonymous nested struct/union fields (#​408)
• #​1715: fix: document inherited COM interface methods

See More

• #​1728: Serialize Linux test runs and capture crash dumps as a dedicated artifact
• #​1722: Limit test parallelism on Linux to avoid OOM kills
• #​1709: Update actions/checkout action to v5.0.1
• #​1723: Suppress CS3016 on internal COM wrappers without [CLSCompliant(false)] (#​1703)

This list of changes was auto generated.

0.3.287

Changes:

Fixes:

• #​1703: CsWin32-generated COM structs trip CS3016 under [assembly: CLSCompliant(true)]
• #​1704: IComIID is not emitted on net472 / netstandard2.0
• #​1716: Generated IStream.Read/Write forward to ISequentialStream and fail for IID_IStream COM objects
• #​1696: Broken code generated due to hardcoded "PInvoke" classname

Enhancements:

• #​1477: Allow specifying extension member target for static class

Others:

• #​1718: Add integration tests to PR gate and fix Roslyn 4 analyzer leg
• #​1701: Add extensionReceiver option for layered PInvoke composition (#​1477)

See More

• #​1706: Mark internal COM struct wrappers [CLSCompliant(false)] when they carry CCW thunks
• #​1698: Auto-generated baselines by 1ES Pipeline Templates
• #​1705: Emit IComIID on downlevel TFMs (net472 / netstandard2.0)
• #​1555: Downgrade dependencies so the source analyzer works with .NET 8 SDK again
• #​1717: Fix #​1716: emit friendly overloads for inherited COM methods on derived interfaces in source-generator mode
• #​1707: Bump .NET SDK to 10.0.108 (CG alert 12352554)
• #​1694: Add missing unchecked regions
• #​1697: Fix hardcoded PInvoke class name in ICCloseSafeHandle generation
• #​1690: Add validate gate job for single required status check
• #​1685: Add GitHub Actions workflow to run all tests in PR

This list of changes was auto generated.

0.3.275

Changes:

• #​1678: Fix cross-winmd STATUS_SUCCESS lookup
• #​1672: Promote handle pointer to an out reference if handle cannot be trivially represented as a SafeHandle
• #​1668: Bump metadata version
• #​1621: Fix AppLocalAllowedLibraries handling in CsWin32RunAsBuildTask mode
• #​1623: Cleanup codecov sample comment
• #​1620: Reduce allocations

This list of changes was auto generated.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.5 to 4.0.0.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.0

Release notes: https://xunit.net/releases/visualstudio/4.0.0

4.0.0-pre.5

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.5

4.0.0-pre.4

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.4

4.0.0-pre.3

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.3

Commits viewable in compare view.

Updated xunit.v3 from 3.2.2 to 4.0.0.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Build Metrics Report

Binary Sizes

Artifact	Baseline	Current	Delta
CLI (ARM64)	46.12 MB	N/A	N/A
CLI (x64)	46.03 MB	N/A	N/A
MSIX (ARM64)	19.04 MB	N/A	N/A
MSIX (x64)	20.19 MB	N/A	N/A
NPM Package	39.62 MB	N/A	N/A
NuGet Package	39.75 MB	N/A	N/A

Test Results

✅ 0 passed out of 0 tests in 0.0s (-5834 tests, -980.8s vs. baseline)

Test Coverage

❌ 0% line coverage, 0% branch coverage · ⚠️ -87.6% vs. baseline

---

Updated 2026-09-16 00:14:40 UTC · commit 9db5899 · workflow run

[Copilot]

🟡 Changes recommended

Roslyn 5.9 breaks the production analyzer’s documented .NET 8 compiler compatibility.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates six NuGet dependencies across the CLI and analyzer projects.

Changes:

• Updates CsWin32.
• Updates Roslyn analyzer dependencies.
• Updates the analyzer test stack.

File summaries

File	Description
src/winapp-CLI/Directory.Packages.props	Updates CsWin32.
src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers/Microsoft.WindowsAppSDK.Analyzers.csproj	Updates Roslyn dependencies.
src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers.Tests/Microsoft.WindowsAppSDK.Analyzers.Tests.csproj	Updates test and Roslyn packages.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Warm CLI build

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.