The Microsoft.DiaSymReader / .PortablePdb packages pull NETStandard.Library
1.6.1, which drags in 4.3.0 builds of System.Net.Http, System.Private.Uri
and System.Text.RegularExpressions, all carrying known advisories (NU1902/
NU1903). They are framework-provided at runtime on net10.0; pin the patched
4.3.4 / 4.3.2 / 4.3.1 via central transitive pinning so NuGet audit passes.
Enabling transitive pinning also aligns a handful of other transitive
packages to their declared central versions.
Assisted-by: Claude:claude-opus-4-8:Claude Code
Rename Avalonia.Xaml.Behaviors to its successor Xaml.Behaviors.Avalonia
(12.0.0.1), and bump Dock (12.0.0.2), Svg.Controls.Skia.Avalonia,
AvaloniaUI.DiagnosticsSupport, CliWrap, coverlet.MTP, and NUnit to their
latest releases.
Assisted-by: Claude:claude-opus-4-8:Claude Code
These PackageVersion entries had no PackageReference anywhere in the tree -- WPF-era leftovers (TomsToolbox.Wpf.*, Microsoft.Xaml.Behaviors.Wpf, AvalonEdit, Dirkster.AvalonDock, DataGridExtensions), unused theme/diagnostics variants (Avalonia/Dock Fluent themes, Avalonia.Diagnostics, Fonts.Inter), the VSTest SDK (the suite runs on Microsoft.Testing.Platform), and bare System.* versions that pin nothing under central package management. Restore leaves every packages.lock.json unchanged, confirming none were in use.
Assisted-by: Claude:claude-opus-4-8:Claude Code
On Linux desktops where the com.canonical.AppMenu.Registrar name is absent or
blinks in and out (e.g. KDE Plasma, where kappmenu owns it only transiently),
Avalonia's DBusMenuExporter fired an unguarded UnregisterWindowAsync on dispose.
The faulted fire-and-forget task went unobserved and was rethrown by the
finalizer as org.freedesktop.DBus.Error.ServiceUnknown ("The name is not
activatable"), surfacing through the global exception dialog. 12.0.4 observes
that task (AvaloniaUI/Avalonia#21344, fixing #17616); verified the ContinueWith
guard is present in the resolved Avalonia.FreeDesktop binary.
No lock-file churn: only the cross-platform decompiler libraries pin lock files
and none reference Avalonia. Full headless suite shows no new failures.
Without per-dockable view resolution the dock chrome caches one view per
slot and reuses it for every dockable that lands there, so a second pane
sharing an Alignment (Analyzer + Debug Steps both Bottom) renders the
first pane's content under the second pane's tab. Each dockable instead
owns its view (IDockableViewOwner) and DockableViewRecycling hands that
instance back keyed by dockable identity -- there is no app-lifetime
global view cache to leak every transient document tab's view subtree.
Resolution runs through the single application-wide ViewLocator (its
dispatch map is introduced here rather than in the later DataTemplate
cleanup) so the dock never re-resolves an owned view through the template
machinery on a cache hit.
Assisted-by: Claude:claude-opus-4-8:Claude Code
The Fluent theme combined with the Inter font made the app feel like a
modern UWP/WinUI surface, not the WPF/native Windows look the project
wants. Switching to Avalonia's Simple theme (and Dock's matching
DockSimpleTheme + DataGrid Simple.v2.xaml) gives flatter chrome with
denser default control padding. Dropping WithInterFont() lets Avalonia
fall back to the OS font (Segoe UI on Windows).
Assisted-by: Claude:claude-opus-4-7:Claude Code
Replaces the temporary 3-column Grid placeholder in MainWindow with a
Dock.Avalonia DockControl driven by an ILSpyDockFactory and orchestrated
by a [Shared] DockWorkspace exported via MEF.
Assisted-by: Claude:claude-opus-4-7:Claude Code
* .NET 11 RC2 minimal changes
* Heuristic for transport feed Roslyn selection
* Microsoft.CodeAnalysis.NetAnalyzers from main NuGet feed
* Use the VS2026 image
* Switch all test projects to net11
* Extract constants
* Include vsix with plain nuget.config files
Add explicit System.Security.Cryptography.Pkcs dependency to avoid security vulnerability warning in ILSpyCmd.
Suppress security vulnerability warnings in test projects.