chore(deps): update dependency microsoft.visualstudio.threading.analyzers to v18 by thomhurst · Pull Request #6297 · thomhurst/TUnit

thomhurst · 2026-06-22T18:26:39Z

This PR contains the following updates:

Package	Type	Update	Change
Microsoft.VisualStudio.Threading.Analyzers (source)	nuget	major	`17.14.15` → `18.7.23`

Release Notes

microsoft/vs-threading (Microsoft.VisualStudio.Threading.Analyzers)

`v18.7.23`

What's Changed

Fixes

Fix CancellationToken.Combine with 3+ cancelable tokens by @AArnott in #1443
Fix VSTHRD110 firing in Expression-valued scenarios by @AArnott with @Copilot in #1467
Fix super set for VSTHRD103 by @AArnott in #1545
Fix VSTHRD114 not firing for null in ternary conditional expressions by @AArnott with @Copilot in #1548
Disable VSTHRD010 in AppWithoutMainThread.editorconfig by @ArturDorochowicz in #1562
Fix VSTHRD103 missing diagnostic for sync extension methods with async alternatives in the same static class by @drewnoakes with @Copilot in #1569

Enhancements

Add JoinableTaskFactory.DisableProcessing() by @AArnott in #1576
Add NoMessagePumpSyncContext..ctor(SynchronizationContext) for Post/Send behaviors by @AArnott in #1578
Add trim and NativeAOT safety attributes by @AArnott in #1471
Add IPendingExecutionRequestState interface to expose completion state of SingleExecuteProtector by @lifengl in #1447
Add AdditionalFiles support to VSTHRD103 analyzer for excluding specific APIs by @AArnott with @Copilot in #1465
Document InvalidOperationException for AsyncReaderWriterLock acquisition methods by @AArnott with @Copilot in #1466
Allow library code to detect the JoinableTaskContext is not associated with Main thread by @lifengl in #1477
remove NotifyOfCrossThreadDependency call inside get_NoMessagePumpSynchronizationContext by @lifengl in #1486
reduce overhead when running in no main thread mode by @lifengl in #1502
Join tasks waited by JoinableTaskCollection.JoinUntilEmpty in dumpasync result by @lifengl in #1538
Remove slow regex from threading analyzers by @AArnott in #1547

New Contributors

@jgrosic made their first contribution in #1485
@AbhitejJohn made their first contribution in #1533
@ArturDorochowicz made their first contribution in #1562
@microsoft-github-policy-service[bot] made their first contribution in #1587

Full Changelog: microsoft/vs-threading@v17.14.15...v18.7.23

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

…zers to v18

claude

Code Review

This is a single-line dependency bump of Microsoft.VisualStudio.Threading.Analyzers from 17.14.15 → 18.7.23 in Directory.Packages.props.

Assessment: Looks good ✓

Risk is low — this is an analyzer-only package (compile-time tooling, no runtime dependency), so a major version bump carries far less risk than a runtime library upgrade. No production code changes, no API surface changes for consumers.

Notable improvements in v18 that are particularly relevant to TUnit:

NativeAOT safety attributes added — TUnit has a hard requirement that all code must work with Native AOT. The new trim/NativeAOT annotations in the analyzer itself align well with this project goal.
False-positive fixes — VSTHRD110 (expression-valued scenarios), VSTHRD103 (sync extension methods with async alternatives, superset fix), and VSTHRD114 (null in ternary conditionals) were all causing incorrect diagnostics. Fewer false positives means cleaner CI signal.
Regex performance improvement — slow regex removed from the analyzers; marginally faster build times.

One thing to watch: The major version jump (17 → 18) may surface new or stricter analyzer warnings on existing code that previously went undiagnosed. If the build treats warnings-as-errors (common with Roslyn analyzers), this could cause a build failure. The pending CI runs will confirm — the modularpipeline matrix jobs across Linux/macOS/Windows are the right signal here.

No action needed beyond letting CI pass.

codacy-production · 2026-06-22T18:28:53Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Updated [TUnit.Core](https://github.com/thomhurst/TUnit) from 1.56.25 to 1.57.0. <details> <summary>Release notes</summary> _Sourced from [TUnit.Core's releases](https://github.com/thomhurst/TUnit/releases)._ ## 1.57.0  ## What's Changed ### Other Changes * perf(sourcegen): consolidate per-file ModuleInitializers into merged .cctor (#6226) by @thomhurst in thomhurst/TUnit#6286 * fix: resolve CS0121 IsEqualTo ambiguity on .NET 8 SDK (#6296) by @thomhurst in thomhurst/TUnit#6313 * chore(docs): apply Codacy markdownlint fixes by @thomhurst in thomhurst/TUnit#6284 * fix(mocks): generate mock for qualified-name X.Mock() calls (#6298) by @thomhurst in thomhurst/TUnit#6314 ### Dependencies * chore(deps): update tunit to 1.56.35 by @thomhurst in thomhurst/TUnit#6306 * chore(deps): update dependency stackexchange.redis to 3.0.7 by @thomhurst in thomhurst/TUnit#6307 * chore(deps): update dependency opentelemetry.instrumentation.http to 1.16.0 by @thomhurst in thomhurst/TUnit#6308 * chore(deps): update dependency opentelemetry.instrumentation.aspnetcore to 1.16.0 by @thomhurst in thomhurst/TUnit#6309 * chore(deps): update dependency qs to v6.15.3 by @thomhurst in thomhurst/TUnit#6310 * chore(deps): update dependency polyfill to 10.11.0 by @thomhurst in thomhurst/TUnit#6312 * chore(deps): update dependency polyfill to 10.11.0 by @thomhurst in thomhurst/TUnit#6311 * chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /docs by @dependabot[bot] in thomhurst/TUnit#6303 **Full Changelog**: thomhurst/TUnit@v1.56.35...v1.57.0 ## 1.56.35  ## What's Changed ### Other Changes * feat(aspire): tear down Aspire on test-run abort via session cancellation token by @thomhurst in thomhurst/TUnit#6292 ### Dependencies * chore(deps): update tunit to 1.56.25 by @thomhurst in thomhurst/TUnit#6294 * chore(deps): update dependency microsoft.visualstudio.threading.analyzers to v18 by @thomhurst in thomhurst/TUnit#6297 * chore(deps): update dependency microsoft.net.test.sdk to 18.7.0 by @thomhurst in thomhurst/TUnit#6300 * chore(deps): update dependency microsoft.playwright to 1.61.0 by @thomhurst in thomhurst/TUnit#6302 * chore(deps): update actions/cache action to v6 by @thomhurst in thomhurst/TUnit#6301 * chore(deps): update dependency azure.storage.blobs to 12.29.1 by @thomhurst in thomhurst/TUnit#6304 **Full Changelog**: thomhurst/TUnit@v1.56.25...v1.56.35 Commits viewable in [compare view](thomhurst/TUnit@v1.56.25...v1.57.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=TUnit.Core&package-manager=nuget&previous-version=1.56.25&new-version=1.57.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): update dependency microsoft.visualstudio.threading.analy…

b4d5b09

…zers to v18

thomhurst added dependencies Pull requests that update a dependency file MAJOR renovate-bot labels Jun 22, 2026

thomhurst enabled auto-merge (squash) June 22, 2026 18:26

thomhurst added the MAJOR label Jun 22, 2026

thomhurst had a problem deploying to Pull Requests June 22, 2026 18:26 — with GitHub Actions Failure

thomhurst temporarily deployed to Pull Requests June 22, 2026 18:26 — with GitHub Actions Inactive

claude Bot reviewed Jun 22, 2026

View reviewed changes

thomhurst merged commit 9138122 into main Jun 22, 2026
13 of 14 checks passed

thomhurst deleted the renovate/microsoft.visualstudio.threading.analyzers-18.x branch June 22, 2026 18:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency microsoft.visualstudio.threading.analyzers to v18#6297

chore(deps): update dependency microsoft.visualstudio.threading.analyzers to v18#6297
thomhurst merged 1 commit into
mainfrom
renovate/microsoft.visualstudio.threading.analyzers-18.x

thomhurst commented Jun 22, 2026

Uh oh!

claude Bot left a comment

Uh oh!

codacy-production Bot commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

thomhurst commented Jun 22, 2026

Release Notes

v18.7.23

What's Changed

Fixes

Enhancements

New Contributors

Configuration

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review

Assessment: Looks good ✓

Uh oh!

codacy-production Bot commented Jun 22, 2026

Up to standards ✅

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`v18.7.23`