Bump GitVersion.MsBuild from 6.8.1 to 6.8.2

[dependabot]

Updated GitVersion.MsBuild from 6.8.1 to 6.8.2.

Release notes

Sourced from GitVersion.MsBuild's releases.

6.8.2

As part of this release we had 10 commits which resulted in 4 issues being closed.

Dependencies

• !5022 (deps): Bump SharpYaml from 3.11.0 to 3.12.0 by dependabot[bot]
• !5024 (build deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 in /.github/workflows by dependabot[bot]
• !5027 (build deps): bump the codeql group across 1 directory with 3 updates by dependabot[bot]

Improvements

• #​5026 [ISSUE]: Incorrect label placeholders should not throw exception by robertcoltheart resolved in !5025 by robertcoltheart

Contributors

2 contributors made this release possible.

SHA256 Hashes of the release artifacts

• gitversion-linux-arm64-6.8.2.tar.gz — 1b51227f88ddf705fc01a3b04ca15eb50fe76baf78013f99c731a2fac729dd8e
• gitversion-linux-musl-arm64-6.8.2.tar.gz — f55140d5a94c046561528e1746f7ad1bf530ee9a71cf4414843090964f9ce273
• gitversion-linux-musl-x64-6.8.2.tar.gz — a850cf6a02bf2cadf647fbfead9570179b50da8190fa59dc85405363f5e2cf86
• gitversion-linux-x64-6.8.2.tar.gz — 4b9c361952a7bd8230e3dfeb68189ac99fc3059b561b186d8c1fce22a2287dc2
• gitversion-osx-arm64-6.8.2.tar.gz — 02eb6ec6f65a0661bf5f0d0b12a503762372db6bf7e28bc2657015aaf1e0c38f
• gitversion-osx-x64-6.8.2.tar.gz — 34b79fa8dc9ee659dc4a7c57f8e3a89ff25fd3959f555d00c8d0d6ad9cb01a01
• gitversion-win-arm64-6.8.2.zip — 13d95502e3888055df077ed4383ed2e010ec659a3a0f0b3db726e9d7a8fa6724
• gitversion-win-x64-6.8.2.zip — 73219908a616847bd4049680dff389fc3623d4fbe8585e92198a5572da63f796

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 2:22 AM ET / 06:22 UTC.

Summary
Updates the centrally referenced GitVersion.MsBuild package in src/Directory.Build.props from 6.8.1 to 6.8.2.

Reproducibility: not applicable. this pull request performs routine build dependency maintenance rather than addressing a reported runtime defect.

Review metrics: 2 noteworthy metrics.

• Dependency surface: 1 package changed in 1 file. The narrow version-only diff limits the review and regression surface.
• Version delta: 6.8.1 → 6.8.2. This is a patch-level upgrade rather than a minor or major compatibility jump.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] GitVersion.MsBuild executes during builds and controls generated version metadata, so the remaining build and packaging-sensitive CI results should complete before merge.
• [P1] Repository-local ownership provenance for src/Directory.Build.props could not be confirmed because local read-only shell inspection was unavailable during this review.

Maintainer options:

1. Decide the mitigation before merge
   Merge the patch update after the required build, shared tests, tray tests, and CI complete successfully and generated version metadata remains correct.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair is identified; maintainers should allow the pending required validation to complete and merge normally if it remains green.

Security
Cleared: The diff only advances an existing NuGet dependency by one patch version and introduces no new package source, script, workflow permission, secret access, or download mechanism.

Review details

Best possible solution:

Merge the patch update after the required build, shared tests, tray tests, and CI complete successfully and generated version metadata remains correct.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this pull request performs routine build dependency maintenance rather than addressing a reported runtime defect.

Is this the best way to solve the issue?

Yes; updating the existing central package reference is the narrowest maintainable way to adopt GitVersion.MsBuild 6.8.2, provided the required build and tests pass.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 06b4f6362594.

Label changes

Label changes:

• add P3: This is a low-risk routine dependency maintenance update with no demonstrated user-facing regression or urgent security impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable to this bot-authored dependency update; successful repository build and test results are the appropriate evidence.

Label justifications:

• P3: This is a low-risk routine dependency maintenance update with no demonstrated user-facing regression or urgent security impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable to this bot-authored dependency update; successful repository build and test results are the appropriate evidence.

Evidence reviewed

What I checked:

• Current main version: Current main still references GitVersion.MsBuild 6.8.1, so the requested update has not already been implemented. (src/Directory.Build.props:18, 06b4f6362594)
• Focused patch: The pull request changes one package version in one file, with one addition and one deletion and no unrelated source, workflow, or lockfile changes. (src/Directory.Build.props:18, 048928ab76cc)
• Upstream release scope: The supplied upstream 6.8.2 notes describe a patch release containing dependency maintenance and a fix for invalid label placeholders throwing an exception.
• Validation state: Repository-hygiene and setup-gate checks succeeded, while the main test and three setup E2E checks were still running in the supplied current-head context. (.github/workflows/ci.yml, 048928ab76cc)
• Relevant repository policy: AGENTS.md requires the full repository build plus shared and tray test suites after every code change; the pending CI should finish before merge. (AGENTS.md:5, 06b4f6362594)

Likely related people:

• robertcoltheart: The supplied 6.8.2 release notes identify this contributor with the release’s functional fix, making them the clearest named person connected to the changed package behavior; repository-local line ownership could not be established from the available read-only inspection. (role: upstream release contributor; confidence: low; files: src/Directory.Build.props)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.