Bump Microsoft.CodeAnalysis.Analyzers and 5 others by dependabot[bot] · Pull Request #857 · microsoft/winappCli

Smarter COM marshalling (#1771). CsWin32 now automatically marshals recognized COM outputs as WinRT objects when appropriate.
Simpler IID/PPV calls (#1720). IID and void** parameter pairs now produce generic <T> overloads.

Before:

shellItem.BindToHandler(pbc, in bhid, typeof(IStream).GUID, out object result);
IStream stream = (IStream)result;

After:

shellItem.BindToHandler<IStream>(pbc, in bhid, out IStream stream);

CsWin32 supplies the IID and returns the strongly typed interface directly.

Changes:

Fixes:

#1745: Invalid Code Generated for CsWin32.UI.Accessibility methods/interfaces/Delegates With "allowMarshaling": true
#1739: NullReferenceException from passing null as CallbackParam for MiniDumpWriteDump

Others:

#1812: Make generator path quoting test cross-platform
#1810: Preserve coclass generic type fields for AOT
#1809: Quote generator tool path in command line
#1771: Automatically marshal COM outputs as WinRT
#1789: Update dotnet monorepo to 5.9.0
#1797: Update dependency nerdbank.dotnetrepotools to v1.5.42

See More

#1803: Update dependency CSharpIsNullAnalyzer to 0.2.19 - autoclosed
#1801: Update dependency Microsoft.Windows.SDK.CPP to 10.0.28000.2705
#1800: Update dependency Microsoft.Windows.SDK.BuildTools to 10.0.28000.2705
#1788: Update dependency Microsoft.NET.Test.Sdk to 18.9.0
#1787: Update dependency powershell to v7.6.5
#1782: Update Dockerfile and global.json updates
#1786: Qualify special string typedefs (PCWSTR) to Windows.Win32.Foundation for non-Win32 metadata
#1784: Update dependency NuGet.Protocol to 7.9.0
#1781: Null-terminate PCSTR friendly overload strings
#1775: Generated string-friendly overloads for PCSTR parameters do not append a null terminator
... (truncated)

0.3.298 Changes:

#1734: Run COM runtime tests on GitHub Actions windows-latest
#1733: Fix managed IID_PPV_ARGS overloads for native COM out pointers

This list of changes was auto generated.

0.3.296 Changes:

Fixes:

#1703: CsWin32-generated COM structs trip CS3016 under [assembly: CLSCompliant(true)]

Enhancements:

#408: Fields in Anonymous nested structs should be exposed with property getters on the nesting struct
#1720: Generate generic overloads for IID_PPV_ARGS pattern on COM methods

Others:

#1531: Update nbgv and nerdbank.gitversioning updates to 3.9.50
#1727: Flatten anonymous bitfield sub-properties (#408 phase 2)
#1721: Flatten anonymous nested struct/union fields (#408)
#1715: fix: document inherited COM interface methods

See More

#1728: Serialize Linux test runs and capture crash dumps as a dedicated artifact
#1722: Limit test parallelism on Linux to avoid OOM kills
#1709: Update actions/checkout action to v5.0.1
#1723: Suppress CS3016 on internal COM wrappers without [CLSCompliant(false)] (#1703)

This list of changes was auto generated.

0.3.287 Changes:

Fixes:

#1703: CsWin32-generated COM structs trip CS3016 under [assembly: CLSCompliant(true)]
#1704: IComIID is not emitted on net472 / netstandard2.0
#1716: Generated IStream.Read/Write forward to ISequentialStream and fail for IID_IStream COM objects
#1696: Broken code generated due to hardcoded "PInvoke" classname

Enhancements:

#1477: Allow specifying extension member target for static class

Others:

#1718: Add integration tests to PR gate and fix Roslyn 4 analyzer leg
#1701: Add extensionReceiver option for layered PInvoke composition (#1477)

See More

#1706: Mark internal COM struct wrappers [CLSCompliant(false)] when they carry CCW thunks
#1698: Auto-generated baselines by 1ES Pipeline Templates
#1705: Emit IComIID on downlevel TFMs (net472 / netstandard2.0)
#1555: Downgrade dependencies so the source analyzer works with .NET 8 SDK again
#1717: Fix #1716: emit friendly overloads for inherited COM methods on derived interfaces in source-generator mode
#1707: Bump .NET SDK to 10.0.108 (CG alert 12352554)
#1694: Add missing unchecked regions
#1697: Fix hardcoded PInvoke class name in ICCloseSafeHandle generation
#1690: Add validate gate job for single required status check
#1685: Add GitHub Actions workflow to run all tests in PR

This list of changes was auto generated.

0.3.275 Changes:

#1678: Fix cross-winmd STATUS_SUCCESS lookup
#1672: Promote handle pointer to an out reference if handle cannot be trivially represented as a SafeHandle
#1668: Bump metadata version
#1621: Fix AppLocalAllowedLibraries handling in CsWin32RunAsBuildTask mode
#1623: Cleanup codecov sample comment
#1620: Reduce allocations

This list of changes was auto generated.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 3.1.5 to 4.0.0.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.0

Release notes: https://xunit.net/releases/visualstudio/4.0.0

4.0.0-pre.5

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.5

4.0.0-pre.4

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.4

4.0.0-pre.3

Release notes: https://xunit.net/releases/visualstudio/4.0.0-pre.3

Commits viewable in compare view.

Updated xunit.v3 from 3.2.2 to 4.0.0.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Microsoft.CodeAnalysis.Analyzers from 5.3.0 to 5.9.0 Bumps Microsoft.CodeAnalysis.CSharp to 5.9.0 Bumps Microsoft.NET.Test.Sdk from 18.6.0 to 18.10.0 Bumps Microsoft.Windows.CsWin32 from 0.3.269 to 0.3.333 Bumps xunit.runner.visualstudio from 3.1.5 to 4.0.0 Bumps xunit.v3 from 3.2.2 to 4.0.0 --- updated-dependencies: - dependency-name: Microsoft.CodeAnalysis.Analyzers dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Microsoft.CodeAnalysis.CSharp dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.CodeAnalysis.CSharp dependency-version: 5.9.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: xunit.v3 dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.Windows.CsWin32 dependency-version: 0.3.333 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-16T18:12:53Z

Build Metrics Report

Binary Sizes

Artifact	Baseline	Current	Delta
CLI (ARM64)	48.44 MB	N/A	N/A
CLI (x64)	48.29 MB	N/A	N/A
MSIX (ARM64)	19.96 MB	N/A	N/A
MSIX (x64)	21.16 MB	N/A	N/A
NPM Package	41.53 MB	N/A	N/A
NuGet Package	41.66 MB	N/A	N/A

Test Results

✅ 0 passed out of 0 tests in 0.0s (-6856 tests, -1698.0s vs. baseline)

Test Coverage

❌ 0% line coverage, 0% branch coverage · ⚠️ -85.9% vs. baseline

Updated 2026-09-16 21:12:42 UTC · commit 53e5828 · workflow run

Copilot

🟡 Changes recommended

The analyzer’s 5.9 reference can cause Roslyn 4.8/.NET 8 consumers to skip it, disabling diagnostics.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates analyzer, compiler, test, source-generation, and xUnit dependencies.

Changes:

Upgrades CsWin32 to 0.3.333.
Upgrades Roslyn dependencies to 5.9.0.
Updates test SDK and xUnit packages.

File summaries

File	Description
`src/winapp-CLI/Directory.Packages.props`	Updates CsWin32.
`src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers/Microsoft.WindowsAppSDK.Analyzers.csproj`	Updates Roslyn dependencies; the analyzer reference must remain compatible with supported .NET 8 SDKs.
`src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers.Tests/Microsoft.WindowsAppSDK.Analyzers.Tests.csproj`	Updates test dependencies.

Review details

Files reviewed: 3/3 changed files
Comments generated: 1
Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.3.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />


Copilot · 2026-09-16T18:15:36Z

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Warm CLI build

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

…ft.WindowsAppSDK.Analyzers.Tests/nuget-18eaa37a88

Nikola Metulev (nmetulev) · 2026-09-17T20:06:24Z

Superseded by #869, which adopts these updates with the CsWin32 SHGetImageList API fix, preserves the shipped analyzer Roslyn 4.8 compatibility baseline, and includes regression coverage plus published NativeAOT and package-consumer validation. The production Roslyn 5.9 bump in this automated PR is intentionally not adopted.

dependabot · 2026-09-17T20:06:28Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

…mpatibility (#869) ## Description Manually adopt the dependency updates from #855 and #857 with the required CsWin32 API adaptation and compatibility coverage. Both Dependabot PRs failed to compile because CsWin32 0.3.333 replaces the `SHGetImageList` convenience overload used by the CLI. Use its typed `out IImageList2` overload and strengthen the shell-icon test to verify repeated acquisition and serialization after native handles are released. Update Microsoft.NET.Test.Sdk to 18.10.0, xunit.v3 and xunit.runner.visualstudio to 4.0.0, Microsoft.CodeAnalysis.Analyzers to 5.9.0, and the test host's Microsoft.CodeAnalysis.CSharp to 5.9.0. **Keep the shipped analyzer's Microsoft.CodeAnalysis.CSharp reference at 4.8.0** so older supported compilers can still load it. Add assembly-reference regression tests and exclude that package from automatic Dependabot bumps. ## Usage Example No public commands, flags, configuration formats, or library APIs change. Existing executable-icon extraction continues to work: ```powershell winapp manifest generate . --executable .\MyApp.exe ``` ## Related Issue Supersedes #855 and #857. The production Roslyn bump in those PRs is intentionally omitted to preserve the supported compiler baseline. ## Type of Change - 🐛 Bug fix - 🔧 Config/build - 🧪 Test update ## Checklist - [x] Regression tests added and exercised - [x] Tested locally on Windows - [x] CLI schema and plugin documentation regenerated and validated; no user-facing documentation changes required ## Screenshots / Demo Not applicable: no intended UI or CLI behavior change. ## Additional Notes ### Validation | Coverage | Result | | --- | --- | | Focused CLI tests: icons, manifest generation, public API surface, real MP4 encoder, recording | 77 passed | | Full UI Automation library suite | 649 passed; 2 opt-in live pointer-injection tests skipped | | Analyzer suite on Roslyn 5.9 | 65 passed | | Analyzer suite temporarily run against Roslyn 4.8 | 65 passed; test dependency restored to 5.9 afterward | | Analyzer compatibility negative check | Both new tests correctly failed when the production reference was temporarily raised to 5.9; production reference restored to 4.8 | | Analyzer MSBuild stand-down contract | Passed | | npm unit tests | 307 passed | | NuGet package layout and MSBuild contracts | 62 passed | | `scripts\build-cli.ps1 -SkipTests` | Produced x64/ARM64 NativeAOT binaries, npm package, all four NuGet packages, and both MSIX packages | | `scripts\validate-llm-docs.ps1` | Passed | The build script's test phase was skipped because the dependency-focused suites above were run separately; the full CLI suite was not run. ### Published-binary and consumer checks Tested both published binaries on an ARM64 Windows host: ARM64 natively and x64 under emulation. Both successfully extracted an executable's icon and generated 49 assets, inspected a dedicated test window, round-tripped a text value, captured nonblank screenshots, and recorded six-frame WGC/H.264 videos with JPEG evidence. Checked output dimensions, frame manifests, changing image content, and finalized MP4 sample tables. Fresh consumers of the packaged `net10.0-windows` and `net10.0-windows10.0.19041.0` library targets restored, compiled with warnings as errors, and ran. The lean target retained GDI-only capture; the full target exposed WGC and recording. CsWin32 was absent from the consumers' transitive dependency graph. No downstream break was found in these tested paths; x64 hardware execution and opt-in live pointer injection were not covered. Co-authored-by: Nikola Metulev <711864+nmetulev@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 16, 2026

Copilot AI balanced review requested due to automatic review settings September 16, 2026 18:09

dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Sep 16, 2026

Copilot started reviewing on behalf of Microsoft (microsoft) September 16, 2026 18:13 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Merge branch 'main' into dependabot/nuget/src/winapp-Analyzer/Microso…

53e5828

…ft.WindowsAppSDK.Analyzers.Tests/nuget-18eaa37a88

Nikola Metulev (nmetulev) mentioned this pull request Sep 17, 2026

Update CsWin32 and analyzer dependencies while preserving compiler compatibility #869

Merged

3 tasks

Nikola Metulev (nmetulev) closed this Sep 17, 2026

dependabot Bot deleted the dependabot/nuget/src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers.Tests/nuget-18eaa37a88 branch September 17, 2026 20:06

Navigation Menu

Bump Microsoft.CodeAnalysis.Analyzers and 5 others - #857

Bump Microsoft.CodeAnalysis.Analyzers and 5 others#857
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/src/winapp-Analyzer/Microsoft.WindowsAppSDK.Analyzers.Tests/nuget-18eaa37a88

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Sep 16, 2026

Uh oh!

Nikola Metulev (nmetulev) commented Sep 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

5.0.4

5.0.2

Repos

5.0.1

Repo

5.0.4

5.0.2

Repos

5.0.1

Repo

18.10.0

What's Changed

18.9.0

What's Changed

New Contributors

18.8.1

What's Changed

18.8.0

What's Changed

18.7.0

What's Changed

New Contributors

0.3.333

Feature Improvements

Changes:

Fixes:

Others:

0.3.298

Changes:

0.3.296

Changes:

Fixes:

Enhancements:

Others:

0.3.287

Changes:

Fixes:

Enhancements:

Others:

0.3.275

Changes:

4.0.0

4.0.0-pre.5

4.0.0-pre.4

4.0.0-pre.3

Uh oh!

github-actions Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Build Metrics Report

Binary Sizes

Test Results

Test Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI commented Sep 16, 2026

Uh oh!

Nikola Metulev (nmetulev) commented Sep 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading

github-actions Bot commented Sep 16, 2026 •

edited

Loading