What's changed

SDK behavior

• MA0002 now reports only non-ordinal string comparisons while remaining a warning.
• Package projects now discover THIRD-PARTY-NOTICES files with .TXT, .txt, .MD, and .md extensions deterministically.
• Test projects can set MinimumExpectedTests; setting it to 0 omits the SDK-supplied Microsoft Testing Platform guard.
• Direct xUnit v3 consumers now receive XUNIT_ENTRYPOINT_DISABLE_WARNINGS once, with EnableXunitEntryPointDisableWarnings=false as an opt-out.

Tooling

• Updated CSharpier.MSBuild from 0.30.2 to 1.3.0 and adopted its current C# and XML formatting contract.
• Updated Meziantou.Analyzer from 3.0.177 to 3.0.190.
• Reviewed and accepted the upstream defaults for MA0218, MA0219, and MA0220.

No runtime API behavior changed; this release changes build-time SDK configuration and package behavior.

Full changes: PR #47, PR #48

What's changed

• Updated Microsoft.CodeAnalysis.CSharp.Workspaces from 5.6.0 to 5.9.0.
• Updated MSBuild.StructuredLogger from 2.3.244 to 2.3.246.
• Reviewed and accepted Meziantou.Analyzer's informational MA0216 rule when running on the Roslyn 5.9 workspace surface.

No runtime or public API behavior changed.

Full changes: PR #46

What's changed

• Added Roslynator.Formatting.Analyzers 5.0.0 with suggestion-level structural blank-line rules around statements, regions, using lists, declarations, and documentation.
• Kept accessor, brace, wrapping, indentation, and blank-line removal rules disabled to avoid conflicts with CSharpier.
• Updated Roslynator.Analyzers to 5.0.0 and Meziantou.Analyzer to 3.0.177.
• Strengthened analyzer package, policy, and scaffolded-editorconfig contract checks.

No runtime or public API behavior changed.

Full changes: PR #44

Changed

• Updated the bundled Meziantou analyzer from 3.0.159 to 3.0.165, adding Roslyn 5.9 support and upstream false-positive fixes.
• Recorded MA0216 at its upstream informational default without changing the SDK severity policy.

No public API or runtime behavior changed. See #43.

Changed

• Refreshed the SDK's shipped test-tool dependency contract: the Microsoft Testing Platform extensions move to 2.3.3 and CodeCoverage moves to 18.10.0. Central pins, SDK-injected versions, and package dependency ranges remain synchronized. (#36, #39)
• Updated the mandatory analyzer bundle to Meziantou.Analyzer 3.0.159 and Roslynator.Analyzers 4.16.1. Newly introduced MA0213, MA0214, and MA0215 rules retain their upstream disabled-by-default severity. (#38, #39)
• Updated build dependencies and moved the repository toolchain to the .NET 10.0.400 security servicing release. (#39)
• Updated test SDK examples to xUnit 4.0.0. xUnit remains consumer-selected and is not injected by the SDK. (#39)

No public SDK API or configuration default changed in this release.

Validation

• Linux build, test, and package validation passed.
• Windows and macOS consumer smoke tests passed.
• All six package graphs report no known vulnerable or deprecated direct or transitive dependencies.

Added

• External Microsoft Testing Platform module runners can resolve the SDK-owned coverage denominator policy through HeadlessCoverageSettingsPath. The evaluated property returns the absolute packaged default.runsettings path across project-SDK, global.json SDK, additional-SDK, and PackageReference consumption. (#34)

Changed

• Project-evaluated coverage uses the same public property for its --coverage-settings argument, so module runners no longer need a consumer-owned runsettings copy. (#34)
• Coverage excludes compiler and source-generator output under cross-platform obj/**/generated/** paths while retaining the existing generated-file, generated-code attribute, migration, and test-assembly exclusions. (#34)

Original release date: 2026-08-03

Changed

• Updated the mandatory analyzer baseline from Meziantou.Analyzer 3.0.125 to 3.0.129 and the integration-test support dependency Microsoft.Bcl.AsyncInterfaces from 10.0.9 to 10.0.10.

Original release date: 2026-08-02

Breaking Changes

• The bumped analyzer baseline introduces new rules that participate immediately under AnalysisLevel=latest-all and escalate to errors on CI. This is intentional policy: the mandatory baseline tightens with each SDK release, and consumer code that was warning-free may need updates. Individual rules can now be disabled per project through the consumer's .editorconfig (see the NoWarn migration below).
• Builds driven by AI coding agents now treat warnings as errors (HeadlessIsLlmContext); agent sessions on code with pre-existing warnings fail where they previously succeeded. Opt out with HeadlessIsLlmContext=false.
• Consumer .editorconfig severities for previously-NoWarn'd rules now take effect: /nowarn no longer wins, so a consumer config that raises one of those rules will start reporting it. Clearing $(NoWarn) no longer re-enables baseline-disabled rules; re-enablement goes through editorconfig severities.
• Project-body downgrades of Deterministic, AnalysisLevel, or AnalysisMode no longer take effect; the mandatory baseline is re-asserted after the project body in every consumption mode, closing a loophole in the documented authoritative contract.
• The embedded and snupkg symbol formats embed untracked sources (including source-generator output) into shipped PDBs. Review generated content for sensitive values or opt out with EmbedUntrackedSources=false.

Added

• AI coding-agent detection (HeadlessIsLlmContext, auto-detected from Claude Code, Codex, Cursor, Copilot, Gemini, Windsurf, Zed, Cline, Aider, and other agent environment variables): agent-driven builds treat compiler, analyzer, nullable, and MSBuild warnings as errors without inheriting CI-only behavior (SBOM, locked restore, coverage). Consumer-overridable with HeadlessIsLlmContext=false.
• Analyzer rule-coverage gate: a repository test reflection-loads the nine mandatory analyzer packages, enumerates every supported diagnostic, and fails when an analyzer version bump introduces a rule that is neither tuned in a shipped editorconfig nor recorded in the reviewed package-defaults baseline — new rules now require an explicit severity decision instead of arriving silently.

Changed

• Advisory defaults (WarningLevel, Features, ReportAnalyzer, SuppressNETCoreSdkPreviewMessage, CheckEolTargetFramework, SuppressTfmSupportBuildWarnings) are now guarded so a consumer Directory.Build.props value wins under both MSBuild-SDK and PackageReference consumption. The mandatory baseline (Deterministic, AnalysisLevel, AnalysisMode, analyzer execution) is re-asserted after the project body, so both consumption modes now behave identically for it as well.
• Analyzer-rule disables moved from $(NoWarn) to the shipped editorconfigs as severity = none, so a consumer .editorconfig can re-enable any baseline-disabled rule per project (/nowarn cannot be overridden downstream). $(NoWarn) now carries only diagnostics analyzer config cannot express: CS1712, NU5104, the CS1573/CS1591 documentation pair, and the Aspire-host CA1707 relaxation. Test-project relaxations moved into Headless.NET.Sdk.Tests.editorconfig, and CA2007 enforcement is now expressed purely through the baseline none plus the HeadlessEnforceConfigureAwait overlay.
• Updated the mandatory analyzer baseline: Meziantou.Analyzer 3.0.75 → 3.0.125, Microsoft.CodeAnalysis.BannedApiAnalyzers 4.14.0 → 5.6.0, and Microsoft.VisualStudio.Threading.Analyzers 17.14.15 → 18.7.23. The remaining six analyzer packages were already at their latest published versions.
• Analyzer versions are now single-sourced through Directory.Packages.props and covered by the Dependabot anchor project, so analyzer bump PRs open automatically; VersionConsistencyTests enforces consistency between the central pins, the shipped version properties, and the nuspec dependency ranges.
• The embedded and snupkg symbol formats now default EmbedUntrackedSources=true so untracked sources (source-generator output, generated files) stay debuggable from the PDB; SourceLink cannot fetch files the repository does not track. Consumer-set values win, and HeadlessSymbolFormat=none stays on Microsoft defaults.

Fixed

• GenerateSBOM=true now resolves the SBOM tooling from the restore-resolved package location under MSBuild SDK consumption, fixing packs when Microsoft.Sbom.Targets is satisfied from a NuGet fallback folder or shared cache. Under PackageReference consumption, restore evaluation cannot see package-delivered references (ExcludeRestorePackageImports), so such consumers must restore the tooling into their local packages folder before packing; this limitation is now documented in the shipped targets.
• Integration-test consumer restores now use the host global packages folder as a read-only NuGet fallback and no longer pass RestoreIgnoreFailedSources=true: restores resolve without network access in the common case, and genuine restore failures surface loudly instead of being masked.
• The shipped packaging targets no longer inject the SDK author's tag into consumer PackageTags; consumer tags pass through untouched.
• Platform contract tests now report as skipped instead of passed when running on a non-matching operating system.

Original release date: 2026-07-27

Changed

• Updated build, test, and source-link dependencies, including the injected Microsoft Testing Platform extensions now shipped at 2.3.2.
• Updated repository CI to .NET SDK 10.0.302 and current GitHub Actions runtime dependencies.

Original release date: 2026-07-19

Breaking Changes

• Headless SDK behavior is now direct opt-in: buildTransitive assets are no longer shipped, so a project reference no longer propagates Headless policy to downstream projects. Add the appropriate Headless SDK directly to every project that should receive it.
• Projects must declare TargetFramework or TargetFrameworks; the removed inference switches no longer select a framework implicitly.
• Headless.NET.Sdk.Test is Microsoft Testing Platform-only. Migrate VSTest projects and removed VSTest properties to the MTP runner and extensions documented below.
• Analyzer, editorconfig, NuGet audit, and SBOM infrastructure is authoritative. The removed infrastructure opt-outs no longer disable it; the three documented banned-symbol controls remain available.
• Legacy CI, single-file, SponsorLink alias, and generic xUnit/TUnit detection inputs were removed. Use ContinuousIntegrationBuild, FileBasedProgram, DisableSponsorLink, and the explicit MTP/xUnit v3 configuration described below.

Added

• Added first-class contract coverage for all five supported consumption modes: direct PackageReference, versioned project SDK, additional SDK, versionless global.json MSBuild SDK resolution, and .NET 10 #:sdk file-based apps. All six SDK family members support every mode.
• Added consumer tests against newly packed packages for restore, build, run, pack, static-graph evaluation, design-time evaluation, mixed and duplicate imports, multi-targeting outer and inner builds, target-framework compatibility, analyzer enforcement and opt-outs, CI warnings, locked restore, NuGet audit, SBOM generation, Microsoft Testing Platform execution, packaging defaults, and explicit consumer overrides.
• Added Windows validation for packed Windows Desktop WPF and Windows Forms consumers and macOS validation for a packed base-SDK consumer. Linux, Windows, and macOS validation must all pass before publication.
• Added System.Collections.ArrayList and Assembly.GetAssembly(Type) to the general banned-symbol list.
• Added SHA-256 package hashes and a six-package ID/version manifest so publication promotes and verifies the exact artifacts produced by the build job.

Changed

• All base and satellite sdk, build, and buildMultiTargeting imports are sentinel-guarded and evaluate exactly once across project-SDK, additional-SDK, mixed SDK plus PackageReference, static-graph, design-time, and multi-targeting outer/inner builds. Wrapper identity and pre-Directory.Build.props/pre-Microsoft-target ordering are preserved.
• Satellite packages are self-contained: each carries its project-type wrapper plus the shared base build and configuration assets and no longer depends on resolving a separate Headless.NET.Sdk package version.
• All six packages use explicit, content-only MSBuild SDK nuspec contracts. Package assets are limited to sdk, build, buildMultiTargeting, configurations, README, and logo content; dependencies use framework-agnostic groups, and the former lib/netstandard2.0/_._ compatibility marker is gone.
• The repository is built with exactly .NET SDK 10.0.301 (rollForward=disable), but Headless no longer restricts consumer target frameworks. Normal MSBuild projects must declare TargetFramework or TargetFrameworks; compatibility is determined by the selected Microsoft SDK and installed targeting packs or workloads. .NET 10 is required only for repository tooling and the file-app host.
• Blazor WebAssembly and Windows Desktop file apps use the base Microsoft.NET.Sdk while retaining their Headless satellite identity; normal projects continue to wrap Microsoft.NET.Sdk.BlazorWebAssembly and Microsoft.NET.Sdk.WindowsDesktop.
• File-based apps always receive the dedicated analyzer profile. Headless extra global usings now evaluate after the project body and are added only when ImplicitUsings is enable/true and the consumer TFM is compatible with net8.0.
• In-project HeadlessEnableStrictSystemTextJsonRuntimeDefaults=true now evaluates after the consumer project body and adds the strict runtime switches only to inner builds compatible with net9.0.
• The nine analyzer packages are mandatory, private, SDK-owned dependencies. Their versions and asset metadata are reasserted after consumer item evaluation; duplicate consumer references cannot weaken or leak them, and conflicting Central Package Management entries are rejected instead of replacing the baseline. Meziantou.Analyzer package projects retain the self-reference exception.
• Analyzer execution, .NET analyzers, code-style enforcement, and the base, ConfigureAwait, file-app, and test editorconfig inputs are reasserted after the project body and included exactly once.
• The general and Newtonsoft.Json banned-symbol lists remain enabled by default but are independently configurable. DisableSupportBannedSymbols=true disables both lists, IncludeDefaultBannedSymbols=false disables the general list, and BannedNewtonsoftJsonSymbols=false disables only the Newtonsoft.Json list. The Microsoft.CodeAnalysis.BannedApiAnalyzers package remains mandatory analyzer infrastructure.
• SponsorLink and Moq analyzer cleanup remains enabled by default. DisableSponsorLink=false is the sole supported opt-out that retains those analyzers.
• CI provider variables are authoritative and ContinuousIntegrationBuild=true is the only manual activation input. CI now treats compiler, analyzer, nullable, and MSBuild warnings plus confirmed vulnerabilities (NU1901-NU1904) as errors; local Debug no longer defaults compiler warnings to errors, and Release alone no longer activates warning or vulnerability escalation.
• NuGet restore, pack, signing, and feed diagnostics remain warnings under the CI compiler/MSBuild gate. NU1900 and NU1905 remain warnings because they indicate unavailable audit data, while the visible NETSDK1138 end-of-life diagnostic remains non-fatal so Headless does not turn an otherwise targetable TFM into a framework restriction.
• Deterministic=true is authoritative. Explicit consumer values are now preserved for RootNamespace, AssemblyName, ImplicitUsings, GenerateDocumentationFile, non-CI CodeAnalysisTreatWarningsAsErrors, AccelerateBuildsInVisualStudio, NeutralLanguage, PreferredUILang, IsPackable, and the Test SDK's IsPublishable default.
• CI locked restore is enabled only when packages.lock.json exists or a late NuGetLockFilePath identifies an existing lock file. Repositories without a lock file restore normally.
• NuGet audit is authoritative at NuGetAudit=true, NuGetAuditMode=all, and NuGetAuditLevel=low. Direct PackageReference consumers must bootstrap first-clean-restore audit, lock, and warning policy in repository props or CLI arguments because NuGet cannot import package build assets before that initial restore.
• Headless.NET.Sdk.Test is Microsoft Testing Platform only. It defaults library output to an executable MTP host and supplies restore-visible, private, SDK-owned crash dump, code coverage, hang dump, hot reload, retry, and TRX extensions in every consumption mode; consumers continue to choose and version their test framework.
• Base-SDK projects using IsTestProject=true or IsTestHarnessProject=true now receive test analysis, editorconfig, warning-relaxation, and non-packable defaults only. The complete MTP host, extension dependencies, and command-line defaults require Headless.NET.Sdk.Test.
• Test execution retains default TRX output, crash and hang dumps, a ten-minute hang timeout, a minimum-one-test guard, and CI coverage arguments. Analyzer suppression is now MTP-only and controlled by OptimizeTestRun; xUnit global-using injection now applies only to xunit.v3.mtp-v2.
• .NET 10 command hosts must select Microsoft.Testing.Platform through global.json; this command-host setting is independent of the test project's target framework.
• Microsoft.Sbom.Targets is now an exact, private, restore-visible dependency in every consumption mode. Headless owns its single targets import, generation remains opt-in through GenerateSBOM=true, and requesting generation without restored tooling produces a targeted pack error.
• Headless follows the Microsoft SDK default for EmbedUntrackedSources instead of forcing source embedding.
• Package metadata now uses the general-purpose, consumer-facing SDK-family description, the repository README and logo, exact repository branch/commit provenance, and no license metadata. The family is not limited to Headless Framework consumers and is distributed through GitHub Packages and NuGet.org.
• Tag and manual workflow runs publish only to GitHub Packages after hash verification. Public and private packages are both supported; duplicate versions fail at the package push, and pushes are never retried automatically.
• Published GitHub Releases publish only to NuGet.org after the complete build/test/platform gate, SHA-256 verification, an exact release-tag/package-version match, and approval in the protected NuGet Release environment. The release artifact set must contain exactly six .nupkg files and no .snupkg files; duplicate versions fail.
• Publication is serialized across the package family with queued runs and bounded job timeouts. A partial feed publication is not retried automatically.
• CI now builds and packs once, tests the immutable packed artifact set, retains warnings in final logs, isolates clean-consumer NuGet caches outside source globs, and exposes a single Linux/Windows/macOS final status.
• Repository CI now retains TRX diagnostics without collecting non-gated coverage for the C# integration harness, and .NET workload integrity checking is no longer disabled. The Test SDK's consumer coverage extension and CI defaults are unchanged.
• Repository restore now clears inherited sources, uses NuGet.org as its only package and audit source, and no lo...