chore(deps): update dependency microsoft.visualstudio.threading.analyzers to v18

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
Microsoft.VisualStudio.Threading.Analyzers (source)	nuget	major	17.14.15 → 18.7.23

---

Release Notes

microsoft/vs-threading (Microsoft.VisualStudio.Threading.Analyzers)

v18.7.23

What's Changed

Fixes

• Fix CancellationToken.Combine with 3+ cancelable tokens by @​AArnott in #​1443
• Fix VSTHRD110 firing in Expression-valued scenarios by @​AArnott with @​Copilot in #​1467
• Fix super set for VSTHRD103 by @​AArnott in #​1545
• Fix VSTHRD114 not firing for null in ternary conditional expressions by @​AArnott with @​Copilot in #​1548
• Disable VSTHRD010 in AppWithoutMainThread.editorconfig by @​ArturDorochowicz in #​1562
• Fix VSTHRD103 missing diagnostic for sync extension methods with async alternatives in the same static class by @​drewnoakes with @​Copilot in #​1569

Enhancements

• Add JoinableTaskFactory.DisableProcessing() by @​AArnott in #​1576
• Add NoMessagePumpSyncContext..ctor(SynchronizationContext) for Post/Send behaviors by @​AArnott in #​1578
• Add trim and NativeAOT safety attributes by @​AArnott in #​1471
• Add IPendingExecutionRequestState interface to expose completion state of SingleExecuteProtector by @​lifengl in #​1447
• Add AdditionalFiles support to VSTHRD103 analyzer for excluding specific APIs by @​AArnott with @​Copilot in #​1465
• Document InvalidOperationException for AsyncReaderWriterLock acquisition methods by @​AArnott with @​Copilot in #​1466
• Allow library code to detect the JoinableTaskContext is not associated with Main thread by @​lifengl in #​1477
• remove NotifyOfCrossThreadDependency call inside get_NoMessagePumpSynchronizationContext by @​lifengl in #​1486
• reduce overhead when running in no main thread mode by @​lifengl in #​1502
• Join tasks waited by JoinableTaskCollection.JoinUntilEmpty in dumpasync result by @​lifengl in #​1538
• Remove slow regex from threading analyzers by @​AArnott in #​1547

New Contributors

• @​jgrosic made their first contribution in #​1485
• @​AbhitejJohn made their first contribution in #​1533
• @​ArturDorochowicz made their first contribution in #​1562
• @​microsoft-github-policy-service[bot] made their first contribution in #​1587

Full Changelog: microsoft/vs-threading@v17.14.15...v18.7.23

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[claude]

Code Review

This is a single-line dependency bump of Microsoft.VisualStudio.Threading.Analyzers from 17.14.15 → 18.7.23 in Directory.Packages.props.

Assessment: Looks good ✓

Risk is low — this is an analyzer-only package (compile-time tooling, no runtime dependency), so a major version bump carries far less risk than a runtime library upgrade. No production code changes, no API surface changes for consumers.

Notable improvements in v18 that are particularly relevant to TUnit:

• NativeAOT safety attributes added — TUnit has a hard requirement that all code must work with Native AOT. The new trim/NativeAOT annotations in the analyzer itself align well with this project goal.
• False-positive fixes — VSTHRD110 (expression-valued scenarios), VSTHRD103 (sync extension methods with async alternatives, superset fix), and VSTHRD114 (null in ternary conditionals) were all causing incorrect diagnostics. Fewer false positives means cleaner CI signal.
• Regex performance improvement — slow regex removed from the analyzers; marginally faster build times.

One thing to watch: The major version jump (17 → 18) may surface new or stricter analyzer warnings on existing code that previously went undiagnosed. If the build treats warnings-as-errors (common with Roslyn analyzers), this could cause a build failure. The pending CI runs will confirm — the modularpipeline matrix jobs across Linux/macOS/Windows are the right signal here.

No action needed beyond letting CI pass.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}