[dependabot]

Pull request

Summary

Update all six C#/Visual Basic Roslyn testing packages through their shared MicrosoftCodeAnalysisAnalyzerTestingVersion property, and synchronize the separate native Bazel analyzer-test graph to 1.1.4.

• Regenerate eng/bazel/tests-support/paket.lock, preview-package integrity metadata, and MODULE.bazel.lock with the existing updater. The nine direct/transitive testing packages now resolve from nuget.org at 1.1.4; obsolete preview-feed integrity entries are removed.
• Group future root NuGet updates matching Microsoft.CodeAnalysis.*.Testing into one Dependabot PR. The pattern matches exactly the six packages sharing this property.
• Consolidate the identical updates in [main] Bump Microsoft.CodeAnalysis.CSharp.Analyzer.Testing from 1.1.3-beta1.26255.1 to 1.1.4 #12340, [main] Bump Microsoft.CodeAnalysis.CSharp.CodeFix.Testing from 1.1.3-beta1.26255.1 to 1.1.4 #12341, [main] Bump Microsoft.CodeAnalysis.CSharp.CodeRefactoring.Testing from 1.1.3-beta1.26255.1 to 1.1.4 #12342, and [main] Bump Microsoft.CodeAnalysis.VisualBasic.CodeFix.Testing from 1.1.3-beta1.26255.1 to 1.1.4 #12343 here. [main] Bump Microsoft.CodeAnalysis.Analyzers and Microsoft.CodeAnalysis.CSharp.Workspaces #12339 updates a different analyzer package and remains separate.

Design and decision record

This is dependency synchronization and grouping of packages that already share one version property, not a new product feature or API. A separate design record is unnecessary. It follows the existing native Roslyn pin policy. The supported Roslyn compiler baseline remains 4.14.0.

Demonstration

No UI or report-layout change; screenshots are not applicable. The actual executed native test layouts were inspected: the original dependency manifest lists all nine testing packages at 1.1.3-beta1.26255.1; the updated manifest lists all nine at 1.1.4, with assembly versions 1.1.4.0.

Validation and regression proof

Compared original PR head 6206172593160eef74f2e42b875ebf8559d07c38 with fix af0b8bfd55ea8c02906b79c06ce22b60f0eb08de, using a separate detached checkout and isolated Bazel outputs for the original graph. Native tests used the repository-pinned Bazel/.NET toolchain, net10.0, win-x64, .NET runtime 10.0.14, and the unchanged method-parallel scheduling.

Command	Result
.\eng\bazel\tests-support\update-dependencies.ps1 -Resolve	Passed, exit 0; regenerated Paket, integrity, and Bzlmod metadata.
.\eng\bazel\tests-support\update-dependencies.ps1	Passed, exit 0; regeneration left the committed worktree unchanged.
.\eng\bazel\verify-roslyn-dependencies.ps1 -SelfTest	Passed, exit 0; eight existing verifier self-tests and compiler-pin checks passed.
Get-Content .\.github\dependabot.yml -Raw | ConvertFrom-Yaml	Passed with the installed powershell-yaml module; additionally checked the group against the six central package entries and confirmed other update scopes are unaffected.
git diff HEAD^ HEAD --check	Passed, exit 0.

The following exact focused command passed on both revisions, executing the same 50 existing AvoidAssertAreEqualOnCollectionsAnalyzerTests analyzer/code-fix cases: Passed: 50, Failed: 0, Skipped: 0 on each graph. The selected identities were compared from the two TRX files.

.\eng\bazel.ps1 test //:analyzer_tests --jobs=2 --test_timeout=180 --test_output=errors --noshow_progress --show_result=0 --lockfile_mode=error --test_arg=--filter "--test_arg=FullyQualifiedName~AvoidAssertAreEqualOnCollectionsAnalyzerTests"

The unfiltered updated run used:

.\eng\bazel.ps1 test //:analyzer_tests --jobs=2 --test_output=errors --noshow_progress --show_result=0 --lockfile_mode=error

It built successfully, then returned Bazel exit 3: total 3,086; passed 3,069; failed 16; skipped 1. All 16 failing fixture identities also failed on the original PR head: ten GlobalConfigGeneratorContinuationTests cases depend on missing native assembly/build-tool configuration, and six process-compatibility cases require the controlled-child entry point omitted by the existing native bootstrap. The original unfiltered comparison was stopped after reproducing these failures because that bootstrap launches recursive test children. A broad compound-filter retry still executed the child fixtures and was also stopped; neither interrupted run is counted as a completed baseline suite.

The broad retry command was the unfiltered command above with --test_arg=--filter and the single argument "--test_arg=FullyQualifiedName!~GlobalConfigGeneratorContinuationTests&FullyQualifiedName!~AnalyzerProcessCompatibilityTests&FullyQualifiedName!~AnalyzerCompatibilityTests.WaitForExit_OwnedChildCancellation_CompletesAndReleasesItsWait" appended. The final bounded, positive class filter above was verified from its TRX selection instead.

Remaining gap: no clean unfiltered native-suite result is claimed. Full MSBuild/acceptance and shipping-package suites were not run; this change adds no product-code or API changes. Evidence logs/TRX files are retained locally and have not been uploaded: native-analyzer-tests.log, updated-native-analyzer-tests.trx, baseline-native-unfiltered-partial.log, baseline-filtered-retry-partial.log, baseline-focused-analyzer-tests.trx, updated-focused-analyzer-tests.trx, and focused-analyzer-comparison.json.

Test-value evidence

Contract	Original graph	Updated graph	Evidence
Native testing pins equal the central testing version	Executed: rejected 15 stale entries (six declarations and nine lock entries).	Executed: all 15 entries equal 1.1.4.	The same read-only assertion was run against immutable Git blobs at the two full SHAs above; this proves configuration alignment, not a product-runtime red phase.
Existing analyzer diagnostics and code fixes remain compatible	Executed: 50 passed, zero failed/skipped.	Executed: the identical 50 passed, zero failed/skipped.	Focused command and TRX selection comparison above; both actual dependency manifests were inspected.
Complete native test suite	Interrupted original run reproduced all 16 failing fixture identities.	Executed: 3,069 passed, 16 failed, one skipped.	Known native fixture/bootstrap limitations remain; interrupted baseline runs are not green-before evidence.

Original Dependabot metadata

Updated Microsoft.CodeAnalysis.VisualBasic.CodeRefactoring.Testing from 1.1.3-beta1.26255.1 to 1.1.4.

Release notes

Sourced from Microsoft.CodeAnalysis.VisualBasic.CodeRefactoring.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Build the repository

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟡 Changes recommended

The six Bazel test-support pins still resolve the old harness, leaving native analyzer tests out of sync with MSBuild’s 1.1.4 harness and violating the documented pin-alignment requirement.

1 open issue

• Update native analyzer-test pins to match the 1.1.4 test harness · New

What changed in this PR

Updates the shared Roslyn testing dependency version used by MSTest analyzer tests from 1.1.3-beta1.26255.1 to stable 1.1.4.

Changes:

• Updates the central MicrosoftCodeAnalysisAnalyzerTestingVersion property.
• Applies the upgrade to six C# and Visual Basic analyzer, code-fix, and refactoring testing packages—not only the package named in the title.

Test-value evidence: Static inspection only; no build or test results were supplied or executed.

File	Description
Directory.Packages.props	Raises the shared version for six Roslyn testing packages to 1.1.4.

_{Review effort: Balanced}

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Build the repository

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the Roslyn testing dependency alignment.

No open issues 🎉

1 resolved since last review

• Update native analyzer-test pins to match the 1.1.4 test harness

_{Review effort: Balanced}

[github-actions]

🧪 Test quality review — PR #12344

Compared merge base 182908fecaf00e54664be23e82b575716dc76199 with head af0b8bfd55ea8c02906b79c06ce22b60f0eb08de. Evidence applies to this head, not every intermediate commit.

Test-value evidence

Contract	Evidence	Result
Roslyn analyzer-testing packages bumped from 1.1.3-beta1.26255.1 to 1.1.4 (Directory.Packages.props, Bazel lock, paket files)	Dependency change only. The existing analyzer and code-fix unit tests are the consumers. No paired execution records were accessible.	Not applicable / unverified
Dependabot roslyn-testing group added	Configuration only.	Not applicable
eng/bazel/tests-support/package-integrity.json reduced to {}	Static observation only. I could not confirm whether this is intended generator output.	Unverified

🧵 Parallel safety

STATUS: PARTIAL. The only parallelization candidate is Directory.Packages.props, and its change is a package version bump with no parallelization properties. The parallel-safety-reviewer specialist task was not run, so this is not a clean result. I found no parallel-safety findings by static inspection of the diff.

Per-test assessment

No changed test methods were in scope (test_count = 0), so the result is Not applicable.

<sub>This advisory review is heuristic and non-blocking.

Re-run the combined review with /review-tests, or only the parallel-safety specialist with /parallel-audit.</sub>

🤖 Automated content by GitHub Copilot. Generated by the Test Quality Review on PR (on open / sync) workflow. · copilot · auto · ~27 AIC · ⌖ ~1 AIC · ⊞ 8.1K