[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Microsoft.Build.Utilities.Core (source)	18.8.2 → 18.11.0
Microsoft.SourceLink.GitHub	10.0.301 → 10.0.403

---

Release Notes

dotnet/msbuild (Microsoft.Build.Utilities.Core)

v18.11.0

What's Changed

• Add vs18.10 to merge-flow config; retire vs18.7 by @​AlesProkop in #​14563
• Bump main to 18.11.0 after vs18.10 snap by @​AlesProkop in #​14564
• Phase out ChangeWaves 17.10, 17.12, 17.14 and 18.3 by @​JanProvaznik in #​14551
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14572
• Default XML tasks to prohibit DTDs and improve DTD error diagnostics by @​VolPlita in #​14285
• Don't log TaskAssemblyLocationMismatch for task-host-routed tasks by @​JanProvaznik in #​14550
• Scope MSBuild server and coordinator resource names to the current user by @​JanProvaznik in #​14543
• Promote MSBuild server out of Experimental namespace (#​12099) by @​JanProvaznik in #​13964
• Fix builds by adding missing using by @​rainersigwald in #​14587
• Add event-level task telemetry (build/tasks/details) by @​jankratochvilcz in #​13609
• Migrate ResolveCodeAnalysisRuleSet to multithreaded execution by @​jankratochvilcz in #​13636
• Use <inheritdoc /> for TaskEnvironment in ResolveCodeAnalysisRuleSet by @​jankratochvilcz in #​14589
• Add aliases for configuration and test parameters in build scripts by @​AR-May in #​14591
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14617
• Emit assemblyName payload for FallbackAssemblyLoad EventSource events by @​AR-May in #​14014
• Bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.84.1 by @​dependabot[bot] in #​14611
• Bump github/gh-aw-actions/setup from 0.83.3 to 0.84.1 by @​dependabot[bot] in #​14610
• Migrate GetAssembliesMetadata to multithreaded execution by @​jankratochvilcz in #​13637
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14619
• Fix concurrent BuildCheck callback mutation by @​YuliiaKovalova in #​14590
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14612
• Make experimental VS insertion reviewers configurable by @​rainersigwald in #​14632
• Fix NullReferenceException reporting file accesses for detoured nodes by @​dfederm in #​14602
• Scope .NET TaskHost handshake leniency to architecture by @​JanProvaznik in #​14579
• Ensure MSBuild.csproj is included for Release|ARM64 by @​KirillOsenkov in #​14622
• Declare the Sdk element in Microsoft.Build.Core.xsd by @​ViktorHofer with @​Copilot in #​14637
• Call out MSBUILD_LOGGING_ARGS by @​rainersigwald in #​14641
• [Spec] Define MSBuild server child-process ownership by @​JanProvaznik in #​14508
• Pre-buffer TaskHost packet bodies before deserialization by @​AR-May in #​14505
• Expose item glob patterns via MSBuildProvideItemGlobs by @​drewnoakes in #​14389
• Avoid republishing coverage artifacts on CI retries by @​JanProvaznik in #​14423
• Make the resolved change wave part of the node handshake by @​JanProvaznik with @​Copilot in #​14557
• Bump github/gh-aw-actions/setup from 0.84.1 to 0.86.1 by @​dependabot[bot] in #​14665
• Bump github/gh-aw-actions/setup-cli from 0.84.1 to 0.86.1 by @​dependabot[bot] in #​14664
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14672
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14677
• Give each transient MSBuild Server its own identity by @​JanProvaznik in #​14647
• Don't discard the XML cache after restore when it reloads from disk by @​ViktorHofer in #​14558
• Add TarDirectory and Untar tasks for creating and extracting tar archives by @​ViktorHofer with @​Copilot in #​14451
• Add Directory.Parse.config to skip unknown attributes/elements during parsing by @​benwitmanmsft in #​14588
• Revert branch freeze PowerShell automation by @​AlesProkop in #​14692
• Fix MT switch by @​AR-May in #​14682
• Document multi-request target crosstalk by @​rainersigwald in #​14403
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14698
• Keep project active through post-build telemetry by @​AR-May in #​14679
• Make eng/build.sh portable (don't hardcode /bin/bash) by @​ViktorHofer in #​14707
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14709
• Drop stale secret group by @​rainersigwald in #​14710
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14713
• Bump github/gh-aw-actions/setup from 0.86.1 to 0.86.2 by @​dependabot[bot] in #​14712
• Bump github/gh-aw-actions/setup-cli from 0.86.1 to 0.86.2 by @​dependabot[bot] in #​14711
• Update release checklist and documentation sync steps for Change Waves by @​AR-May in #​14702
• Release checklist: fix Phase 5 based on the 18.9 release by @​ViktorHofer in #​14685
• Remove SBOM generation step from build jobs by @​ViktorHofer in #​14717
• Promote typed parameter diagnostics to warnings by @​OvesN in #​14706
• Make telemetry initialization and disposal best-effort so it can never fail a build by @​AlesProkop with @​Copilot in #​14554
• Accept uppercase MSBUILDDEBUGENGINE on Unix by @​rainersigwald with @​Copilot in #​14708
• [automated] Merge branch 'vs18.10' => 'main' by @​github-actions[bot] in #​14715
• Remove obsolete Publish-Build-Assets variable group import by @​missymessa in #​14736
• Add Orchard Core command-line evaluation benchmark by @​OvesN in #​14634
• Optimize FileMatcher wildcard enumeration by @​JeremyKuhne in #​14663
• Fix argument forwarding and stage logging in eng/build.ps1 by @​ViktorHofer in #​14767
• Enable SAC group config for MSBuild.exe.config in VS by @​pieandcakes in #​14739
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14781
• Bump github/gh-aw-actions/setup from 0.86.2 to 0.87.2 by @​dependabot[bot] in #​14796
• Bump github/gh-aw-actions/setup-cli from 0.86.2 to 0.87.2 by @​dependabot[bot] in #​14797
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14807
• Remove inter-branch merge flow infrastructure by @​ViktorHofer with @​Copilot in #​14786
• Harden MT migration skill with defect classes found in a 150-task migration by @​ViktorHofer in #​14795
• Remove stale BundledVersion.props update by @​rainersigwald in #​14766
• Surface critical graph build exceptions instead of hanging by @​AlesProkop in #​14461
• Isolate DebugUtils dump-file test to prevent cross-assembly race by @​JeremyKuhne with @​Copilot in #​14741
• Improve ComReferenceWalker test diagnostics by @​rainersigwald in #​14773
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1507291 by @​dotnet-oneloc-localization[bot] in #​14814
• Add focused evaluation performance benchmarks by @​DustinCampbell in #​14660
• Improve MSBuild expansion performance by @​DustinCampbell in #​14697
• Expand built-in metadata references in the task host by @​JanProvaznik in #​14770
• Correct MT routing docs and add analyzer rules for mismatched declarations by @​ViktorHofer in #​14809
• Harden typed task parameter infrastructure by @​OvesN in #​14819
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14835
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14894
• [vs18.11] Point VS insertion and OptProf at rel/insiders by @​AR-May in #​14921
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14944
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​15017
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​15079
• [vs18.11] Fix excludes with lexical include roots by @​github-actions[bot] in #​15147
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​15198
• [vs18.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​15245
• [vs18.11] Publish release packages as an additional pipeline artifact by @​JanProvaznik in #​15261

New Contributors

• @​benwitmanmsft made their first contribution in #​14588
• @​missymessa made their first contribution in #​14736

Full Changelog: dotnet/msbuild@v18.10.1...v18.11.0

v18.10.1

What's Changed

• [vs16.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13103
• [vs17.12] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13796
• [vs17.8] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13902
• [vs17.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13903
• [vs17.12] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13909
• [vs17.12] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13986
• Add vs18.9 to merge-flow config; retire vs18.3 by @​JanProvaznik in #​14214
• Bump labeler-cache-retention to use issue-labeler v2.1.0 by @​jeffhandley in #​14171
• Bump main to 18.10.0 after vs18.9 snap by @​JanProvaznik in #​14216
• Improve release skill: Phase 2 DARC rules, VMR backflow, deterministic baseline by @​JanProvaznik in #​14220
• Determinize release: hardcode OptProf baseline + Phase 3.2 baseline resolver by @​JanProvaznik in #​14222
• Serialize BuildRequestConfiguration.RequestedTargets to fix solution metaproject MSB4057 in parallel builds by @​ViktorHofer in #​14223
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14203
• Core support for AbsolutePath/FileInfo/DirectoryInfo and ITaskItem as task parameters by @​baronfel in #​13971
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14206
• Fix existence cache kind poisoning by @​AlesProkop in #​14249
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14226
• Don't disable the MSBuild server for /mt builds when node reuse is off by @​AR-May in #​14248
• Enhance expert reviewer guidelines with additional checks. by @​AR-May in #​14255
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14253
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14268
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14267
• Bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by @​dependabot[bot] in #​14266
• Avoid boxing the struct enumerator in PropertyDictionary.GetEnumerator() by @​nareshjo in #​14272
• Refresh copy marker when implementation output changes by @​AlesProkop in #​14231
• Send task-host build process environment as delta by @​OvesN in #​14126
• Add regression coverage for metadata newline preservation by @​VolPlita in #​14261
• Fix EmbedInBinlog items with relative paths from child projects by @​huulinhnguyen-dev in #​13990
• Stop requiring VersionPrefix updates in servicing - insert prerelease versions to VS by @​ViktorHofer in #​14277
• Fix WriteLinesToFile rewriting unchanged file when custom encoding is used by @​huulinhnguyen-dev in #​14146
• Enable trim/AOT analyzers for Microsoft.Build and clean up annotations by @​JeremyKuhne in #​14064
• [automated] Merge branch 'vs18.9' => 'main' by @​github-actions[bot] in #​14291
• Fix MicroBuild plugin feed URL to use allowed pkgs.dev.azure.com format by @​AlesProkop in #​14295
• Pass ExcludeRestorePackageImports during restore to avoid redundant evaluations by @​ViktorHofer with @​Copilot in #​14274
• [vs18.7] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13988
• Adopt Clever Test Selection (CTS) as parallel, non-blocking PR pipeline by @​jankratochvilcz in #​14212
• Harden exceptions when connecting to server by @​JanProvaznik in #​14292
• Update MicrosoftBuildVersion in analyzer template by @​github-actions[bot] in #​13886
• Fix MSBuild Server client dropping build result under WaitAny race (#​14172) by @​JanProvaznik in #​14251
• Partially revert #​13660: remove NuGet RestoreTask transient TaskHost workaround by @​JanProvaznik in #​14297
• Disable daily AI credits guardrail for Expert Code Review workflow by @​JanProvaznik with @​Copilot in #​14314
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1461473 by @​dotnet-bot in #​14246
• Add opt-in partial (stop-after-pass) project evaluation by @​ViktorHofer in #​14290
• Use partial evaluation for -getProperty/-getItem without a target by @​ViktorHofer in #​14296
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14324
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14333
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14330
• Bump github/gh-aw-actions/setup from 0.82.2 to 0.82.8 by @​dependabot[bot] in #​14328
• Restrict partial evaluation to ProjectInstance by @​ViktorHofer in #​14340
• Add Roslyn analyzers (MSBuildTask0006/0007) to suggest typed task parameters by @​baronfel in #​13972
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14348
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1464388 by @​dotnet-bot in #​14342
• Revert passing ExcludeRestorePackageImports during restore (#​14274) by @​ViktorHofer in #​14349
• Update to .NET 11 P5 SDK and Arcade main by @​ViktorHofer in #​14318
• Remove local fork requirement from contributing guide by @​jankratochvilcz in #​14350
• Log MSBuild Server lifecycle (spawn/reuse/not-used) to the build log by @​JanProvaznik in #​14156
• Remove NuGet restore task for internal tools by @​ViktorHofer in #​14352
• Use eng/common enable-internal-sources.yml for internal feeds auth by @​ViktorHofer in #​14353
• Default restore to true in sdk-task scripts by @​ViktorHofer in #​14354
• Add Roslyn analyzer (MSBuildTask0009) warning for unsupported ITaskItem type arguments by @​baronfel in #​13973
• Fix MSBuild coordinator deadlock for nested MSBuild processes by @​DustinCampbell in #​14224
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14362
• Add Dreaming workflow to curate Copilot memory weekly by @​jankratochvilcz in #​14357
• Fix #​14364: upgrade gh-aw to v0.82.9 and repin setup by @​jankratochvilcz in #​14365
• Dreaming: set protected-files: allowed so the workflow can open its curation PR by @​jankratochvilcz in #​14369
• [Dreaming] dreaming: flag System.Reflection on hot paths in expert-reviewer checklist by @​github-actions[bot] in #​14372
• Skip CI build/test legs for documentation- and .github-only changes by @​jankratochvilcz in #​14371
• Dreaming: up to 3 atomic PRs + per-PR core-team reviewer requests by @​jankratochvilcz in #​14373
• [Dreaming] dreaming: agents must not resolve reviewer threads without explicit maintainer acknowledgment by @​github-actions[bot] in #​14382
• Dreaming: enforce reviewer intersection (discussion participant AND kitten member) by @​jankratochvilcz in #​14383
• Refactor bootstrapped build infrastructure by @​ViktorHofer in #​14361
• Remove FEATURE_LEGACY_GETFULLPATH and use Microsoft.IO.Path.GetFullPath in .NET Framework. by @​teo-tsirpanis in #​13769
• Bootstrap PowerShell modules in flaky test detector by @​AlesProkop in #​14390
• Fix official build as -officialBuild parameter is now just a property by @​ViktorHofer in #​14391
• Bump .NET runtime packages to 10.0.9 by @​AArnott in #​14343
• Support TaskEnvironment injection via task constructors by @​baronfel in #​14315
• Align ITaskItem binding with ValueTypeParser and flag culture-sensitive conversions by @​baronfel in #​13974
• Eliminate shared string resource file by @​DustinCampbell in #​14386
• Fix Forwarding logger issue by @​AlesProkop in #​14396
• Handle null task type in OutOfProc task host to avoid NullReferenceException by @​JanProvaznik with @​Copilot in #​14007
• docs: fix outdated NuGet package link in Binary-Log.md by @​JanProvaznik with @​Copilot in #​14412
• [vs18.6] Fix VMR validation pipeline endpoint by @​JanProvaznik in #​14411
• Raise def-344 quarantine scan limits so the Flaky Test fixer completes by @​AlesProkop in #​14421
• Run -mt VMR validation three times weekly by @​JanProvaznik in #​14410
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14449
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14446
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14442
• Bump github/gh-aw-actions/setup-cli from 0.82.9 to 0.82.13 by @​dependabot[bot] in #​14436
• Bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by @​dependabot[bot] in #​14437
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​14438
• [vs17.8] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14439
• [vs17.12] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14447
• [vs17.14] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14445
• [Flaky Test] Quarantine 3 flaky tests by @​github-actions[bot] in #​14397
• [vs17.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14440
• [vs18.6] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14405
• [vs18.7] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14450
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14444
• [vs18.8] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14443
• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14441
• Avoid duplicate flaky-test issues from stale search results by @​AlesProkop in #​14454
• [Fix] MSBuild Producing Different Output Paths if the Paths are Passes as Absolute or Relative by @​AlesProkop in #​13752
• Recompile agent workflows with gh-aw 0.82.13 by @​AlesProkop in #​14457
• Add analyzer for TaskEnvironment constructor injection by @​jankratochvilcz in #​14401
• Update TFM to net11.0 and update accompanying files by @​ViktorHofer in #​14455
• Bump XML cryptography packages to 10.0.10 by @​AlesProkop in #​14472
• [Flaky Test] Quarantine 5 flaky tests by @​github-actions[bot] in #​14460
• [automated] Merge branch 'vs18.6' => 'vs18.7' by @​github-actions[bot] in #​14424
• [automated] Merge branch 'vs18.7' => 'vs18.8' by @​github-actions[bot] in #​14478
• Place Framework buildTransitive target in the net10.0 asset group by @​baronfel in #​14469
• Add EnumeratePattern and OpenedFileOrDirectoryAttributes to FileAccessData by @​dfederm in #​14104
• Rewrite branch freeze automation in PowerShell by @​AlesProkop in #​14470
• Harden coordinator client lifecycle races by @​emaf in #​14240
• [vs18.6] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14483
• Grant pull-requests: write to branch freeze command workflow by @​AlesProkop in #​14495
• Extract DebugTrace into a standalone Framework class by @​DustinCampbell in #​14494
• Consolidate message code parsing and formatting into MessageParser and MessageFormatter by @​DustinCampbell in #​14493
• Remove orphaned neutral and English .xlf localization files by @​DustinCampbell in #​14491
• [Flaky Test] Quarantine 2 flaky tests by @​github-actions[bot] in #​14503
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​14518
• Bump github/gh-aw-actions/setup from 0.82.13 to 0.83.3 by @​dependabot[bot] in #​14517
• Bump github/gh-aw-actions/setup-cli from 0.82.13 to 0.83.3 by @​dependabot[bot] in #​14519
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14523
• [vs17.12] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14528
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14527
• [vs17.14] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14526
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14524
• [vs18.8] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14525
• [vs17.11] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14521
• [vs17.8] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14520
• Update expert-reviewer models: Opus 5, GPT-5.6 Sol, Gemini 3.6 Flash by @​JanProvaznik in #​14532
• Fix false and over-broad checks in the expert-reviewer agent by @​JanProvaznik in #​14533
• De-stale the release skill after #​14277 removed stabilization by @​JanProvaznik in #​14534
• Reset process state between MSBuild server requests by @​JanProvaznik with @​Copilot in #​14475
• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14522
• Fix quoting in eng/build.sh by @​omajid in #​14506
• Bump .NET runtime packages to 10.0.10 by @​AlesProkop in #​14549
• [Flaky Test] Quarantine 1 flaky test by @​github-actions[bot] in #​14542
• [Flaky Test] Quarantine 2 flaky tests by @​github-actions[bot] in [#​14553](https://redirect

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks